Edit tour

Windows Analysis Report
https://github.com/netwrix/pingcastle/releases/download/3.3.0.1/PingCastle_3.3.0.1.zip

Overview

General Information

Sample URL:	https://github.com/netwrix/pingcastle/releases/download/3.3.0.1/PingCastle_3.3.0.1.zip
Analysis ID:	1587408
Infos:

Detection

Score:	56
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Downloads suspicious files via Chrome

Writes a notice file (html or txt) to demand a ransom

Yara detected Costura Assembly Loader

Yara detected Generic Downloader

Allocates memory with a write watch (potentially for evading sandboxes)

Creates a process in suspended mode (likely to inject code)

Detected suspicious crossdomain redirect

Drops PE files

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found dropped PE file which has not been started or loaded

May sleep (evasive loops) to hinder dynamic analysis

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Classification

Process Tree

System is w10x64

chrome.exe (PID: 3872 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 2840 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2504 --field-trial-handle=2476,i,8198650963386273841,13647284136402883920,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

unarchiver.exe (PID: 6848 cmdline: "C:\Windows\SysWOW64\unarchiver.exe" "C:\Users\user\Downloads\PingCastle_3.3.0.1.zip" MD5: 16FF3CC6CC330A08EED70CBC1D35F5D2)

7za.exe (PID: 6876 cmdline: "C:\Windows\System32\7za.exe" x -pinfected -y -o"C:\Users\user\AppData\Local\Temp\hqqkbpyi.fzp" "C:\Users\user\Downloads\PingCastle_3.3.0.1.zip" MD5: 77E556CDFDC5C592F5C46DB4127C6F4C)

conhost.exe (PID: 6884 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cmd.exe (PID: 6952 cmdline: "cmd.exe" /C "C:\Users\user\AppData\Local\Temp\hqqkbpyi.fzp\Active_Directory_Security_Self_Assessment_v1.4.pdf" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 6960 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

Acrobat.exe (PID: 7032 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\hqqkbpyi.fzp\Active_Directory_Security_Self_Assessment_v1.4.pdf" MD5: 24EAD1C46A47022347DC0F05F6EFBB8C)

AcroCEF.exe (PID: 6396 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

AcroCEF.exe (PID: 6196 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2104 --field-trial-handle=1736,i,8144944481098509710,6803883750261835604,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

chrome.exe (PID: 6544 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://github.com/netwrix/pingcastle/releases/download/3.3.0.1/PingCastle_3.3.0.1.zip" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

cleanup

Yara Signatures

Dropped Files

Source	Rule	Description	Author
C:\Users\user\AppData\Local\Temp\hqqkbpyi.fzp\PingCastleAutoUpdater.exe	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
C:\Users\user\AppData\Local\Temp\hqqkbpyi.fzp\PingCastle.exe	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
C:\Users\user\AppData\Local\Temp\hqqkbpyi.fzp\PingCastle.exe	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Source: C:\Windows\SysWOW64\7za.exe

File created: C:\Users\user\AppData\Local\Temp\hqqkbpyi.fzp\license.rtf

Jump to behavior

Source: C:\Windows\SysWOW64\unarchiver.exe

File opened: C:\Windows\WinSxS\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.9672_none_d08f9da24428a513\MSVCR80.dll

Jump to behavior

Source:	Binary string: costura.pingcastlecommon.pdb.compressed source: PingCastle.exe.6.dr, PingCastleAutoUpdater.exe.6.dr
Source:	Binary string: costura.pingcastlecommon.pdb.compressed\|\|\|PingCastleCommon.pdb\|7DDD915C227E121D4CB3B1789518B6FD23A0336B\|8392 source: PingCastleAutoUpdater.exe.6.dr
Source:	Binary string: costura=costura.costura.dll.compressed=costura.costura.pdb.compressed source: PingCastle.exe.6.dr
Source:	Binary string: costura.pingcastlecommon.pdb.compressed\|\|\|PingCastleCommon.pdb\|152C3DEDC015FD0112599238C3853C7E1F051465\|8392 source: PingCastle.exe.6.dr
Source:	Binary string: D:\a\1\s\obj\release\PingCastle.pdb source: PingCastle.exe.6.dr
Source:	Binary string: D:\a\1\s\PingCastleAutoUpdater\obj\release\PingCastleAutoUpdater.pdb- source: PingCastleAutoUpdater.exe.6.dr
Source:	Binary string: D:\a\1\s\obj\release\PingCastle.pdbD@)^@) P@)_CorExeMainmscoree.dll source: PingCastle.exe.6.dr
Source:	Binary string: newtonsoft.jsonMcostura.newtonsoft.json.dll.compressed!pingcastlecommonOcostura.pingcastlecommon.dll.compressedOcostura.pingcastlecommon.pdb.compressed source: PingCastle.exe.6.dr
Source:	Binary string: <Run>b__8_0<>9__8_1<Run>b__8_1IEnumerable`1IOrderedEnumerable`1ReadOnlyCollection`1IEnumerator`1List`1Int32<>9__8_2<Run>b__8_2Func`2Dictionary`2get_UTF8<>9<Module>System.IOGETCosturacostura.metadatamscorlib<>cSystem.Collections.GenericReadLoadforceDownloadfileNameLastDownloadAddWriteInRedisAttachedInterlockedcostura.costura.pdb.compressedcostura.pingcastlecommon.pdb.compressedcostura.costura.dll.compressedcostura.system.diagnostics.diagnosticsource.dll.compressedcostura.pingcastlecommon.dll.compressed<name>k__BackingField<prerelease>k__BackingField<size>k__BackingField<browser_download_url>k__BackingField<assets>k__BackingField<published_at>k__BackingFieldReadToEndTracesourceZipArchiveModeCompressionModeExchangenullCacheEnumerableIDisposableFileConsoleget_Nameget_FullNamefullNameGetNamerequestedAssemblyNameGetDirectoryNameget_nameset_nameDateTimeWriteLineSecurityProtocolTypeCompareWhereSystem.Corecultureget_CodeBaseReleaseget_prereleaseset_prereleaseget_ResponseWebResponseGetResponseCloseDisposeTryParseCreateDeleteWriteCompilerGeneratedAttributeGuidAttributeDebuggableAttributeComVisibleAttributeAssemblyTitleAttributeAssemblyTrademarkAttributeTargetFrameworkAttributeAssemblyFileVersionAttributeAssemblyConfigurationAttributeAssemblyDescriptionAttributeCompilationRelaxationsAttributeAssemblyProductAttributeAssemblyCopyrightAttributeAssemblyCompanyAttributeRuntimeCompatibilityAttributeByteTryGetValuevalueZipArchiveadd_AssemblyResolveMovePingCastleAutoUpdater.exeDeserializeget_sizeset_sizeSystem.ThreadingOrderByDescendingGetEncodingSystem.Runtime.VersioningCultureToStringAttachget_LocalPathGetFullPathget_LengthEndsWithUrinullCacheLockCheckPathTraversalSystem.Collections.ObjectModelProceedReleaseInstallget_SecurityProtocolset_SecurityProtocolreleaseInfoUrlget_browser_download_urlset_browser_download_urlReadStreamLoadStreamGetManifestResourceStreamFileStreamGetResponseStreamDeflateStreamMemoryStreamstreamProgramset_ItemSystemop_LessThanOpenMainAppDomainget_CurrentDomainget_VersionFodyVersionSystem.IO.CompressiondestinationSystem.GlobalizationSystem.Web.Script.SerializationSystem.Reflectionset_PositionWebExceptionPingCastleCommonStringComparisonRunCopyToget_CultureInfoDisplayHelpSystem.LinqStreamReaderTextReaderAssemblyLoadersenderServicePointManagerResolveEventHandlerPingCastleAutoUpdaterEnterJavaScriptSerializerset_ForegroundColorConsoleColorResetColorFilesValidatorIEnumeratorGetEnumerator.ctor.cctorMonitorSystem.DiagnosticsSystem.Runtime.InteropServicesSystem.Runtime.CompilerServicesReadFromEmbeddedResourcesDebuggingModesGetAssembliesget_EntriesresourceNamessymbolNamesassemblyNamesget_FlagsAssemblyNameFlagsResolveEventArgsargsEqualsSystem.Web.ExtensionsSystem.Collectionsget_assetsset_assetsExistsAddDaysget_published_atset_published_atConcatObjectSystem.NetAssetExitToLowerInvariantset_UserAgentEnvironmentget_CurrentCountHttpWebRequestFirstMoveNextSystem.TextReadAllTextWriteAllTextpreviewget_NownumberOfDaysToWayPingCastleAutoUpdater_ProcessedByFodyConta
Source:	Binary string: costura.costura.pdb.compressed source: PingCastle.exe.6.dr, PingCastleAutoUpdater.exe.6.dr
Source:	Binary string: D:\a\1\s\PingCastleAutoUpdater\obj\release\PingCastleAutoUpdater.pdb source: PingCastleAutoUpdater.exe.6.dr
Source:	Binary string: costura.costura.pdb.compressed\|\|\|Costura.pdb\|6C6000A5EAF8579850AB82A89BD6268776EB51AD\|2608 source: PingCastle.exe.6.dr, PingCastleAutoUpdater.exe.6.dr
Source:	Binary string: costura=costura.costura.dll.compressed=costura.costura.pdb.compressed!pingcastlecommonOcostura.pingcastlecommon.dll.compressedOcostura.pingcastlecommon.pdb.compressedGsystem.diagnostics.diagnosticsourceucostura.system.diagnostics.diagnosticsource.dll.compressedlDd source: PingCastleAutoUpdater.exe.6.dr

Networking

Yara detected Generic Downloader

Source: Yara match

File source: C:\Users\user\AppData\Local\Temp\hqqkbpyi.fzp\PingCastle.exe, type: DROPPED

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

HTTP traffic: Redirect from: github.com to https://objects.githubusercontent.com/github-production-release-asset-2e65be/146924413/3bc39ae0-06ab-46ba-9145-597f72315fc8?x-amz-algorithm=aws4-hmac-sha256&x-amz-credential=releaseassetproduction%2f20250110%2fus-east-1%2fs3%2faws4_request&x-amz-date=20250110t095439z&x-amz-expires=300&x-amz-signature=7baf7e0309ddde41fc38b6583aff69974df729cb65205dc720c7b02c0841e8d5&x-amz-signedheaders=host&response-content-disposition=attachment%3b%20filename%3dpingcastle_3.3.0.1.zip&response-content-type=application%2foctet-stream

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET /netwrix/pingcastle/releases/download/3.3.0.1/PingCastle_3.3.0.1.zip HTTP/1.1Host: github.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /github-production-release-asset-2e65be/146924413/3bc39ae0-06ab-46ba-9145-597f72315fc8?X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Credential=releaseassetproduction%2F20250110%2Fus-east-1%2Fs3%2Faws4_request&X-Amz-Date=20250110T095439Z&X-Amz-Expires=300&X-Amz-Signature=7baf7e0309ddde41fc38b6583aff69974df729cb65205dc720c7b02c0841e8d5&X-Amz-SignedHeaders=host&response-content-disposition=attachment%3B%20filename%3DPingCastle_3.3.0.1.zip&response-content-type=application%2Foctet-stream HTTP/1.1Host: objects.githubusercontent.comConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentsec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9

Source: Active_Directory_Security_Self_Assessment_v1.4.pdf.6.dr	String found in binary or memory: <</IsMap false/S/URI/URI(https://www.facebook.com/Netwrix)>> equals www.facebook.com (Facebook)
Source: Active_Directory_Security_Self_Assessment_v1.4.pdf.6.dr	String found in binary or memory: <</IsMap false/S/URI/URI(https://www.linkedin.com/company/455932/)>> equals www.linkedin.com (Linkedin)
Source: Active_Directory_Security_Self_Assessment_v1.4.pdf.6.dr	String found in binary or memory: <</IsMap false/S/URI/URI(https://www.youtube.com/Netwrix)>> equals www.youtube.com (Youtube)

Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: github.com
Source: global traffic	DNS traffic detected: DNS query: objects.githubusercontent.com
Source: global traffic	DNS traffic detected: DNS query: x1.i.lencr.org

Source: PingCastle.exe.6.dr	String found in binary or memory: http://blog.backslasher.net/preventing-users-from-adding-computers-to-a-domain.html
Source: 7za.exe, 00000006.00000003.1882211132.0000000002420000.00000004.00000800.00020000.00000000.sdmp, PingCastle.exe.6.dr, PingCastleAutoUpdater.exe.6.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: 7za.exe, 00000006.00000003.1882211132.0000000002420000.00000004.00000800.00020000.00000000.sdmp, PingCastle.exe.6.dr, PingCastleAutoUpdater.exe.6.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crt0
Source: 7za.exe, 00000006.00000003.1882211132.0000000002420000.00000004.00000800.00020000.00000000.sdmp, PingCastle.exe.6.dr, PingCastleAutoUpdater.exe.6.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: 7za.exe, 00000006.00000003.1882211132.0000000002420000.00000004.00000800.00020000.00000000.sdmp, PingCastle.exe.6.dr, PingCastleAutoUpdater.exe.6.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: 7za.exe, 00000006.00000003.1882211132.0000000002420000.00000004.00000800.00020000.00000000.sdmp, PingCastle.exe.6.dr, PingCastleAutoUpdater.exe.6.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: 7za.exe, 00000006.00000003.1882211132.0000000002420000.00000004.00000800.00020000.00000000.sdmp, PingCastle.exe.6.dr, PingCastleAutoUpdater.exe.6.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0S
Source: 7za.exe, 00000006.00000003.1882211132.0000000002420000.00000004.00000800.00020000.00000000.sdmp, PingCastle.exe.6.dr, PingCastleAutoUpdater.exe.6.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: 7za.exe, 00000006.00000003.1882211132.0000000002420000.00000004.00000800.00020000.00000000.sdmp, PingCastle.exe.6.dr, PingCastleAutoUpdater.exe.6.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: 7za.exe, 00000006.00000003.1882211132.0000000002420000.00000004.00000800.00020000.00000000.sdmp, PingCastle.exe.6.dr, PingCastleAutoUpdater.exe.6.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0
Source: PingCastle.exe.6.dr	String found in binary or memory: http://gary-nebbett.blogspot.com/2020/01/ldap-channel-binding.html
Source: Active_Directory_Security_Self_Assessment_v1.4.pdf.6.dr	String found in binary or memory: http://netwrix.com/ADSecurity)
Source: Active_Directory_Security_Self_Assessment_v1.4.pdf.6.dr	String found in binary or memory: http://netwrix.com/active-directory-risk-assessment.html)
Source: 7za.exe, 00000006.00000003.1882211132.0000000002420000.00000004.00000800.00020000.00000000.sdmp, PingCastle.exe.6.dr, PingCastleAutoUpdater.exe.6.dr	String found in binary or memory: http://ocsp.digicert.com0
Source: 7za.exe, 00000006.00000003.1882211132.0000000002420000.00000004.00000800.00020000.00000000.sdmp, PingCastle.exe.6.dr, PingCastleAutoUpdater.exe.6.dr	String found in binary or memory: http://ocsp.digicert.com0A
Source: 7za.exe, 00000006.00000003.1882211132.0000000002420000.00000004.00000800.00020000.00000000.sdmp, PingCastle.exe.6.dr, PingCastleAutoUpdater.exe.6.dr	String found in binary or memory: http://ocsp.digicert.com0C
Source: 7za.exe, 00000006.00000003.1882211132.0000000002420000.00000004.00000800.00020000.00000000.sdmp, PingCastle.exe.6.dr, PingCastleAutoUpdater.exe.6.dr	String found in binary or memory: http://ocsp.digicert.com0X
Source: PingCastle.exe.6.dr	String found in binary or memory: http://prajwaldesai.com/allow-domain-user-to-add-computer-to-domain/
Source: PingCastle.exe.6.dr	String found in binary or memory: http://provisioning.microsoftonline.com/IProvisioningWebService/GetCompanyDirSyncFeaturesResponsee
Source: PingCastle.exe.6.dr	String found in binary or memory: http://provisioning.microsoftonline.com/IProvisioningWebService/GetCompanyDirSyncFeaturesT
Source: PingCastle.exe.6.dr	String found in binary or memory: http://provisioning.microsoftonline.com/IProvisioningWebService/GetCompanyInformationResponse
Source: PingCastle.exe.6.dr	String found in binary or memory: http://provisioning.microsoftonline.com/IProvisioningWebService/GetCompanyInformationT
Source: PingCastle.exe.6.dr	String found in binary or memory: http://provisioning.microsoftonline.com/IProvisioningWebService/ListDomainsResponse
Source: PingCastle.exe.6.dr	String found in binary or memory: http://provisioning.microsoftonline.com/IProvisioningWebService/ListDomainsT
Source: PingCastle.exe.6.dr	String found in binary or memory: http://provisioning.microsoftonline.com/IProvisioningWebService/ListRoleMembersResponse
Source: PingCastle.exe.6.dr	String found in binary or memory: http://provisioning.microsoftonline.com/IProvisioningWebService/ListRoleMembersT
Source: PingCastle.exe.6.dr	String found in binary or memory: http://provisioning.microsoftonline.com/IProvisioningWebService/ListRolesResponse
Source: PingCastle.exe.6.dr	String found in binary or memory: http://provisioning.microsoftonline.com/IProvisioningWebService/ListRolesT
Source: PingCastle.exe.6.dr	String found in binary or memory: http://provisioning.microsoftonline.com/IProvisioningWebService/ListUsersByStrongAuthenticationRespo
Source: PingCastle.exe.6.dr	String found in binary or memory: http://provisioning.microsoftonline.com/IProvisioningWebService/ListUsersByStrongAuthenticationT
Source: PingCastle.exe.6.dr	String found in binary or memory: http://provisioning.microsoftonline.com/IProvisioningWebService/ListUsersResponse
Source: PingCastle.exe.6.dr	String found in binary or memory: http://provisioning.microsoftonline.com/IProvisioningWebService/ListUsersT
Source: PingCastle.exe.6.dr	String found in binary or memory: http://provisioning.microsoftonline.com/IProvisioningWebService/NavigateUserResultsResponse
Source: PingCastle.exe.6.dr	String found in binary or memory: http://provisioning.microsoftonline.com/IProvisioningWebService/NavigateUserResultsT
Source: PingCastle.exe.6.dr	String found in binary or memory: http://provisioning.microsoftonline.com/T
Source: PingCastle.exe.6.dr	String found in binary or memory: http://schemas.datacontract.org/2004/07/Microsoft.Online.Administration
Source: PingCastle.exe.6.dr	String found in binary or memory: http://schemas.datacontract.org/2004/07/Microsoft.Online.Administration.WebService
Source: PingCastle.exe.6.dr	String found in binary or memory: http://schemas.datacontract.org/2004/07/Microsoft.Online.Administration.WebServiceV
Source: PingCastle.exe.6.dr	String found in binary or memory: http://schemas.datacontract.org/2004/07/Microsoft.Online.Administration.WebServiced
Source: PingCastle.exe.6.dr	String found in binary or memory: http://schemas.datacontract.org/2004/07/Microsoft.Online.Administration.WebServicet
Source: PingCastle.exe.6.dr	String found in binary or memory: http://schemas.datacontract.org/2004/07/Microsoft.Online.Administration.WebServiceu
Source: PingCastle.exe.6.dr	String found in binary or memory: http://schemas.datacontract.org/2004/07/Microsoft.Online.Administration.WebService~
Source: PingCastle.exe.6.dr	String found in binary or memory: http://schemas.datacontract.org/2004/07/Microsoft.Online.AdministrationN
Source: PingCastle.exe.6.dr	String found in binary or memory: http://schemas.datacontract.org/2004/07/Microsoft.Online.AdministrationS
Source: PingCastle.exe.6.dr	String found in binary or memory: http://schemas.datacontract.org/2004/07/Microsoft.Online.Administrationk
Source: PingCastle.exe.6.dr	String found in binary or memory: http://schemas.datacontract.org/2004/07/Microsoft.Online.Administrationo
Source: PingCastle.exe.6.dr	String found in binary or memory: http://schemas.datacontract.org/2004/07/Microsoft.Online.Administrationr
Source: PingCastle.exe.6.dr	String found in binary or memory: http://schemas.datacontract.org/2004/07/Microsoft.Online.Administrationt
Source: PingCastle.exe.6.dr	String found in binary or memory: http://schemas.datacontract.org/2004/07/Microsoft.Online.Administrationu
Source: PingCastle.exe.6.dr	String found in binary or memory: http://schemas.datacontract.org/2004/07/Microsoft.Online.Administrationx
Source: PingCastle.exe.6.dr	String found in binary or memory: http://schemas.datacontract.org/2004/07/Microsoft.Online.Administrationz
Source: PingCastle.exe.6.dr	String found in binary or memory: http://schemas.datacontract.org/2004/07/System.Xml.LinqT
Source: PingCastle.exe.6.dr	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing
Source: PingCastle.exe.6.dr	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing/faultT
Source: PingCastle.exe.6.dr	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/09/enumeration
Source: PingCastle.exe.6.dr	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/09/enumeration/EnumerateResponse
Source: PingCastle.exe.6.dr	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/09/enumeration/EnumerateT
Source: PingCastle.exe.6.dr	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/09/enumeration/GetStatusResponse
Source: PingCastle.exe.6.dr	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/09/enumeration/GetStatusT
Source: PingCastle.exe.6.dr	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/09/enumeration/PullResponse
Source: PingCastle.exe.6.dr	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/09/enumeration/PullT
Source: PingCastle.exe.6.dr	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/09/enumeration/ReleaseResponse
Source: PingCastle.exe.6.dr	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/09/enumeration/ReleaseT
Source: PingCastle.exe.6.dr	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/09/enumeration/RenewResponse
Source: PingCastle.exe.6.dr	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/09/enumeration/RenewT
Source: PingCastle.exe.6.dr	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/09/enumeration/faultT
Source: PingCastle.exe.6.dr	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/09/enumerationT
Source: PingCastle.exe.6.dr	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/09/enumerationW
Source: PingCastle.exe.6.dr	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/09/transfer/CreateResponse
Source: PingCastle.exe.6.dr	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/09/transfer/CreateT
Source: PingCastle.exe.6.dr	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/09/transfer/DeleteResponse
Source: PingCastle.exe.6.dr	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/09/transfer/DeleteT
Source: PingCastle.exe.6.dr	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/09/transfer/GetResponse
Source: PingCastle.exe.6.dr	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/09/transfer/GetT
Source: PingCastle.exe.6.dr	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/09/transfer/PutResponse
Source: PingCastle.exe.6.dr	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/09/transfer/PutT
Source: PingCastle.exe.6.dr	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/09/transfer/faultT
Source: PingCastle.exe.6.dr	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/09/transfer5
Source: PingCastle.exe.6.dr	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/09/transferT
Source: PingCastle v3.0.0.pdf.6.dr	String found in binary or memory: http://visjs.org/)
Source: 7za.exe, 00000006.00000003.1882211132.0000000002420000.00000004.00000800.00020000.00000000.sdmp, PingCastle.exe.6.dr, PingCastleAutoUpdater.exe.6.dr	String found in binary or memory: http://www.digicert.com/CPS0
Source: PingCastle.exe.6.dr	String found in binary or memory: http://www.harmj0y.net/blog/activedirectory/roasting-as-reps/
Source: PingCastle.exe.6.dr	String found in binary or memory: http://www.harmj0y.net/blog/redteaming/not-a-security-boundary-breaking-forest-trusts/
Source: 2D85F72862B55C4EADD9E66E06947F3D0.11.dr	String found in binary or memory: http://x1.i.lencr.org/
Source: PingCastle.exe.6.dr	String found in binary or memory: http://xxx/certsrv/certrqxt.asp
Source: PingCastle.exe.6.dr	String found in binary or memory: http://xxx/yyy_CES_Kerberos/services.svc
Source: PingCastle.exe.6.dr	String found in binary or memory: https://access.redhat.com/articles/4661861
Source: PingCastle.exe.6.dr	String found in binary or memory: https://access.redhat.com/discussions/1283873
Source: PingCastle.exe.6.dr	String found in binary or memory: https://adsecurity.org/?p=1405
Source: PingCastle.exe.6.dr	String found in binary or memory: https://adsecurity.org/?p=1667
Source: PingCastle.exe.6.dr	String found in binary or memory: https://adsecurity.org/?p=2604
Source: PingCastle.exe.6.dr	String found in binary or memory: https://adsecurity.org/?p=3299
Source: PingCastle.exe.6.dr	String found in binary or memory: https://adsecurity.org/?p=3377
Source: PingCastle.exe.6.dr	String found in binary or memory: https://adsecurity.org/?p=3466
Source: PingCastle.exe.6.dr	String found in binary or memory: https://adsecurity.org/?p=376
Source: PingCastle.exe.6.dr	String found in binary or memory: https://adsecurity.org/?p=4056
Source: PingCastle.exe.6.dr	String found in binary or memory: https://adsecurity.org/?p=4115
Source: PingCastleAutoUpdater.exe.6.dr	String found in binary or memory: https://api.github.com/repos/netwrix/pingcastle/releases
Source: PingCastle.exe.6.dr	String found in binary or memory: https://attack.mitre.org/
Source: PingCastle.exe.6.dr	String found in binary or memory: https://attack.mitre.org/mitigations/
Source: PingCastle.exe.6.dr	String found in binary or memory: https://attack.mitre.org/techniques/9Mitre
Source: PingCastle.exe.6.dr	String found in binary or memory: https://azurecloudai.blog/2019/10/01/laps-security-concern-computers-joiners-are-able-to-see-laps-pa
Source: PingCastle.exe.6.dr	String found in binary or memory: https://blog.0patch.com/2021/11/micropatch-for-remote-code-execution-by.html
Source: PingCastle.exe.6.dr	String found in binary or memory: https://blog.andreas-schreiner.de/2018/09/07/active-directory-sicherheit-teil-1-privilegierte-benutz
Source: PingCastle.exe.6.dr	String found in binary or memory: https://blog.lithnet.io/2018/12/disabling-unauthenticated-binds-in.html
Source: PingCastle.exe.6.dr	String found in binary or memory: https://blog.netwrix.com/2015/02/20/add-sensitive-user-accounts-to-active-directory-protected-users-
Source: PingCastle.exe.6.dr	String found in binary or memory: https://blog.nviso.eu/2023/12/08/rpc-or-not-here-we-log-preventing-exploitation-and-abuse-with-rpc-f
Source: PingCastle.exe.6.dr	String found in binary or memory: https://blog.palantir.com/microsoft-defender-attack-surface-reduction-recommendations-a5c7d41c3cf8
Source: PingCastle.exe.6.dr	String found in binary or memory: https://blog.stealthbits.com/resource-based-constrained-delegation-abuse/
Source: PingCastle.exe.6.dr	String found in binary or memory: https://bootstrap-table.com/
Source: PingCastle.exe.6.dr	String found in binary or memory: https://bugs.chromium.org/p/project-zero/issues/detail?id=2186
Source: Active_Directory_Security_Self_Assessment_v1.4.pdf.6.dr	String found in binary or memory: https://community.spiceworks.com/pages/NetWrix)
Source: PingCastle.exe.6.dr	String found in binary or memory: https://community.spiceworks.com/t/are-redirected-printers-a-security-risk/826344/27
Source: PingCastle.exe.6.dr	String found in binary or memory: https://crocs.fi.muni.cz/public/papers/rsa_ccs17
Source: PingCastle.exe.6.dr	String found in binary or memory: https://csrc.nist.gov/publications/detail/fips/186/5/draft
Source: PingCastle.exe.6.dr	String found in binary or memory: https://cyber.gouv.fr/sites/default/files/IMG/pdf/NP_ActiveDirectory_NoteTech.pdf
Source: PingCastle v3.0.0.pdf.6.dr	String found in binary or memory: https://datatables.net/)
Source: PingCastle.exe.6.dr	String found in binary or memory: https://datatracker.ietf.org/doc/html/rfc2713
Source: PingCastle.exe.6.dr	String found in binary or memory: https://dirkjanm.io/ntlm-relaying-to-ad-certificate-services/
Source: PingCastle.exe.6.dr	String found in binary or memory: https://dirteam.com/sander/2008/12/09/active-directory-visibility-modes/
Source: PingCastle.exe.6.dr	String found in binary or memory: https://dirteam.com/sander/2011/07/13/preventing-ous-and-containers-from-accidental-deletion/
Source: PingCastle.exe.6.dr	String found in binary or memory: https://dirteam.com/sander/2014/11/25/ten-things-you-need-to-be-aware-of-before-using-the-protected-
Source: PingCastle.exe.6.dr	String found in binary or memory: https://dirteam.com/sander/2021/08/10/two-new-azure-ad-connect-versions-were-released-to-prevent-mit
Source: PingCastle.exe.6.dr	String found in binary or memory: https://docs.oracle.com/cd/E19424-01/820-4813/6ng8jv82s/index.html
Source: PingCastle v3.0.0.pdf.6.dr	String found in binary or memory: https://editor.swagger.io/?url=https://gist.githubusercontent.com/vletoux/c6c565c8af07b4df5df65ed01f
Source: PingCastle.exe.6.dr	String found in binary or memory: https://enterinit.com/powershell-enable-active-directory-recycle-bin
Source: PingCastle.exe.6.dr	String found in binary or memory: https://getbootstrap.com/
Source: PingCastle v3.0.0.pdf.6.dr	String found in binary or memory: https://getbootstrap.com/)
Source: PingCastle.exe.6.dr	String found in binary or memory: https://gist.github.com/IISResetMe/399a75cfccabc1a17d0cc3b5ae29f3aa#file-update-msexchstoragegroupsc
Source: PingCastle.exe.6.dr	String found in binary or memory: https://gist.github.com/gladiatx0r/1ffe59031d42c08603a3bde0ff678feb#rpc-to-rce-steps
Source: PingCastle v3.0.0.pdf.6.dr	String found in binary or memory: https://gist.githubusercontent.com/vletoux/c6c565c8af07b4df5df65ed01ffeb917/raw/fca7a288050b7b17ba60
Source: PingCastle.exe.6.dr	String found in binary or memory: https://github.com/ANSSI-FR/AD-control-paths
Source: PingCastle.exe.6.dr	String found in binary or memory: https://github.com/BloodHoundAD/BloodHound
Source: PingCastle.exe.6.dr	String found in binary or memory: https://github.com/GoSecure/WSuspicious
Source: PingCastle.exe.6.dr	String found in binary or memory: https://github.com/MicrosoftDocs/azure-docs/blob/main/articles/active-directory/hybrid/connect/tshoo
Source: PingCastle.exe.6.dr	String found in binary or memory: https://github.com/PSSecTools/Krbtgt
Source: PingCastle.exe.6.dr	String found in binary or memory: https://github.com/crocs-muni/roca
Source: PingCastle.exe.6.dr	String found in binary or memory: https://github.com/daem0nc0re/PrivFu#privilegedoperations
Source: PingCastle.exe.6.dr	String found in binary or memory: https://github.com/daem0nc0re/PrivFu/blob/main/PrivilegedOperations/SeTrustedCredManAccessPrivilegeP
Source: PingCastle.exe.6.dr	String found in binary or memory: https://github.com/decoder-it/psgetsystem
Source: PingCastle.exe.6.dr	String found in binary or memory: https://github.com/gdedrouas/Exchange-AD-Privesc/blob/master/DomainObject/Fix-DomainObjectDACL.ps1
Source: PingCastle.exe.6.dr	String found in binary or memory: https://github.com/lgandx/Responder-Windows
Source: PingCastle.exe.6.dr	String found in binary or memory: https://github.com/microsoft/New-KrbtgtKeys.ps1
Source: PingCastle.exe.6.dr	String found in binary or memory: https://github.com/microsoft/New-KrbtgtKeys.ps1/blob/master/New-KrbtgtKeys.ps1
Source: PingCastle.exe.6.dr	String found in binary or memory: https://github.com/misterch0c/shadowbroker/tree/master/windows/exploits
Source: PingCastle.exe.6.dr	String found in binary or memory: https://github.com/netwrix/pingcastle/issues
Source: PingCastle.exe.6.dr	String found in binary or memory: https://github.com/nsacyber/Pass-the-Hash-Guidance
Source: PingCastle.exe.6.dr	String found in binary or memory: https://github.com/p0dalirius/Coercer
Source: PingCastle.exe.6.dr	String found in binary or memory: https://github.com/p0w3rsh3ll/NetCease
Source: PingCastle.exe.6.dr	String found in binary or memory: https://github.com/pimps/wsuxploit
Source: PingCastle.exe.6.dr	String found in binary or memory: https://github.com/zeronetworks/rpcfirewall
Source: PingCastle.exe.6.dr	String found in binary or memory: https://github.com/zyn3rgy/LdapRelayScan
Source: PingCastle.exe.6.dr	String found in binary or memory: https://graph.windows.net
Source: PingCastle.exe.6.dr	String found in binary or memory: https://graph.windows.net/
Source: PingCastle.exe.6.dr	String found in binary or memory: https://helpcenter.netwrix.com/category/pingcastle
Source: PingCastle.exe.6.dr	String found in binary or memory: https://isc.sans.edu/diary/Controlling
Source: PingCastle.exe.6.dr	String found in binary or memory: https://itpro-tips.com/wp-content/uploads/files/TechnetGallery/Azure-AD-SSO-Key-Rollover-d2f1604a.zi
Source: PingCastle.exe.6.dr	String found in binary or memory: https://itpro-tips.com/wp-content/uploads/files/TechnetGallery/Enterprise-Key-Admins-720eb270.zip
Source: PingCastle.exe.6.dr	String found in binary or memory: https://jquery.org/
Source: PingCastle v3.0.0.pdf.6.dr	String found in binary or memory: https://jquery.org/)
Source: PingCastle.exe.6.dr	String found in binary or memory: https://keychest.net/roca
Source: PingCastle.exe.6.dr	String found in binary or memory: https://labs.withsecure.com/publications/how-to-own-any-windows-network-with-group-policy-hijacking-
Source: PingCastle.exe.6.dr	String found in binary or memory: https://login.microsoftonline.com/common/GetCredentialTypeshttps://login.microsoftonline.com/GetUser
Source: PingCastle.exe.6.dr	String found in binary or memory: https://login.microsoftonline.com/common/oauth2/authorize
Source: PingCastle.exe.6.dr	String found in binary or memory: https://login.microsoftonline.com/common/oauth2/token
Source: PingCastle.exe.6.dr	String found in binary or memory: https://login.microsoftonline.com/organizations/oauth2/nativeclient
Source: PingCastle.exe.6.dr	String found in binary or memory: https://login.microsoftonline.com/organizations/oauth2/v2.0/authorizeAhttps://login.microsoftonline.
Source: PingCastle.exe.6.dr	String found in binary or memory: https://login.microsoftonline.com/rhttps://login.microsoftonline.com/common/oauth2/authorizejhttps:/
Source: PingCastle.exe.6.dr	String found in binary or memory: https://login.windows.net/xxxxx/.well-known/openid-configuration
Source: PingCastle.exe.6.dr	String found in binary or memory: https://main.iam.ad.ext.azure.com/api/Directories/
Source: PingCastle.exe.6.dr	String found in binary or memory: https://management.azure.com/
Source: PingCastle.exe.6.dr	String found in binary or memory: https://management.core.windows.net/
Source: PingCastle.exe.6.dr, changelog.txt.6.dr	String found in binary or memory: https://medium.com/
Source: PingCastle.exe.6.dr	String found in binary or memory: https://nicksnettravels.builttoroam.com/post/2017/01/24/Admin-Consent-for-Permissions-in-Azure-Activ
Source: PingCastle.exe.6.dr	String found in binary or memory: https://outlook.office365.com/adminapi/beta/
Source: PingCastle.exe.6.dr	String found in binary or memory: https://outlook.office365.comChttps://login.microsoftonline.com/organizations/oauth2/nativeclient
Source: PingCastle.exe.6.dr	String found in binary or memory: https://oxfordcomputergroup.com/resources/ldap-channel-binding-signing-requirements/
Source: PingCastle.exe.6.dr	String found in binary or memory: https://popper.js.org/
Source: PingCastle v3.0.0.pdf.6.dr	String found in binary or memory: https://popper.js.org/)
Source: PingCastle.exe.6.dr	String found in binary or memory: https://posts.specterops.io/certified-pre-owned-d95910965cd2
Source: PingCastle.exe.6.dr	String found in binary or memory: https://provisioningapi.microsoftonline.com/provisioningwebservice.svc
Source: PingCastle.exe.6.dr	String found in binary or memory: https://provisioningapi.microsoftonline.com/provisioningwebservice.svc%UserIdentityHeaderQhttp://pro
Source: PingCastle.exe.6.dr	String found in binary or memory: https://pupuweb.com/solved-how-enable-kerberos-armoring-eap-fast-ad/
Source: PingCastle.exe.6.dr	String found in binary or memory: https://research.ifcr.dk/certifried-active-directory-domain-privilege-escalation-cve-2022-26923-9e09
Source: PingCastle.exe.6.dr	String found in binary or memory: https://rickardnobel.se/verify-redirected-computers-container-in-active-directory/
Source: PingCastle.exe.6.dr	String found in binary or memory: https://secureidentity.se/adprep-bug-in-windows-server-2016/
Source: PingCastle.exe.6.dr	String found in binary or memory: https://specterops.io/blog/2023/01/25/at-the-edge-of-tier-zero-the-curious-case-of-the-rodc/
Source: PingCastle.exe.6.dr	String found in binary or memory: https://stat.pingcastle.com/Benchmark
Source: PingCastle.exe.6.dr	String found in binary or memory: https://sts.windows.net/3Exception
Source: PingCastle.exe.6.dr	String found in binary or memory: https://support.hpe.com/hpsc/doc/public/display?docId=emr_na-c04197764-1
Source: PingCastle.exe.6.dr	String found in binary or memory: https://syfuhs.net/lessons-in-disabling-rc4-in-active-directoryEThis
Source: PingCastle.exe.6.dr	String found in binary or memory: https://talubu.wordpress.com/2018/02/28/configuring-unc-hardened-access-through-group-policy/
Source: PingCastle.exe.6.dr	String found in binary or memory: https://tldrlegal.com/license/mit-license
Source: PingCastle v3.0.0.pdf.6.dr	String found in binary or memory: https://tldrlegal.com/license/mit-license)
Source: PingCastle.exe.6.dr	String found in binary or memory: https://tools.ietf.org/html/rfc6150
Source: PingCastle.exe.6.dr	String found in binary or memory: https://tools.ietf.org/html/rfc6194
Source: PingCastle.exe.6.dr	String found in binary or memory: https://trustedsec.com/blog/a-comprehensive-guide-on-relaying-anno-2022
Source: PingCastle.exe.6.dr	String found in binary or memory: https://twitter.com/0gtweet/status/1303427935647531018?s=20
Source: Active_Directory_Security_Self_Assessment_v1.4.pdf.6.dr	String found in binary or memory: https://twitter.com/netwrix)
Source: PingCastle.exe.6.dr	String found in binary or memory: https://woshub.com/remote-desktop-session-time-limit/
Source: PingCastle.exe.6.dr	String found in binary or memory: https://www.alitajran.com/exchange-schema-versions/#Exchange
Source: PingCastle.exe.6.dr	String found in binary or memory: https://www.blackhat.com/docs/us-16/materials/us-16-Munoz-A-Journey-From-JNDI-LDAP-Manipulation-To-R
Source: PingCastle.exe.6.dr	String found in binary or memory: https://www.blackhillsinfosec.com/domain-goodness-learned-love-ad-explorer/
Source: PingCastle.exe.6.dr	String found in binary or memory: https://www.cert.ssi.gouv.fr/actualite/
Source: PingCastle.exe.6.dr	String found in binary or memory: https://www.cert.ssi.gouv.fr/alerte/
Source: PingCastle.exe.6.dr	String found in binary or memory: https://www.cert.ssi.gouv.fr/dur/CERTFR-2020-DUR-001/
Source: PingCastle.exe.6.dr	String found in binary or memory: https://www.cert.ssi.gouv.fr/information/
Source: PingCastle.exe.6.dr	String found in binary or memory: https://www.cert.ssi.gouv.fr/uploads/ad_checklist.html#vuln_
Source: PingCastle.exe.6.dr	String found in binary or memory: https://www.cert.ssi.gouv.fr/uploads/ad_checklist.html#vuln_3
Source: PingCastle.exe.6.dr	String found in binary or memory: https://www.dsinternals.com/en/impersonating-office-365-users-mimikatz/
Source: PingCastle.exe.6.dr	String found in binary or memory: https://www.gosecure.net/blog/2021/11/22/gosecure-investigates-abusing-windows-server-update-service
Source: PingCastle.exe.6.dr	String found in binary or memory: https://www.gradenegger.eu/?p=1132
Source: PingCastle.exe.6.dr	String found in binary or memory: https://www.iad.gov/iad/library/ia-guidance/ia-solutions-for-classified/algorithm-guidance/commercia
Source: Active_Directory_Security_Self_Assessment_v1.4.pdf.6.dr	String found in binary or memory: https://www.instagram.com/netwrix/)
Source: PingCastle.exe.6.dr	String found in binary or memory: https://www.kb.cert.org/vuls/id/836068
Source: Active_Directory_Security_Self_Assessment_v1.4.pdf.6.dr	String found in binary or memory: https://www.linkedin.com/company/455932/)
Source: PingCastle.exe.6.dr	String found in binary or memory: https://www.netspi.com/blog/technical/network-penetration-testing/exploiting-adidns/
Source: Active_Directory_Security_Self_Assessment_v1.4.pdf.6.dr	String found in binary or memory: https://www.netwrix.com/social_communities.html)
Source: Active_Directory_Security_Self_Assessment_v1.4.pdf.6.dr	String found in binary or memory: https://www.netwrix.com/social_communities.html?utm_source=content&utm_medium=guide&utm_campaign=win
Source: PingCastle.exe.6.dr	String found in binary or memory: https://www.netwrix.com/support.html
Source: PingCastle.exe.6.dr	String found in binary or memory: https://www.petri.com/active-directory-security-understanding-adminsdholder-object
Source: PingCastle.exe.6.dr	String found in binary or memory: https://www.pingcastle.com
Source: PingCastle v3.0.0.pdf.6.dr	String found in binary or memory: https://www.pingcastle.com/PingCastleFiles/ad_hc_summary.html)
Source: PingCastle v3.0.0.pdf.6.dr	String found in binary or memory: https://www.pingcastle.com/PingCastleFiles/ad_hc_summary_full_node_map.html)
Source: PingCastle v3.0.0.pdf.6.dr	String found in binary or memory: https://www.pingcastle.com/PingCastleFiles/ad_hc_summary_simple_node_map.html)
Source: PingCastle v3.0.0.pdf.6.dr	String found in binary or memory: https://www.pingcastle.com/methodology/)
Source: PingCastle.exe.6.dr	String found in binary or memory: https://www.pingcastle.com/reports/
Source: PingCastle.exe.6.dr	String found in binary or memory: https://www.pingcastle.com/services/
Source: PingCastle v3.0.0.pdf.6.dr	String found in binary or memory: https://www.pingcastle.com/wp/wp-content/uploads/2018/09/pingcastle-methodology.png)
Source: PingCastle.exe.6.dr	String found in binary or memory: https://www.pingcastle.com;
Source: PingCastle.exe.6.dr	String found in binary or memory: https://www.riskinsight-wavestone.com/en/2021/06/microsoft-adcs-abusing-pki-in-active-directory-envi
Source: PingCastle.exe.6.dr	String found in binary or memory: https://www.romhack.io/slides/RomHack%202018%20-%20Andrea%20Pierini%20-%20whoami%20priv%20-%20show%2
Source: PingCastle.exe.6.dr	String found in binary or memory: https://www.sans.org/reading-room/whitepapers/windows/null-sessions-nt-2000-286
Source: PingCastle.exe.6.dr	String found in binary or memory: https://www.securityinsider-wavestone.com/2020/01/taking-over-windows-workstations-pxe-laps.html
Source: PingCastle.exe.6.dr	String found in binary or memory: https://www.semperis.com/blog/active-directory-security-abusing-display-specifiers/
Source: PingCastle.exe.6.dr	String found in binary or memory: https://www.sentinelone.com/labs/relaying-potatoes-another-unexpected-privilege-escalation-vulnerabi
Source: PingCastle.exe.6.dr	String found in binary or memory: https://www.slideshare.net/harmj0y/derbycon-the-unintended-risks-of-trusting-active-directory
Source: PingCastle.exe.6.dr	String found in binary or memory: https://www.ssi.gouv.fr/archive/fr/sciences/fichiers/lcr/mu04c.pdf
Source: PingCastle.exe.6.dr	String found in binary or memory: https://www.ssi.gouv.fr/guide/cryptographie-les-regles-du-rgs/
Source: PingCastle.exe.6.dr	String found in binary or memory: https://www.stigviewer.com/stig/active_directory_domain/2017-12-15/finding/
Source: PingCastle.exe.6.dr	String found in binary or memory: https://www.stigviewer.com/stig/active_directory_forest/2016-12-19/finding/
Source: PingCastle.exe.6.dr	String found in binary or memory: https://www.stigviewer.com/stig/active_directory_service_2003/2011-05-20/finding/
Source: PingCastle.exe.6.dr	String found in binary or memory: https://www.stigviewer.com/stig/active_directory_service_2008/2011-05-23/finding/
Source: PingCastle.exe.6.dr	String found in binary or memory: https://www.stigviewer.com/stig/windows_10/2018-04-06/finding/
Source: PingCastle.exe.6.dr	String found in binary or memory: https://www.stigviewer.com/stig/windows_2008_member_server/2018-03-07/finding/
Source: PingCastle.exe.6.dr	String found in binary or memory: https://www.stigviewer.com/stig/windows_7/2012-08-22/finding/
Source: PingCastle.exe.6.dr	String found in binary or memory: https://www.tarlogic.com/en/blog/abusing-seloaddriverprivilege-for-privilege-escalation/
Source: PingCastle.exe.6.dr	String found in binary or memory: https://www.vkernel.ro/blog/installing-and-configuring-cep-and-ces-for-certificate-enrolling-on-non-
Source: PingCastle.exe.6.dr	String found in binary or memory: https://www.ws-its.de/gegenmassnahme-zum-angriff-dns-wildcard/
Source: Active_Directory_Security_Self_Assessment_v1.4.pdf.6.dr	String found in binary or memory: https://www.youtube.com/Netwrix)
Source: PingCastle.exe.6.dr	String found in binary or memory: https://xxx/certsrv/certrqxt.asp
Source: PingCastle.exe.6.dr	String found in binary or memory: https://xxx/yyy_CES_Kerberos/service.svc
Source: PingCastle.exe.6.dr	String found in binary or memory: https://youtu.be/Fg2gvk0qgjM

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49840
Source: unknown	Network traffic detected: HTTP traffic on port 49840 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 49739 -> 443

Spam, unwanted Advertisements and Ransom Demands

Writes a notice file (html or txt) to demand a ransom

Source: C:\Windows\SysWOW64\7za.exe

File dropped: C:\Users\user\AppData\Local\Temp\hqqkbpyi.fzp\changelog.txt -> decryption process was broken as successful descryption always triggered a failure* fix s-dc-subnetmissing when subnet are duplicated (contains cnf and generated from replication problem)* fix nt4 mismatch if the year was not present and include the word "datacenter"* add a check for "smart card required" for administrator accounts* reworked the menu to be more interactive2.5.0.0* rewrote all rules description / rationale / etc* added start and end date for exception* breaking: change the date at which the exception / migration is evaluated from current date to report generation date* new rules: a-smb2signaturenotenabled a-smb2signaturenotrequired s-dc-subnetmissing p-delegationloginscript* added an experimental scanner for replication usn check* allows dns admin group to be moved to another ou than cn=users (as a reminder, the group is selected based on its description)* fix logon logoff script label inverted* allow users to be in the guest group for their primary group (was domai

Jump to dropped file

System Summary

Downloads suspicious files via Chrome

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File dump: C:\Users\user\Downloads\PingCastle_3.3.0.1.zip (copy)

Jump to dropped file

Source: PingCastleAutoUpdater.exe.6.dr

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: classification engine

Classification label: mal56.rans.troj.evad.win@41/59@8/5

Source: Active_Directory_Security_Self_Assessment_v1.4.pdf.6.dr	Initial sample: http://netwrix.com/active-directory-risk-assessment.html
Source: Active_Directory_Security_Self_Assessment_v1.4.pdf.6.dr	Initial sample: http://netwrix.com/ADSecurity
Source: Active_Directory_Security_Self_Assessment_v1.4.pdf.6.dr	Initial sample: https://www.youtube.com/netwrix
Source: Active_Directory_Security_Self_Assessment_v1.4.pdf.6.dr	Initial sample: https://community.spiceworks.com/pages/NetWrix
Source: Active_Directory_Security_Self_Assessment_v1.4.pdf.6.dr	Initial sample: https://www.facebook.com/Netwrix
Source: Active_Directory_Security_Self_Assessment_v1.4.pdf.6.dr	Initial sample: https://www.youtube.com/Netwrix
Source: Active_Directory_Security_Self_Assessment_v1.4.pdf.6.dr	Initial sample: https://community.spiceworks.com/pages/netwrix
Source: Active_Directory_Security_Self_Assessment_v1.4.pdf.6.dr	Initial sample: https://www.netwrix.com/social_communities.html
Source: Active_Directory_Security_Self_Assessment_v1.4.pdf.6.dr	Initial sample: https://twitter.com/netwrix
Source: Active_Directory_Security_Self_Assessment_v1.4.pdf.6.dr	Initial sample: https://www.linkedin.com/company/455932/
Source: Active_Directory_Security_Self_Assessment_v1.4.pdf.6.dr	Initial sample: https://www.instagram.com/netwrix/
Source: Active_Directory_Security_Self_Assessment_v1.4.pdf.6.dr	Initial sample: https://www.facebook.com/netwrix
Source: Active_Directory_Security_Self_Assessment_v1.4.pdf.6.dr	Initial sample: http://netwrix.com/adsecurity
Source: Active_Directory_Security_Self_Assessment_v1.4.pdf.6.dr	Initial sample: https://www.netwrix.com/social_communities.html?utm_source=content&utm_medium=guide&utm_campaign=windows-server-hardening-checklist

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Users\user\Downloads\637beebf-6d79-452d-be89-3db27af0e04d.tmp

Jump to behavior

Source: C:\Windows\SysWOW64\unarchiver.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6884:120:WilError_03

Source: C:\Windows\SysWOW64\unarchiver.exe

File created: C:\Users\user\AppData\Local\Temp\unarchiver.log

Jump to behavior

Source: C:\Windows\SysWOW64\cmd.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Windows\SysWOW64\unarchiver.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2504 --field-trial-handle=2476,i,8198650963386273841,13647284136402883920,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://github.com/netwrix/pingcastle/releases/download/3.3.0.1/PingCastle_3.3.0.1.zip"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Windows\SysWOW64\unarchiver.exe "C:\Windows\SysWOW64\unarchiver.exe" "C:\Users\user\Downloads\PingCastle_3.3.0.1.zip"
Source: C:\Windows\SysWOW64\unarchiver.exe	Process created: C:\Windows\SysWOW64\7za.exe "C:\Windows\System32\7za.exe" x -pinfected -y -o"C:\Users\user\AppData\Local\Temp\hqqkbpyi.fzp" "C:\Users\user\Downloads\PingCastle_3.3.0.1.zip"
Source: C:\Windows\SysWOW64\7za.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\unarchiver.exe	Process created: C:\Windows\SysWOW64\cmd.exe "cmd.exe" /C "C:\Users\user\AppData\Local\Temp\hqqkbpyi.fzp\Active_Directory_Security_Self_Assessment_v1.4.pdf"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\hqqkbpyi.fzp\Active_Directory_Security_Self_Assessment_v1.4.pdf"
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2104 --field-trial-handle=1736,i,8144944481098509710,6803883750261835604,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2504 --field-trial-handle=2476,i,8198650963386273841,13647284136402883920,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Windows\SysWOW64\unarchiver.exe "C:\Windows\SysWOW64\unarchiver.exe" "C:\Users\user\Downloads\PingCastle_3.3.0.1.zip"	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process created: C:\Windows\SysWOW64\7za.exe "C:\Windows\System32\7za.exe" x -pinfected -y -o"C:\Users\user\AppData\Local\Temp\hqqkbpyi.fzp" "C:\Users\user\Downloads\PingCastle_3.3.0.1.zip"	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process created: C:\Windows\SysWOW64\cmd.exe "cmd.exe" /C "C:\Users\user\AppData\Local\Temp\hqqkbpyi.fzp\Active_Directory_Security_Self_Assessment_v1.4.pdf"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\hqqkbpyi.fzp\Active_Directory_Security_Self_Assessment_v1.4.pdf"	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2104 --field-trial-handle=1736,i,8144944481098509710,6803883750261835604,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior

Source: C:\Windows\SysWOW64\unarchiver.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\7za.exe	Section loaded: 7z.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: cmdext.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: sfc_os.dll	Jump to behavior

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe

File opened: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\crash_reporter.cfg

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\SysWOW64\unarchiver.exe

File opened: C:\Windows\WinSxS\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.9672_none_d08f9da24428a513\MSVCR80.dll

Jump to behavior

Source:	Binary string: costura.pingcastlecommon.pdb.compressed source: PingCastle.exe.6.dr, PingCastleAutoUpdater.exe.6.dr
Source:	Binary string: costura.pingcastlecommon.pdb.compressed\|\|\|PingCastleCommon.pdb\|7DDD915C227E121D4CB3B1789518B6FD23A0336B\|8392 source: PingCastleAutoUpdater.exe.6.dr
Source:	Binary string: costura=costura.costura.dll.compressed=costura.costura.pdb.compressed source: PingCastle.exe.6.dr
Source:	Binary string: costura.pingcastlecommon.pdb.compressed\|\|\|PingCastleCommon.pdb\|152C3DEDC015FD0112599238C3853C7E1F051465\|8392 source: PingCastle.exe.6.dr
Source:	Binary string: D:\a\1\s\obj\release\PingCastle.pdb source: PingCastle.exe.6.dr
Source:	Binary string: D:\a\1\s\PingCastleAutoUpdater\obj\release\PingCastleAutoUpdater.pdb- source: PingCastleAutoUpdater.exe.6.dr
Source:	Binary string: D:\a\1\s\obj\release\PingCastle.pdbD@)^@) P@)_CorExeMainmscoree.dll source: PingCastle.exe.6.dr
Source:	Binary string: newtonsoft.jsonMcostura.newtonsoft.json.dll.compressed!pingcastlecommonOcostura.pingcastlecommon.dll.compressedOcostura.pingcastlecommon.pdb.compressed source: PingCastle.exe.6.dr
Source:	Binary string: <Run>b__8_0<>9__8_1<Run>b__8_1IEnumerable`1IOrderedEnumerable`1ReadOnlyCollection`1IEnumerator`1List`1Int32<>9__8_2<Run>b__8_2Func`2Dictionary`2get_UTF8<>9<Module>System.IOGETCosturacostura.metadatamscorlib<>cSystem.Collections.GenericReadLoadforceDownloadfileNameLastDownloadAddWriteInRedisAttachedInterlockedcostura.costura.pdb.compressedcostura.pingcastlecommon.pdb.compressedcostura.costura.dll.compressedcostura.system.diagnostics.diagnosticsource.dll.compressedcostura.pingcastlecommon.dll.compressed<name>k__BackingField<prerelease>k__BackingField<size>k__BackingField<browser_download_url>k__BackingField<assets>k__BackingField<published_at>k__BackingFieldReadToEndTracesourceZipArchiveModeCompressionModeExchangenullCacheEnumerableIDisposableFileConsoleget_Nameget_FullNamefullNameGetNamerequestedAssemblyNameGetDirectoryNameget_nameset_nameDateTimeWriteLineSecurityProtocolTypeCompareWhereSystem.Corecultureget_CodeBaseReleaseget_prereleaseset_prereleaseget_ResponseWebResponseGetResponseCloseDisposeTryParseCreateDeleteWriteCompilerGeneratedAttributeGuidAttributeDebuggableAttributeComVisibleAttributeAssemblyTitleAttributeAssemblyTrademarkAttributeTargetFrameworkAttributeAssemblyFileVersionAttributeAssemblyConfigurationAttributeAssemblyDescriptionAttributeCompilationRelaxationsAttributeAssemblyProductAttributeAssemblyCopyrightAttributeAssemblyCompanyAttributeRuntimeCompatibilityAttributeByteTryGetValuevalueZipArchiveadd_AssemblyResolveMovePingCastleAutoUpdater.exeDeserializeget_sizeset_sizeSystem.ThreadingOrderByDescendingGetEncodingSystem.Runtime.VersioningCultureToStringAttachget_LocalPathGetFullPathget_LengthEndsWithUrinullCacheLockCheckPathTraversalSystem.Collections.ObjectModelProceedReleaseInstallget_SecurityProtocolset_SecurityProtocolreleaseInfoUrlget_browser_download_urlset_browser_download_urlReadStreamLoadStreamGetManifestResourceStreamFileStreamGetResponseStreamDeflateStreamMemoryStreamstreamProgramset_ItemSystemop_LessThanOpenMainAppDomainget_CurrentDomainget_VersionFodyVersionSystem.IO.CompressiondestinationSystem.GlobalizationSystem.Web.Script.SerializationSystem.Reflectionset_PositionWebExceptionPingCastleCommonStringComparisonRunCopyToget_CultureInfoDisplayHelpSystem.LinqStreamReaderTextReaderAssemblyLoadersenderServicePointManagerResolveEventHandlerPingCastleAutoUpdaterEnterJavaScriptSerializerset_ForegroundColorConsoleColorResetColorFilesValidatorIEnumeratorGetEnumerator.ctor.cctorMonitorSystem.DiagnosticsSystem.Runtime.InteropServicesSystem.Runtime.CompilerServicesReadFromEmbeddedResourcesDebuggingModesGetAssembliesget_EntriesresourceNamessymbolNamesassemblyNamesget_FlagsAssemblyNameFlagsResolveEventArgsargsEqualsSystem.Web.ExtensionsSystem.Collectionsget_assetsset_assetsExistsAddDaysget_published_atset_published_atConcatObjectSystem.NetAssetExitToLowerInvariantset_UserAgentEnvironmentget_CurrentCountHttpWebRequestFirstMoveNextSystem.TextReadAllTextWriteAllTextpreviewget_NownumberOfDaysToWayPingCastleAutoUpdater_ProcessedByFodyConta
Source:	Binary string: costura.costura.pdb.compressed source: PingCastle.exe.6.dr, PingCastleAutoUpdater.exe.6.dr
Source:	Binary string: D:\a\1\s\PingCastleAutoUpdater\obj\release\PingCastleAutoUpdater.pdb source: PingCastleAutoUpdater.exe.6.dr
Source:	Binary string: costura.costura.pdb.compressed\|\|\|Costura.pdb\|6C6000A5EAF8579850AB82A89BD6268776EB51AD\|2608 source: PingCastle.exe.6.dr, PingCastleAutoUpdater.exe.6.dr
Source:	Binary string: costura=costura.costura.dll.compressed=costura.costura.pdb.compressed!pingcastlecommonOcostura.pingcastlecommon.dll.compressedOcostura.pingcastlecommon.pdb.compressedGsystem.diagnostics.diagnosticsourceucostura.system.diagnostics.diagnosticsource.dll.compressedlDd source: PingCastleAutoUpdater.exe.6.dr

Data Obfuscation

Yara detected Costura Assembly Loader

Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\hqqkbpyi.fzp\PingCastleAutoUpdater.exe, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\hqqkbpyi.fzp\PingCastle.exe, type: DROPPED

Source: PingCastleAutoUpdater.exe.6.dr

Static PE information: section name: .text entropy: 7.526102532371397

Source: C:\Windows\SysWOW64\7za.exe	File created: C:\Users\user\AppData\Local\Temp\hqqkbpyi.fzp\PingCastleAutoUpdater.exe			Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	File created: C:\Users\user\AppData\Local\Temp\hqqkbpyi.fzp\PingCastle.exe			Jump to dropped file

Source: C:\Windows\SysWOW64\7za.exe

File created: C:\Users\user\AppData\Local\Temp\hqqkbpyi.fzp\license.rtf

Jump to behavior

Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Windows\SysWOW64\unarchiver.exe	Memory allocated: 1090000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Memory allocated: 2E40000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Memory allocated: 1100000 memory commit \| memory reserve \| memory write watch	Jump to behavior

Source: C:\Windows\SysWOW64\unarchiver.exe	Window / User API: threadDelayed 1006			Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Window / User API: threadDelayed 8992			Jump to behavior

Source: C:\Windows\SysWOW64\7za.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\hqqkbpyi.fzp\PingCastleAutoUpdater.exe			Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\hqqkbpyi.fzp\PingCastle.exe			Jump to dropped file

Source: C:\Windows\SysWOW64\unarchiver.exe TID: 6944	Thread sleep count: 1006 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe TID: 6944	Thread sleep time: -503000s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe TID: 6944	Thread sleep count: 8992 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe TID: 6944	Thread sleep time: -4496000s >= -30000s	Jump to behavior

Source: C:\Windows\SysWOW64\unarchiver.exe	Last function: Thread delayed
Source: C:\Windows\SysWOW64\unarchiver.exe	Last function: Thread delayed

Source: C:\Windows\SysWOW64\unarchiver.exe

Code function: 5_2_0103B1D6 GetSystemInfo,

5_2_0103B1D6

Source: cmd.exe, 00000008.00000002.2565401642.0000000003101000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: 7p}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_C)6

Source: C:\Windows\SysWOW64\unarchiver.exe

Memory allocated: page read and write | page guard

Jump to behavior

Source: C:\Windows\SysWOW64\unarchiver.exe	Process created: C:\Windows\SysWOW64\7za.exe "C:\Windows\System32\7za.exe" x -pinfected -y -o"C:\Users\user\AppData\Local\Temp\hqqkbpyi.fzp" "C:\Users\user\Downloads\PingCastle_3.3.0.1.zip"	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process created: C:\Windows\SysWOW64\cmd.exe "cmd.exe" /C "C:\Users\user\AppData\Local\Temp\hqqkbpyi.fzp\Active_Directory_Security_Self_Assessment_v1.4.pdf"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\hqqkbpyi.fzp\Active_Directory_Security_Self_Assessment_v1.4.pdf"	Jump to behavior

Source: C:\Windows\SysWOW64\cmd.exe

Queries volume information: C:\ VolumeInformation

Jump to behavior

Source: C:\Windows\SysWOW64\unarchiver.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	1 Spearphishing Link	Windows Management Instrumentation	1 DLL Side-Loading	11 Process Injection	1 Masquerading	OS Credential Dumping	1 Security Software Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	1 Data Encrypted for Impact
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 DLL Side-Loading	2 Virtualization/Sandbox Evasion	LSASS Memory	2 Virtualization/Sandbox Evasion	Remote Desktop Protocol	Data from Removable Media	1 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	1 Disable or Modify Tools	Security Account Manager	1 Application Window Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	2 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	11 Process Injection	NTDS	1 File and Directory Discovery	Distributed Component Object Model	Input Capture	3 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Obfuscated Files or Information	LSA Secrets	13 System Information Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	2 Software Packing	Cached Domain Credentials	Wi-Fi Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 DLL Side-Loading	DCSync	Remote System Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
https://github.com/netwrix/pingcastle/releases/download/3.3.0.1/PingCastle_3.3.0.1.zip	0%	Avira URL Cloud	safe

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\user\AppData\Local\Temp\hqqkbpyi.fzp\PingCastle.exe	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\hqqkbpyi.fzp\PingCastleAutoUpdater.exe	0%	ReversingLabs

Source	Detection	Scanner	Label
http://provisioning.microsoftonline.com/IProvisioningWebService/ListDomainsT	0%	Avira URL Cloud	safe
https://dirteam.com/sander/2014/11/25/ten-things-you-need-to-be-aware-of-before-using-the-protected-	0%	Avira URL Cloud	safe
https://outlook.office365.comChttps://login.microsoftonline.com/organizations/oauth2/nativeclient	0%	Avira URL Cloud	safe
https://crocs.fi.muni.cz/public/papers/rsa_ccs17	0%	Avira URL Cloud	safe
https://www.ssi.gouv.fr/archive/fr/sciences/fichiers/lcr/mu04c.pdf	0%	Avira URL Cloud	safe
https://bootstrap-table.com/	0%	Avira URL Cloud	safe
https://blog.0patch.com/2021/11/micropatch-for-remote-code-execution-by.html	0%	Avira URL Cloud	safe
https://enterinit.com/powershell-enable-active-directory-recycle-bin	0%	Avira URL Cloud	safe
https://oxfordcomputergroup.com/resources/ldap-channel-binding-signing-requirements/	0%	Avira URL Cloud	safe
https://www.blackhat.com/docs/us-16/materials/us-16-Munoz-A-Journey-From-JNDI-LDAP-Manipulation-To-R	0%	Avira URL Cloud	safe
https://www.romhack.io/slides/RomHack%202018%20-%20Andrea%20Pierini%20-%20whoami%20priv%20-%20show%2	0%	Avira URL Cloud	safe
http://provisioning.microsoftonline.com/IProvisioningWebService/GetCompanyDirSyncFeaturesResponsee	0%	Avira URL Cloud	safe
http://blog.backslasher.net/preventing-users-from-adding-computers-to-a-domain.html	0%	Avira URL Cloud	safe
http://schemas.datacontract.org/2004/07/Microsoft.Online.Administrationx	0%	Avira URL Cloud	safe
https://adsecurity.org/?p=376	0%	Avira URL Cloud	safe
http://provisioning.microsoftonline.com/IProvisioningWebService/ListRolesResponse	0%	Avira URL Cloud	safe
https://dirteam.com/sander/2011/07/13/preventing-ous-and-containers-from-accidental-deletion/	0%	Avira URL Cloud	safe
http://schemas.datacontract.org/2004/07/Microsoft.Online.Administrationz	0%	Avira URL Cloud	safe
http://provisioning.microsoftonline.com/IProvisioningWebService/ListUsersT	0%	Avira URL Cloud	safe
https://www.riskinsight-wavestone.com/en/2021/06/microsoft-adcs-abusing-pki-in-active-directory-envi	0%	Avira URL Cloud	safe
http://schemas.datacontract.org/2004/07/Microsoft.Online.Administrationr	0%	Avira URL Cloud	safe
https://talubu.wordpress.com/2018/02/28/configuring-unc-hardened-access-through-group-policy/	0%	Avira URL Cloud	safe
http://schemas.datacontract.org/2004/07/Microsoft.Online.Administrationo	0%	Avira URL Cloud	safe
http://schemas.datacontract.org/2004/07/Microsoft.Online.Administrationu	0%	Avira URL Cloud	safe
https://trustedsec.com/blog/a-comprehensive-guide-on-relaying-anno-2022	0%	Avira URL Cloud	safe
https://www.gosecure.net/blog/2021/11/22/gosecure-investigates-abusing-windows-server-update-service	0%	Avira URL Cloud	safe
http://schemas.datacontract.org/2004/07/Microsoft.Online.Administrationt	0%	Avira URL Cloud	safe
https://editor.swagger.io/?url=https://gist.githubusercontent.com/vletoux/c6c565c8af07b4df5df65ed01f	0%	Avira URL Cloud	safe
http://schemas.datacontract.org/2004/07/Microsoft.Online.Administration.WebServiced	0%	Avira URL Cloud	safe
http://schemas.datacontract.org/2004/07/Microsoft.Online.Administrationk	0%	Avira URL Cloud	safe
https://www.tarlogic.com/en/blog/abusing-seloaddriverprivilege-for-privilege-escalation/	0%	Avira URL Cloud	safe
http://www.harmj0y.net/blog/redteaming/not-a-security-boundary-breaking-forest-trusts/	0%	Avira URL Cloud	safe
https://www.securityinsider-wavestone.com/2020/01/taking-over-windows-workstations-pxe-laps.html	0%	Avira URL Cloud	safe
https://www.stigviewer.com/stig/windows_10/2018-04-06/finding/	0%	Avira URL Cloud	safe
http://schemas.datacontract.org/2004/07/Microsoft.Online.Administration.WebServicet	0%	Avira URL Cloud	safe
https://dirkjanm.io/ntlm-relaying-to-ad-certificate-services/	0%	Avira URL Cloud	safe
http://schemas.datacontract.org/2004/07/Microsoft.Online.Administration.WebServiceu	0%	Avira URL Cloud	safe
http://provisioning.microsoftonline.com/IProvisioningWebService/ListUsersByStrongAuthenticationT	0%	Avira URL Cloud	safe
http://schemas.datacontract.org/2004/07/Microsoft.Online.Administration.WebService~	0%	Avira URL Cloud	safe
https://adsecurity.org/?p=3466	0%	Avira URL Cloud	safe
http://schemas.datacontract.org/2004/07/Microsoft.Online.AdministrationS	0%	Avira URL Cloud	safe
http://schemas.datacontract.org/2004/07/Microsoft.Online.AdministrationN	0%	Avira URL Cloud	safe
https://pupuweb.com/solved-how-enable-kerberos-armoring-eap-fast-ad/	0%	Avira URL Cloud	safe
https://www.stigviewer.com/stig/active_directory_service_2003/2011-05-20/finding/	0%	Avira URL Cloud	safe
http://gary-nebbett.blogspot.com/2020/01/ldap-channel-binding.html	0%	Avira URL Cloud	safe
https://adsecurity.org/?p=2604	0%	Avira URL Cloud	safe
https://www.petri.com/active-directory-security-understanding-adminsdholder-object	0%	Avira URL Cloud	safe
https://syfuhs.net/lessons-in-disabling-rc4-in-active-directoryEThis	0%	Avira URL Cloud	safe
https://adsecurity.org/?p=3377	0%	Avira URL Cloud	safe
https://www.dsinternals.com/en/impersonating-office-365-users-mimikatz/	0%	Avira URL Cloud	safe
https://www.stigviewer.com/stig/windows_7/2012-08-22/finding/	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
github.com	140.82.121.4	true	false	high
www.google.com	142.250.185.100	true	false	high
objects.githubusercontent.com	185.199.111.133	true	false	high
x1.i.lencr.org	unknown	unknown	false	high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://access.redhat.com/articles/4661861	PingCastle.exe.6.dr	false		high
https://github.com/nsacyber/Pass-the-Hash-Guidance	PingCastle.exe.6.dr	false		high
https://dirteam.com/sander/2014/11/25/ten-things-you-need-to-be-aware-of-before-using-the-protected-	PingCastle.exe.6.dr	false	Avira URL Cloud: safe	unknown
https://github.com/netwrix/pingcastle/issues	PingCastle.exe.6.dr	false		high
http://schemas.xmlsoap.org/ws/2004/08/addressing/faultT	PingCastle.exe.6.dr	false		high
http://schemas.xmlsoap.org/ws/2004/09/enumeration/PullResponse	PingCastle.exe.6.dr	false		high
https://www.youtube.com/Netwrix)	Active_Directory_Security_Self_Assessment_v1.4.pdf.6.dr	false		high
https://www.slideshare.net/harmj0y/derbycon-the-unintended-risks-of-trusting-active-directory	PingCastle.exe.6.dr	false		high
https://www.cert.ssi.gouv.fr/uploads/ad_checklist.html#vuln_	PingCastle.exe.6.dr	false		high
http://provisioning.microsoftonline.com/IProvisioningWebService/ListDomainsT	PingCastle.exe.6.dr	false	Avira URL Cloud: safe	unknown
https://www.netwrix.com/social_communities.html)	Active_Directory_Security_Self_Assessment_v1.4.pdf.6.dr	false		high
https://www.blackhat.com/docs/us-16/materials/us-16-Munoz-A-Journey-From-JNDI-LDAP-Manipulation-To-R	PingCastle.exe.6.dr	false	Avira URL Cloud: safe	unknown
https://crocs.fi.muni.cz/public/papers/rsa_ccs17	PingCastle.exe.6.dr	false	Avira URL Cloud: safe	unknown
https://outlook.office365.comChttps://login.microsoftonline.com/organizations/oauth2/nativeclient	PingCastle.exe.6.dr	false	Avira URL Cloud: safe	unknown
https://github.com/MicrosoftDocs/azure-docs/blob/main/articles/active-directory/hybrid/connect/tshoo	PingCastle.exe.6.dr	false		high
http://schemas.xmlsoap.org/ws/2004/09/enumeration/RenewResponse	PingCastle.exe.6.dr	false		high
https://oxfordcomputergroup.com/resources/ldap-channel-binding-signing-requirements/	PingCastle.exe.6.dr	false	Avira URL Cloud: safe	unknown
https://main.iam.ad.ext.azure.com/api/Directories/	PingCastle.exe.6.dr	false		high
https://blog.0patch.com/2021/11/micropatch-for-remote-code-execution-by.html	PingCastle.exe.6.dr	false	Avira URL Cloud: safe	unknown
https://bootstrap-table.com/	PingCastle.exe.6.dr	false	Avira URL Cloud: safe	unknown
https://enterinit.com/powershell-enable-active-directory-recycle-bin	PingCastle.exe.6.dr	false	Avira URL Cloud: safe	unknown
https://github.com/p0dalirius/Coercer	PingCastle.exe.6.dr	false		high
https://www.ssi.gouv.fr/archive/fr/sciences/fichiers/lcr/mu04c.pdf	PingCastle.exe.6.dr	false	Avira URL Cloud: safe	unknown
http://blog.backslasher.net/preventing-users-from-adding-computers-to-a-domain.html	PingCastle.exe.6.dr	false	Avira URL Cloud: safe	unknown
http://provisioning.microsoftonline.com/IProvisioningWebService/ListRolesResponse	PingCastle.exe.6.dr	false	Avira URL Cloud: safe	unknown
http://provisioning.microsoftonline.com/IProvisioningWebService/GetCompanyDirSyncFeaturesResponsee	PingCastle.exe.6.dr	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2004/09/enumeration/GetStatusResponse	PingCastle.exe.6.dr	false		high
https://www.romhack.io/slides/RomHack%202018%20-%20Andrea%20Pierini%20-%20whoami%20priv%20-%20show%2	PingCastle.exe.6.dr	false	Avira URL Cloud: safe	unknown
https://provisioningapi.microsoftonline.com/provisioningwebservice.svc%UserIdentityHeaderQhttp://pro	PingCastle.exe.6.dr	false		high
https://dirteam.com/sander/2011/07/13/preventing-ous-and-containers-from-accidental-deletion/	PingCastle.exe.6.dr	false	Avira URL Cloud: safe	unknown
https://sts.windows.net/3Exception	PingCastle.exe.6.dr	false		high
https://graph.windows.net	PingCastle.exe.6.dr	false		high
http://schemas.xmlsoap.org/ws/2004/09/enumeration/EnumerateT	PingCastle.exe.6.dr	false		high
https://github.com/PSSecTools/Krbtgt	PingCastle.exe.6.dr	false		high
http://provisioning.microsoftonline.com/IProvisioningWebService/ListUsersT	PingCastle.exe.6.dr	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2004/08/addressing	PingCastle.exe.6.dr	false		high
https://adsecurity.org/?p=376	PingCastle.exe.6.dr	false	Avira URL Cloud: safe	unknown
http://schemas.datacontract.org/2004/07/Microsoft.Online.Administrationz	PingCastle.exe.6.dr	false	Avira URL Cloud: safe	unknown
http://schemas.datacontract.org/2004/07/Microsoft.Online.Administrationx	PingCastle.exe.6.dr	false	Avira URL Cloud: safe	unknown
https://github.com/decoder-it/psgetsystem	PingCastle.exe.6.dr	false		high
https://github.com/lgandx/Responder-Windows	PingCastle.exe.6.dr	false		high
https://www.riskinsight-wavestone.com/en/2021/06/microsoft-adcs-abusing-pki-in-active-directory-envi	PingCastle.exe.6.dr	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2004/09/enumeration/EnumerateResponse	PingCastle.exe.6.dr	false		high
http://schemas.datacontract.org/2004/07/Microsoft.Online.Administrationr	PingCastle.exe.6.dr	false	Avira URL Cloud: safe	unknown
https://csrc.nist.gov/publications/detail/fips/186/5/draft	PingCastle.exe.6.dr	false		high
http://schemas.datacontract.org/2004/07/Microsoft.Online.Administrationo	PingCastle.exe.6.dr	false	Avira URL Cloud: safe	unknown
https://talubu.wordpress.com/2018/02/28/configuring-unc-hardened-access-through-group-policy/	PingCastle.exe.6.dr	false	Avira URL Cloud: safe	unknown
http://schemas.datacontract.org/2004/07/Microsoft.Online.Administrationu	PingCastle.exe.6.dr	false	Avira URL Cloud: safe	unknown
http://schemas.datacontract.org/2004/07/Microsoft.Online.Administrationt	PingCastle.exe.6.dr	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2004/09/transfer/PutT	PingCastle.exe.6.dr	false		high
https://trustedsec.com/blog/a-comprehensive-guide-on-relaying-anno-2022	PingCastle.exe.6.dr	false	Avira URL Cloud: safe	unknown
https://www.gosecure.net/blog/2021/11/22/gosecure-investigates-abusing-windows-server-update-service	PingCastle.exe.6.dr	false	Avira URL Cloud: safe	unknown
https://editor.swagger.io/?url=https://gist.githubusercontent.com/vletoux/c6c565c8af07b4df5df65ed01f	PingCastle v3.0.0.pdf.6.dr	false	Avira URL Cloud: safe	unknown
https://medium.com/	PingCastle.exe.6.dr, changelog.txt.6.dr	false		high
http://schemas.datacontract.org/2004/07/Microsoft.Online.Administration.WebServiced	PingCastle.exe.6.dr	false	Avira URL Cloud: safe	unknown
http://schemas.datacontract.org/2004/07/Microsoft.Online.Administrationk	PingCastle.exe.6.dr	false	Avira URL Cloud: safe	unknown
https://www.tarlogic.com/en/blog/abusing-seloaddriverprivilege-for-privilege-escalation/	PingCastle.exe.6.dr	false	Avira URL Cloud: safe	unknown
https://github.com/ANSSI-FR/AD-control-paths	PingCastle.exe.6.dr	false		high
https://www.securityinsider-wavestone.com/2020/01/taking-over-windows-workstations-pxe-laps.html	PingCastle.exe.6.dr	false	Avira URL Cloud: safe	unknown
http://www.harmj0y.net/blog/redteaming/not-a-security-boundary-breaking-forest-trusts/	PingCastle.exe.6.dr	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2004/09/transfer5	PingCastle.exe.6.dr	false		high
https://www.stigviewer.com/stig/windows_10/2018-04-06/finding/	PingCastle.exe.6.dr	false	Avira URL Cloud: safe	unknown
http://schemas.datacontract.org/2004/07/Microsoft.Online.Administration.WebServicet	PingCastle.exe.6.dr	false	Avira URL Cloud: safe	unknown
http://schemas.datacontract.org/2004/07/Microsoft.Online.Administration.WebServiceu	PingCastle.exe.6.dr	false	Avira URL Cloud: safe	unknown
https://twitter.com/0gtweet/status/1303427935647531018?s=20	PingCastle.exe.6.dr	false		high
http://schemas.xmlsoap.org/ws/2004/09/transfer/PutResponse	PingCastle.exe.6.dr	false		high
https://community.spiceworks.com/pages/NetWrix)	Active_Directory_Security_Self_Assessment_v1.4.pdf.6.dr	false		high
https://login.microsoftonline.com/organizations/oauth2/v2.0/authorizeAhttps://login.microsoftonline.	PingCastle.exe.6.dr	false		high
https://dirkjanm.io/ntlm-relaying-to-ad-certificate-services/	PingCastle.exe.6.dr	false	Avira URL Cloud: safe	unknown
http://provisioning.microsoftonline.com/IProvisioningWebService/ListUsersByStrongAuthenticationT	PingCastle.exe.6.dr	false	Avira URL Cloud: safe	unknown
https://www.cert.ssi.gouv.fr/information/	PingCastle.exe.6.dr	false		high
https://www.kb.cert.org/vuls/id/836068	PingCastle.exe.6.dr	false		high
http://schemas.datacontract.org/2004/07/Microsoft.Online.Administration.WebService~	PingCastle.exe.6.dr	false	Avira URL Cloud: safe	unknown
http://schemas.datacontract.org/2004/07/Microsoft.Online.AdministrationS	PingCastle.exe.6.dr	false	Avira URL Cloud: safe	unknown
https://adsecurity.org/?p=3466	PingCastle.exe.6.dr	false	Avira URL Cloud: safe	unknown
http://schemas.datacontract.org/2004/07/Microsoft.Online.AdministrationN	PingCastle.exe.6.dr	false	Avira URL Cloud: safe	unknown
https://github.com/microsoft/New-KrbtgtKeys.ps1/blob/master/New-KrbtgtKeys.ps1	PingCastle.exe.6.dr	false		high
http://schemas.xmlsoap.org/ws/2004/09/enumeration	PingCastle.exe.6.dr	false		high
https://pupuweb.com/solved-how-enable-kerberos-armoring-eap-fast-ad/	PingCastle.exe.6.dr	false	Avira URL Cloud: safe	unknown
http://gary-nebbett.blogspot.com/2020/01/ldap-channel-binding.html	PingCastle.exe.6.dr	false	Avira URL Cloud: safe	unknown
https://www.netwrix.com/support.html	PingCastle.exe.6.dr	false		high
https://datatables.net/)	PingCastle v3.0.0.pdf.6.dr	false		high
http://schemas.xmlsoap.org/ws/2004/09/transfer/DeleteT	PingCastle.exe.6.dr	false		high
https://api.github.com/repos/netwrix/pingcastle/releases	PingCastleAutoUpdater.exe.6.dr	false		high
http://schemas.xmlsoap.org/ws/2004/09/transferT	PingCastle.exe.6.dr	false		high
https://graph.windows.net/	PingCastle.exe.6.dr	false		high
https://syfuhs.net/lessons-in-disabling-rc4-in-active-directoryEThis	PingCastle.exe.6.dr	false	Avira URL Cloud: safe	unknown
https://attack.mitre.org/techniques/9Mitre	PingCastle.exe.6.dr	false		high
http://schemas.xmlsoap.org/ws/2004/09/enumeration/GetStatusT	PingCastle.exe.6.dr	false		high
https://www.petri.com/active-directory-security-understanding-adminsdholder-object	PingCastle.exe.6.dr	false	Avira URL Cloud: safe	unknown
http://x1.i.lencr.org/	2D85F72862B55C4EADD9E66E06947F3D0.11.dr	false		high
https://adsecurity.org/?p=3377	PingCastle.exe.6.dr	false	Avira URL Cloud: safe	unknown
https://community.spiceworks.com/t/are-redirected-printers-a-security-risk/826344/27	PingCastle.exe.6.dr	false		high
https://adsecurity.org/?p=2604	PingCastle.exe.6.dr	false	Avira URL Cloud: safe	unknown
https://www.stigviewer.com/stig/active_directory_service_2003/2011-05-20/finding/	PingCastle.exe.6.dr	false	Avira URL Cloud: safe	unknown
https://www.dsinternals.com/en/impersonating-office-365-users-mimikatz/	PingCastle.exe.6.dr	false	Avira URL Cloud: safe	unknown
https://www.stigviewer.com/stig/windows_7/2012-08-22/finding/	PingCastle.exe.6.dr	false	Avira URL Cloud: safe	unknown
https://github.com/BloodHoundAD/BloodHound	PingCastle.exe.6.dr	false		high
http://schemas.xmlsoap.org/ws/2004/09/transfer/CreateT	PingCastle.exe.6.dr	false		high
https://getbootstrap.com/)	PingCastle v3.0.0.pdf.6.dr	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
142.250.185.100	www.google.com	United States	15169	GOOGLEUS	false
140.82.121.4	github.com	United States	36459	GITHUBUS	false
185.199.111.133	objects.githubusercontent.com	Netherlands	54113	FASTLYUS	false
239.255.255.250	unknown	Reserved	unknown	unknown	false

Private

IP
192.168.2.4

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1587408
Start date and time:	2025-01-10 10:53:33 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 22s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	browseurl.jbs
Sample URL:	https://github.com/netwrix/pingcastle/releases/download/3.3.0.1/PingCastle_3.3.0.1.zip
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	18
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal56.rans.troj.evad.win@41/59@8/5
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 100% Number of executed functions: 43 Number of non-executed functions: 0

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 142.250.186.163, 142.250.184.238, 142.250.110.84, 142.250.184.206, 142.250.186.78, 199.232.214.172, 192.229.221.95, 2.23.240.205, 142.250.185.174, 50.16.47.176, 54.224.241.105, 18.213.11.84, 34.237.241.83, 2.16.168.107, 2.16.168.105, 162.159.61.3, 172.64.41.3, 142.250.181.238, 23.209.209.135, 142.250.186.46, 142.250.185.110, 172.217.16.195, 142.250.186.142, 172.217.16.206, 2.23.242.162, 20.12.23.50, 104.77.220.172, 13.107.246.45, 4.245.163.56
Excluded domains from analysis (whitelisted): e4578.dscg.akamaiedge.net, chrome.cloudflare-dns.com, fs.microsoft.com, e8652.dscx.akamaiedge.net, accounts.google.com, slscr.update.microsoft.com, otelrules.azureedge.net, acroipm2.adobe.com.edgesuite.net, ctldl.windowsupdate.com, clientservices.googleapis.com, p13n.adobe.io, acroipm2.adobe.com, fe3cr.delivery.mp.microsoft.com, clients2.google.com, ocsp.digicert.com, edgedl.me.gvt1.com, redirector.gvt1.com, armmf.adobe.com, ssl-delivery.adobe.com.edgekey.net, a122.dscd.akamai.net, update.googleapis.com, clients.l.google.com, geo2.adobe.com, crl.root-x1.letsencrypt.org.edgekey.net
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: https://github.com/netwrix/pingcastle/releases/download/3.3.0.1/PingCastle_3.3.0.1.zip

Simulations

Behavior and APIs

Time	Type	Description
04:54:59	API Interceptor	1x Sleep call for process: AcroCEF.exe modified
04:55:19	API Interceptor	15997x Sleep call for process: unarchiver.exe modified

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.261912772529715
Encrypted:	false
SSDEEP:	6:iO4oRKSyMq2Pwkn2nKuAl9OmbnIFUtSoRKSXjZZmwsoRKSXjzkwOwkn2nKuAl9Oe:7vHyMvYfHAahFUtRHN/7H/5JfHAaSJ
MD5:	EC6FE04A6B853A8CC1D9E132DD6FD8BB
SHA1:	273ACD55A7A2083B9CA5349D29F13F2B8336ECEC
SHA-256:	0F9FBD5348F994EFECD30FF6D094B85D6F6DAD44506A2A0BCED146CC54D96BD8
SHA-512:	75B2D5B25A304717C5C29A0B45D5C0ECCC35AE393E00EF7813AA9E1F732045A405E33193C052731869144697FFA35E53B42DBBE7197CEE678030D448A4344673
Malicious:	false
Reputation:	low
Preview:	2025/01/10-04:54:46.779 1934 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-04:54:46.781 1934 Recovering log #3.2025/01/10-04:54:46.781 1934 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.261912772529715
Encrypted:	false
SSDEEP:	6:iO4oRKSyMq2Pwkn2nKuAl9OmbnIFUtSoRKSXjZZmwsoRKSXjzkwOwkn2nKuAl9Oe:7vHyMvYfHAahFUtRHN/7H/5JfHAaSJ
MD5:	EC6FE04A6B853A8CC1D9E132DD6FD8BB
SHA1:	273ACD55A7A2083B9CA5349D29F13F2B8336ECEC
SHA-256:	0F9FBD5348F994EFECD30FF6D094B85D6F6DAD44506A2A0BCED146CC54D96BD8
SHA-512:	75B2D5B25A304717C5C29A0B45D5C0ECCC35AE393E00EF7813AA9E1F732045A405E33193C052731869144697FFA35E53B42DBBE7197CEE678030D448A4344673
Malicious:	false
Reputation:	low
Preview:	2025/01/10-04:54:46.779 1934 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-04:54:46.781 1934 Recovering log #3.2025/01/10-04:54:46.781 1934 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	336
Entropy (8bit):	5.19754871336214
Encrypted:	false
SSDEEP:	6:iO4oRNyaq2Pwkn2nKuAl9Ombzo2jMGIFUtSoRNSFEZmwsoRNJFkwOwkn2nKuAl97:7vfvYfHAa8uFUtRuFE/7z5JfHAa8RJ
MD5:	70E2C780A131E61FACB97373FFD7E201
SHA1:	6CFB0CB6F9097AF39670D3EA4B67B91BAFCD4CDD
SHA-256:	1B30E6F08C181523FB304B430E9C05774BB4947EF0D180516295BCF045C8A9DF
SHA-512:	73F3B3B5FF648A427F2007EC7F9926D0FA5C558A82879C1980BCC65ACB40E861B4DD17B28F4A1045446A4778F7DE112CF0549C93140F962D345FC728D31BD53C
Malicious:	false
Reputation:	low
Preview:	2025/01/10-04:54:47.284 1884 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-04:54:47.292 1884 Recovering log #3.2025/01/10-04:54:47.304 1884 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	336
Entropy (8bit):	5.19754871336214
Encrypted:	false
SSDEEP:	6:iO4oRNyaq2Pwkn2nKuAl9Ombzo2jMGIFUtSoRNSFEZmwsoRNJFkwOwkn2nKuAl97:7vfvYfHAa8uFUtRuFE/7z5JfHAa8RJ
MD5:	70E2C780A131E61FACB97373FFD7E201
SHA1:	6CFB0CB6F9097AF39670D3EA4B67B91BAFCD4CDD
SHA-256:	1B30E6F08C181523FB304B430E9C05774BB4947EF0D180516295BCF045C8A9DF
SHA-512:	73F3B3B5FF648A427F2007EC7F9926D0FA5C558A82879C1980BCC65ACB40E861B4DD17B28F4A1045446A4778F7DE112CF0549C93140F962D345FC728D31BD53C
Malicious:	false
Reputation:	low
Preview:	2025/01/10-04:54:47.284 1884 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-04:54:47.292 1884 Recovering log #3.2025/01/10-04:54:47.304 1884 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	4320
Entropy (8bit):	5.25780746871752
Encrypted:	false
SSDEEP:	96:etJCV4FAsszrNamjTN/2rjYMta02fDtehgO7BtTgo7TEC:etJCV4FiN/jTN/2r8Mta02fEhgO73goL
MD5:	550A21F3295E7EA326F719BA0D8D0601
SHA1:	B78DCE1C6EA190DA8232EA9FD7CF338667BBA9B4
SHA-256:	5A85D02490134B28D9130F3B150784CD00D281628E0D49A2A3EB06EE5872C655
SHA-512:	E24C8D4BD21E8FCCFA79403FD782A75D210691718436643444A8C4D11804F07027589C10BC7D0EA9F2FAACBFECC89057FE390DDEB87E9C041D18A553615575AA
Malicious:	false
Reputation:	low
Preview:	*...#................version.1..namespace-['O.o................next-map-id.1.Pnamespace-158f4913_074a_4bdf_b463_eb784cc805b4-https://rna-resource.acrobat.com/.0>...r................next-map-id.2.Snamespace-fd2db5bd_ef7e_4124_bfa7_f036ce1d74e5-https://rna-v2-resource.acrobat.com/.1O..r................next-map-id.3.Snamespace-cd5be8d1_42d2_481d_ac0e_f904ae470bda-https://rna-v2-resource.acrobat.com/.2.\.o................next-map-id.4.Pnamespace-6070ce43_6a74_4d0a_9cb8_0db6c3126811-https://rna-resource.acrobat.com/.3....^...............Pnamespace-158f4913_074a_4bdf_b463_eb784cc805b4-https://rna-resource.acrobat.com/..\|.^...............Pnamespace-6070ce43_6a74_4d0a_9cb8_0db6c3126811-https://rna-resource.acrobat.com/n..Fa...............Snamespace-fd2db5bd_ef7e_4124_bfa7_f036ce1d74e5-https://rna-v2-resource.acrobat.com/DQ..a...............Snamespace-cd5be8d1_42d2_481d_ac0e_f904ae470bda-https://rna-v2-resource.acrobat.com/i.`do................next-map-id.5.Pnamespace-de635bf2_6773_4d83_ad16_

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	324
Entropy (8bit):	5.212187513706369
Encrypted:	false
SSDEEP:	6:iO4oRNnROq2Pwkn2nKuAl9OmbzNMxIFUtSoRN29ZmwsoRNlkwOwkn2nKuAl9Ombg:7vwvYfHAa8jFUtR6/7Z5JfHAa84J
MD5:	4C78124BDCD44D89EEB4D5CB5651156C
SHA1:	A373A5BFB2646AB2591360E0CCC9797C055C34EF
SHA-256:	765D9B928B8AA7A9A71AE9A95A42682E916EF7B5E653123405BEBEAB238BC219
SHA-512:	195231EBDC6C88369C6C9CE6CBB8F761B8CA1537FC4FC1E1E61865ACEDA2A04417A9597B1CC8CF569E322817DE9FC6B5FD28D0D460E7B3DB20C3493CF483F93C
Malicious:	false
Reputation:	low
Preview:	2025/01/10-04:54:47.612 1884 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-04:54:47.613 1884 Recovering log #3.2025/01/10-04:54:47.614 1884 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	324
Entropy (8bit):	5.212187513706369
Encrypted:	false
SSDEEP:	6:iO4oRNnROq2Pwkn2nKuAl9OmbzNMxIFUtSoRN29ZmwsoRNlkwOwkn2nKuAl9Ombg:7vwvYfHAa8jFUtR6/7Z5JfHAa84J
MD5:	4C78124BDCD44D89EEB4D5CB5651156C
SHA1:	A373A5BFB2646AB2591360E0CCC9797C055C34EF
SHA-256:	765D9B928B8AA7A9A71AE9A95A42682E916EF7B5E653123405BEBEAB238BC219
SHA-512:	195231EBDC6C88369C6C9CE6CBB8F761B8CA1537FC4FC1E1E61865ACEDA2A04417A9597B1CC8CF569E322817DE9FC6B5FD28D0D460E7B3DB20C3493CF483F93C
Malicious:	false
Reputation:	low
Preview:	2025/01/10-04:54:47.612 1884 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-04:54:47.613 1884 Recovering log #3.2025/01/10-04:54:47.614 1884 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 15, database pages 21, cookie 0x5, schema 4, UTF-8, version-valid-for 15
Category:	dropped
Size (bytes):	86016
Entropy (8bit):	4.445127987993464
Encrypted:	false
SSDEEP:	384:yezci5tAiBA7aDQPsknQ0UNCFOa14ocOUw6zyFzqFkdZ+EUTTcdUZ5yDQhJL:rXs3OazzU89UTTgUL
MD5:	A413D187249EF22A1EAABF867FBF6CEF
SHA1:	4C5D619D845A31A9031677DD840CAFD44A63527F
SHA-256:	A90AFC6F86EEBBAA90C18BB6F4A4E3E5A0D2397AC185D6BFF3000C52E395C7AA
SHA-512:	E80CC0758B23976A62314DFB17B47971A15084E236BF745832C4A12D8960A69E2A46E5F6ADD1983D95922B67ED02FB8657134CC53BAF9BC08CBA097C20E400A6
Malicious:	false
Reputation:	low
Preview:	SQLite format 3......@ ..........................................................................c.......1........T...U.1.D............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	3.7763672993833093
Encrypted:	false
SSDEEP:	48:7MRcUp/E2ioyVUioy9oWoy1Cwoy1AKOioy1noy1AYoy1Wioy1hioybioyWoy1noN:78xpjuUFLXKQHBNb9IVXEBodRBkG
MD5:	2FCF25E2D5575DF15B82F16CBEDCCCE3
SHA1:	3D2E56D2BFE1AB2B20ECAFE2CE2B3DC6CA93C94C
SHA-256:	2FA8C25BE88A54BB0512712729B53D5F1685A56A29A865012B30B0FDCF1E409B
SHA-512:	3AB10C66552073A7F5A55C958A4C84C7205590D54B2D61BB98C1CF624E953F72B69E58AEEC829838B91548D63C721B5CC41D1376E291474DC8BE5D482F463ECA
Malicious:	false
Reputation:	low
Preview:	.... .c........^...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................T...[...b...r...t...}.....L..............................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Certificate, Version=3
Category:	dropped
Size (bytes):	1391
Entropy (8bit):	7.705940075877404
Encrypted:	false
SSDEEP:	24:ooVdTH2NMU+I3E0Ulcrgdaf3sWrATrnkC4EmCUkmGMkfQo1fSZotWzD1:ooVguI3Kcx8WIzNeCUkJMmSuMX1
MD5:	0CD2F9E0DA1773E9ED864DA5E370E74E
SHA1:	CABD2A79A1076A31F21D253635CB039D4329A5E8
SHA-256:	96BCEC06264976F37460779ACF28C5A7CFE8A3C0AAE11A8FFCEE05C0BDDF08C6
SHA-512:	3B40F27E828323F5B91F8909883A78A21C86551761F27B38029FAAEC14AF5B7AA96FB9F9CC93EE201B5EB1D0FEF17B290747E8B839D2E49A8F36C5EBF3C7C910
Malicious:	false
Reputation:	low
Preview:	0..k0..S............@.YDc.c...0....H........0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10...150604110438Z..350604110438Z0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10.."0....H.............0..........$s..7.+W(.....8..n<.W.x.u...jn..O(..h.lD...c...k....1.!~.3<.H..y.....!.K...qiJffl.~<p..)"......K...~....G.\|.H#S.8.O.o...IW..t../.8.{.p!.u.0<.....c...O..K~.....w...{J.L.%.p..)..S$........J.?..aQ.....cq...o[...\4ylv.;.by.../&.....................6....7..6u...r......I......A..v........5/(.l....dwnG7..Y^h..r...A)>Y>.&.$...Z.L@.F....:Qn.;.}r...xY.>Qx....../..>{J.Ks......P.\|C.t..t.....0.[q6....00\H..;..}`...).........A.......\|.;F.H..v.v..j.=...8.d..+..(.....B.".'].y...p..N..:..'Qn..d.3CO......B0@0...U...........0...U.......0....0...U......y.Y.{....s.....X..n0...*.H.............U.X....P.....i ')..au\.n...i/..VK..s.Y.!.~.Lq...`.9....!V..P.Y...Y.............b.E.f..\|o..;.....'...}~.."......

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	192
Entropy (8bit):	2.7425532007658724
Encrypted:	false
SSDEEP:	3:kkFkl81K3/tfllXlE/HT8k+h1NNX8RolJuRdxLlGB9lQRYwpDdt:kKl1yeT8b7NMa8RdWBwRd
MD5:	4CDC52FD3015AAD021B64861A1CD3D4B
SHA1:	02CAF780372FF691C886E67FA3093466E6C6D42C
SHA-256:	B55A864E5F4EBEECF6A53C049A096CC3DFC2076C2EBB346B7E32A28B7A88DBA8
SHA-512:	3039E452DAFB2E07E4E6868C143AD7C67A61DBE0B38D8811A9DEA3453D278ED8F3B998360C58C18B8EE284AE1C9788AC1906784AD44AD5B9BD98E104C0EB026A
Malicious:	false
Reputation:	low
Preview:	p...... ............Ec..(....................................................... ..........W....ij..............o...h.t.t.p.:././.x.1...i...l.e.n.c.r...o.r.g./...".6.4.c.d.6.6.5.4.-.5.6.f."...

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Reputation:	low
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.7124

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Reputation:	low
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Reputation:	low
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Reputation:	low
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AdobeFnt23.lst.7124

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Reputation:	low
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.337473187684442
Encrypted:	false
SSDEEP:	6:YEQXJ2HXHTZAgVoZcg1vRcR0YDgDeoAvJM3g98kUwPeUkwRe9:YvXKXzZApZc0vYgDVGMbLUkee9
MD5:	566E603402DE57467B0B102B61DF8E63
SHA1:	412192188E8194DE433190DA22C748C5819CD3D0
SHA-256:	08F97A18D368C82440057DCB4E69ED495D8724878A8D54C38A0B79F8B3151DB0
SHA-512:	122B9B832DDA1A43779CE6E3935E99A09056CB4A549E2F478BD1DFAA86AB61E1DF2171AF09DD28F565F8561B868C58FBE922D09FD0D5C9918E3F290F64938C55
Malicious:	false
Reputation:	low
Preview:	{"analyticsData":{"responseGUID":"0d08e2c3-eb9a-4bb6-91ce-d60e91eafcaa","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736679052994,"statusCode":200,"surfaceID":"ACROBAT_READER_MASTER_SURFACEID","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.282622672370268
Encrypted:	false
SSDEEP:	6:YEQXJ2HXHTZAgVoZcg1vRcR0YDgDeoAvJfBoTfXpnrPeUkwRe9:YvXKXzZApZc0vYgDVGWTfXcUkee9
MD5:	68167387F8D391199616C4728E3EC946
SHA1:	6C637138A50ACEE8FD74FDA7780BF270AD85E032
SHA-256:	42AA9E7832BF9FB37B1772C7BFD7C6962F6DC7682C72735E6A366524652CF0AA
SHA-512:	AEB991543074DE5103020878A9EF424D00CF7E6DA4612E3BD0713FD600BF069A7B7DFC6DCADD2D7ACB66F58CA7BA33E8145712BB3C0959FDC680F02CCAC09999
Malicious:	false
Reputation:	low
Preview:	{"analyticsData":{"responseGUID":"0d08e2c3-eb9a-4bb6-91ce-d60e91eafcaa","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736679052994,"statusCode":200,"surfaceID":"DC_FirstMile_Home_View_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.261538193428123
Encrypted:	false
SSDEEP:	6:YEQXJ2HXHTZAgVoZcg1vRcR0YDgDeoAvJfBD2G6UpnrPeUkwRe9:YvXKXzZApZc0vYgDVGR22cUkee9
MD5:	765007F45075499F6CAFA91E17E96A0C
SHA1:	F8AADBD03D02778F0421E34BC7BFE8E33D20AA50
SHA-256:	3363EA2851C519110CBDF352654A59C99D9EC940FB844C583E569295C233E088
SHA-512:	B9A3A3843A94C857C839BDAC8AF12C4A7740D54A391FB47073C7FE10C519200DD00C0803FE9AE0679D475560FEC13175E243335BAD4A55F34AB8DC79AB466164
Malicious:	false
Reputation:	low
Preview:	{"analyticsData":{"responseGUID":"0d08e2c3-eb9a-4bb6-91ce-d60e91eafcaa","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736679052994,"statusCode":200,"surfaceID":"DC_FirstMile_Right_Sec_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	285
Entropy (8bit):	5.323575265857399
Encrypted:	false
SSDEEP:	6:YEQXJ2HXHTZAgVoZcg1vRcR0YDgDeoAvJfPmwrPeUkwRe9:YvXKXzZApZc0vYgDVGH56Ukee9
MD5:	8E813FF5171774255E3942F5AFCA856B
SHA1:	1DC3C91C483EC0FCE44420ADF143A103141C5B11
SHA-256:	1CAB75AC9E3782C90B43B97952A8D563D138A2A24777F65810A381A2B67CE5BB
SHA-512:	607D321ED179CDC6FE76AC26CF74D811A6ED9174578D0147CD119E607E0EE31F51F72AD14BBF3E1BF72639F6FE551284160B2C7F2D1F1CB2BCE51C17447C8D6E
Malicious:	false
Reputation:	low
Preview:	{"analyticsData":{"responseGUID":"0d08e2c3-eb9a-4bb6-91ce-d60e91eafcaa","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736679052994,"statusCode":200,"surfaceID":"DC_READER_LAUNCH_CARD","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1123
Entropy (8bit):	5.6774372125381625
Encrypted:	false
SSDEEP:	24:Yv6XSpzvYgD6pLgE9cQx8LennAvzBvkn0RCmK8czOCCSu9b:YvL9DD6hgy6SAFv5Ah8cv/uZ
MD5:	A590E2F229F1607CA84C927EA4FBA955
SHA1:	2C5BFC9F1CDC81679CF7ABCFFC698B91321D9517
SHA-256:	CA28D9E22C7FA1BD5538FC171253A445BBDA162F0C2CFFCCB195832E33BD4268
SHA-512:	ACE0EDC8666EBD136615A073323D95574EDB7F9A731437E8C276C161317E37BB75DFCD41AA9B244C07700BC7D96D2B793C3E53926291BF2C27EEBD729197C33B
Malicious:	false
Reputation:	low
Preview:	{"analyticsData":{"responseGUID":"0d08e2c3-eb9a-4bb6-91ce-d60e91eafcaa","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736679052994,"statusCode":200,"surfaceID":"DC_Reader_Convert_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Convert_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_1","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"d5bba1ae-6009-4d23-8886-fd4a474b8ac9","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Convert_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IkNvbnZlcnRQREZSZHJSSFBBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkV4cG9ydCBQREZzIHRvIE1pY3Jvc29mdCBXb3JkIGFuZCBFeGNlbC4ifSwidGNh

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.265405061459228
Encrypted:	false
SSDEEP:	6:YEQXJ2HXHTZAgVoZcg1vRcR0YDgDeoAvJf8dPeUkwRe9:YvXKXzZApZc0vYgDVGU8Ukee9
MD5:	D94EC896A3EF792C2FB398BAD7EECB80
SHA1:	3AEFBC43B6B8F052C3789DA2D2AFFA2A9004B875
SHA-256:	FA6E80B37695517090A296A0A31D3703DB1074F59FEAF35058AAF39C4DC0B46B
SHA-512:	5C7B67744A8D5B52DDCE3F55193CD23C941AB695386AAC70BCEE7EBDBE741A856231BACF629A8464E64B7EA3489A84799135E5694F9E027344D7D5D1BA052378
Malicious:	false
Reputation:	low
Preview:	{"analyticsData":{"responseGUID":"0d08e2c3-eb9a-4bb6-91ce-d60e91eafcaa","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736679052994,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.269444625124427
Encrypted:	false
SSDEEP:	6:YEQXJ2HXHTZAgVoZcg1vRcR0YDgDeoAvJfQ1rPeUkwRe9:YvXKXzZApZc0vYgDVGY16Ukee9
MD5:	1B129AE7E4B0D6710392A8E75D159066
SHA1:	96175CFA67ECD4D160A26BF0415FE02EF6C932B7
SHA-256:	CE41E4A33A1DF0863133DAA3A043FD4998D66105B2844A1037B01F54815BA556
SHA-512:	FEE0C41531D2D93CC6AE99B494027632542C37E1AF573B2B60478E05C8D870BC621B24C74539F3C4332C6C98009D7F6BE6346686DAF1AF01D7C00BC0D31C8F9E
Malicious:	false
Reputation:	low
Preview:	{"analyticsData":{"responseGUID":"0d08e2c3-eb9a-4bb6-91ce-d60e91eafcaa","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736679052994,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.2751625930858665
Encrypted:	false
SSDEEP:	6:YEQXJ2HXHTZAgVoZcg1vRcR0YDgDeoAvJfFldPeUkwRe9:YvXKXzZApZc0vYgDVGz8Ukee9
MD5:	93A923BAB90CDCE298A69F37DFE9AE4B
SHA1:	0AF70C32E6C428D03CE9495377C066CD201F28BB
SHA-256:	72938C110E060F9FCECDB48E17769EF95773DB6294E9BB6ED485EB35B2E591F9
SHA-512:	F5BAE1F126BF823877BC50D4506F9C9688EE90C8DF0169A9BA31E2EB8656BB18D48758DCF895FD86D821609AC1235BAB783EB68DB2C7A59F746C4B5119DDAF66
Malicious:	false
Reputation:	low
Preview:	{"analyticsData":{"responseGUID":"0d08e2c3-eb9a-4bb6-91ce-d60e91eafcaa","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736679052994,"statusCode":200,"surfaceID":"DC_Reader_Edit_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.29076971278703
Encrypted:	false
SSDEEP:	6:YEQXJ2HXHTZAgVoZcg1vRcR0YDgDeoAvJfzdPeUkwRe9:YvXKXzZApZc0vYgDVGb8Ukee9
MD5:	1CD06638925875242316235EF8236292
SHA1:	D4334A960BFB9C7D13E25F881BB9BBD4EF701FDB
SHA-256:	968C5C7192C75207E32DF3D44D943EE9FF35E9A18938E7601F9AE1154392A5D7
SHA-512:	7DED439C5AFED353B0E5D9B225FA341B22981A23B918EFA18590504AC8B8E50D96E62BBD53BD2DCAA3D8A1DB10E9D255A7388726EF081399B8D10D35B9CC69AF
Malicious:	false
Reputation:	low
Preview:	{"analyticsData":{"responseGUID":"0d08e2c3-eb9a-4bb6-91ce-d60e91eafcaa","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736679052994,"statusCode":200,"surfaceID":"DC_Reader_Home_LHP_Trial_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.271360147494364
Encrypted:	false
SSDEEP:	6:YEQXJ2HXHTZAgVoZcg1vRcR0YDgDeoAvJfYdPeUkwRe9:YvXKXzZApZc0vYgDVGg8Ukee9
MD5:	E1D0D388F806A90A22E03EE39FCAAC04
SHA1:	1832C28F76D76E47564AB7D30575F3F25AD2089E
SHA-256:	29AAEDCB5D45151050AF4DA6832E6A4592ED81CB4039A5B861E45C782E88C42C
SHA-512:	508D88EF0D11AABB485373B769516FD4DD357DABAB30801588AD85FF6C07B984B73B3F79D38FF2539EA022392EEF7E6D63C7CB3BC9631758ADF8FF5D545CC6E6
Malicious:	false
Reputation:	low
Preview:	{"analyticsData":{"responseGUID":"0d08e2c3-eb9a-4bb6-91ce-d60e91eafcaa","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736679052994,"statusCode":200,"surfaceID":"DC_Reader_More_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	284
Entropy (8bit):	5.258009240094783
Encrypted:	false
SSDEEP:	6:YEQXJ2HXHTZAgVoZcg1vRcR0YDgDeoAvJf+dPeUkwRe9:YvXKXzZApZc0vYgDVG28Ukee9
MD5:	6C95F47729083177F82C2371E25D906E
SHA1:	196350C493D8AEE1C42FCA1B8920E6158919330D
SHA-256:	F735B1F2EC033A210067DFD73F5F2B65FEA4C69D36B9CB2C4825E6CDDA8927CB
SHA-512:	573B540F07809A4B07498E002F219EE4964E6F9695C578869C4A75B346EE70E1454D5D0988CB4199DB636E5C759468EA50B6A479BBC9CE0D1876824E3867B058
Malicious:	false
Reputation:	low
Preview:	{"analyticsData":{"responseGUID":"0d08e2c3-eb9a-4bb6-91ce-d60e91eafcaa","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736679052994,"statusCode":200,"surfaceID":"DC_Reader_RHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	291
Entropy (8bit):	5.255104082642494
Encrypted:	false
SSDEEP:	6:YEQXJ2HXHTZAgVoZcg1vRcR0YDgDeoAvJfbPtdPeUkwRe9:YvXKXzZApZc0vYgDVGDV8Ukee9
MD5:	C840EB01FEB7562B7F3949A305D3E91B
SHA1:	B4EA36D6DC740F367900E3E572A1C9BDA81D26DF
SHA-256:	2B8BA4A1CE39ADCAC3D04F8274CC5BF6F487AF7798F48359BA280961E5E13C29
SHA-512:	2074CBFA7A09ECE3180DFE674D957DD3212BFD391C9B0D530A41803FC97CF1A1A9F513DAA046E990E42CB655F5A894BEA2CA6F6F099FA7922EFE90DC955041BD
Malicious:	false
Reputation:	low
Preview:	{"analyticsData":{"responseGUID":"0d08e2c3-eb9a-4bb6-91ce-d60e91eafcaa","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736679052994,"statusCode":200,"surfaceID":"DC_Reader_RHP_Intent_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	287
Entropy (8bit):	5.2599343937041025
Encrypted:	false
SSDEEP:	6:YEQXJ2HXHTZAgVoZcg1vRcR0YDgDeoAvJf21rPeUkwRe9:YvXKXzZApZc0vYgDVG+16Ukee9
MD5:	70159938E6D6DA996C47D5C02537F276
SHA1:	352FC06F731DBE19963FEDDC657A0E5C67C88E42
SHA-256:	A6934413E4838AC533276F611124B94DAD1C7C7A81DEC21423C09C3B481D0B70
SHA-512:	DEE414B9B199579A476C581DE422E947C278D08306EDE843E885CB0931DDE97F560C19F4AB57930A3AE606F29B5BDB7B062FA9B8CF095321D473A003A6825297
Malicious:	false
Reputation:	low
Preview:	{"analyticsData":{"responseGUID":"0d08e2c3-eb9a-4bb6-91ce-d60e91eafcaa","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736679052994,"statusCode":200,"surfaceID":"DC_Reader_RHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1090
Entropy (8bit):	5.652097789577902
Encrypted:	false
SSDEEP:	24:Yv6XSpzvYgDmamXayLgE+cNDxeNaqnAvz7xHn0RCmK8czOC/BSu9b:YvL9DDoBgkDMUJUAh8cvMuZ
MD5:	8AA5891F46A007751DF02C0CDC71FC87
SHA1:	8104561BF6BAAAE0EC8399F712E74D4151C51BE7
SHA-256:	F3EB2BD5DA83F192B53B05188A4329A639C46AD641A3F7F71F818EA36784C01F
SHA-512:	E13BA918F0AB932D943AF1799FCA4AD2652FE07A3F21A9E4F92FB89A2631A3ED6B614150F9EBC1CA9EF78D09F002E1779E3144606BC10933E700D6B64FC4DCE1
Malicious:	false
Reputation:	low
Preview:	{"analyticsData":{"responseGUID":"0d08e2c3-eb9a-4bb6-91ce-d60e91eafcaa","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736679052994,"statusCode":200,"surfaceID":"DC_Reader_Sign_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Sign_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_0","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"266234d2-130d-426e-8466-c7a061db101f","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Sign_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IlVwZ3JhZGVSSFBSZHJBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkVhc2lseSBmaWxsIGFuZCBzaWduIFBERnMuIn0sInRjYXRJZCI6bnVsbH0=","dataType":"app

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	286
Entropy (8bit):	5.235697955317789
Encrypted:	false
SSDEEP:	6:YEQXJ2HXHTZAgVoZcg1vRcR0YDgDeoAvJfshHHrPeUkwRe9:YvXKXzZApZc0vYgDVGUUUkee9
MD5:	9D6575DE8FF0817F13400F554B8BAF01
SHA1:	3742EFA816727CF68375080CD6A992BE4F18B6DE
SHA-256:	4DE3273F1BE73A8A36A0164C45A0519595C3E04F2716D34ABCCF5FEDA966BA41
SHA-512:	9090002ED04C91839FA339C67A910C1D031F9A272498749784658AED1A51B536AC858E494885DC79C665DAF464648CB642B6C6C729A1CA439023FA4565055395
Malicious:	false
Reputation:	low
Preview:	{"analyticsData":{"responseGUID":"0d08e2c3-eb9a-4bb6-91ce-d60e91eafcaa","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736679052994,"statusCode":200,"surfaceID":"DC_Reader_Upsell_Cards","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	282
Entropy (8bit):	5.248455317254338
Encrypted:	false
SSDEEP:	6:YEQXJ2HXHTZAgVoZcg1vRcR0YDgDeoAvJTqgFCrPeUkwRe9:YvXKXzZApZc0vYgDVGTq16Ukee9
MD5:	29CD164E4EFC3AA574965C84F4F24CBF
SHA1:	91EF98226CADEAE858C3B9C5EBAD3BAC78019DEE
SHA-256:	68CAC39FBADA49324038560B845907172DBFA23C61A16E8AC777169BC167FD9F
SHA-512:	B2711076DF79D7349FC34AC27CC04974AB879C373D88FC2C04CD9920AA47CA06BF3878696C856E33DCF1E3335C858CB1ED2085B2936806AC7D916017E41311EC
Malicious:	false
Reputation:	low
Preview:	{"analyticsData":{"responseGUID":"0d08e2c3-eb9a-4bb6-91ce-d60e91eafcaa","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736679052994,"statusCode":200,"surfaceID":"Edit_InApp_Aug2020","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	4
Entropy (8bit):	0.8112781244591328
Encrypted:	false
SSDEEP:	3:e:e
MD5:	DC84B0D741E5BEAE8070013ADDCC8C28
SHA1:	802F4A6A20CBF157AAF6C4E07E4301578D5936A2
SHA-256:	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
SHA-512:	65D5F2A173A43ED2089E3934EB48EA02DD9CCE160D539A47D33A616F29554DBD7AF5D62672DA1637E0466333A78AAA023CBD95846A50AC994947DC888AB6AB71
Malicious:	false
Reputation:	low
Preview:	....

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2814
Entropy (8bit):	5.132961025988793
Encrypted:	false
SSDEEP:	48:YmRHKDHg+qfkR0b55GuHAPYHM/6tMPML48SrQcYR29jwGl5:zyAffkogwHMMhSFL77
MD5:	030560C1C29CEDDA5BABB9824532761F
SHA1:	65C53F7192AEB7BD180C6D3AC21552AAA7073657
SHA-256:	C5922E94480B8790C02E8AD38414B99D4E5E892ADE223774BE2C5909FAAA66ED
SHA-512:	C020A9DB0B04FAFEE96CE473FF4F6542A6D75D643440ABFF86324DD02B218C0751504DB2E85C636C08EFA36BFE737AE5D47394E0FF8594EB1251D3ABA5B21227
Malicious:	false
Reputation:	low
Preview:	{"all":[{"id":"DC_Reader_Disc_LHP_Banner","info":{"dg":"e6f2ada004b8e37db1be2801e44a75c3","sid":"DC_Reader_Disc_LHP_Banner"},"mimeType":"file","size":289,"ts":1736502892000},{"id":"DC_Reader_More_LHP_Banner","info":{"dg":"89584c5e82b8a1da817407ee37cf8924","sid":"DC_Reader_More_LHP_Banner"},"mimeType":"file","size":289,"ts":1736502892000},{"id":"DC_Reader_Sign_LHP_Banner","info":{"dg":"c412185f3295741e0034b0dd3e92a725","sid":"DC_Reader_Sign_LHP_Banner"},"mimeType":"file","size":1090,"ts":1736502892000},{"id":"DC_Reader_Home_LHP_Trial_Banner","info":{"dg":"920d9c379dcb6fb3610ad71d0bfd24d5","sid":"DC_Reader_Home_LHP_Trial_Banner"},"mimeType":"file","size":295,"ts":1736502892000},{"id":"DC_Reader_Disc_LHP_Retention","info":{"dg":"2085b978fd23d1931d14e8a23b276f29","sid":"DC_Reader_Disc_LHP_Retention"},"mimeType":"file","size":292,"ts":1736502892000},{"id":"DC_Reader_Edit_LHP_Banner","info":{"dg":"4332bba302b6a4ee886b05ef96a5bbb7","sid":"DC_Reader_Edit_LHP_Banner"},"mimeType":"file","size":2

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 25, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 25
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	1.1881126959654726
Encrypted:	false
SSDEEP:	48:TGufl2GL7msEHUUUUUUUUpSvR9H9vxFGiDIAEkGVvpZ:lNVmswUUUUUUUUp+FGSItN
MD5:	2801D9BCEBB478C0185698825DFD56BC
SHA1:	5883DEEF41308323DA4E229B33E3E7E99508D5A7
SHA-256:	A86790435D9F1A57996A8E338B4529BE2933B38FBBD9C2E2954388B31D437C95
SHA-512:	F36D7F464A352F66D8DD70AF4F58BA1C7487F209D6171A8CE797B6939E253E67645ABEF821973804F9E22802D2449028BC5C48C8056A9332FB66F04DC4D833FC
Malicious:	false
Reputation:	low
Preview:	SQLite format 3......@ ..........................................................................c.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	1.6063362875592324
Encrypted:	false
SSDEEP:	48:7MeKUUUUUUUUUUBvR9H9vxFGiDIAEkGVvWqFl2GL7msj:7WUUUUUUUUUUlFGSItsKVmsj
MD5:	CDA8AEF7DBD93A16A6462E581B738E0C
SHA1:	B4A4D546365194C4980E93272F02DB49793009D7
SHA-256:	F065C5E4F3096975ED675CB2CA7A8F84AE9388463836162201308CF17A3A0DC1
SHA-512:	155FCC4273A41AC543B1DFF2253919B4226751B9B88A4F2D8410E111A9E4E52BD353725C9E64BE0F300A9E16AD393662794EC57C640BA938D0B0C6B1EED72856
Malicious:	false
Reputation:	low
Preview:	.... .c.......D.......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................f.................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\UserCache64.bin

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	66726
Entropy (8bit):	5.392739213842091
Encrypted:	false
SSDEEP:	768:RNOpblrU6TBH44ADKZEg+JfiU2stjZsnQs6CXBlGe61n3yOKYyu:6a6TZ44ADE+FiU2sRZsoCbGaK
MD5:	DDB1725D81E852510F5D1B91A56B465E
SHA1:	2504D02721A39B566E1F898A93D30ABE2119D645
SHA-256:	06AC375951632FA821035EAA131EA048633127BDB7B6144E18B480DC979B44BC
SHA-512:	EC2A5D54096B24E82809F6547F4DD1519D4799BA8FCD4820D1AC6FE5BED6F2CE6347510B85F21CE23DF0527BC6924DCA542B91ED01D34A7745ED490E8D5A5831
Malicious:	false
Reputation:	low
Preview:	4.397.90.FID.2:o:..........:F:AgencyFB-Reg.P:Agency FB.L:$.........................."F:Agency FB.#.96.FID.2:o:..........:F:AgencyFB-Bold.P:Agency FB Bold.L:%.........................."F:Agency FB.#.84.FID.2:o:..........:F:Algerian.P:Algerian.L:$..........................RF:Algerian.#.95.FID.2:o:..........:F:ArialNarrow.P:Arial Narrow.L:$.........................."F:Arial Narrow.#.109.FID.2:o:..........:F:ArialNarrow-Italic.P:Arial Narrow Italic.L:$.........................."F:Arial Narrow.#.105.FID.2:o:..........:F:ArialNarrow-Bold.P:Arial Narrow Bold.L:%.........................."F:Arial Narrow.#.118.FID.2:o:..........:F:ArialNarrow-BoldItalic.P:Arial Narrow Bold Italic.L:%.........................."F:Arial Narrow.#.77.FID.2:o:..........:F:ArialMT.P:Arial.L:$.........................."F:Arial.#.91.FID.2:o:..........:F:Arial-ItalicMT.P:Arial Italic.L:$.........................."F:Arial.#.87.FID.2:o:..........:F:Arial-BoldMT.P:Arial Bold.L:$.........................."F:Arial.#.100.FID.2

C:\Users\user\AppData\Local\Temp\MSIe5e12.LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	246
Entropy (8bit):	3.5085442896850614
Encrypted:	false
SSDEEP:	6:Qgl946caEbiQLxuZUQu+lEbYnuoblv2K8EebClYQZ9:Qw946cPbiOxDlbYnuRK+bKZ9
MD5:	4275EF39F0FF1AD54F31CD4E3138E199
SHA1:	0A4A27C4389C8A0C24F0D8C704F631F5FED31774
SHA-256:	C23E947D14CCDF0FB6307BF7F6DDA4E8DA17AFF76128311820AD58A52F3A9775
SHA-512:	BC7739CB7CEB04C6D174C44AC236449622E54D87AEEADEF3C2360F6474E1119FEDF6B2F65B8652590F1DCDD0160BA950DB42794696726581B8229A8E9E366904
Malicious:	false
Reputation:	low
Preview:	..E.r.r.o.r. .2.7.1.1...T.h.e. .s.p.e.c.i.f.i.e.d. .F.e.a.t.u.r.e. .n.a.m.e. .(.'.A.R.M.'.). .n.o.t. .f.o.u.n.d. .i.n. .F.e.a.t.u.r.e. .t.a.b.l.e.......=.=.=. .L.o.g.g.i.n.g. .s.t.o.p.p.e.d.:. .1.0./.0.1./.2.0.2.5. . .0.4.:.5.4.:.5.4. .=.=.=.....

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2025-01-10 04-54-49-190.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393)
Category:	dropped
Size (bytes):	16525
Entropy (8bit):	5.345946398610936
Encrypted:	false
SSDEEP:	384:zHIq8qrq0qoq/qUILImCIrImI9IWdFdDdoPtPTPtP7ygyAydy0yGV///X/J/VokV:nNW
MD5:	8947C10F5AB6CFFFAE64BCA79B5A0BE3
SHA1:	70F87EEB71BA1BE43D2ABAB7563F94C73AB5F778
SHA-256:	4F3449101521DA7DF6B58A2C856592E1359BA8BD1ACD0688ECF4292BA5388485
SHA-512:	B76DB9EF3AE758F00CAF0C1705105C875838C7801F7265B17396466EECDA4BCD915DA4611155C5F2AD1C82A800C1BEC855E52E2203421815F915B77AA7331CA0
Malicious:	false
Reputation:	low
Preview:	SessionID=f94b8f43-fcd8-49f4-8c6e-bbf5cd863db9.1696420882088 Timestamp=2023-10-04T13:01:22:088+0100 ThreadID=3400 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------".SessionID=f94b8f43-fcd8-49f4-8c6e-bbf5cd863db9.1696420882088 Timestamp=2023-10-04T13:01:22:089+0100 ThreadID=3400 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found".SessionID=f94b8f43-fcd8-49f4-8c6e-bbf5cd863db9.1696420882088 Timestamp=2023-10-04T13:01:22:089+0100 ThreadID=3400 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!".SessionID=f94b8f43-fcd8-49f4-8c6e-bbf5cd863db9.1696420882088 Timestamp=2023-10-04T13:01:22:089+0100 ThreadID=3400 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1".SessionID=f94b8f43-fcd8-49f4-8c6e-bbf5cd863db9.1696420882088 Timestamp=2023-10-04T13:01:22:089+0100 ThreadID=3400 Component=ngl-lib_NglAppLib Description="SetConfig:

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393), with CRLF line terminators
Category:	dropped
Size (bytes):	15114
Entropy (8bit):	5.349070097362017
Encrypted:	false
SSDEEP:	384:9xDELpKljyrha4zWDpNs4fGpw5t5B//t4dP5vZAO2Ql1q8q/qxq2qUqVqycq8qJ0:rZtZyEzh4uZMZcBBzU
MD5:	0022C1341421AF09824A7B21F183E471
SHA1:	9C52F20DC9FD7C2C3E56FBF305A4E24DEA46B2B1
SHA-256:	F21918F435CC0C8D5639AA2E76C769715331EFAC5E216AE6BA8A3CBF05FB988B
SHA-512:	6907EA0073DF07C24F529EA4BDCEB986325B2677D2EADDB3D0AB94936335E52509BC28CEDB56DEDE2D550B150D4B4FF03093F999B916FCC7744A72BD380F2ACD
Malicious:	false
Reputation:	low
Preview:	SessionID=bac89ba4-1e96-4be6-8181-431256463a33.1736502889205 Timestamp=2025-01-10T04:54:49:205-0500 ThreadID=2088 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------"..SessionID=bac89ba4-1e96-4be6-8181-431256463a33.1736502889205 Timestamp=2025-01-10T04:54:49:206-0500 ThreadID=2088 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found"..SessionID=bac89ba4-1e96-4be6-8181-431256463a33.1736502889205 Timestamp=2025-01-10T04:54:49:206-0500 ThreadID=2088 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!"..SessionID=bac89ba4-1e96-4be6-8181-431256463a33.1736502889205 Timestamp=2025-01-10T04:54:49:206-0500 ThreadID=2088 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1"..SessionID=bac89ba4-1e96-4be6-8181-431256463a33.1736502889205 Timestamp=2025-01-10T04:54:49:206-0500 ThreadID=2088 Component=ngl-lib_NglAppLib Description="SetConf

C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	29752
Entropy (8bit):	5.388151243301508
Encrypted:	false
SSDEEP:	768:anddBuBYZwcfCnwZCnR8Bu5hx18HoCnLlAY+iCBuzhLCnx1CnPrRRFS10l8gT2rg:PU
MD5:	7516A8A908906BDBEC865110DCDA82B6
SHA1:	D3A87D11334169C1A724B6137A101E6EBF087068
SHA-256:	64B98EF5432F4DA9F042DAA9D365432BF794877F7EAEFFA9047CCA56C627B274
SHA-512:	88E3BD4B053977E0ABD455BB5B87AD1848AD4CB7D1D71C3F2CF61594ABD9D7540C9C08062815103378CC0626F93ECA335F07F409752BBC4561A5D2250388B569
Malicious:	false
Reputation:	low
Preview:	03-10-2023 12:50:40:.---2---..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : *************************************..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : ***********************************..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : **** Starting new session ******..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : Starting NGL..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : Setting synchronous launch...03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 ::::: Configuring as AcrobatReader1..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : NGLAppVersion 23.6.20320.6..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : NGLAppMode NGL_INIT..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : AcroCEFPath, NGLCEFWorkflowModulePath - C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1 C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : isNGLExternalBrowserDisabled - No..03-10-2023 12:50:40:.Closing File..03-10-

C:\Users\user\AppData\Local\Temp\acrocef_low\06cac884-23a8-4431-983f-daef8d145ce6.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142
Category:	dropped
Size (bytes):	1419751
Entropy (8bit):	7.976496077007677
Encrypted:	false
SSDEEP:	24576:/xA7ouWLgGZtwYIGNPJodpy6mlind9j2kvhsfFXpAXDgrFBU2/R07D:JVuWLgGZtwZGk3mlind9i4ufFXpAXkru
MD5:	A8E5C37206C98D1B655FF994A420FFB6
SHA1:	827237782AB5971EC205C3BCECCC7950BE9F84C3
SHA-256:	F1F755059AF7C2CBC36920337941AEFB18FBDB3CD14D3239CBBBCF0CB8F208EA
SHA-512:	12DE33EB7624458AEC44D83D4E2C09E626F8E54E177FC0C26EEBA232935F34FAAAEB71FBB025EB7C53BEA9933C46ADCE759C32516D1B80C03B6734C61D61CEB2
Malicious:	false
Reputation:	low
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\0e1586ae-1468-4a1e-bf79-9ce2958ef06a.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538
Category:	dropped
Size (bytes):	758601
Entropy (8bit):	7.98639316555857
Encrypted:	false
SSDEEP:	12288:ONh3P65+Tegs6121YSWBlkipdjuv1ybxrr/IxkB1mabFhOXZ/fEa+vTJJJJv+9U0:O3Pjegf121YS8lkipdjMMNB1DofjgJJg
MD5:	3A49135134665364308390AC398006F1
SHA1:	28EF4CE5690BF8A9E048AF7D30688120DAC6F126
SHA-256:	D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B
SHA-512:	BE2C3C39CA57425B28DC36E669DA33B5FF6C7184509756B62832B5E2BFBCE46C9E62EAA88274187F7EE45474DCA98CD8084257EA2EBE6AB36932E28B857743E5
Malicious:	false
Reputation:	low
Preview:	...........kWT..0...W`.........b..@..nn........5.._..I.R3I..9g.x....s.\+.J......F...P......V]u......t....jK...C.fD..]..K....;......y._.U..}......S.........7...Q.............W.D..S.....y......%..=.....e..^.RG......L..].T.9.y.zqm.Q]..y..(......Q]..~~..}..q...@.T..xI.B.L.a.6...{..W..}.mK?u...5.#.{...n...........z....m^.6!.`.....u...eFa........N....o..hA-..s.N..B.q..{..z.{=..va4_`5Z........3.uG.n...+...t...z.M."2..x.-...DF..VtK.....o]b.Fp.>........c....,..t..an[............5.1.(}..q.q......K3.....[>..;e..f.Y.........mV.cL...]eF..7.e.<.._.o\.S..Z...`..}......>@......\|.......ox.........h.......o....-Yj=.s.g.Cc\.i..\..A.B>.X..8`...P......[..O...-.g...r..u\...k..7..#E....N}...8.....(..0....w....j.......>.L....H.....y.x3...[>..t......0..z.qw..]X..i8..w.b..?0.wp..XH.A.[.....S..g.g..I.A.15.0?._n.Q.]..r8.....l..18...(.].m...!\|G.1...... .3.`./....`~......G.............\|..pS.e.C....:o.u_..oi.:..\|....joi...eM.m.K...2%...Z..j...VUh..9.}.....

C:\Users\user\AppData\Local\Temp\acrocef_low\63867207-24a5-436e-9b4a-fd0cd3992fda.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 33081
Category:	dropped
Size (bytes):	1407294
Entropy (8bit):	7.97605879016224
Encrypted:	false
SSDEEP:	24576:/M7o5dpy6mlind9j2kvhsfFXpAXDgrFBU2/R077WLaGZjZwYIGNPJe:RB3mlind9i4ufFXpAXkrfUs03WLaGZje
MD5:	716C2C392DCD15C95BBD760EEBABFCD0
SHA1:	4B4CE9C6AED6A7F809236B2DAFA9987CA886E603
SHA-256:	DD3E6CFC38DA1B30D5250B132388EF73536D00628267E7F9C7E21603388724D8
SHA-512:	E164702386F24FF72111A53DA48DC57866D10DAE50A21D4737B5687E149FF9D673729C5D2F2B8DA9EB76A2E5727A2AFCFA5DE6CC0EEEF7D6EBADE784385460AF
Malicious:	false
Reputation:	low
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\da4f1808-c9da-4786-95bf-8b8d80799da6.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022
Category:	dropped
Size (bytes):	386528
Entropy (8bit):	7.9736851559892425
Encrypted:	false
SSDEEP:	6144:8OSTJJJJEQ6T9UkRm1lBgI81ReWQ53+sQ36X/FLYVbxrr/IxktOQZ1mau4yBwsOo:sTJJJJv+9UZX+Tegs661ybxrr/IxkB1m
MD5:	5C48B0AD2FEF800949466AE872E1F1E2
SHA1:	337D617AE142815EDDACB48484628C1F16692A2F
SHA-256:	F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
SHA-512:	44210CE41F6365298BFBB14F6D850E59841FF555EBA00B51C6B024A12F458E91E43FDA3FA1A10AAC857D4BA7CA6992CCD891C02678DCA33FA1F409DE08859324
Malicious:	false
Reputation:	low
Preview:	...........]s[G. Z...{....;...J$%K&..%.[..k...S....$,.`. )Z..m........a.......o..7.VfV...S..HY}Ba.<.NUVVV~W.].;qG4..b,N..#1.=1.#1..o.Fb.........IC.....Z...g_~.OO.l..g.uO...bY.,[..o.s.D<..W....w....?$4..+..%.[.?..h.w<.T.9.vM.!..h0......}..H..$[...lq,....>..K.)=..s.{.g.O...S9".....Q...#...+..)>=.....\|6......<4W.'.U.j$....+..=9...l.....S..<.\.k.'....{.1<.?..<..uk.v;.7n.!...g....."P..4.U........c.KC..w._G..u..g./.g....{'^.-\|..h#.g.\.PO.\|...]x..Kf4..s..............+.Y.....@.K....zI..X......6e?[..u.g"{..h.vKbM<.?i6{%.q)i...v..<P8P3.......CW.fwd...{:@h...;........5..@.C.j.....a.. U.5...].$.L..wW....z...v.......".M.?c.......o..}.a.9..A..%V..o.d....'..\|m.WC.....\|.....e.[W.p.8...rm....^..x'......5!...\|......z..#......X_..Gl..c..R..`...*.s-1f..]x......f...g...k........g....... ).3.B..{"4...!r....v+As...Zn.]K{.8[..M.r.Y..........+%...]...J}f]~}_..K....;.Z.[..V.&..g...>...{F..{I..@~.^.\|P..G.R>....U..../HY...(.z.<.~.9OW.Sxo.Y

C:\Users\user\AppData\Local\Temp\hqqkbpyi.fzp\Active_Directory_Security_Self_Assessment_v1.4.pdf

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PDF document, version 1.7
Category:	dropped
Size (bytes):	2803867
Entropy (8bit):	7.932015097296447
Encrypted:	false
SSDEEP:	49152:WG9z3ohyZ218Stk+FH3nLpm6K+I97/Y0LEMOvMAeQIlDJB/F3:WCzsW2mwk4H3nLMD97/RLEM+kQIF3
MD5:	870B825A7657DACE55AD4A4A78169899
SHA1:	9D92DCB9165646D59A6E1E5E6A65C37648362115
SHA-256:	D19CDFBAA10106C0245CC9517714C353A0BC40A26BB6640EB8B022AAF9BD2007
SHA-512:	3A58E0AAA685F813BF3025487BF7D5320E635773CCC1964D57BA86BC3579F2CFE1D1F7FF57438FBEED37FEE83343F6BBCA01DAC54BC67EAB7BB47AA9EF62C78F
Malicious:	false
Reputation:	low
Preview:	%PDF-1.7.%......174 0 obj.<</Linearized 1/L 2803867/O 176/E 1646921/N 16/T 2800266/H [ 616 1108]>>.endobj. ..xref..174 16..0000000016 00000 n..0000001724 00000 n..0000001855 00000 n..0000002877 00000 n..0000002991 00000 n..0000003326 00000 n..0000003363 00000 n..0000003811 00000 n..0000004068 00000 n..0000004560 00000 n..0000006497 00000 n..0000009147 00000 n..0000018501 00000 n..0000048746 00000 n..0000048785 00000 n..0000000616 00000 n..trailer..<</Size 190/Root 175 0 R/Info 173 0 R/ID[<26B8313D07E39E439DD1E3935C32E232><E7CE2211823CC540BEAF109AC30B433A>]/Prev 2800254>>..startxref..0..%%EOF.. ..189 0 obj.<</Filter/FlateDecode/I 1278/Length 1009/O 1262/S 994/T 1198>>stream..h.b```....l..l..... ..cg`a..i<.`..!....~b.GEh...........Z../...0.9.4....;{.D.....^<;..n...Y.....0...+.....e...S%.d<..N..;P..$&...JeU..2....v$..N..m...r:..).k..7sK^....m#...7.w.t.1px..`.<..I......<.b.Nm.+.~.-mQY\|u.........A.....e..+..tni.B..v.u..l1.P)........t..)VO...r{.H....2...p.....p

C:\Users\user\AppData\Local\Temp\hqqkbpyi.fzp\PingCastle v3.0.0.pdf

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PDF document, version 1.7, 38 pages
Category:	dropped
Size (bytes):	1696514
Entropy (8bit):	7.962001627679884
Encrypted:	false
SSDEEP:	24576:dpvvnQ8IbTw2YIG0+cRhKjW3WuG3gQuWlK9hlT69uhrWuQe+FAjjKva:faTw5IimhKSGuG3gQuWE68hiueF3a
MD5:	C8F501513B29FB8194A6E02B8F16042F
SHA1:	3F5A9B1C3AC898B9534FBFC16187723A22FD226D
SHA-256:	687592FF1AB4AF1D2C4D8D249A14164CD31E79E1D7BC35C213A256904F3BD565
SHA-512:	B292310BD16A4F2813429D963F1CAF6794433C961EB6FC5E521FFBE17783779315BD0DDF1AE5ACA8CC1506996BFE107C43E6675A8A398A10F3E1A66EF6EFA295
Malicious:	false
Reputation:	low
Preview:	%PDF-1.7..%......1 0 obj..<</Type/Catalog/Pages 2 0 R/Lang(en-US) /StructTreeRoot 213 0 R/MarkInfo<</Marked true>>/Metadata 1181 0 R/ViewerPreferences 1182 0 R>>..endobj..2 0 obj..<</Type/Pages/Count 38/Kids[ 4 0 R 15 0 R 20 0 R 21 0 R 31 0 R 34 0 R 37 0 R 41 0 R 43 0 R 44 0 R 45 0 R 46 0 R 47 0 R 50 0 R 53 0 R 56 0 R 57 0 R 60 0 R 61 0 R 64 0 R 65 0 R 68 0 R 71 0 R 73 0 R 76 0 R 78 0 R 79 0 R 80 0 R 82 0 R 83 0 R 86 0 R 88 0 R 89 0 R 90 0 R 91 0 R 93 0 R 204 0 R 210 0 R] >>..endobj..3 0 obj..<</MSIP_Label_673d0be4-9550-4def-b71d-47d68b4c3c31_Enabled(true) /MSIP_Label_673d0be4-9550-4def-b71d-47d68b4c3c31_SetDate(2023-02-07T17:37:18Z) /MSIP_Label_673d0be4-9550-4def-b71d-47d68b4c3c31_Method(Standard) /MSIP_Label_673d0be4-9550-4def-b71d-47d68b4c3c31_Name(C1 - VINCI. Interne) /MSIP_Label_673d0be4-9550-4def-b71d-47d68b4c3c31_SiteId(6612aa33-55a2-4f05-ad52-359bbfce0374) /MSIP_Label_673d0be4-9550-4def-b71d-47d68b4c3c31_ActionId(4a10dd41-7d2a-4e7d-9f10-4d8a885f889f) /MSIP_Label_673d0be4-9550-4

C:\Users\user\AppData\Local\Temp\hqqkbpyi.fzp\PingCastle.exe

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PE32 executable (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	2741984
Entropy (8bit):	6.4390275497168945
Encrypted:	false
SSDEEP:	49152:etalrGGXwX8goyu5zP7yBApd3ZhUetRYoOPlBTJYIPw+W7SCSFtA9i/VeYnpHgy:WMX7OdBJYIIgFtA9DYOy
MD5:	9FB8F599C1979CE9AA2957DC99C1493D
SHA1:	1F98C1A6CEE744BE2E1774B22573930DDCC8B4D6
SHA-256:	BA17CB0EEBB8DBBB82D0C233C7CEFC39D48F3AF7C40D385C17B4AD441301481E
SHA-512:	87E29720D56F9A726E936B33BF09E7AB557E2864C24FA26B376AD569420E397120B49E99E7802776EDD0C9099EBCA77D195C049251140D1B3D7817E7DB272305
Malicious:	true
Yara Hits:	Rule: JoeSecurity_CosturaAssemblyLoader, Description: Yara detected Costura Assembly Loader, Source: C:\Users\user\AppData\Local\Temp\hqqkbpyi.fzp\PingCastle.exe, Author: Joe Security Rule: JoeSecurity_GenericDownloader_1, Description: Yara detected Generic Downloader, Source: C:\Users\user\AppData\Local\Temp\hqqkbpyi.fzp\PingCastle.exe, Author: Joe Security
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....^.f.........."...0..").........n@).. ........@.. ....................... ......k...`..................................@).O....`).p.............).."..........?).............................................. ............... ..H............text...t ).. ...")................. ..`.rsrc...p....`)......$).............@..@.reloc...............).............@..B................P@).....H........:..........a...(...,_...........................................(. ....{......{......{....r.(......}......}......}.....0..Y........u........L.,G(.....{.....{....o....,/(.....{.....{....o....,.(.....{.....{....o..........0..K....... m... )UU.Z(.....{....o....X )UU.Z(.....{....o....X )UU.Z(.....{....o....X..0...........r...p......%..{.......%q.........-.&.+.......o.....%..{.......%q.........-.&.+.......o.....%..{.......%q.........-.&.+.......o.....(......(...

C:\Users\user\AppData\Local\Temp\hqqkbpyi.fzp\PingCastle.exe.config

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	XML 1.0 document, ASCII text, with very long lines (1057), with CRLF line terminators
Category:	dropped
Size (bytes):	5808
Entropy (8bit):	5.459593246508048
Encrypted:	false
SSDEEP:	96:NocMH8el3K6ypGikhckhc8aRfMLDFeThil1W5M:NoTcWypGiicikVMLDFeN40M
MD5:	ED3CC115C9DBCF9ED5CEEAAF167C5AEA
SHA1:	AA3E2C601E39419854DCBEA492BBB8D4068C5636
SHA-256:	4580629059E726F07B3E1B2579757DFBFA432511E1DF5E96C94F291CAFC8FC91
SHA-512:	CC1EC71E50928860C739B547B8F6D07BBB89B5DA59BA24EA84B72DE48E9A9045D380802CEA55117BF729952F0DC75F800A0E0F3802C0692C03156D9881DCDCF6
Malicious:	false
Reputation:	low
Preview:	<?xml version="1.0"?>..<configuration>.. <configSections> .. <section name="LicenseSettings" type="PingCastle.ADHealthCheckingLicenseSettings, PingCastle" />.. <section name="encryptionSettings" type="PingCastle.Healthcheck.EncryptionSettings, PingCastle" />.. <section name="honeyPotSettings" type="PingCastle.Healthcheck.HoneyPotSettings, PingCastle" />.. <section name="infrastructureSettings" type="PingCastle.Healthcheck.InfrastructureSettings, PingCastle" />.. <section name="customRulesSettings" type="PingCastle.Rules.CustomRulesSettings, PingCastle" />.. </configSections>.. Compatibility with all .Net version starting from 3.0 (for WCF) -->.. <startup useLegacyV2RuntimeActivationPolicy="true">.. <supportedRuntime version="v4.0"/>.. <supportedRuntime version="v2.0.50727"/>.. </startup>.. .. For brand customization for customers having a license.. <appSettings>.. <add key="BrandLogo" value="base64 encoded icon"/>.. <add key="BrandCss" value

C:\Users\user\AppData\Local\Temp\hqqkbpyi.fzp\PingCastleAutoUpdater.exe

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PE32 executable (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	90336
Entropy (8bit):	7.212263087542653
Encrypted:	false
SSDEEP:	1536:XgxFIQ29suranxH2ufS/nzM3XqdPiOHkNmB3GTcIx+4:XgxF922gaxH2znzj/HkwCcB4
MD5:	57E354DC3E46AD02379F73A88527A926
SHA1:	06CACB5BE9591C3E8CB4038D12E74B836A56F099
SHA-256:	175D3984EC4DBEA0CB9F3146306F978446574D4F9C04CEF2E56D926A62568A5B
SHA-512:	4A9C0588C3A52F74E75D0645004D3A3758D93F5B657A93DE853F2D119B4BC18D6E92C4BC1D5B7511C5BC2C02BBE0A73F6D1A5E2718B4D3EE236FF07E155755D9
Malicious:	true
Yara Hits:	Rule: JoeSecurity_CosturaAssemblyLoader, Description: Yara detected Costura Assembly Loader, Source: C:\Users\user\AppData\Local\Temp\hqqkbpyi.fzp\PingCastleAutoUpdater.exe, Author: Joe Security
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...:..f.........."...0.............^.... ........@.. ....................................`.....................................V.......d............>..."........................................................... ............... ..H............text...d.... ...................... ..`.rsrc...d...........................@..@.reloc...............<..............@..B................@.......H.......l... )...........+...t...........................................((...2s.....o.....0..........r...p(.......8............r3..p(....-:..rG..p(....-Q..ri..p(....-L..rw..p(....-D..r...p(....-?+r...X..i2.r...p(.........X%...}....+f..}....+](......}....+N...X..i2.r...p(........X%....\|....(....-$rO..p(....r...p....(....(....(....*...X......i?....r...p(....r...p(....%-.&.+.o....(....(....(....r...p(.....{....(.....r...p(......r...p(....,7.{....-/.{....,.r5..p(....r...p(

C:\Users\user\AppData\Local\Temp\hqqkbpyi.fzp\PingCastleAutoUpdater.exe.config

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	134
Entropy (8bit):	4.603515674984344
Encrypted:	false
SSDEEP:	3:vFWWMNHUz/cIMOofMuQVQDURAmIRMNHjKbolFvREBAW4QIMOov:TMV0kIGMfVJ7V2bofJuAW4QIm
MD5:	DEA31F202AAF4648A796B89B66933388
SHA1:	75107E87B9FBF95DEB9F6DBADBC003AD2E89C2BD
SHA-256:	190F7A6016CAD1FA8EAAAD5D809E0B3634F3DB2B9DA24BA2403A39731B29CC49
SHA-512:	D64F0959C7A2E547271523C34776D63AE86B5A980DF73118647B66CA220000FA57ADD584687594EFC2B5998A360CC20DAB8328891ECEC6B2BDDCD171EFC007F2
Malicious:	false
Reputation:	low
Preview:	<?xml version="1.0"?>..<configuration>.. <startup> .. <supportedRuntime version="v4.0"/>.. </startup>..</configuration>..

C:\Users\user\AppData\Local\Temp\hqqkbpyi.fzp\changelog.txt

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	ISO-8859 text, with CRLF line terminators
Category:	dropped
Size (bytes):	37821
Entropy (8bit):	4.819540083340405
Encrypted:	false
SSDEEP:	768:6cgpk9ZPpS4ie/cWatcq2gCozmOMgob+0v88loV+pA:6cb/ieytcq2QzmOMgwlod
MD5:	F5A9407B1F4FC2DCF4DE8A35ACB6B7E3
SHA1:	06FD82C2DE2359F4A11A6FB33A8F387B88AD5333
SHA-256:	494A44E1F94FC5453EDCD7B10B1BE78C8F3686834577156938A72A0DCBF3C673
SHA-512:	D8E2283D5592681B85223D28ADAD03F980E86A98D15B17ADF27B0FE69F96DD45F18D5DB52E9143854AA58F1F32FDACF65C34BE86F3F32468CD7DA2F3F57F8462
Malicious:	true
Reputation:	low
Preview:	3.3.0.1..* fix an issue where rule is not displayed when impacted users/computers count is less than 100...* Fix OS version detection issue....3.3.0.0..* adjusted the rules S-DesEnabled, S-PwdNotRequired, S-PwdNeverExpires, P-Delegated, A-PreWin2000Other, S-PrimaryGroup, P-ServiceDomainAdmin, .. A-AdminSDHolder to display directly the list of impacted users in the rule if the number is limited (hardcoded to 100) so Pro / Enterprise users can set accounts in exceptions..* handle the case where the property ms-DS-MachineAccountQuota has been removed (you can add as many computers as you want)..* ignore RPC coerce test if the computer used to run PingCastle is the DC (false positive)..* added the rule S-FirewallScript which recommends firewall rules against script engines (suggestion of Steen Poulsen)..* added the rule S-TerminalServicesGPO which recommends session timeout for RDP (suggestion of Steen Poulsen)..* Upgraded .NET Framework version to 4.7.2..* Release will contain version fo

C:\Users\user\AppData\Local\Temp\hqqkbpyi.fzp\license.rtf

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	Rich Text Format data, version 1, ANSI, code page 1252, default language ID 1036
Category:	dropped
Size (bytes):	12456
Entropy (8bit):	4.577959412867706
Encrypted:	false
SSDEEP:	192:qKAnO7iqPpXUvSpxrw7KqkGGrfLbK6pnU5F/TKwWwFBsdtskDSPqS5Ok2:qWL9fxrwWzmy8Pgl7k2
MD5:	75B29725BDD80341C84BC70BFFD45BE4
SHA1:	2CAE506114608D7F4CAF1D0B276A0621C5776638
SHA-256:	8F56DD7FA2E00C0888BC0FC9F96A2619F31A74388FC06DF5BB336F45B6C6B1D0
SHA-512:	1D328A6FBAAA33D1E1802D3FCE00E233A1CCB82C4A1316826039615918DE37662AD49E4BDAF333485AF6E43D28C8F48C6F8C9F66EEB09A31BA417691E768C1DB
Malicious:	false
Reputation:	low
Preview:	{\rtf1\ansi\ansicpg1252\deff0\nouicompat\deflang1036\deflangfe1036{\fonttbl{\f0\fmodern\fprq1\fcharset0 Courier New;}{\f1\fswiss\fprq2 Tahoma;}}..{\colortbl ;\red250\green156\blue26;}..{\*\generator Riched20 10.0.19041}\viewkind4\uc1 ..\pard\nowidctlpar\cf1\b\f0\fs22\lang1033 PingCastle\cf0\b0\par..Copyright (C) 2016-2018 Ping Castle SAS\par..\par..\par..\par..1. Preamble: This Agreement governs the relationship between the user (hereinafter: Licensee) and Ping Castle whose principal place of business is France (Hereinafter: Licensor). This Agreement sets the terms, rights, restrictions and obligations on using [PingCastle] (hereinafter: The Software) created and owned by Licensor, as detailed herein\par..\par..2. License Grant: Licensor hereby grants Licensee a Personal, Non-assignable & non-transferable by default, which is deemed non-commercial, Without the rights to create derivative works, Non-exclusive license, all with accordance with the terms set forth and other legal re

C:\Users\user\AppData\Local\Temp\unarchiver.log

Download File

Process:	C:\Windows\SysWOW64\unarchiver.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1565
Entropy (8bit):	5.1903279434330205
Encrypted:	false
SSDEEP:	48:xp2pN3pyG4pyGb4pyG4pyGpKpyG5WuzpyG4pyGpfpyGbupyGSpyGwpyG4pyG4pyB:AMntn
MD5:	423109B325E3EAACF78700EBF535CAB5
SHA1:	3F523BCF4A1678861E652E8F2B108CC2751267AA
SHA-256:	BD5CE0010DB1FE4CD471BF7880C96EB3B166B96C59102249A6E86C931ED49BDD
SHA-512:	C3C1144A02DD618197DE5E000E9612BDCB911851D48EB59BD23BD6392C7076A6496D4A0EC152BAABE7635A0D895E8015F23C9072CD11A054323D9F521A47D04E
Malicious:	false
Reputation:	low
Preview:	01/10/2025 4:54 AM: Unpack: C:\Users\user\Downloads\PingCastle_3.3.0.1.zip..01/10/2025 4:54 AM: Tmp dir: C:\Users\user\AppData\Local\Temp\hqqkbpyi.fzp..01/10/2025 4:54 AM: Received from standard out: ..01/10/2025 4:54 AM: Received from standard out: 7-Zip 18.05 (x86) : Copyright (c) 1999-2018 Igor Pavlov : 2018-04-30..01/10/2025 4:54 AM: Received from standard out: ..01/10/2025 4:54 AM: Received from standard out: Scanning the drive for archives:..01/10/2025 4:54 AM: Received from standard out: 1 file, 5479682 bytes (5352 KiB)..01/10/2025 4:54 AM: Received from standard out: ..01/10/2025 4:54 AM: Received from standard out: Extracting archive: C:\Users\user\Downloads\PingCastle_3.3.0.1.zip..01/10/2025 4:54 AM: Received from standard out: --..01/10/2025 4:54 AM: Received from standard out: Path = C:\Users\user\Downloads\PingCastle_3.3.0.1.zip..01/10/2025 4:54 AM: Received from standard out: Type = zip..01/10/2025 4:54 AM: Received from standard out: Physical Size = 5479682..01/10/20

C:\Users\user\Downloads\637beebf-6d79-452d-be89-3db27af0e04d.tmp

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Zip archive data, at least v2.0 to extract, compression method=deflate
Category:	dropped
Size (bytes):	13780
Entropy (8bit):	7.98648541539224
Encrypted:	false
SSDEEP:	384:D1FjjaVWNTeymaL32N/SZgG9ZTjs/rh4H:HyVTyjyNaCG9ZTjShA
MD5:	5571C841166DEC66B22C52CE7A1DE489
SHA1:	B494E10231F44B5F2EFD23DF23543355CE88CF13
SHA-256:	F5A28330BBC7302C169572143C9FCBE1DEA7672A3CE8DFBD9751CC1DDB5B3CC9
SHA-512:	C0702D9988B22045EF4D7852AB1448106A7ADBCC89ECAD9ED9AD37A7BE0AA4B592DF601178B11DB5CB584F16444EB510F9948DBC2287E9B4C8EC3800FCD97B24
Malicious:	false
Reputation:	low
Preview:	PK..........9Y....4..........changelog.txt.[]s.6...L...3.#.X.e;M.s.JI.....v;sn.@$$!&.......@B..^$.H\|,...>...'......./.Z.....}...V9%\W+x ......NU...5.,.\|.r.Ui....I..3.;..{..0...\|.3...n....5.RA.A.8..^...ccY}.<N..,...x..;#W........V..i7<Q0...-<.gb.]j......K..........u...F..o.v-./.{.Z.Fj3..m....t./..+.D.I%...B...Zk..]?S.._..k.l.f...J7.....U..p...v..Kg.+..z[...#..Y...%...P_K.J=..t_...O.._[g[..N4~.(.e..F.x.?:.$t.b.`..j.#....M.J..F......`.'i.)N.7..l..94R.....i......:#..l...6:l....Z. {k...Q..mT.a.&...x.u].N.....-...4.T^...hHr.{..xn...V...w...d...E../m.....).6!.h4............Q..bm..],.}..v.$.8.~w'.;.'..z...]M.L...-.9.U...Xa..g....\..WC.~\|.m...^.$....UvN.........z1......~P...k..R...w.._.h.....f.[!.Yr.C.....W...4(...D..H...k..6"l........YK.z.w.....o......\|.\a...`+...pe..i1[...h....,W.8.u..q.S.FZ.....7..4q1.)./..V../../.%....t.2.}.I...W...'?.s..,...1IT(&.......5.4"...SQo.wmk..(`.'....)..%...`...0....f.`q..w.........i:......eMM.t...@%p.\...n...s.....

C:\Users\user\Downloads\PingCastle_3.3.0.1.zip (copy)

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Zip archive data, at least v2.0 to extract, compression method=deflate
Category:	dropped
Size (bytes):	5479682
Entropy (8bit):	7.999409019609525
Encrypted:	true
SSDEEP:	98304:PSi5Hg0tl9BiX7zU5JmYiBbV5H2Bwwufn6OFmH3xg5997zzGC8+OPBZtzSqHxY7A:Pj1vhBi0mYiBbfH2+N/nmS599RrOpZAM
MD5:	5E083FDDDA732EA2E3FD6A322FE86FA6
SHA1:	2C1485DFDCF189CA0554727B1F7C2A8041C2841C
SHA-256:	CE39D23D0849E765E6C47CE0542E0D70C21BDA3FD2264369C8779E2D25C3B13D
SHA-512:	42197F2B4631A2846D432ABCD9516DCBB8A6E09ED3070D43EC569950998BF3A36AD9E070102FE597B8E812D12AF4BEE783D4336DFC3D94CB64F3D572503C5D2B
Malicious:	true
Reputation:	low
Preview:	PK..........9Y....4..........changelog.txt.[]s.6...L...3.#.X.e;M.s.JI.....v;sn.@$$!&.......@B..^$.H\|,...>...'......./.Z.....}...V9%\W+x ......NU...5.,.\|.r.Ui....I..3.;..{..0...\|.3...n....5.RA.A.8..^...ccY}.<N..,...x..;#W........V..i7<Q0...-<.gb.]j......K..........u...F..o.v-./.{.Z.Fj3..m....t./..+.D.I%...B...Zk..]?S.._..k.l.f...J7.....U..p...v..Kg.+..z[...#..Y...%...P_K.J=..t_...O.._[g[..N4~.(.e..F.x.?:.$t.b.`..j.#....M.J..F......`.'i.)N.7..l..94R.....i......:#..l...6:l....Z. {k...Q..mT.a.&...x.u].N.....-...4.T^...hHr.{..xn...V...w...d...E../m.....).6!.h4............Q..bm..],.}..v.$.8.~w'.;.'..z...]M.L...-.9.U...Xa..g....\..WC.~\|.m...^.$....UvN.........z1......~P...k..R...w.._.h.....f.[!.Yr.C.....W...4(...D..H...k..6"l........YK.z.w.....o......\|.\a...`+...pe..i1[...h....,W.8.u..q.S.FZ.....7..4q1.)./..V../../.%....t.2.}.I...W...'?.s..,...1IT(&.......5.4"...SQo.wmk..(`.'....)..%...`...0....f.`q..w.........i:......eMM.t...@%p.\...n...s.....

C:\Users\user\Downloads\PingCastle_3.3.0.1.zip.crdownload

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Zip archive data, at least v2.0 to extract, compression method=deflate
Category:	dropped
Size (bytes):	5479682
Entropy (8bit):	7.999409019609525
Encrypted:	true
SSDEEP:	98304:PSi5Hg0tl9BiX7zU5JmYiBbV5H2Bwwufn6OFmH3xg5997zzGC8+OPBZtzSqHxY7A:Pj1vhBi0mYiBbfH2+N/nmS599RrOpZAM
MD5:	5E083FDDDA732EA2E3FD6A322FE86FA6
SHA1:	2C1485DFDCF189CA0554727B1F7C2A8041C2841C
SHA-256:	CE39D23D0849E765E6C47CE0542E0D70C21BDA3FD2264369C8779E2D25C3B13D
SHA-512:	42197F2B4631A2846D432ABCD9516DCBB8A6E09ED3070D43EC569950998BF3A36AD9E070102FE597B8E812D12AF4BEE783D4336DFC3D94CB64F3D572503C5D2B
Malicious:	false
Reputation:	low
Preview:	PK..........9Y....4..........changelog.txt.[]s.6...L...3.#.X.e;M.s.JI.....v;sn.@$$!&.......@B..^$.H\|,...>...'......./.Z.....}...V9%\W+x ......NU...5.,.\|.r.Ui....I..3.;..{..0...\|.3...n....5.RA.A.8..^...ccY}.<N..,...x..;#W........V..i7<Q0...-<.gb.]j......K..........u...F..o.v-./.{.Z.Fj3..m....t./..+.D.I%...B...Zk..]?S.._..k.l.f...J7.....U..p...v..Kg.+..z[...#..Y...%...P_K.J=..t_...O.._[g[..N4~.(.e..F.x.?:.$t.b.`..j.#....M.J..F......`.'i.)N.7..l..94R.....i......:#..l...6:l....Z. {k...Q..mT.a.&...x.u].N.....-...4.T^...hHr.{..xn...V...w...d...E../m.....).6!.h4............Q..bm..],.}..v.$.8.~w'.;.'..z...]M.L...-.9.U...Xa..g....\..WC.~\|.m...^.$....UvN.........z1......~P...k..R...w.._.h.....f.[!.Yr.C.....W...4(...D..H...k..6"l........YK.z.w.....o......\|.\a...`+...pe..i1[...h....,W.8.u..q.S.FZ.....7..4q1.)./..V../../.%....t.2.}.I...W...'?.s..,...1IT(&.......5.4"...SQo.wmk..(`.'....)..%...`...0....f.`q..w.........i:......eMM.t...@%p.\...n...s.....

Chrome Cache Entry: 154

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Zip archive data, at least v2.0 to extract, compression method=deflate
Category:	downloaded
Size (bytes):	5479682
Entropy (8bit):	7.999409019609525
Encrypted:	true
SSDEEP:	98304:PSi5Hg0tl9BiX7zU5JmYiBbV5H2Bwwufn6OFmH3xg5997zzGC8+OPBZtzSqHxY7A:Pj1vhBi0mYiBbfH2+N/nmS599RrOpZAM
MD5:	5E083FDDDA732EA2E3FD6A322FE86FA6
SHA1:	2C1485DFDCF189CA0554727B1F7C2A8041C2841C
SHA-256:	CE39D23D0849E765E6C47CE0542E0D70C21BDA3FD2264369C8779E2D25C3B13D
SHA-512:	42197F2B4631A2846D432ABCD9516DCBB8A6E09ED3070D43EC569950998BF3A36AD9E070102FE597B8E812D12AF4BEE783D4336DFC3D94CB64F3D572503C5D2B
Malicious:	false
Reputation:	low
URL:	https://objects.githubusercontent.com/github-production-release-asset-2e65be/146924413/3bc39ae0-06ab-46ba-9145-597f72315fc8?X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Credential=releaseassetproduction%2F20250110%2Fus-east-1%2Fs3%2Faws4_request&X-Amz-Date=20250110T095439Z&X-Amz-Expires=300&X-Amz-Signature=7baf7e0309ddde41fc38b6583aff69974df729cb65205dc720c7b02c0841e8d5&X-Amz-SignedHeaders=host&response-content-disposition=attachment%3B%20filename%3DPingCastle_3.3.0.1.zip&response-content-type=application%2Foctet-stream
Preview:	PK..........9Y....4..........changelog.txt.[]s.6...L...3.#.X.e;M.s.JI.....v;sn.@$$!&.......@B..^$.H\|,...>...'......./.Z.....}...V9%\W+x ......NU...5.,.\|.r.Ui....I..3.;..{..0...\|.3...n....5.RA.A.8..^...ccY}.<N..,...x..;#W........V..i7<Q0...-<.gb.]j......K..........u...F..o.v-./.{.Z.Fj3..m....t./..+.D.I%...B...Zk..]?S.._..k.l.f...J7.....U..p...v..Kg.+..z[...#..Y...%...P_K.J=..t_...O.._[g[..N4~.(.e..F.x.?:.$t.b.`..j.#....M.J..F......`.'i.)N.7..l..94R.....i......:#..l...6:l....Z. {k...Q..mT.a.&...x.u].N.....-...4.T^...hHr.{..xn...V...w...d...E../m.....).6!.h4............Q..bm..],.}..v.$.8.~w'.;.'..z...]M.L...-.9.U...Xa..g....\..WC.~\|.m...^.$....UvN.........z1......~P...k..R...w.._.h.....f.[!.Yr.C.....W...4(...D..H...k..6"l........YK.z.w.....o......\|.\a...`+...pe..i1[...h....,W.8.u..q.S.FZ.....7..4q1.)./..V../../.%....t.2.}.I...W...'?.s..,...1IT(&.......5.4"...SQo.wmk..(`.'....)..%...`...0....f.`q..w.........i:......eMM.t...@%p.\...n...s.....

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 10, 2025 10:54:36.007625103 CET	49739	443	192.168.2.4	142.250.185.100
Jan 10, 2025 10:54:36.007714033 CET	443	49739	142.250.185.100	192.168.2.4
Jan 10, 2025 10:54:36.007806063 CET	49739	443	192.168.2.4	142.250.185.100
Jan 10, 2025 10:54:36.008084059 CET	49739	443	192.168.2.4	142.250.185.100
Jan 10, 2025 10:54:36.008120060 CET	443	49739	142.250.185.100	192.168.2.4
Jan 10, 2025 10:54:36.661801100 CET	443	49739	142.250.185.100	192.168.2.4
Jan 10, 2025 10:54:36.662148952 CET	49739	443	192.168.2.4	142.250.185.100
Jan 10, 2025 10:54:36.662183046 CET	443	49739	142.250.185.100	192.168.2.4
Jan 10, 2025 10:54:36.663800955 CET	443	49739	142.250.185.100	192.168.2.4
Jan 10, 2025 10:54:36.663897991 CET	49739	443	192.168.2.4	142.250.185.100
Jan 10, 2025 10:54:36.665205002 CET	49739	443	192.168.2.4	142.250.185.100
Jan 10, 2025 10:54:36.665293932 CET	443	49739	142.250.185.100	192.168.2.4
Jan 10, 2025 10:54:36.717549086 CET	49739	443	192.168.2.4	142.250.185.100
Jan 10, 2025 10:54:36.717566967 CET	443	49739	142.250.185.100	192.168.2.4
Jan 10, 2025 10:54:36.764533997 CET	49739	443	192.168.2.4	142.250.185.100
Jan 10, 2025 10:54:38.489208937 CET	49741	443	192.168.2.4	140.82.121.4
Jan 10, 2025 10:54:38.489311934 CET	443	49741	140.82.121.4	192.168.2.4
Jan 10, 2025 10:54:38.489371061 CET	49742	443	192.168.2.4	140.82.121.4
Jan 10, 2025 10:54:38.489401102 CET	49741	443	192.168.2.4	140.82.121.4
Jan 10, 2025 10:54:38.489458084 CET	443	49742	140.82.121.4	192.168.2.4
Jan 10, 2025 10:54:38.489540100 CET	49742	443	192.168.2.4	140.82.121.4
Jan 10, 2025 10:54:38.489700079 CET	49741	443	192.168.2.4	140.82.121.4
Jan 10, 2025 10:54:38.489737034 CET	443	49741	140.82.121.4	192.168.2.4
Jan 10, 2025 10:54:38.489926100 CET	49742	443	192.168.2.4	140.82.121.4
Jan 10, 2025 10:54:38.489972115 CET	443	49742	140.82.121.4	192.168.2.4
Jan 10, 2025 10:54:39.140635967 CET	443	49741	140.82.121.4	192.168.2.4
Jan 10, 2025 10:54:39.140731096 CET	443	49742	140.82.121.4	192.168.2.4
Jan 10, 2025 10:54:39.144169092 CET	49742	443	192.168.2.4	140.82.121.4
Jan 10, 2025 10:54:39.144227028 CET	443	49742	140.82.121.4	192.168.2.4
Jan 10, 2025 10:54:39.144427061 CET	49741	443	192.168.2.4	140.82.121.4
Jan 10, 2025 10:54:39.144496918 CET	443	49741	140.82.121.4	192.168.2.4
Jan 10, 2025 10:54:39.145899057 CET	443	49742	140.82.121.4	192.168.2.4
Jan 10, 2025 10:54:39.145983934 CET	49742	443	192.168.2.4	140.82.121.4
Jan 10, 2025 10:54:39.146101952 CET	443	49741	140.82.121.4	192.168.2.4
Jan 10, 2025 10:54:39.146172047 CET	49741	443	192.168.2.4	140.82.121.4
Jan 10, 2025 10:54:39.153320074 CET	49741	443	192.168.2.4	140.82.121.4
Jan 10, 2025 10:54:39.153541088 CET	443	49741	140.82.121.4	192.168.2.4
Jan 10, 2025 10:54:39.153564930 CET	49741	443	192.168.2.4	140.82.121.4
Jan 10, 2025 10:54:39.158356905 CET	49742	443	192.168.2.4	140.82.121.4
Jan 10, 2025 10:54:39.158581972 CET	443	49742	140.82.121.4	192.168.2.4
Jan 10, 2025 10:54:39.195333004 CET	443	49741	140.82.121.4	192.168.2.4
Jan 10, 2025 10:54:39.203732967 CET	49741	443	192.168.2.4	140.82.121.4
Jan 10, 2025 10:54:39.203749895 CET	443	49741	140.82.121.4	192.168.2.4
Jan 10, 2025 10:54:39.203917980 CET	49742	443	192.168.2.4	140.82.121.4
Jan 10, 2025 10:54:39.203979015 CET	443	49742	140.82.121.4	192.168.2.4
Jan 10, 2025 10:54:39.251266956 CET	49741	443	192.168.2.4	140.82.121.4
Jan 10, 2025 10:54:39.251435041 CET	49742	443	192.168.2.4	140.82.121.4
Jan 10, 2025 10:54:39.548289061 CET	443	49741	140.82.121.4	192.168.2.4
Jan 10, 2025 10:54:39.548557997 CET	443	49741	140.82.121.4	192.168.2.4
Jan 10, 2025 10:54:39.548609018 CET	443	49741	140.82.121.4	192.168.2.4
Jan 10, 2025 10:54:39.548640013 CET	49741	443	192.168.2.4	140.82.121.4
Jan 10, 2025 10:54:39.548712969 CET	49741	443	192.168.2.4	140.82.121.4
Jan 10, 2025 10:54:39.549746990 CET	49741	443	192.168.2.4	140.82.121.4
Jan 10, 2025 10:54:39.549788952 CET	443	49741	140.82.121.4	192.168.2.4
Jan 10, 2025 10:54:39.564157009 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:39.564241886 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:39.564332008 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:39.564573050 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:39.564611912 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:40.024116993 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:40.056355953 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:40.056416988 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:40.060344934 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:40.060431004 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:40.061590910 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:40.061779976 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:40.061789036 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:40.103359938 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:40.116337061 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:40.116355896 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:40.163681030 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:40.208595991 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:40.209186077 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:40.209224939 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:40.209259033 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:40.209290981 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:40.209362984 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:40.209362984 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:40.209433079 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:40.209495068 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:40.209862947 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:40.210310936 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:40.210596085 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:40.210655928 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:40.210674047 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:40.210915089 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:40.213860035 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:40.223793983 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:40.223877907 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:40.223891973 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:40.266484022 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:40.300009012 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:40.300082922 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:40.300251007 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:40.300261974 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:40.300282955 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:40.300327063 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:40.300378084 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:40.300559044 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:40.300595999 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:40.300630093 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:40.300632000 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:40.300673962 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:40.300707102 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:40.301172972 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:40.301218033 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:40.301254034 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:40.301258087 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:40.301270962 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:40.301314116 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:40.301333904 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:40.301398993 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:40.301413059 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:40.301877022 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:40.301928997 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:40.301944971 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:40.301959991 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:40.302011013 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:40.302052021 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:40.302062035 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:40.302077055 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:40.302108049 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:40.302737951 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:40.302782059 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:40.302799940 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:40.302814960 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:40.303095102 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:40.350627899 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:40.386683941 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:40.386748075 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:40.386864901 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:40.386929989 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:40.386930943 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:40.386953115 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:40.386977911 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:40.387036085 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:40.387068033 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:40.387248039 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:40.387305021 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:40.387334108 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:40.388261080 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:40.388281107 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:40.388319016 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:40.388341904 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:40.388361931 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:40.388394117 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:40.388434887 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:40.389331102 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:40.389372110 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:40.389410019 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:40.389424086 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:40.389452934 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:40.389476061 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:40.390938997 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:40.390959024 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:40.391007900 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:40.391021967 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:40.391051054 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:40.391071081 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:40.474023104 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:40.474072933 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:40.474220037 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:40.474220037 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:40.474286079 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:40.474520922 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:40.474730015 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:40.474771976 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:40.474800110 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:40.474816084 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:40.474849939 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:40.474976063 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:40.475519896 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:40.475560904 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:40.475596905 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:40.475617886 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:40.475641966 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:40.475802898 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:40.476243019 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:40.476281881 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:40.476316929 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:40.476330042 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:40.476360083 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:40.476380110 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:40.478966951 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:40.479007959 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:40.479038000 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:40.479051113 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:40.479083061 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:40.479123116 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:40.479692936 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:40.479732990 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:40.479764938 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:40.479782104 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:40.479805946 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:40.479826927 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:40.480423927 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:40.480463028 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:40.480496883 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:40.480509043 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:40.480535030 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:40.480570078 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:40.560568094 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:40.560616016 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:40.560781002 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:40.560781002 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:40.560846090 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:40.560946941 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:40.561081886 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:40.561121941 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:40.561156988 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:40.561172962 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:40.561201096 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:40.561228037 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:40.561491966 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:40.561531067 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:40.561561108 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:40.561573982 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:40.561602116 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:40.561639071 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:40.561882973 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:40.561920881 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:40.561980009 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:40.561992884 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:40.562020063 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:40.562041044 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:40.562238932 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:40.562282085 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:40.562323093 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:40.562335968 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:40.562364101 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:40.562414885 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:40.562532902 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:40.562572002 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:40.562608004 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:40.562619925 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:40.562650919 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:40.562674046 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:40.562916040 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:40.562952995 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:40.562990904 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:40.563004017 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:40.563029051 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:40.563045979 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:40.611294031 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:40.611346006 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:40.611499071 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:40.611500025 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:40.611563921 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:40.611815929 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:40.647511005 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:40.647574902 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:40.647609949 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:40.647625923 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:40.647658110 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:40.647686958 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:40.647810936 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:40.647865057 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:40.648000002 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:40.648000002 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:40.648065090 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:40.648233891 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:40.648267984 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:40.648283958 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:40.648296118 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:40.648318052 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:40.648353100 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:40.648387909 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:40.648610115 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:40.648649931 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:40.648677111 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:40.648696899 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:40.648731947 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:40.648731947 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:40.648761988 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:40.648855925 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:40.648895979 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:40.648919106 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:40.648931980 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:40.648958921 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:40.648978949 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:40.649261951 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:40.649305105 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:40.649333000 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:40.649346113 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:40.649370909 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:40.649396896 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:40.649688959 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:40.649735928 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:40.649790049 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:40.649802923 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:40.649827957 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:40.649873972 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:40.697803020 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:40.697824955 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:40.697987080 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:40.697988033 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:40.698051929 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:40.698122978 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:40.734436035 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:40.734481096 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:40.734654903 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:40.734654903 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:40.734719038 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:40.734786034 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:40.734802961 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:40.734847069 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:40.734870911 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:40.734885931 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:40.734918118 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:40.734940052 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:40.735218048 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:40.735260010 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:40.735285997 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:40.735304117 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:40.735358953 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:40.735358953 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:40.735590935 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:40.735636950 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:40.735667944 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:40.735682011 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:40.735711098 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:40.735744953 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:40.735955000 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:40.735995054 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:40.736025095 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:40.736037970 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:40.736066103 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:40.736165047 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:40.736268044 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:40.736316919 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:40.736341953 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:40.736360073 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:40.736385107 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:40.736385107 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:40.736409903 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:40.736483097 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:40.736524105 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:40.736548901 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:40.736567020 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:40.736603022 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:40.736603022 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:40.736622095 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:40.784679890 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:40.784713984 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:40.784882069 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:40.784883022 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:40.784946918 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:40.785011053 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:40.821233034 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:40.821260929 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:40.821429968 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:40.821429968 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:40.821495056 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:40.821691036 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:40.821892023 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:40.821912050 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:40.821962118 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:40.821981907 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:40.822010040 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:40.822031975 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:40.822324038 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:40.822343111 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:40.822402000 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:40.822415113 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:40.822442055 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:40.822462082 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:40.822714090 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:40.822732925 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:40.822773933 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:40.822786093 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:40.822813034 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:40.822958946 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:40.823215008 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:40.823235989 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:40.823278904 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:40.823292017 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:40.823347092 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:40.823347092 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:40.823637962 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:40.823657036 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:40.823708057 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:40.823720932 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:40.823748112 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:40.823769093 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:40.823983908 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:40.824003935 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:40.824057102 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:40.824069977 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:40.824088097 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:40.824184895 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:40.871592045 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:40.871622086 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:40.871809959 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:40.871809959 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:40.871874094 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:40.871948957 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:40.913430929 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:40.913459063 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:40.913512945 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:40.913582087 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:40.913621902 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:40.913642883 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:40.913887024 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:40.913907051 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:40.913949013 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:40.913964987 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:40.914010048 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:40.914030075 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:40.914272070 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:40.914292097 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:40.914331913 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:40.914345026 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:40.914374113 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:40.914391041 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:40.914582968 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:40.914603949 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:40.914642096 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:40.914654016 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:40.914681911 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:40.914716005 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:40.915008068 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:40.915029049 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:40.915081978 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:40.915093899 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:40.915119886 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:40.915137053 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:40.915381908 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:40.915400982 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:40.915437937 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:40.915450096 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:40.915477037 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:40.915499926 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:40.915723085 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:40.915750027 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:40.915791035 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:40.915803909 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:40.915827990 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:40.915851116 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:40.958483934 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:40.958512068 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:40.958569050 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:40.958632946 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:40.958673954 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:40.959063053 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:40.995971918 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:40.995997906 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:40.996153116 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:40.996154070 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:40.996217012 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:40.996285915 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:40.996368885 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:40.996387959 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:40.996433020 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:40.996453047 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:40.996478081 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:40.996499062 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:40.996757984 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:40.996779919 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:40.996822119 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:40.996834040 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:40.996870995 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:40.996870995 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:40.997235060 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:40.997252941 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:40.997303009 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:40.997314930 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:40.997342110 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:40.997368097 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:41.000009060 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:41.000029087 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:41.000072956 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:41.000085115 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:41.000111103 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:41.000130892 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:41.000463009 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:41.000484943 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:41.000531912 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:41.000544071 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:41.000569105 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:41.000590086 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:41.000936985 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:41.000956059 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:41.001014948 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:41.001025915 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:41.001053095 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:41.001072884 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:41.045346022 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:41.045367956 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:41.045550108 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:41.045614004 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:41.045675993 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:41.082808971 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:41.082829952 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:41.082998037 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:41.083060980 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:41.083146095 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:41.083440065 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:41.083468914 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:41.083539963 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:41.083563089 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:41.083589077 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:41.083684921 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:41.083709955 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:41.083720922 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:41.083739996 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:41.083769083 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:41.083769083 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:41.083795071 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:41.084057093 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:41.084098101 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:41.084146023 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:41.084163904 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:41.084187031 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:41.084230900 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:41.086927891 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:41.086978912 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:41.087024927 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:41.087035894 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:41.087074041 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:41.087100029 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:41.087219000 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:41.087275982 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:41.087301016 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:41.087316990 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:41.087372065 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:41.087373018 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:41.087692022 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:41.087740898 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:41.087771893 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:41.087790012 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:41.087817907 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:41.087838888 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:41.132363081 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:41.132421017 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:41.132560015 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:41.132560015 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:41.132625103 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:41.132680893 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:41.169822931 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:41.169867039 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:41.170030117 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:41.170030117 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:41.170030117 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:41.170097113 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:41.170135975 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:41.170191050 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:41.170205116 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:41.170224905 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:41.170257092 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:41.170274973 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:41.170420885 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:41.170461893 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:41.170486927 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:41.170500040 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:41.170526981 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:41.170550108 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:41.170825005 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:41.170869112 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:41.170906067 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:41.170923948 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:41.170947075 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:41.170973063 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:41.173727989 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:41.173769951 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:41.173835993 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:41.173847914 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:41.173898935 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:41.173898935 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:41.174104929 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:41.174145937 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:41.174175978 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:41.174192905 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:41.174216032 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:41.174305916 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:41.174428940 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:41.174474001 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:41.174499035 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:41.174510956 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:41.174539089 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:41.174559116 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:41.219358921 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:41.219417095 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:41.219549894 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:41.219549894 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:41.219614983 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:41.219670057 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:41.256700993 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:41.256762028 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:41.256906033 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:41.256906033 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:41.256972075 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:41.257035017 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:41.257153034 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:41.257204056 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:41.257247925 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:41.257268906 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:41.257293940 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:41.257338047 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:41.257482052 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:41.257522106 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:41.257544994 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:41.257558107 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:41.257589102 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:41.257620096 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:41.257791042 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:41.257841110 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:41.257862091 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:41.257874012 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:41.257909060 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:41.257929087 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:41.260998964 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:41.261055946 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:41.261089087 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:41.261101007 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:41.261128902 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:41.261146069 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:41.261334896 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:41.261385918 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:41.261411905 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:41.261424065 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:41.261531115 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:41.261564016 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:41.261745930 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:41.261789083 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:41.261847019 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:41.261877060 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:41.261888981 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:41.261939049 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:41.306180000 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:41.306237936 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:41.306276083 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:41.306343079 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:41.306380987 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:41.306636095 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:41.343683004 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:41.343744993 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:41.343837976 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:41.343838930 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:41.343903065 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:41.344211102 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:41.344391108 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:41.344434023 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:41.344460964 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:41.344481945 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:41.344506025 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:41.344532967 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:41.344788074 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:41.344832897 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:41.344854116 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:41.344866991 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:41.344894886 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:41.344912052 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:41.345166922 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:41.345207930 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:41.345240116 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:41.345252037 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:41.345277071 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:41.345297098 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:41.347773075 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:41.347814083 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:41.347841978 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:41.347853899 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:41.347893000 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:41.347913980 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:41.348310947 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:41.348351955 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:41.348391056 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:41.348402023 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:41.348427057 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:41.348458052 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:41.348624945 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:41.348664045 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:41.348700047 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:41.348711967 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:41.348736048 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:41.348754883 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:41.393096924 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:41.393153906 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:41.393291950 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:41.393291950 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:41.393357038 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:41.393419981 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:41.430330992 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:41.430394888 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:41.430526018 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:41.430526018 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:41.430589914 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:41.430651903 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:41.431258917 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:41.431301117 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:41.431353092 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:41.431368113 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:41.431400061 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:41.431667089 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:41.432256937 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:41.432318926 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:41.432338953 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:41.432353020 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:41.432384014 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:41.432405949 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:41.432447910 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:41.432503939 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:41.432528019 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:41.432540894 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:41.432565928 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:41.432584047 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:41.434606075 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:41.434652090 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:41.434686899 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:41.434699059 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:41.434730053 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:41.434747934 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:41.435084105 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:41.435141087 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:41.435161114 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:41.435174942 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:41.435203075 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:41.435220957 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:41.435445070 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:41.435484886 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:41.435513020 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:41.435530901 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:41.435554981 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:41.435579062 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:41.479831934 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:41.479876041 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:41.479933977 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:41.480003119 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:41.480045080 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:41.480429888 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:41.517301083 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:41.517343998 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:41.517401934 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:41.517468929 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:41.517507076 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:41.517529964 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:41.518145084 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:41.518188000 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:41.518237114 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:41.518250942 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:41.518279076 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:41.518300056 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:41.518503904 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:41.518544912 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:41.518569946 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:41.518583059 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:41.518610954 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:41.518627882 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:41.518929958 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:41.518968105 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:41.519006968 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:41.519020081 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:41.519048929 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:41.519067049 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:41.521500111 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:41.521538973 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:41.521591902 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:41.521605015 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:41.521634102 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:41.521683931 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:41.522376060 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:41.522414923 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:41.522461891 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:41.522474051 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:41.522502899 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:41.522541046 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:41.522723913 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:41.522764921 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:41.522811890 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:41.522829056 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:41.522852898 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:41.522878885 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:41.566674948 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:41.566716909 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:41.566880941 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:41.566880941 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:41.566946030 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:41.567004919 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:41.604130983 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:41.604178905 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:41.604368925 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:41.604368925 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:41.604434013 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:41.604677916 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:41.604960918 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:41.605001926 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:41.605046988 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:41.605062008 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:41.605103970 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:41.605360985 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:41.605422974 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:41.605456114 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:41.605456114 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:41.605472088 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:41.605509043 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:41.605581045 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:41.605806112 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:41.605844975 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:41.605891943 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:41.605905056 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:41.605932951 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:41.606034040 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:41.608628988 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:41.608666897 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:41.608704090 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:41.608717918 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:41.608752966 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:41.609034061 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:41.609471083 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:41.609510899 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:41.609554052 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:41.609572887 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:41.609595060 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:41.610008955 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:41.610213995 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:41.610251904 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:41.610297918 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:41.610310078 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:41.610342026 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:41.610438108 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:41.653333902 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:41.653378010 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:41.653531075 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:41.653593063 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:41.653645992 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:41.654007912 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:41.691179037 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:41.691243887 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:41.691409111 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:41.691473007 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:41.691519022 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:41.691765070 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:41.692019939 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:41.692068100 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:41.692114115 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:41.692128897 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:41.692178965 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:41.692243099 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:41.692356110 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:41.692388058 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:41.692460060 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:41.692460060 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:41.692476034 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:41.692604065 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:41.692677021 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:41.692702055 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:41.692764997 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:41.692764997 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:41.692779064 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:41.692970037 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:41.695524931 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:41.695549011 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:41.695589066 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:41.695600986 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:41.695637941 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:41.695780039 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:41.696099997 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:41.696127892 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:41.696170092 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:41.696182966 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:41.696218967 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:41.696537018 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:41.696921110 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:41.696943998 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:41.697016001 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:41.697016954 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:41.697030067 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:41.697331905 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:41.740269899 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:41.740315914 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:41.740479946 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:41.740479946 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:41.740544081 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:41.740869045 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:41.778078079 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:41.778120995 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:41.778170109 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:41.778184891 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:41.778223991 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:41.778249025 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:41.779026985 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:41.779076099 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:41.779109001 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:41.779129982 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:41.779166937 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:41.779405117 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:41.779455900 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:41.779509068 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:41.779529095 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:41.779577017 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:41.779726028 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:41.779763937 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:41.779768944 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:41.779804945 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:41.779809952 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:41.779843092 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:41.779927015 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:41.782475948 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:41.782517910 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:41.782568932 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:41.782586098 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:41.782625914 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:41.783015966 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:41.783071995 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:41.783111095 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:41.783154011 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:41.783166885 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:41.783205032 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:41.783277988 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:41.783874035 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:41.783915043 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:41.783957958 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:41.783970118 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:41.784004927 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:41.784379005 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:41.827176094 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:41.827214956 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:41.827259064 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:41.827276945 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:41.827316999 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:41.827841043 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:41.864840031 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:41.864881039 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:41.864926100 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:41.864942074 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:41.864984989 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:41.865324974 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:41.865873098 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:41.865959883 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:41.866007090 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:41.866024017 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:41.866053104 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:41.866245985 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:41.866437912 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:41.866492033 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:41.866535902 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:41.866548061 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:41.866586924 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:41.866710901 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:41.866900921 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:41.866941929 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:41.866986990 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:41.866998911 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:41.867023945 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:41.867089033 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:41.872239113 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:41.872284889 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:41.872334957 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:41.872351885 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:41.872389078 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:41.872699022 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:41.874192953 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:41.874237061 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:41.874283075 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:41.874295950 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:41.874337912 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:41.874572039 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:41.874618053 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:41.874666929 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:41.874680042 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:41.874705076 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:41.874815941 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:41.914618015 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:41.914688110 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:41.914741993 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:41.914760113 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:41.914803982 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:41.915982008 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:41.952183962 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:41.952265978 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:41.952428102 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:41.952429056 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:41.952492952 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:41.952831030 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:41.953243017 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:41.953286886 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:41.953331947 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:41.953592062 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:41.953608036 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:41.953640938 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:41.953687906 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:41.953689098 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:41.953722954 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:41.953742027 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:41.953763962 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:41.953845024 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:41.953917027 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:41.953957081 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:41.954001904 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:41.954015017 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:41.954042912 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:41.954088926 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:41.959072113 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:41.959112883 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:41.959161997 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:41.959177017 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:41.959233046 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:41.959233046 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:41.959753990 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:41.959795952 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:41.959841967 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:41.959853888 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:41.959894896 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:41.960129976 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:41.960511923 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:41.960556030 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:41.960599899 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:41.960612059 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:41.960654974 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:41.960980892 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:42.001354933 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:42.001425982 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:42.001476049 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:42.001487970 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:42.001528978 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:42.001966000 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:42.038589954 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:42.038649082 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:42.038693905 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:42.038726091 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:42.038764954 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:42.039014101 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:42.039573908 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:42.039617062 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:42.039663076 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:42.039695024 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:42.039738894 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:42.039959908 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:42.039982080 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:42.039997101 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:42.040033102 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:42.040041924 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:42.040107965 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:42.040107965 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:42.040123940 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:42.040210962 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:42.040251017 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:42.040260077 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:42.040277958 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:42.040299892 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:42.040323973 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:42.040384054 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:42.045758009 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:42.045804977 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:42.045854092 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:42.045866966 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:42.045902967 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:42.045933962 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:42.046295881 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:42.046335936 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:42.046381950 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:42.046395063 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:42.046437979 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:42.046475887 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:42.047076941 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:42.047116041 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:42.047162056 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:42.047173977 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:42.047215939 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:42.047777891 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:42.088254929 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:42.088331938 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:42.088488102 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:42.088488102 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:42.088552952 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:42.088861942 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:42.125657082 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:42.125725985 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:42.125905037 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:42.125905991 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:42.125969887 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:42.126166105 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:42.126419067 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:42.126462936 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:42.126507998 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:42.126523018 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:42.126563072 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:42.126775980 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:42.126825094 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:42.126827955 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:42.126858950 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:42.126876116 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:42.126902103 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:42.126938105 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:42.127262115 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:42.127310038 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:42.127379894 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:42.127393961 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:42.127444983 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:42.127861023 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:42.132663012 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:42.132704973 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:42.132750034 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:42.132762909 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:42.132800102 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:42.133074045 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:42.133121014 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:42.133174896 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:42.133188963 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:42.133233070 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:42.133615017 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:42.133914948 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:42.133955002 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:42.134001970 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:42.134013891 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:42.134056091 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:42.139596939 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:42.175543070 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:42.175602913 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:42.175802946 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:42.175802946 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:42.175868034 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:42.175981998 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:42.213016987 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:42.213074923 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:42.213252068 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:42.213252068 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:42.213316917 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:42.213450909 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:42.213848114 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:42.213897943 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:42.213948965 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:42.213964939 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:42.213996887 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:42.214236021 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:42.214284897 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:42.214289904 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:42.214320898 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:42.214342117 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:42.214390993 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:42.214391947 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:42.214864969 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:42.214904070 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:42.214950085 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:42.214963913 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:42.215007067 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:42.215287924 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:42.219538927 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:42.219587088 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:42.219638109 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:42.219650984 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:42.219680071 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:42.219770908 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:42.219825983 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:42.219865084 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:42.219912052 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:42.219923973 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:42.219961882 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:42.220042944 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:42.220671892 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:42.220729113 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:42.220774889 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:42.220788002 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:42.220834017 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:42.221009970 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:42.262098074 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:42.262166977 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:42.262361050 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:42.262376070 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:42.262602091 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:42.299490929 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:42.299556971 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:42.299736977 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:42.299806118 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:42.299849987 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:42.300235033 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:42.300299883 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:42.300365925 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:42.300388098 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:42.300412893 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:42.300502062 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:42.300542116 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:42.300590038 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:42.300606012 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:42.300635099 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:42.300719023 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:42.300738096 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:42.300786972 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:42.300833941 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:42.300846100 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:42.300894022 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:42.301079988 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:42.306353092 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:42.306394100 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:42.306441069 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:42.306454897 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:42.306493044 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:42.306756020 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:42.306806087 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:42.306862116 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:42.306876898 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:42.306920052 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:42.307482004 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:42.307521105 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:42.307571888 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:42.307586908 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:42.307620049 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:42.307712078 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:42.349256992 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:42.349314928 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:42.349499941 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:42.349499941 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:42.349577904 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:42.351785898 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:42.386286020 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:42.386352062 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:42.386404037 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:42.386421919 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:42.386457920 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:42.386903048 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:42.386956930 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:42.387017965 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:42.387043953 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:42.387089014 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:42.387280941 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:42.387347937 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:42.387413979 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:42.387435913 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:42.387473106 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:42.387631893 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:42.387680054 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:42.387733936 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:42.387748957 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:42.387775898 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:42.389452934 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:42.393121958 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:42.393165112 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:42.393218040 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:42.393237114 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:42.393269062 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:42.393464088 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:42.393524885 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:42.393580914 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:42.393604040 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:42.393649101 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:42.394395113 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:42.394434929 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:42.395780087 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:42.395797968 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:42.403784990 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:42.436202049 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:42.436244011 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:42.436300993 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:42.436327934 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:42.436357021 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:42.436496973 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:42.473511934 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:42.473577976 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:42.473628998 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:42.473650932 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:42.473696947 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:42.473748922 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:42.473799944 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:42.473849058 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:42.473867893 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:42.473908901 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:42.474098921 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:42.474138021 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:42.474188089 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:42.474208117 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:42.474244118 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:42.474524975 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:42.474572897 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:42.474618912 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:42.474632025 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:42.474672079 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:42.479784012 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:42.480755091 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:42.480804920 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:42.480853081 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:42.480870962 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:42.480914116 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:42.481136084 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:42.481184006 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:42.481239080 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:42.481252909 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:42.481296062 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:42.482537985 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:42.482577085 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:42.482630014 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:42.482642889 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:42.482678890 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:42.487061977 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:42.523236036 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:42.523296118 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:42.523350954 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:42.523370981 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:42.523416996 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:42.531784058 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:42.560523033 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:42.560589075 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:42.560751915 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:42.560756922 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:42.560808897 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:42.560817003 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:42.560842037 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:42.560853004 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:42.560889959 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:42.561093092 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:42.561131954 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:42.561187983 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:42.561222076 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:42.561264992 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:42.561341047 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:42.561439991 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:42.561499119 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:42.561515093 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:42.561562061 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:42.567646980 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:42.567675114 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:42.567771912 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:42.567771912 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:42.567791939 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:42.568248987 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:42.568272114 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:42.568315983 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:42.568331003 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:42.568376064 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:42.569526911 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:42.569546938 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:42.569596052 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:42.569610119 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:42.569655895 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:42.609957933 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:42.610004902 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:42.610162020 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:42.610162020 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:42.610235929 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:42.647154093 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:42.647197008 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:42.647346020 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:42.647346973 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:42.647418022 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:42.647629023 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:42.647674084 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:42.647705078 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:42.647722960 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:42.647758007 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:42.647984028 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:42.648020983 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:42.648056984 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:42.648071051 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:42.648097992 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:42.648267031 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:42.648310900 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:42.648332119 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:42.648344994 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:42.648377895 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:42.654489994 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:42.654529095 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:42.654565096 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:42.654577971 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:42.654608965 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:42.655066967 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:42.655113935 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:42.655190945 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:42.655206919 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:42.656229973 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:42.656269073 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:42.656303883 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:42.656318903 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:42.656347036 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:42.696894884 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:42.696942091 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:42.697082043 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:42.697082996 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:42.697149992 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:42.734275103 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:42.734314919 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:42.734349966 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:42.734384060 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:42.734400988 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:42.734635115 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:42.734682083 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:42.734694958 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:42.734704971 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:42.734738111 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:42.734954119 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:42.734992027 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:42.735017061 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:42.735030890 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:42.735058069 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:42.735397100 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:42.735455036 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:42.735475063 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:42.735488892 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:42.735517979 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:42.741311073 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:42.741348982 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:42.741381884 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:42.741400003 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:42.741426945 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:42.741770983 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:42.741818905 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:42.741839886 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:42.741852999 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:42.741882086 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:42.743144989 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:42.743184090 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:42.743217945 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:42.743237019 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:42.743261099 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:42.783843040 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:42.783906937 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:42.784039021 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:42.784039974 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:42.784107924 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:42.821171045 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:42.821223021 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:42.821355104 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:42.821355104 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:42.821422100 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:42.821489096 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:42.821540117 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:42.821553946 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:42.821576118 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:42.821614981 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:42.821796894 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:42.821839094 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:42.821861982 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:42.821880102 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:42.821913958 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:42.822181940 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:42.822228909 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:42.822256088 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:42.822271109 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:42.822298050 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:42.828174114 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:42.828212023 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:42.828246117 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:42.828258991 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:42.828289986 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:42.828644991 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:42.828691959 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:42.828702927 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:42.828720093 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:42.828758955 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:42.829798937 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:42.829838991 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:42.829881907 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:42.829895973 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:42.829935074 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:42.870683908 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:42.870731115 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:42.870866060 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:42.870866060 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:42.870934010 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:42.912792921 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:42.912832975 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:42.912971020 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:42.912971973 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:42.913038015 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:42.913275003 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:42.913321018 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:42.913358927 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:42.913392067 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:42.913419962 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:42.913634062 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:42.913686037 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:42.913723946 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:42.913738966 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:42.913769960 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:42.913944006 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:42.913988113 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:42.914012909 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:42.914027929 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:42.914058924 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:42.915057898 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:42.915096998 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:42.915132046 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:42.915146112 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:42.915173054 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:42.915415049 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:42.915461063 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:42.915483952 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:42.915497065 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:42.915529013 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:42.916793108 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:42.916831970 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:42.916863918 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:42.916877985 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:42.916904926 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:42.957668066 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:42.957731009 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:42.957863092 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:42.957936049 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:42.957974911 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:42.999857903 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:42.999912977 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:43.000055075 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:43.000056028 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:43.000089884 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:43.000122070 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:43.000169992 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:43.000174046 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:43.000174046 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:43.000197887 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:43.000237942 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:43.000272989 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:43.000453949 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:43.000504971 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:43.000538111 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:43.000575066 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:43.000607014 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:43.000724077 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:43.000768900 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:43.000768900 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:43.000788927 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:43.000801086 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:43.000834942 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:43.000857115 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:43.002567053 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:43.002614021 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:43.002651930 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:43.002666950 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:43.002695084 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:43.002784967 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:43.002918959 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:43.002970934 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:43.003000975 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:43.003019094 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:43.003045082 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:43.003062010 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:43.003488064 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:43.003528118 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:43.003570080 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:43.003582001 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:43.003607988 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:43.003695965 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:43.044677973 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:43.044745922 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:43.044787884 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:43.044807911 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:43.044842005 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:43.044853926 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:43.086632013 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:43.086690903 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:43.086837053 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:43.086837053 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:43.086900949 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:43.086963892 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:43.087057114 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:43.087112904 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:43.087141991 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:43.087162971 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:43.087188005 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:43.087207079 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:43.087446928 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:43.087496996 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:43.087524891 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:43.087538004 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:43.087568045 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:43.087590933 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:43.087753057 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:43.087798119 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:43.087820053 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:43.087832928 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:43.087858915 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:43.087876081 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:43.088854074 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:43.088895082 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:43.088943958 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:43.088963032 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:43.088987112 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:43.089006901 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:43.089211941 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:43.089256048 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:43.089293003 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:43.089310884 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:43.089334011 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:43.089353085 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:43.090332031 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:43.090373039 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:43.090435982 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:43.090447903 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:43.090476990 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:43.090579033 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:43.131422997 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:43.131486893 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:43.131649017 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:43.131649017 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:43.131714106 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:43.131768942 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:43.173666954 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:43.173738003 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:43.173887014 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:43.173887014 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:43.173924923 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:43.173957109 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:43.174005985 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:43.174006939 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:43.174006939 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:43.174030066 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:43.174067974 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:43.174101114 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:43.174210072 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:43.174251080 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:43.174274921 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:43.174309015 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:43.174343109 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:43.174365997 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:43.174664021 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:43.174704075 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:43.174731016 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:43.174745083 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:43.174774885 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:43.174793959 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:43.175658941 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:43.175698042 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:43.175754070 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:43.175765991 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:43.175797939 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:43.175817013 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:43.176028013 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:43.176070929 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:43.176099062 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:43.176115990 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:43.176141024 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:43.176162004 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:43.177246094 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:43.177284002 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:43.177494049 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:43.177508116 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:43.178227901 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:43.218472958 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:43.218513012 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:43.218669891 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:43.218669891 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:43.218734980 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:43.218792915 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:43.260507107 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:43.260579109 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:43.260725021 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:43.260725975 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:43.260791063 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:43.260834932 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:43.260870934 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:43.260890961 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:43.260893106 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:43.260921001 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:43.260961056 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:43.260984898 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:43.261147976 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:43.261188984 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:43.261212111 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:43.261228085 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:43.261256933 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:43.261277914 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:43.261542082 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:43.261580944 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:43.261625051 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:43.261637926 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:43.261665106 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:43.261734009 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:43.262409925 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:43.262449026 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:43.262489080 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:43.262507915 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:43.262531042 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:43.262557030 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:43.263006926 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:43.263047934 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:43.263072014 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:43.263089895 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:43.263115883 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:43.263115883 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:43.263494015 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:43.263887882 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:43.263942957 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:43.263961077 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:43.263972998 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:43.264003992 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:43.264025927 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:43.305306911 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:43.305365086 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:43.305515051 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:43.305515051 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:43.305591106 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:43.305663109 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:43.347412109 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:43.347469091 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:43.347527027 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:43.347599983 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:43.347644091 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:43.347781897 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:43.347832918 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:43.347851992 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:43.347868919 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:43.347899914 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:43.347942114 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:43.348063946 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:43.348103046 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:43.348138094 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:43.348157883 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:43.348181009 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:43.348203897 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:43.348439932 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:43.348479033 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:43.348516941 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:43.348529100 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:43.348556042 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:43.348576069 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:43.349209070 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:43.349251032 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:43.349296093 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:43.349307060 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:43.349333048 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:43.349353075 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:43.349891901 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:43.349931955 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:43.349971056 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:43.349982977 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:43.350008965 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:43.350039005 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:43.350965977 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:43.351006031 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:43.351063967 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:43.351075888 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:43.351114988 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:43.351114988 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:43.392343044 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:43.392416954 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:43.392445087 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:43.392457962 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:43.392483950 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:43.392503977 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:43.434138060 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:43.434205055 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:43.434238911 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:43.434266090 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:43.434289932 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:43.434315920 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:43.434381008 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:43.434425116 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:43.434452057 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:43.434469938 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:43.434495926 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:43.434511900 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:43.434767008 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:43.434808969 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:43.434850931 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:43.434874058 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:43.434896946 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:43.434920073 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:43.435079098 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:43.435127974 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:43.435159922 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:43.435172081 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:43.435197115 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:43.435261011 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:43.436052084 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:43.436094046 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:43.436136961 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:43.436148882 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:43.436172962 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:43.436193943 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:43.436471939 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:43.436517954 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:43.436553001 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:43.436563969 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:43.436592102 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:43.436676025 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:43.437730074 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:43.437783957 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:43.437809944 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:43.437822104 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:43.437849998 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:43.437866926 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:43.479155064 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:43.479213953 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:43.479247093 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:43.479265928 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:43.479291916 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:43.479311943 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:43.521179914 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:43.521233082 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:43.521265984 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:43.521284103 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:43.521311998 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:43.521349907 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:43.521579027 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:43.521622896 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:43.521651983 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:43.521675110 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:43.521697998 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:43.521720886 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:43.521923065 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:43.521960974 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:43.521994114 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:43.522006035 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:43.522030115 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:43.522049904 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:43.522109032 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:43.522149086 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:43.522186041 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:43.522197962 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:43.522222996 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:43.522278070 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:43.522739887 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:43.522780895 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:43.522818089 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:43.522830009 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:43.522855043 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:43.522875071 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:43.523431063 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:43.523475885 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:43.523511887 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:43.523529053 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:43.523550987 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:43.523935080 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:43.524523973 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:43.524579048 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:43.524616003 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:43.524627924 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:43.524652958 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:43.524669886 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:43.565851927 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:43.565896034 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:43.566041946 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:43.566042900 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:43.566109896 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:43.566174984 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:43.608186007 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:43.608243942 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:43.608408928 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:43.608408928 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:43.608422041 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:43.608479023 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:43.608530998 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:43.608536959 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:43.608536959 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:43.608566999 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:43.608623981 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:43.608623981 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:43.608736038 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:43.608783007 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:43.608819962 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:43.608835936 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:43.608875990 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:43.608897924 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:43.608989954 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:43.609029055 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:43.609069109 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:43.609081030 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:43.609110117 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:43.609555960 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:43.609603882 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:43.609620094 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:43.609637022 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:43.609674931 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:43.609695911 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:43.610125065 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:43.610166073 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:43.610203028 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:43.610220909 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:43.610244989 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:43.610265970 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:43.611211061 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:43.611255884 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:43.611290932 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:43.611304045 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:43.611360073 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:43.612617970 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:43.653059959 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:43.653117895 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:43.653264999 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:43.653265953 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:43.653330088 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:43.653512955 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:43.695549965 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:43.695615053 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:43.695770025 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:43.695770025 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:43.695835114 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:43.695894957 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:43.695907116 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:43.695923090 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:43.695956945 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:43.695966959 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:43.695976019 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:43.696000099 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:43.696033955 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:43.696058035 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:43.696429968 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:43.696470976 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:43.696497917 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:43.696516037 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:43.696540117 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:43.696655035 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:43.696964979 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:43.697012901 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:43.697041988 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:43.697058916 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:43.697082996 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:43.697101116 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:43.697448015 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:43.697496891 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:43.697523117 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:43.697535038 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:43.697560072 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:43.697711945 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:43.698286057 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:43.698342085 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:43.698373079 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:43.698390007 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:43.698414087 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:43.698633909 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:43.699534893 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:43.699584007 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:43.699619055 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:43.699630976 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:43.699661970 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:43.699908972 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:43.739758968 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:43.739819050 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:43.739986897 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:43.739986897 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:43.740051031 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:43.740118027 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:43.782650948 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:43.782710075 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:43.782852888 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:43.782852888 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:43.782917023 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:43.782979965 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:43.783097029 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:43.783138990 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:43.783169985 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:43.783190966 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:43.783216000 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:43.783233881 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:43.783468008 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:43.783508062 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:43.783531904 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:43.783550024 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:43.783576012 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:43.783592939 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:43.784004927 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:43.784046888 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:43.784073114 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:43.784085989 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:43.784116983 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:43.784205914 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:43.784671068 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:43.784713030 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:43.784745932 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:43.784759045 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:43.784785986 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:43.784874916 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:43.786189079 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:43.786231041 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:43.786268950 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:43.786281109 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:43.786309004 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:43.786413908 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:43.786613941 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:43.786653042 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:43.786670923 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:43.786705017 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:43.786720037 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:43.786742926 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:43.786787987 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:43.868931055 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:43.869008064 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:43.869133949 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:43.869133949 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:43.869199038 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:43.869236946 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:43.869263887 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:43.869280100 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:43.869311094 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:43.869319916 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:43.869329929 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:43.869348049 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:43.869383097 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:43.869406939 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:43.869653940 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:43.869694948 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:43.869723082 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:43.869735956 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:43.869764090 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:43.869785070 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:43.870332956 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:43.870374918 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:43.870404959 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:43.870418072 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:43.870445967 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:43.870464087 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:43.870645046 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:43.870687008 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:43.870712042 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:43.870724916 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:43.870753050 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:43.870843887 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:43.871220112 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:43.871287107 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:43.871305943 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:43.871320963 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:43.871370077 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:43.871370077 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:43.872669935 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:43.872690916 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:43.872737885 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:43.872752905 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:43.872783899 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:43.872922897 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:43.873261929 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:43.873281956 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:43.873317003 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:43.873330116 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:43.873358965 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:43.873375893 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:43.955197096 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:43.955223083 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:43.955394983 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:43.955395937 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:43.955461979 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:43.955607891 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:43.955859900 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:43.955887079 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:43.955950022 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:43.955967903 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:43.956021070 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:43.956269026 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:43.956290960 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:43.956332922 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:43.956346035 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:43.956374884 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:43.956506014 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:43.956664085 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:43.956685066 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:43.956720114 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:43.956733942 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:43.956760883 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:43.956778049 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:43.957223892 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:43.957245111 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:43.957304001 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:43.957320929 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:43.957344055 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:43.957384109 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:43.957549095 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:43.957571983 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:43.957621098 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:43.957638025 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:43.957660913 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:43.957741022 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:43.958298922 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:43.958319902 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:43.958367109 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:43.958379030 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:43.958405018 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:43.958626032 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:43.958822012 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:43.958848953 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:43.958888054 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:43.958905935 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:43.958929062 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:43.958951950 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:44.042017937 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:44.042048931 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:44.042184114 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:44.042227983 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:44.042228937 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:44.042267084 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:44.042310953 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:44.042318106 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:44.042326927 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:44.042377949 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:44.042377949 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:44.042701960 CET	49744	443	192.168.2.4	185.199.111.133
Jan 10, 2025 10:54:44.042742968 CET	443	49744	185.199.111.133	192.168.2.4
Jan 10, 2025 10:54:44.311992884 CET	443	49742	140.82.121.4	192.168.2.4
Jan 10, 2025 10:54:44.312081099 CET	443	49742	140.82.121.4	192.168.2.4
Jan 10, 2025 10:54:44.312341928 CET	49742	443	192.168.2.4	140.82.121.4
Jan 10, 2025 10:54:44.356918097 CET	49742	443	192.168.2.4	140.82.121.4
Jan 10, 2025 10:54:44.356977940 CET	443	49742	140.82.121.4	192.168.2.4
Jan 10, 2025 10:54:46.567248106 CET	443	49739	142.250.185.100	192.168.2.4
Jan 10, 2025 10:54:46.567425013 CET	443	49739	142.250.185.100	192.168.2.4
Jan 10, 2025 10:54:46.567521095 CET	49739	443	192.168.2.4	142.250.185.100
Jan 10, 2025 10:54:48.108927011 CET	49739	443	192.168.2.4	142.250.185.100
Jan 10, 2025 10:54:48.108966112 CET	443	49739	142.250.185.100	192.168.2.4
Jan 10, 2025 10:55:36.063507080 CET	49840	443	192.168.2.4	142.250.185.100
Jan 10, 2025 10:55:36.063568115 CET	443	49840	142.250.185.100	192.168.2.4
Jan 10, 2025 10:55:36.063638926 CET	49840	443	192.168.2.4	142.250.185.100
Jan 10, 2025 10:55:36.063972950 CET	49840	443	192.168.2.4	142.250.185.100
Jan 10, 2025 10:55:36.064006090 CET	443	49840	142.250.185.100	192.168.2.4
Jan 10, 2025 10:55:36.698327065 CET	443	49840	142.250.185.100	192.168.2.4
Jan 10, 2025 10:55:36.698736906 CET	49840	443	192.168.2.4	142.250.185.100
Jan 10, 2025 10:55:36.698798895 CET	443	49840	142.250.185.100	192.168.2.4
Jan 10, 2025 10:55:36.699327946 CET	443	49840	142.250.185.100	192.168.2.4
Jan 10, 2025 10:55:36.699722052 CET	49840	443	192.168.2.4	142.250.185.100
Jan 10, 2025 10:55:36.699821949 CET	443	49840	142.250.185.100	192.168.2.4
Jan 10, 2025 10:55:36.749119043 CET	49840	443	192.168.2.4	142.250.185.100
Jan 10, 2025 10:55:46.628349066 CET	443	49840	142.250.185.100	192.168.2.4
Jan 10, 2025 10:55:46.628516912 CET	443	49840	142.250.185.100	192.168.2.4
Jan 10, 2025 10:55:46.628571987 CET	49840	443	192.168.2.4	142.250.185.100
Jan 10, 2025 10:55:47.437583923 CET	49840	443	192.168.2.4	142.250.185.100
Jan 10, 2025 10:55:47.437611103 CET	443	49840	142.250.185.100	192.168.2.4

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 10, 2025 10:54:32.439027071 CET	53	54832	1.1.1.1	192.168.2.4
Jan 10, 2025 10:54:32.718605042 CET	53	52754	1.1.1.1	192.168.2.4
Jan 10, 2025 10:54:33.854044914 CET	53	61911	1.1.1.1	192.168.2.4
Jan 10, 2025 10:54:35.999783993 CET	52471	53	192.168.2.4	1.1.1.1
Jan 10, 2025 10:54:35.999912024 CET	54406	53	192.168.2.4	1.1.1.1
Jan 10, 2025 10:54:36.006603003 CET	53	54406	1.1.1.1	192.168.2.4
Jan 10, 2025 10:54:36.006880999 CET	53	52471	1.1.1.1	192.168.2.4
Jan 10, 2025 10:54:38.481448889 CET	60138	53	192.168.2.4	1.1.1.1
Jan 10, 2025 10:54:38.481803894 CET	59493	53	192.168.2.4	1.1.1.1
Jan 10, 2025 10:54:38.488141060 CET	53	60138	1.1.1.1	192.168.2.4
Jan 10, 2025 10:54:38.488533020 CET	53	59493	1.1.1.1	192.168.2.4
Jan 10, 2025 10:54:39.555864096 CET	55036	53	192.168.2.4	1.1.1.1
Jan 10, 2025 10:54:39.556338072 CET	52067	53	192.168.2.4	1.1.1.1
Jan 10, 2025 10:54:39.562592983 CET	53	55036	1.1.1.1	192.168.2.4
Jan 10, 2025 10:54:39.563689947 CET	53	52067	1.1.1.1	192.168.2.4
Jan 10, 2025 10:54:46.097372055 CET	138	138	192.168.2.4	192.168.2.255
Jan 10, 2025 10:54:50.888336897 CET	53	50009	1.1.1.1	192.168.2.4
Jan 10, 2025 10:54:59.394174099 CET	49902	53	192.168.2.4	1.1.1.1
Jan 10, 2025 10:55:09.662484884 CET	53	53139	1.1.1.1	192.168.2.4
Jan 10, 2025 10:55:16.202289104 CET	55538	53	192.168.2.4	1.1.1.1
Jan 10, 2025 10:55:31.978921890 CET	53	57647	1.1.1.1	192.168.2.4
Jan 10, 2025 10:55:32.304838896 CET	53	51448	1.1.1.1	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 10, 2025 10:54:35.999783993 CET	192.168.2.4	1.1.1.1	0x469f	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Jan 10, 2025 10:54:35.999912024 CET	192.168.2.4	1.1.1.1	0x8f0c	Standard query (0)	www.google.com	65	IN (0x0001)	false
Jan 10, 2025 10:54:38.481448889 CET	192.168.2.4	1.1.1.1	0x595	Standard query (0)	github.com	A (IP address)	IN (0x0001)	false
Jan 10, 2025 10:54:38.481803894 CET	192.168.2.4	1.1.1.1	0xf8c6	Standard query (0)	github.com	65	IN (0x0001)	false
Jan 10, 2025 10:54:39.555864096 CET	192.168.2.4	1.1.1.1	0xd695	Standard query (0)	objects.githubusercontent.com	A (IP address)	IN (0x0001)	false
Jan 10, 2025 10:54:39.556338072 CET	192.168.2.4	1.1.1.1	0x9cc5	Standard query (0)	objects.githubusercontent.com	65	IN (0x0001)	false
Jan 10, 2025 10:54:59.394174099 CET	192.168.2.4	1.1.1.1	0x91ea	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)	false
Jan 10, 2025 10:55:16.202289104 CET	192.168.2.4	1.1.1.1	0x4b79	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 10, 2025 10:54:36.006603003 CET	1.1.1.1	192.168.2.4	0x8f0c	No error (0)	www.google.com			65	IN (0x0001)	false
Jan 10, 2025 10:54:36.006880999 CET	1.1.1.1	192.168.2.4	0x469f	No error (0)	www.google.com		142.250.185.100	A (IP address)	IN (0x0001)	false
Jan 10, 2025 10:54:38.488141060 CET	1.1.1.1	192.168.2.4	0x595	No error (0)	github.com		140.82.121.4	A (IP address)	IN (0x0001)	false
Jan 10, 2025 10:54:39.562592983 CET	1.1.1.1	192.168.2.4	0xd695	No error (0)	objects.githubusercontent.com		185.199.111.133	A (IP address)	IN (0x0001)	false
Jan 10, 2025 10:54:39.562592983 CET	1.1.1.1	192.168.2.4	0xd695	No error (0)	objects.githubusercontent.com		185.199.110.133	A (IP address)	IN (0x0001)	false
Jan 10, 2025 10:54:39.562592983 CET	1.1.1.1	192.168.2.4	0xd695	No error (0)	objects.githubusercontent.com		185.199.108.133	A (IP address)	IN (0x0001)	false
Jan 10, 2025 10:54:39.562592983 CET	1.1.1.1	192.168.2.4	0xd695	No error (0)	objects.githubusercontent.com		185.199.109.133	A (IP address)	IN (0x0001)	false
Jan 10, 2025 10:54:59.401658058 CET	1.1.1.1	192.168.2.4	0x91ea	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 10, 2025 10:55:16.209851980 CET	1.1.1.1	192.168.2.4	0x4b79	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false

HTTP Request Dependency Graph

github.com

objects.githubusercontent.com

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49741	140.82.121.4	443	2840	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 09:54:39 UTC	720	OUT	GET /netwrix/pingcastle/releases/download/3.3.0.1/PingCastle_3.3.0.1.zip HTTP/1.1 Host: github.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-10 09:54:39 UTC	969	IN	HTTP/1.1 302 Found Server: GitHub.com Date: Fri, 10 Jan 2025 09:54:39 GMT Content-Type: text/html; charset=utf-8 Vary: X-PJAX, X-PJAX-Container, Turbo-Visit, Turbo-Frame, Accept-Encoding, Accept, X-Requested-With Location: https://objects.githubusercontent.com/github-production-release-asset-2e65be/146924413/3bc39ae0-06ab-46ba-9145-597f72315fc8?X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Credential=releaseassetproduction%2F20250110%2Fus-east-1%2Fs3%2Faws4_request&X-Amz-Date=20250110T095439Z&X-Amz-Expires=300&X-Amz-Signature=7baf7e0309ddde41fc38b6583aff69974df729cb65205dc720c7b02c0841e8d5&X-Amz-SignedHeaders=host&response-content-disposition=attachment%3B%20filename%3DPingCastle_3.3.0.1.zip&response-content-type=application%2Foctet-stream Cache-Control: no-cache Strict-Transport-Security: max-age=31536000; includeSubdomains; preload X-Frame-Options: deny X-Content-Type-Options: nosniff X-XSS-Protection: 0 Referrer-Policy: no-referrer-when-downgrade
2025-01-10 09:54:39 UTC	3382	IN	Data Raw: 43 6f 6e 74 65 6e 74 2d 53 65 63 75 72 69 74 79 2d 50 6f 6c 69 63 79 3a 20 64 65 66 61 75 6c 74 2d 73 72 63 20 27 6e 6f 6e 65 27 3b 20 62 61 73 65 2d 75 72 69 20 27 73 65 6c 66 27 3b 20 63 68 69 6c 64 2d 73 72 63 20 67 69 74 68 75 62 2e 63 6f 6d 2f 61 73 73 65 74 73 2d 63 64 6e 2f 77 6f 72 6b 65 72 2f 20 67 69 74 68 75 62 2e 63 6f 6d 2f 77 65 62 70 61 63 6b 2f 20 67 69 74 68 75 62 2e 63 6f 6d 2f 61 73 73 65 74 73 2f 20 67 69 73 74 2e 67 69 74 68 75 62 2e 63 6f 6d 2f 61 73 73 65 74 73 2d 63 64 6e 2f 77 6f 72 6b 65 72 2f 3b 20 63 6f 6e 6e 65 63 74 2d 73 72 63 20 27 73 65 6c 66 27 20 75 70 6c 6f 61 64 73 2e 67 69 74 68 75 62 2e 63 6f 6d 20 77 77 77 2e 67 69 74 68 75 62 73 74 61 74 75 73 2e 63 6f 6d 20 63 6f 6c 6c 65 63 74 6f 72 2e 67 69 74 68 75 62 2e 63 6f Data Ascii: Content-Security-Policy: default-src 'none'; base-uri 'self'; child-src github.com/assets-cdn/worker/ github.com/webpack/ github.com/assets/ gist.github.com/assets-cdn/worker/; connect-src 'self' uploads.github.com www.githubstatus.com collector.github.co

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49744	185.199.111.133	443	2840	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 09:54:40 UTC	1153	OUT	GET /github-production-release-asset-2e65be/146924413/3bc39ae0-06ab-46ba-9145-597f72315fc8?X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Credential=releaseassetproduction%2F20250110%2Fus-east-1%2Fs3%2Faws4_request&X-Amz-Date=20250110T095439Z&X-Amz-Expires=300&X-Amz-Signature=7baf7e0309ddde41fc38b6583aff69974df729cb65205dc720c7b02c0841e8d5&X-Amz-SignedHeaders=host&response-content-disposition=attachment%3B%20filename%3DPingCastle_3.3.0.1.zip&response-content-type=application%2Foctet-stream HTTP/1.1 Host: objects.githubusercontent.com Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-10 09:54:40 UTC	807	IN	HTTP/1.1 200 OK Connection: close Content-Length: 5479682 Content-Type: application/octet-stream Last-Modified: Wed, 25 Sep 2024 19:16:08 GMT ETag: "0x8DCDD968282CA05" Server: Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0 x-ms-request-id: 48c347df-601e-005e-2e75-550ab5000000 x-ms-version: 2024-11-04 x-ms-creation-time: Wed, 25 Sep 2024 19:16:08 GMT x-ms-lease-status: unlocked x-ms-lease-state: available x-ms-blob-type: BlockBlob Content-Disposition: attachment; filename=PingCastle_3.3.0.1.zip x-ms-server-encrypted: true Via: 1.1 varnish, 1.1 varnish Fastly-Restarts: 1 Accept-Ranges: bytes Age: 0 Date: Fri, 10 Jan 2025 09:54:40 GMT X-Served-By: cache-iad-kjyo7100168-IAD, cache-ewr-kewr1740068-EWR X-Cache: HIT, HIT X-Cache-Hits: 1683, 0 X-Timer: S1736502880.119360,VS0,VE12
2025-01-10 09:54:40 UTC	1378	IN	Data Raw: 50 4b 03 04 14 00 00 00 08 00 f7 a9 39 59 01 0a c8 c2 81 34 00 00 bd 93 00 00 0d 00 00 00 63 68 61 6e 67 65 6c 6f 67 2e 74 78 74 84 5b 5d 73 db 36 b3 be ef 4c fe 03 c6 33 a7 23 e7 58 8a 65 3b 4d da 99 73 a1 4a 49 93 b7 89 ad 9a 76 3b 73 6e ce 40 24 24 21 26 01 16 00 ed a8 bf fe ec 07 40 42 96 92 5e 24 96 48 7c 2c 16 bb cf 3e bb 80 2e 27 97 93 f3 c9 f4 c5 0f 2f c5 5a 7f 15 d2 08 ed 7d a7 c4 d3 56 39 25 5c 57 2b 78 20 8c 0d a2 d2 be ad e5 4e 55 f8 0e 9a 35 ad 2c 03 7c eb bc 72 fe 55 69 9b b6 0b f0 49 94 b6 33 01 3b d5 ca 7b 11 b6 30 e4 f4 fc 7c 82 33 bc 87 19 6e 0a f1 08 cd b4 35 a2 52 41 95 41 db 38 e7 8b 1f 5e fc c0 e2 9c 63 63 59 7d e9 3c 4e 10 b6 2c 88 17 c5 78 a1 fc 3b 23 57 b5 aa ce e0 db f2 a9 ba b6 e1 56 fd dd 69 37 3c 51 30 fe bb af 2d 3c f2 67 62 Data Ascii: PK9Y4changelog.txt[]s6L3#Xe;MsJIv;sn@$$!&@B^$H\|,>.'/Z}V9%\W+x NU5,\|rUiI3;{0\|3n5RAA8^ccY}<N,x;#WVi7<Q0-<gb
2025-01-10 09:54:40 UTC	1378	IN	Data Raw: 57 8c 58 40 14 ce b3 f7 cf 6b 0d 42 41 08 71 2a f4 f4 51 ad 61 55 15 69 1a 3d 56 76 20 94 09 11 b7 53 64 c9 a9 28 68 75 e3 62 e8 24 f4 9c 2d 6e d5 06 d8 95 a3 2e 84 28 20 a1 6e 51 35 6a 9f c2 00 a9 7b 04 c5 83 3d 6d e5 a3 62 1e 13 25 38 43 74 ac 3b b2 80 77 68 56 d6 20 69 7b 50 62 83 14 30 21 fe 31 4a 14 97 f2 8f 72 76 10 f8 7c d8 29 49 6c c7 03 47 32 ca 25 9b 1a b5 bb b0 b5 26 92 20 c7 53 c5 ad 5e 75 81 6c 0e 59 81 fa da d6 56 63 a8 3a 25 19 c6 63 ff a0 db 71 55 8e 5d 5b 46 b6 89 ae 07 f6 a0 3d 4d 72 d4 0d 16 f3 f1 9c e9 56 23 03 2e 61 43 6f 73 c1 60 36 d8 69 ec 9d 60 b3 18 df d4 d5 75 a8 1b 9a f9 40 d3 30 79 90 0f 14 31 12 c2 20 d1 41 b3 79 72 24 32 86 17 fc 1b 29 c2 74 f2 9a f5 a2 be a2 aa 55 72 69 61 57 5f 20 2a 81 67 33 49 aa ad 7d f0 ac 91 de fc 22 Data Ascii: WX@kBAqQaUi=Vv Sd(hub$-n.( nQ5j{=mb%8Ct;whV i{Pb0!1Jrv\|)IlG2%& S^ulYVc:%cqU][F=MrV#.aCos`6i`u@0y1 Ayr$2)tUriaW_ g3I}"
2025-01-10 09:54:40 UTC	1378	IN	Data Raw: c4 b0 d9 8f 70 ff c8 28 50 9e d3 24 50 da 18 0a 2c 8d de 38 82 50 14 7b 62 20 cd bb c4 76 f4 e9 6a f2 1a 9b b0 dc 14 d3 87 62 db bc b6 5d 85 25 1f a4 57 69 21 11 4d e6 ca 85 77 c6 41 8c 9b b3 19 a7 34 9e 73 05 94 2a 7a 0a 3e 4c 45 a5 f9 af e8 0f b1 2a 91 46 a4 4a 73 0d d0 2a 18 68 3a 47 85 05 7a 82 26 8e 66 84 5f b2 78 c6 a4 a5 3f fc 30 34 46 2a 52 0c 7b a0 0d 15 06 fb fd 81 d8 c1 76 52 61 a6 1f 58 b6 78 9c f1 32 05 6c a4 4f ac 71 84 0f 6a 9c 18 9c 0e 5c 9d 2b cb 66 9f d6 0c 5a c6 fd fc 8e 9e 0f e0 26 f1 ac 59 32 0b 9c e0 f0 f1 62 9e 16 f1 a8 7b ce 04 53 81 57 88 7f ac 19 08 32 17 7b 16 73 b6 89 11 ea 8e aa 8d 74 40 b2 30 9e 5a f7 5e fe e1 ee 6e 29 e6 5c 46 05 c9 ef 14 e5 5d a8 c4 eb bb 4f 9f 79 8c 27 b5 f2 3a 60 c1 1d 72 34 8e b5 d7 6a 63 03 56 ac 32 67 Data Ascii: p(P$P,8P{b vjb]%Wi!MwA4sz>LEFJsh:Gz&f_x?04FR{vRaXx2lOqj\+fZ&Y2b{SW2{st@0Z^n)\F]Oy':`r4jcV2g
2025-01-10 09:54:40 UTC	1378	IN	Data Raw: 38 ab 8c c7 47 7d 01 4a af bf 73 a7 89 dc ce c4 03 bc e3 87 67 7f a9 15 1f 5f f6 91 1c d5 31 3c 4d 87 de d9 39 38 6f 73 ba 21 50 47 93 01 46 a8 d7 6a ef 3c 88 68 44 55 89 0f e8 0a cb c1 15 22 85 4f 5b 9f f9 a6 7a 94 75 17 0d c0 55 91 da bc 4b b4 c6 ef c0 74 1a 40 99 47 8f e1 1d a3 fb 9b d3 84 fb 55 57 a2 99 de 14 c2 80 07 61 0a 0b 93 23 fb 71 e1 39 c7 22 51 77 99 4d 79 01 7f b7 c4 29 7e 89 79 2d 25 0f 8a 43 e4 e1 82 69 43 19 32 d0 b6 a3 b5 52 dd 88 06 c4 a4 25 e8 40 f3 11 b1 39 9f 4c 63 45 1c 16 b4 c1 2b 32 51 a3 98 bb 9c 0d 15 3f f4 c0 a8 a5 38 5d 7e 0a cb f1 6e b5 7f c5 2d 5e 8e e0 bd 01 80 99 67 29 e5 f3 8a 1d ce 3e 54 83 e2 6d 3f 82 a3 12 03 1a 61 e1 f6 19 27 ed e5 4f c4 2c 5d 74 92 15 03 89 73 d6 0d e7 7d 1c 4f bf 36 35 5d 05 40 e9 91 00 77 6d 50 d5 Data Ascii: 8G}Jsg_1<M98os!PGFj<hDU"O[zuUKt@GUWa#q9"QwMy)~y-%CiC2R%@9LcE+2Q?8]~n-^g)>Tm?a'O,]ts}O65]@wmP
2025-01-10 09:54:40 UTC	1378	IN	Data Raw: 24 c3 c0 c9 86 7a d3 77 ce 82 b3 92 e3 75 d7 70 d1 29 5d 0e 4c 71 10 b0 09 c8 1e 6f 64 9f a6 76 10 52 fa 09 c8 0b 3c 84 91 72 1b b9 20 65 16 60 f3 e9 36 a1 18 f1 6d cf 44 59 a2 da 89 92 a4 6b f7 fb 6a fb 5c 88 f7 b3 3f 68 20 be fb 8e 57 34 55 48 e6 3d 1b a7 a7 a8 de 5a 9b 87 ac f2 6a b2 df db 64 0c b1 28 3e 25 d6 43 c5 76 b0 d6 13 df f9 96 ca 3d 27 5c 91 32 2a d0 35 be 4a a1 2d a6 21 b9 7c 43 65 63 99 0a ca 9a 7e c7 10 76 67 28 e3 13 96 df 02 df 42 83 cd b2 91 2f 04 fb c0 57 a9 30 ae 87 2d 66 89 1e f2 b3 ce 90 4f ac 38 31 89 8c 2e 1c bf 10 93 55 4f 36 94 1d ef 95 53 96 9d 03 8e a7 ce 0e 8a 2c f9 93 39 09 5c 74 64 24 28 ed 71 d2 36 9c 78 92 04 9f 75 00 05 cd 42 f8 11 bc aa 01 21 d9 4f bf 17 4b 87 1f d8 cd 86 0b de e9 08 69 bd 7f ff a8 3f a7 69 01 2a 82 c1 Data Ascii: $zwup)]LqodvR<r e`6mDYkj\?h W4UH=Zjd(>%Cv='\25J-!\|Cec~vg(B/W0-fO81.UO6S,9\td$(q6xuB!OKi?i
2025-01-10 09:54:40 UTC	1378	IN	Data Raw: 24 77 99 bd 34 c8 f4 28 d6 0e 31 31 4d 14 fb dd 4c 86 de 3d 40 1e ab cd d0 09 a7 07 b7 28 87 8b 7c ea 04 46 35 6f dc 1b 2c 68 40 49 8f a3 b4 24 7d d9 64 23 93 63 5f f5 ca 91 65 42 b2 f6 a9 fd f7 d0 59 20 65 48 2b 9d ed 8d 69 5f 25 6a 9f 8c cf 9a a7 b0 a5 cb 3c ec 9f e0 7d d0 ef df 40 f7 cb 3c b8 4f e9 5f ca 85 9a 79 10 a3 ff 29 35 29 59 02 d2 b0 d3 55 5a 3f 00 50 01 31 e3 64 bb 24 5c 5f dc b7 c7 2b 78 6e a6 41 81 a5 f5 23 a6 d1 8b 36 88 6f 76 eb 32 f5 1f 76 00 5f 88 82 7d ca 1b 4e e8 10 2b 41 4f a7 62 55 d9 68 a5 9b ad 9f 1a 49 29 a1 45 36 55 20 a0 04 a5 49 51 5a bf f7 08 89 fe df 00 b6 3b 1d 2e 1e 3b d6 2b 02 67 18 ca 2c f2 54 52 4a 9d 12 ab ce 7f 17 42 f5 e6 65 c4 ba d4 c0 4e de a2 29 9c 9f 8e 11 ff fd 16 43 8f 3a 6c b6 94 de 98 b3 4d 46 ce e6 52 16 00 Data Ascii: $w4(11ML=@(\|F5o,h@I$}d#c_eBY eH+i_%j<}@<O_y)5)YUZ?P1d$\_+xnA#6ov2v_}N+AObUhI)E6U IQZ;.;+g,TRJBeN)C:lMFR
2025-01-10 09:54:40 UTC	1378	IN	Data Raw: 01 0b c8 3f a3 a4 5d fc c6 f4 e3 67 ba ce 51 04 8d 90 88 48 7d a2 f8 49 b7 c8 ae 9c 29 3d 66 82 22 83 6f b1 d5 db 7a cd e7 f0 0c 5e c9 83 93 24 30 da d9 3c 01 d1 9e db 6b 41 0b 6c d4 22 b5 9a 4a 89 52 b5 5f 22 9d 12 52 42 dc e3 f1 75 dc a2 5f a6 2b ad c7 87 e5 ec 11 65 78 be 37 fa cb d7 db 33 fa ed e8 a4 53 d0 28 2e ea 43 dc b6 fa 58 1f 86 ad 32 92 11 92 46 30 57 4b 27 72 1e 28 fc 48 d1 9e cb 31 d9 d9 27 ad 74 8f 06 f4 50 d4 ad 24 ac a4 a1 14 d7 ad 5f 00 45 e0 3c a1 82 2c 16 c3 5c e2 cc c1 3b 4a 1d bc fb d7 b0 de 21 1b be ab 14 f9 3e 63 86 16 b5 dc 6a 18 36 db 3d a2 4b 54 2f ea 84 c3 ef 00 5e 9f 97 5c 4a e1 12 11 61 5e b4 1d 77 6d 11 90 46 02 b3 f2 58 82 e7 7c fb 5d 33 60 20 28 c2 92 48 a9 01 8e 7c bb 17 7a 77 68 36 6e f4 d2 fa ca 9d 0a 42 5f aa 4f 32 57 Data Ascii: ?]gQH}I)=f"oz^$0<kAl"JR_"RBu_+ex73S(.CX2F0WK'r(H1'tP$_E<,\;J!>cj6=KT/^\Ja^wmFX\|]3` (H\|zwh6nB_O2W
2025-01-10 09:54:40 UTC	1378	IN	Data Raw: bb 26 bf 9f 9e 5d 9c fd 4a 57 f7 b5 ef 56 45 6d d5 91 0b b7 4a dd 22 42 88 52 74 d1 43 5e 4c e0 84 b8 ad fd d4 2e 6a 45 a2 4f 4a c2 d0 4f 69 59 62 a7 d1 5a 55 28 02 c4 5f ab 30 14 d7 d2 67 0c 63 3b d6 a5 f0 11 63 73 13 1f 81 12 17 7b 25 7f 9e bd ce 8d 7f 26 15 e0 20 a2 ce ea 69 bc 9a f4 e6 36 35 36 6d b4 04 cb 2e 75 96 97 a7 27 db d5 37 f3 39 97 cc 9f 54 b3 0d 24 b8 68 4f ac 9a ee bd 73 33 b8 cd a6 9b 69 91 7d 6e 07 bf f0 88 dc 4b 70 53 7c 36 2a ce 2f 84 5a 4a 3f ee b0 c7 6c a6 84 1d a5 b3 97 cb b4 7e 8c de 35 76 a1 b6 48 6e e8 47 00 e9 28 37 8e 9a a2 6c 03 fd 66 97 a7 15 e0 6e d7 04 e0 da 8a 61 e9 48 a2 87 7c e7 92 9c 89 4b 7e 42 9e ed ef 9a 3e 24 ed 36 97 4e 99 99 7a a2 51 a7 90 e3 4c c1 4d 9d 9b 50 31 38 5e b2 7d 1b 62 35 fb a0 2b a3 66 c8 a1 e8 94 74 Data Ascii: &]JWVEmJ"BRtC^L.jEOJOiYbZU(_0gc;cs{%& i656m.u'79T$hOs3i}nKpS\|6*/ZJ?l~5vHnG(7lfnaH\|K~B>$6NzQLMP18^}b5+ft
2025-01-10 09:54:40 UTC	1378	IN	Data Raw: 66 b4 f1 31 ef 1f 3a df b1 9b b9 e5 e5 ea 63 52 0b 48 3c 7c 09 fc c7 bf 65 4a d0 6f f8 2d 7f ca 36 1d 60 92 49 75 7f bf ae ed 29 73 ef d5 c7 a7 5f c5 8d 46 01 2a ed e2 5a 33 04 67 8b 65 b3 b1 2e 59 16 8e a2 f3 8b 92 96 b5 95 20 9c d8 a4 bc 87 cf 35 24 19 9a fa 8d 01 39 57 05 84 df d6 cc 55 ce 6e 82 11 6d 69 72 b0 1e 4b 71 7f e1 2b 75 10 54 a5 f5 ad 9c fc ae d6 d1 8c 4f 61 85 68 6d 2b 7c b3 e5 90 ca 02 f7 20 6f aa 74 8b bc d2 27 73 c6 12 b3 2a 3c 13 e7 b5 4a 66 29 68 4b 88 65 62 f0 ee b7 52 38 83 01 a5 55 06 38 36 04 d4 29 54 0c 32 85 95 20 96 49 92 89 bd 09 bd 62 a0 54 be 2a 95 fb f6 24 6a 3b 60 c4 3d 06 11 c3 5c 22 0d 6e e3 f3 78 19 4e e6 34 4c 73 51 3d 3f 26 d1 c8 2f 48 06 e4 fb b7 ef bd ef c3 90 e5 60 35 b8 45 b1 e4 b3 a8 2c f7 d9 9b 4c b7 b4 8d c9 bd Data Ascii: f1:cRH<\|eJo-6`Iu)s_FZ3ge.Y 5$9WUnmirKq+uTOahm+\| ot's<Jf)hKebR8U86)T2 IbT*$j;`=\"nxN4LsQ=?&/H`5E,L
2025-01-10 09:54:40 UTC	1378	IN	Data Raw: 2f 93 8f b3 e9 c7 b7 61 6a 0f b7 ca 07 6f af 1b 41 c9 d8 b3 4b 79 ac 4e aa 2e 71 d8 81 3d f7 63 87 fb 85 96 79 8d a6 4b fa 5e 8f 3e 90 f9 f9 ab fb 24 94 be c9 a3 93 2d 7e d0 d2 2d 4c 03 0f 45 d6 1a 9d 78 4d 53 ed 98 11 60 6a 70 0f 06 0c a6 1e 3c 4c 07 b4 6b a3 e6 b7 0c b0 60 f1 b3 6d 77 7a c2 d8 93 1e 61 2b c8 76 5a e3 c4 51 8a 08 72 69 c9 7e 5c b3 a2 8f e5 6e 8b 6f 97 28 3b 53 33 37 45 87 19 d0 e8 68 e8 72 7c 74 3c 38 7c ff 91 1c 60 e9 03 86 fa 2b 73 1a 45 4c 35 98 64 7c 18 32 1f fe 1d 55 29 45 83 a6 66 38 cf 46 8b d4 4c bf 4d f9 44 af a7 ac 9d 79 6a 55 8e 26 47 d6 27 68 9e d2 95 cf 87 00 71 5b ef f8 5e ba d4 e4 0c 61 bf d4 a8 b5 3f dd 9c ef fa cc 80 15 60 c6 c3 7a c0 2b 51 30 6f 30 a8 17 cd b2 29 ea ad b5 4b 9a 3e 3a 79 24 60 7d 14 13 ab e4 7c 63 a8 9a Data Ascii: /ajoAKyN.q=cyK^>$-~-LExMS`jp<Lk`mwza+vZQri~\no(;S37Ehr\|t<8\|`+sEL5d\|2U)Ef8FLMDyjU&G'hq[^a?`z+Q0o0)K>:y$`}\|c

Target ID:	0
Start time:	04:54:28
Start date:	10/01/2025
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Imagebase:	0x7ff76e190000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	2
Start time:	04:54:30
Start date:	10/01/2025
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2504 --field-trial-handle=2476,i,8198650963386273841,13647284136402883920,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Imagebase:	0x7ff76e190000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	3
Start time:	04:54:37
Start date:	10/01/2025
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" "https://github.com/netwrix/pingcastle/releases/download/3.3.0.1/PingCastle_3.3.0.1.zip"
Imagebase:	0x7ff76e190000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	04:54:44
Start date:	10/01/2025
Path:	C:\Windows\SysWOW64\unarchiver.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\SysWOW64\unarchiver.exe" "C:\Users\user\Downloads\PingCastle_3.3.0.1.zip"
Imagebase:	0x730000
File size:	12'800 bytes
MD5 hash:	16FF3CC6CC330A08EED70CBC1D35F5D2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	6
Start time:	04:54:44
Start date:	10/01/2025
Path:	C:\Windows\SysWOW64\7za.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\7za.exe" x -pinfected -y -o"C:\Users\user\AppData\Local\Temp\hqqkbpyi.fzp" "C:\Users\user\Downloads\PingCastle_3.3.0.1.zip"
Imagebase:	0x170000
File size:	289'792 bytes
MD5 hash:	77E556CDFDC5C592F5C46DB4127C6F4C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	04:54:44
Start date:	10/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	04:54:45
Start date:	10/01/2025
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"cmd.exe" /C "C:\Users\user\AppData\Local\Temp\hqqkbpyi.fzp\Active_Directory_Security_Self_Assessment_v1.4.pdf"
Imagebase:	0x800000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	9
Start time:	04:54:45
Start date:	10/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	10
Start time:	04:54:45
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\hqqkbpyi.fzp\Active_Directory_Security_Self_Assessment_v1.4.pdf"
Imagebase:	0x7ff6bc1b0000
File size:	5'641'176 bytes
MD5 hash:	24EAD1C46A47022347DC0F05F6EFBB8C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	11
Start time:	04:54:46
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Imagebase:	0x7ff74bb60000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	12
Start time:	04:54:46
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2104 --field-trial-handle=1736,i,8144944481098509710,6803883750261835604,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Imagebase:	0x7ff74bb60000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	21%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	73
Total number of Limit Nodes:	4

Callgraph

Executed
Not Executed
Opacity -> Relevance
Disassembly available

Executed Functions

Function 0103B1D6 Relevance: 1.5, APIs: 1, Instructions: 39COMMON

Download Yara Rule

APIs

GetSystemInfo.KERNELBASE(?), ref: 0103B208

Memory Dump Source

Source File: 00000005.00000002.2565685025.000000000103A000.00000040.00000800.00020000.00000000.sdmp, Offset: 0103A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_103a000_unarchiver.jbxd

Similarity

API ID: InfoSystem
String ID:
API String ID: 31276548-0
Opcode ID: 338ead68b803030e0684ec23d841c6d83db61d4fa7ff45162907d894fd8155d7
Instruction ID: a5f24ae6705d33ebf66f1daf06649f6d3e2b57a43aa9d181a799f170e9a7c18a
Opcode Fuzzy Hash: 338ead68b803030e0684ec23d841c6d83db61d4fa7ff45162907d894fd8155d7
Instruction Fuzzy Hash: E101D1749042409FEB10DF15D885B69FBE8EF84224F08C5EBDD888F256D379A404CBB2

Function 011B0C99 Relevance: 5.1, Strings: 4, Instructions: 86
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

`yj, xrefs: 011B0D37
P{j, xrefs: 011B0CC8
e]Ij^, xrefs: 011B0D6E, 011B0D73
`yj, xrefs: 011B0D62

Memory Dump Source

Source File: 00000005.00000002.2566168271.00000000011B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 011B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_11b0000_unarchiver.jbxd

Similarity

API ID:
String ID: P{j$`yj$`yj$e]Ij^
API String ID: 0-520381980
Opcode ID: 5579f8296272b525c68962c75444551b2bc729f76a1e3bd7dc6feee494584404
Instruction ID: 26cae6b93ba70a6429a423361ef885bc28b4481ab49357d299c4cff72081fe66
Opcode Fuzzy Hash: 5579f8296272b525c68962c75444551b2bc729f76a1e3bd7dc6feee494584404
Instruction Fuzzy Hash: C82137707002444FCB19EB3A85807AEBBE79BC9204F46452DE185DB382DF79ED078392

Function 011B0CA8 Relevance: 5.1, Strings: 4, Instructions: 82
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

`yj, xrefs: 011B0D37
P{j, xrefs: 011B0CC8
e]Ij^, xrefs: 011B0D6E, 011B0D73
`yj, xrefs: 011B0D62

Memory Dump Source

Source File: 00000005.00000002.2566168271.00000000011B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 011B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_11b0000_unarchiver.jbxd

Similarity

API ID:
String ID: P{j$`yj$`yj$e]Ij^
API String ID: 0-520381980
Opcode ID: c7b8fd824b2c74ed79b691ba810269c88a14f6ca6b401d1da8553797f48536dc
Instruction ID: f6c5d05df12f00254848e98ea9692faebfee55a487bea56fbbc349767d003ae8
Opcode Fuzzy Hash: c7b8fd824b2c74ed79b691ba810269c88a14f6ca6b401d1da8553797f48536dc
Instruction Fuzzy Hash: 7A2107707002144FC719EB3AC5807AFB6E75FC9204B46892DE086DB382DF75E9078791

Function 0103B246 Relevance: 1.6, APIs: 1, Instructions: 101
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,00000E24), ref: 0103B2F3

Memory Dump Source

Source File: 00000005.00000002.2565685025.000000000103A000.00000040.00000800.00020000.00000000.sdmp, Offset: 0103A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_103a000_unarchiver.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: aec6b58dbca4113708c680bfad523f7c1ba187a76bda995cea0a3aa318406201
Instruction ID: 9a4283b323efa8c925a4eec7f41cfcbdb1ae19b29b91d68dc5cf57185fc6a93d
Opcode Fuzzy Hash: aec6b58dbca4113708c680bfad523f7c1ba187a76bda995cea0a3aa318406201
Instruction Fuzzy Hash: 5931A6724043846FEB228B65DC45FA7BFFCEF46214F04849EE985CB162D325A919CB71

Function 0103AD04 Relevance: 1.6, APIs: 1, Instructions: 96
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,00000E24), ref: 0103ADA7

Memory Dump Source

Source File: 00000005.00000002.2565685025.000000000103A000.00000040.00000800.00020000.00000000.sdmp, Offset: 0103A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_103a000_unarchiver.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 6b8e092aaa94cc3e45aacc0a082d0d780657dd44125529bedf59af82cae69e2b
Instruction ID: b4d93efb018ae686413b36d945649e1a3f8140a7bb17dc3d28784b40726655fb
Opcode Fuzzy Hash: 6b8e092aaa94cc3e45aacc0a082d0d780657dd44125529bedf59af82cae69e2b
Instruction Fuzzy Hash: 3A31D372104384AFEB228B64DC45FA7BFECEF45224F04889EF985CB152D324A819CB71

Function 0103AB76 Relevance: 1.6, APIs: 1, Instructions: 92
pipeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreatePipe.KERNELBASE(?,00000E24,?,?), ref: 0103AC36

Memory Dump Source

Source File: 00000005.00000002.2565685025.000000000103A000.00000040.00000800.00020000.00000000.sdmp, Offset: 0103A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_103a000_unarchiver.jbxd

Similarity

API ID: CreatePipe
String ID:
API String ID: 2719314638-0
Opcode ID: aadd2b1cc442f35f464c962211de74eaefc72c9fa0798bb1fdefa4c91ab7dd38
Instruction ID: 8f2e11171a1de32cf4053dc4b3eec7c6fe9466dea89c8cfe74e6fbbe25c6b48d
Opcode Fuzzy Hash: aadd2b1cc442f35f464c962211de74eaefc72c9fa0798bb1fdefa4c91ab7dd38
Instruction Fuzzy Hash: D8316C7250E3C06FD3038B718C65A66BFB4AF47610F1A84CBD8C4DF1A3D6296919C762

Function 0103A5DC Relevance: 1.6, APIs: 1, Instructions: 90
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileW.KERNELBASE(?,?,?,?,?,?), ref: 0103A67D

Memory Dump Source

Source File: 00000005.00000002.2565685025.000000000103A000.00000040.00000800.00020000.00000000.sdmp, Offset: 0103A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_103a000_unarchiver.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: e012b2c3073a24eab26eed1ce5ca15c954eb117bc0c8f85449d5756bd69253e8
Instruction ID: 62deca5296af226503afa7d64595efb8e968aa56d7e2a74cbde75136142630ef
Opcode Fuzzy Hash: e012b2c3073a24eab26eed1ce5ca15c954eb117bc0c8f85449d5756bd69253e8
Instruction Fuzzy Hash: D8319C71504340AFE722CB25DC45FA6BBE8EF49220F08849EE985CB262D365E809DB71

Function 0103A120 Relevance: 1.6, APIs: 1, Instructions: 82
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FindNextFileW.KERNELBASE(?,00000E24,?,?), ref: 0103A1C2

Memory Dump Source

Source File: 00000005.00000002.2565685025.000000000103A000.00000040.00000800.00020000.00000000.sdmp, Offset: 0103A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_103a000_unarchiver.jbxd

Similarity

API ID: FileFindNext
String ID:
API String ID: 2029273394-0
Opcode ID: 1cf30f2b25e189f19932cbcb3bb22572c96644460915f7a2c8be5a1b6e751bea
Instruction ID: 010ad650001ec5636a9b10bb2f40fa435aeb42787e8a5921db01011b079300eb
Opcode Fuzzy Hash: 1cf30f2b25e189f19932cbcb3bb22572c96644460915f7a2c8be5a1b6e751bea
Instruction Fuzzy Hash: 6321A17150D3C06FD3128B258C51BA6BFB4EF87610F0945CBD884CF293D225A919C7A2

Function 0103AD2A Relevance: 1.6, APIs: 1, Instructions: 80
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,00000E24), ref: 0103ADA7

Memory Dump Source

Source File: 00000005.00000002.2565685025.000000000103A000.00000040.00000800.00020000.00000000.sdmp, Offset: 0103A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_103a000_unarchiver.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 3cfd62a86d66a52fa45553f42ecd18eaa6782edaac26804ddf3cd17ac5e408d8
Instruction ID: f54b3ddf34f2f93408381cccaf21c37e8f1e3f5aa48b037f8a900d02dc1a8acc
Opcode Fuzzy Hash: 3cfd62a86d66a52fa45553f42ecd18eaa6782edaac26804ddf3cd17ac5e408d8
Instruction Fuzzy Hash: D321C472500204AFEB219F64DC45FABFBECEF44224F04886EE985DB555D734E5058BB1

Function 0103A370 Relevance: 1.6, APIs: 1, Instructions: 80
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegQueryValueExW.KERNELBASE(?,00000E24,5073F907,00000000,00000000,00000000,00000000), ref: 0103A40C

Memory Dump Source

Source File: 00000005.00000002.2565685025.000000000103A000.00000040.00000800.00020000.00000000.sdmp, Offset: 0103A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_103a000_unarchiver.jbxd

Similarity

API ID: QueryValue
String ID:
API String ID: 3660427363-0
Opcode ID: 5cd64e4c58c270092ccf4b995fe279e06438847fcdd15e89bcccc50ab88e88b1
Instruction ID: e89cbf991271e3b137b396a7b0d6d874a41b60005cb049d018e9c3e2d981f0f3
Opcode Fuzzy Hash: 5cd64e4c58c270092ccf4b995fe279e06438847fcdd15e89bcccc50ab88e88b1
Instruction Fuzzy Hash: 29219176604344AFE721CF15DC84FA6BBFCEF45610F08849AE985CB152D364E909CB71

Function 0103B276 Relevance: 1.6, APIs: 1, Instructions: 80
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,00000E24), ref: 0103B2F3

Memory Dump Source

Source File: 00000005.00000002.2565685025.000000000103A000.00000040.00000800.00020000.00000000.sdmp, Offset: 0103A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_103a000_unarchiver.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: bb3b314adcb93b8e8d6df6409a8e5bc4f9143210a5d5a9048e3d6e4be92134d7
Instruction ID: bab9c765b2f9199ef7d6617919c46d21f8e78e7b5088e9faf686ce1032f28619
Opcode Fuzzy Hash: bb3b314adcb93b8e8d6df6409a8e5bc4f9143210a5d5a9048e3d6e4be92134d7
Instruction Fuzzy Hash: 6A21F172500204AFEB219F61DC45FABFBECEF44224F04886EEA85CB151D334E9048BB1

Function 0103A850 Relevance: 1.6, APIs: 1, Instructions: 78
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetFilePointer.KERNELBASE(?,00000E24,5073F907,00000000,00000000,00000000,00000000), ref: 0103A8DE

Memory Dump Source

Source File: 00000005.00000002.2565685025.000000000103A000.00000040.00000800.00020000.00000000.sdmp, Offset: 0103A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_103a000_unarchiver.jbxd

Similarity

API ID: FilePointer
String ID:
API String ID: 973152223-0
Opcode ID: 17deccd8fe032d6b7f4876cc353f26cba91fe65701bbf99ec3cc3903297913be
Instruction ID: d5648e620a1a93e61e6232ade238a78c81d1f08f22624f7ea903f7871032475a
Opcode Fuzzy Hash: 17deccd8fe032d6b7f4876cc353f26cba91fe65701bbf99ec3cc3903297913be
Instruction Fuzzy Hash: 9321A471508380AFEB228B24DC45FA6BFB8EF46614F0984DBE984DB153C265A919C771

Function 0103A933 Relevance: 1.6, APIs: 1, Instructions: 77
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ReadFile.KERNELBASE(?,00000E24,5073F907,00000000,00000000,00000000,00000000), ref: 0103A9C1

Memory Dump Source

Source File: 00000005.00000002.2565685025.000000000103A000.00000040.00000800.00020000.00000000.sdmp, Offset: 0103A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_103a000_unarchiver.jbxd

Similarity

API ID: FileRead
String ID:
API String ID: 2738559852-0
Opcode ID: 30dc42b7fcb94ebc373a9230296864ddfecca538919d4ebd5adc868aed55f06b
Instruction ID: 8fd46f04fad37fcf54f0ecdc1912b2ea3ffdedb384f43c5dc6e38d995f8f62dd
Opcode Fuzzy Hash: 30dc42b7fcb94ebc373a9230296864ddfecca538919d4ebd5adc868aed55f06b
Instruction Fuzzy Hash: 7721B272409380AFEB22CF25DC45F96BFB8EF46214F0884DBE9849F152C365A509CB72

Function 0103A5FE Relevance: 1.6, APIs: 1, Instructions: 76
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileW.KERNELBASE(?,?,?,?,?,?), ref: 0103A67D

Memory Dump Source

Source File: 00000005.00000002.2565685025.000000000103A000.00000040.00000800.00020000.00000000.sdmp, Offset: 0103A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_103a000_unarchiver.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: a2e1cfbb85a2a8cb07a7fb058b64153dfd9603a541929517a0f6de06971c8595
Instruction ID: cc319d50352ccffe22ee0e8996938599024d71e0b6ade48a52c6f6b786dba1e8
Opcode Fuzzy Hash: a2e1cfbb85a2a8cb07a7fb058b64153dfd9603a541929517a0f6de06971c8595
Instruction Fuzzy Hash: 3B218E71600200AFEB21DF65DD45F66FBE8EF88224F0485AEEA85CB652D375E404DB71

Function 0103A78F Relevance: 1.6, APIs: 1, Instructions: 73
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetFileType.KERNELBASE(?,00000E24,5073F907,00000000,00000000,00000000,00000000), ref: 0103A815

Memory Dump Source

Source File: 00000005.00000002.2565685025.000000000103A000.00000040.00000800.00020000.00000000.sdmp, Offset: 0103A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_103a000_unarchiver.jbxd

Similarity

API ID: FileType
String ID:
API String ID: 3081899298-0
Opcode ID: 55e48e69305a259f6a8d1b15c9d5c4798fac555834aca6684449c7cfa14e6ec9
Instruction ID: 62e3ecf5c24836d35e3f5df5e5698d03d7000f639352f8f2846b392f9a724f82
Opcode Fuzzy Hash: 55e48e69305a259f6a8d1b15c9d5c4798fac555834aca6684449c7cfa14e6ec9
Instruction Fuzzy Hash: 7B21A8B54093846FE7128B25DC45BA6BFACDF46714F0880DBE984CB153D268A90AC775

Function 0103AA0B Relevance: 1.6, APIs: 1, Instructions: 70
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateDirectoryW.KERNELBASE(?,?), ref: 0103AA8B

Memory Dump Source

Source File: 00000005.00000002.2565685025.000000000103A000.00000040.00000800.00020000.00000000.sdmp, Offset: 0103A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_103a000_unarchiver.jbxd

Similarity

API ID: CreateDirectory
String ID:
API String ID: 4241100979-0
Opcode ID: a6e72621b28855c6f1b92352299e13eb857e44190f9045774e9d3dbe03df3800
Instruction ID: f18bb42aab41e247a825b2d791fd2797342cff664a5967f915a2ac996fbd6f35
Opcode Fuzzy Hash: a6e72621b28855c6f1b92352299e13eb857e44190f9045774e9d3dbe03df3800
Instruction Fuzzy Hash: BF2171726087C09FEB12CB29DC55B92BFE8AF46224F0D84EAE984CB153D325D905CB61

Function 0103A392 Relevance: 1.6, APIs: 1, Instructions: 69registryCOMMON

Download Yara Rule

APIs

RegQueryValueExW.KERNELBASE(?,00000E24,5073F907,00000000,00000000,00000000,00000000), ref: 0103A40C

Memory Dump Source

Source File: 00000005.00000002.2565685025.000000000103A000.00000040.00000800.00020000.00000000.sdmp, Offset: 0103A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_103a000_unarchiver.jbxd

Similarity

API ID: QueryValue
String ID:
API String ID: 3660427363-0
Opcode ID: 7432027384a9dd2059ebbbfa37fc9044c5c0da4d16545fbaaf33ef7e630fba27
Instruction ID: 64d2061ce493cd23d9fe745ff68bd277da60ba5a318e4e98abadbfd919567886
Opcode Fuzzy Hash: 7432027384a9dd2059ebbbfa37fc9044c5c0da4d16545fbaaf33ef7e630fba27
Instruction Fuzzy Hash: 0D219076600204AFEB21CF25DC85FA6FBECEF84710F04C49AEA85CB251D764E805CAB1

Function 0103A962 Relevance: 1.6, APIs: 1, Instructions: 60fileCOMMON

Download Yara Rule

APIs

ReadFile.KERNELBASE(?,00000E24,5073F907,00000000,00000000,00000000,00000000), ref: 0103A9C1

Memory Dump Source

Source File: 00000005.00000002.2565685025.000000000103A000.00000040.00000800.00020000.00000000.sdmp, Offset: 0103A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_103a000_unarchiver.jbxd

Similarity

API ID: FileRead
String ID:
API String ID: 2738559852-0
Opcode ID: a18b3bfabb3e868d89ee6e5bdf587daea31a01c04dd939a2e32ac846806042df
Instruction ID: c154cf86b773ad442ca5e42168fc24ee5c5e6134c86a0caacfc2fa1aaa270cca
Opcode Fuzzy Hash: a18b3bfabb3e868d89ee6e5bdf587daea31a01c04dd939a2e32ac846806042df
Instruction Fuzzy Hash: 5F11E272500240AFEB21CF25DC45FAAFBE8EF84324F04849BEA85DB141C339A405CBB1

Function 0103A882 Relevance: 1.6, APIs: 1, Instructions: 59COMMON

Download Yara Rule

APIs

SetFilePointer.KERNELBASE(?,00000E24,5073F907,00000000,00000000,00000000,00000000), ref: 0103A8DE

Memory Dump Source

Source File: 00000005.00000002.2565685025.000000000103A000.00000040.00000800.00020000.00000000.sdmp, Offset: 0103A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_103a000_unarchiver.jbxd

Similarity

API ID: FilePointer
String ID:
API String ID: 973152223-0
Opcode ID: 737784f046550c19c8b21888589056d939a06dbfd3cf96132dc1271a301322ac
Instruction ID: 6cdf51795292be8c91fd524bf5c14eb50cf13514b14a26b78dfa2e4c1d4285a0
Opcode Fuzzy Hash: 737784f046550c19c8b21888589056d939a06dbfd3cf96132dc1271a301322ac
Instruction Fuzzy Hash: C711E771500204AFEB21CF54DC45FAAFBECEF84724F04849BE985DB145C375A5158BB1

Function 0103A2AE Relevance: 1.6, APIs: 1, Instructions: 53COMMON

Download Yara Rule

APIs

SetErrorMode.KERNELBASE(?), ref: 0103A30C

Memory Dump Source

Source File: 00000005.00000002.2565685025.000000000103A000.00000040.00000800.00020000.00000000.sdmp, Offset: 0103A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_103a000_unarchiver.jbxd

Similarity

API ID: ErrorMode
String ID:
API String ID: 2340568224-0
Opcode ID: 1fb905f795b2d9858cca864c22beb126c054f66e5a807ff8af8e35992169b383
Instruction ID: ca13e38401651d3cad76a042864a906b8c10e763c0a246c42f3a5abfb6727d95
Opcode Fuzzy Hash: 1fb905f795b2d9858cca864c22beb126c054f66e5a807ff8af8e35992169b383
Instruction Fuzzy Hash: C1114F755093C0AFDB238B25DC55A52BFB4DF47224F0980DBE9858F163D265A809CB72

Function 0103AF8B Relevance: 1.6, APIs: 1, Instructions: 52COMMON

Download Yara Rule

APIs

FindClose.KERNELBASE(?), ref: 0103AFE4

Memory Dump Source

Source File: 00000005.00000002.2565685025.000000000103A000.00000040.00000800.00020000.00000000.sdmp, Offset: 0103A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_103a000_unarchiver.jbxd

Similarity

API ID: CloseFind
String ID:
API String ID: 1863332320-0
Opcode ID: 1cf59316e27d88d12c9957dc2c2b6a989a63940fa788670c20b9814d9f11b5dc
Instruction ID: 8a3daa86280a4f6dc4bc8666ad64d6ca24baa3598241a2ab37188361a03ec1dd
Opcode Fuzzy Hash: 1cf59316e27d88d12c9957dc2c2b6a989a63940fa788670c20b9814d9f11b5dc
Instruction Fuzzy Hash: 4111A3755093C0AFD7128B29DC45B52FFF4EF46220F0984DBED858B263D265A808CB62

Function 0103B1B4 Relevance: 1.6, APIs: 1, Instructions: 52COMMON

Download Yara Rule

APIs

GetSystemInfo.KERNELBASE(?), ref: 0103B208

Memory Dump Source

Source File: 00000005.00000002.2565685025.000000000103A000.00000040.00000800.00020000.00000000.sdmp, Offset: 0103A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_103a000_unarchiver.jbxd

Similarity

API ID: InfoSystem
String ID:
API String ID: 31276548-0
Opcode ID: fe28afa2dc36ca832f60c0a0fda27e4a6466a13c5ac0e7d2c6a330e63e680425
Instruction ID: c4a8da87d623ba82c9d8dad45aa79af1f96d360b95eeed3652f2c5b6e09d9bc8
Opcode Fuzzy Hash: fe28afa2dc36ca832f60c0a0fda27e4a6466a13c5ac0e7d2c6a330e63e680425
Instruction Fuzzy Hash: 401170754093C0AFDB128F15DC44B56BFA4DF46224F0884DAED888F253D279A908CB72

Function 0103A7C2 Relevance: 1.6, APIs: 1, Instructions: 52COMMON

Download Yara Rule

APIs

GetFileType.KERNELBASE(?,00000E24,5073F907,00000000,00000000,00000000,00000000), ref: 0103A815

Memory Dump Source

Source File: 00000005.00000002.2565685025.000000000103A000.00000040.00000800.00020000.00000000.sdmp, Offset: 0103A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_103a000_unarchiver.jbxd

Similarity

API ID: FileType
String ID:
API String ID: 3081899298-0
Opcode ID: 6eecb7b71b2d97e03f6754aedb0feddffacf8554e4e6a3e8ee6246fded69bb5d
Instruction ID: a3c23a12817a97e885ec5640fb513772b2c21f28b2757bd3677520ee5fb6588b
Opcode Fuzzy Hash: 6eecb7b71b2d97e03f6754aedb0feddffacf8554e4e6a3e8ee6246fded69bb5d
Instruction Fuzzy Hash: 8501D671504244AEE720CB15DC45FBAFBDCDF84725F04C09BEE858B242D378A8058AB6

Function 0103AA46 Relevance: 1.6, APIs: 1, Instructions: 52COMMON

Download Yara Rule

APIs

CreateDirectoryW.KERNELBASE(?,?), ref: 0103AA8B

Memory Dump Source

Source File: 00000005.00000002.2565685025.000000000103A000.00000040.00000800.00020000.00000000.sdmp, Offset: 0103A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_103a000_unarchiver.jbxd

Similarity

API ID: CreateDirectory
String ID:
API String ID: 4241100979-0
Opcode ID: f83d4d87597e2cd69f05eab3fb9e1b8d92017353782105242aea911fe4aa953c
Instruction ID: ccb5187a12d46f00a5c5d7cfdc66a475f2feda489b3f6060757a15e5973a5f86
Opcode Fuzzy Hash: f83d4d87597e2cd69f05eab3fb9e1b8d92017353782105242aea911fe4aa953c
Instruction Fuzzy Hash: 94118E726006419FEB50CF29D985B66BBDCEF44220F08C4AADD89CB242E339E505CB61

Function 0103ABE6 Relevance: 1.5, APIs: 1, Instructions: 47pipeCOMMON

Download Yara Rule

APIs

CreatePipe.KERNELBASE(?,00000E24,?,?), ref: 0103AC36

Memory Dump Source

Source File: 00000005.00000002.2565685025.000000000103A000.00000040.00000800.00020000.00000000.sdmp, Offset: 0103A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_103a000_unarchiver.jbxd

Similarity

API ID: CreatePipe
String ID:
API String ID: 2719314638-0
Opcode ID: 61fda542866e30723000f12691764b9a7e6376911cdf7f84f858c9ed34dc86a5
Instruction ID: e8196044c4e16e6212d7532e63d9a334973ba9fa03921178a408e7c6b4359df6
Opcode Fuzzy Hash: 61fda542866e30723000f12691764b9a7e6376911cdf7f84f858c9ed34dc86a5
Instruction Fuzzy Hash: 0B017172A00200AFE310DF16DC46B76FBE8FB88A20F14855AED489B745D735B915CBE6

Function 0103A172 Relevance: 1.5, APIs: 1, Instructions: 47fileCOMMON

Download Yara Rule

APIs

FindNextFileW.KERNELBASE(?,00000E24,?,?), ref: 0103A1C2

Memory Dump Source

Source File: 00000005.00000002.2565685025.000000000103A000.00000040.00000800.00020000.00000000.sdmp, Offset: 0103A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_103a000_unarchiver.jbxd

Similarity

API ID: FileFindNext
String ID:
API String ID: 2029273394-0
Opcode ID: d1abadd4db4e7f48943e70cf133c4aa7d52db14fd0fdee8f170539c810341a03
Instruction ID: 5741c3d5352309a84e42284c4d9efc10b2726d0302beaf34a8fcb27ac1067a94
Opcode Fuzzy Hash: d1abadd4db4e7f48943e70cf133c4aa7d52db14fd0fdee8f170539c810341a03
Instruction Fuzzy Hash: 3201B171A00200AFE310DF16CC46B76FBE8EB88A20F14815AEC089B745D735B911CBE2

Function 0103AFB2 Relevance: 1.5, APIs: 1, Instructions: 39COMMON

Download Yara Rule

APIs

FindClose.KERNELBASE(?), ref: 0103AFE4

Memory Dump Source

Source File: 00000005.00000002.2565685025.000000000103A000.00000040.00000800.00020000.00000000.sdmp, Offset: 0103A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_103a000_unarchiver.jbxd

Similarity

API ID: CloseFind
String ID:
API String ID: 1863332320-0
Opcode ID: 929ff054352d7ac4c168d7cfefda533fb0559d335481e4a47105311940ef6352
Instruction ID: 787c9bdbe5e58645e2df4d007f9d5fa8cb1465372f72c624de0e3de18bcb7fbc
Opcode Fuzzy Hash: 929ff054352d7ac4c168d7cfefda533fb0559d335481e4a47105311940ef6352
Instruction Fuzzy Hash: 0001D1746002449FDB108F19D885766FBD8EF44224F08C0AADD858B292D279E844CAB2

Function 0103A2DA Relevance: 1.5, APIs: 1, Instructions: 35COMMON

Download Yara Rule

APIs

SetErrorMode.KERNELBASE(?), ref: 0103A30C

Memory Dump Source

Source File: 00000005.00000002.2565685025.000000000103A000.00000040.00000800.00020000.00000000.sdmp, Offset: 0103A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_103a000_unarchiver.jbxd

Similarity

API ID: ErrorMode
String ID:
API String ID: 2340568224-0
Opcode ID: fcbed74671236fbfb4a91717d055b34750a6d7ae6b56023dfed0e928cd4c61db
Instruction ID: bbdf74d33c180ad8f0545f3d871147b86106e80001c6ad8f01b7b73c6352e471
Opcode Fuzzy Hash: fcbed74671236fbfb4a91717d055b34750a6d7ae6b56023dfed0e928cd4c61db
Instruction Fuzzy Hash: 2CF0AF34504244DFDB20DF15D885B65FBE4EF44721F08C0DAED898B252D3B9A404CAB2

Function 0103A6D4 Relevance: 1.3, APIs: 1, Instructions: 68COMMON

Download Yara Rule

APIs

CloseHandle.KERNELBASE(?), ref: 0103A748

Memory Dump Source

Source File: 00000005.00000002.2565685025.000000000103A000.00000040.00000800.00020000.00000000.sdmp, Offset: 0103A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_103a000_unarchiver.jbxd

Similarity

API ID: CloseHandle
String ID:
API String ID: 2962429428-0
Opcode ID: 829268710467f622bcf82e078b7dab5ccdf226649270dc9ce00b545d0953212b
Instruction ID: e48e587459e11bbfbe2bffce0583123e12a0e7d210590fd7aa3195b01ca48b0a
Opcode Fuzzy Hash: 829268710467f622bcf82e078b7dab5ccdf226649270dc9ce00b545d0953212b
Instruction Fuzzy Hash: 4821B0B59097C09FDB138B25DC95792BFB8AF06220F0980DADC858B1A3D224A908C772

Function 0103A716 Relevance: 1.3, APIs: 1, Instructions: 43COMMON

Download Yara Rule

APIs

CloseHandle.KERNELBASE(?), ref: 0103A748

Memory Dump Source

Source File: 00000005.00000002.2565685025.000000000103A000.00000040.00000800.00020000.00000000.sdmp, Offset: 0103A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_103a000_unarchiver.jbxd

Similarity

API ID: CloseHandle
String ID:
API String ID: 2962429428-0
Opcode ID: 53ecbd736ed34717012a7cbd9671c333989c88563945e1a358526ab2edce30f7
Instruction ID: 9ba99b5cfb71d84e594a2d25d298b6ccb22a6abfc7ee6e92f816f9200537f069
Opcode Fuzzy Hash: 53ecbd736ed34717012a7cbd9671c333989c88563945e1a358526ab2edce30f7
Instruction Fuzzy Hash: EC01D470600240DFDB118F15DC85765FBE8EF44220F08C4AADC86CB252D279A404CAB2

Function 011B02C0 Relevance: .3, Instructions: 285COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2566168271.00000000011B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 011B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_11b0000_unarchiver.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2962fbad26e12b9651fb1aae2889c2f239eba36b9bc95c4ef58fa10375dfe6f4
Instruction ID: c9d9613177ac780a6cac7fef9dd16e5865b1e8b7ca54cfe9e20cd63e56df06db
Opcode Fuzzy Hash: 2962fbad26e12b9651fb1aae2889c2f239eba36b9bc95c4ef58fa10375dfe6f4
Instruction Fuzzy Hash: B1B12E7C601120CFC718EB66D998B5E7BF2FF8C240B118629FA069B799DB359C42CB51

Function 011B0798 Relevance: .3, Instructions: 284COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2566168271.00000000011B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 011B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_11b0000_unarchiver.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2c216bd32c5ff96d920860708105ac506823e3b6e81de4bfb701bfc1de1a8f26
Instruction ID: 1d18cab471940fb8745fd51f65e3c1b286d7c1b07a433ad331e4d2b616da2d0c
Opcode Fuzzy Hash: 2c216bd32c5ff96d920860708105ac506823e3b6e81de4bfb701bfc1de1a8f26
Instruction Fuzzy Hash: 56A1B138B002208BDB09AB75C59577E77F3AF8C308F158529EA0697389DF799C42CB91

Function 011B0BA0 Relevance: .1, Instructions: 60COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2566168271.00000000011B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 011B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_11b0000_unarchiver.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3bcf11f824900155b3dfba9d4b0d3e4d5223b29341b941d79e3daa04c9738d32
Instruction ID: f396c21da9def3b8022261a04229e1ddd355ad33721380ceafae490f22a0192a
Opcode Fuzzy Hash: 3bcf11f824900155b3dfba9d4b0d3e4d5223b29341b941d79e3daa04c9738d32
Instruction Fuzzy Hash: 5911E735A101186FCB049BB4D8489DF7BF6FF8C214B024975E205D7326DF30D8469B80

Function 011D080A Relevance: .0, Instructions: 50COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2566211259.00000000011D0000.00000040.00000020.00020000.00000000.sdmp, Offset: 011D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_11d0000_unarchiver.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 261a362aeb54aed900cd824d049c8fc1568e2b84d0f79755d03816e0425f645d
Instruction ID: 7e6db9fb872a5746ade4d94723e98b74e01c71a2ca472e2bb08bf1677e3f7e39
Opcode Fuzzy Hash: 261a362aeb54aed900cd824d049c8fc1568e2b84d0f79755d03816e0425f645d
Instruction Fuzzy Hash: 510196B28093446FD3018B559C41C52BFE8DF86514F09C5AEE8448B102D226A915CBA2

Function 011D05E0 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2566211259.00000000011D0000.00000040.00000020.00020000.00000000.sdmp, Offset: 011D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_11d0000_unarchiver.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 704fabc319c0ba437ff71f56a5916055d5bb5b732adb5162c9c989211bc44149
Instruction ID: e55934f0501c5781ac6c3d51768874156d2da3a39a5ff6c990b093aabd597bdc
Opcode Fuzzy Hash: 704fabc319c0ba437ff71f56a5916055d5bb5b732adb5162c9c989211bc44149
Instruction Fuzzy Hash: 690186B65097806FD7128F15EC41863FFE8EE96620709C49FEC498B612D225A909CBB2

Function 011D082E Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2566211259.00000000011D0000.00000040.00000020.00020000.00000000.sdmp, Offset: 011D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_11d0000_unarchiver.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 812c10b48161c88a53342300d1396b9d7eaec01ae5023477dcc3c5885520e5e9
Instruction ID: d387094e638b0106791d30a9f283ad4a995a4a2a45d5ad2dc2e9c1f0cbb62064
Opcode Fuzzy Hash: 812c10b48161c88a53342300d1396b9d7eaec01ae5023477dcc3c5885520e5e9
Instruction Fuzzy Hash: C6F082B28052046FA240DF55ED468A6F7ECDFC4521F04C52EEC488B305E376BD158EE2

Function 011D0606 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2566211259.00000000011D0000.00000040.00000020.00020000.00000000.sdmp, Offset: 011D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_11d0000_unarchiver.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e40817be1ce0b936d6fd2c6b4045a84762b980a745870a9ed85f5d48f53cd1e1
Instruction ID: 14fc6cc88d78ada85012051880dd3afbbcd3797215cfcf469ac694c29148ec01
Opcode Fuzzy Hash: e40817be1ce0b936d6fd2c6b4045a84762b980a745870a9ed85f5d48f53cd1e1
Instruction Fuzzy Hash: 0AE092B6A006045B9750CF0AEC42462F7D8EB84630B08C07FDC0D8B711D239B505CAA6

Function 011B0C50 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2566168271.00000000011B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 011B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_11b0000_unarchiver.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0633e327fa34ddf5fc41ac7b9bbc8195923fc0ae7343180502d3b7d398eaf5f0
Instruction ID: ece392d9f444565f0f868c952ca4c3b5c2f97696c9dcaf84d23e37fffc2fe313
Opcode Fuzzy Hash: 0633e327fa34ddf5fc41ac7b9bbc8195923fc0ae7343180502d3b7d398eaf5f0
Instruction Fuzzy Hash: 40E0DFB1F152641BCB44DBB848945EE7FA6DF81214F82457AD009DB242EE3199438380

Function 011B0C60 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2566168271.00000000011B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 011B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_11b0000_unarchiver.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 14bd24703257be102f736484f6d776505f01593822ea613b521e3704a491dd5e
Instruction ID: dd085166c3d9bb5a810ffce79f47d4e3cf4f8f33b39671ff46599cfb0d72cc94
Opcode Fuzzy Hash: 14bd24703257be102f736484f6d776505f01593822ea613b521e3704a491dd5e
Instruction Fuzzy Hash: BBD01231F042281B8B54DBF958445AE7AEA9BC5154B56447AD009D7341EE3199418790

Function 011B0DD1 Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2566168271.00000000011B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 011B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_11b0000_unarchiver.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8caa8bcc4e94cda549848455c384935c81fd1956fbbf4429c11926bbaaa3b522
Instruction ID: 8878eb5bab1bb9737a8e3c5c2e293ae3f1480775811ec4f8b9edbc0e784c8602
Opcode Fuzzy Hash: 8caa8bcc4e94cda549848455c384935c81fd1956fbbf4429c11926bbaaa3b522
Instruction Fuzzy Hash: E9E0C2302493504FCB0B973898945EA3F615BD5204F8A8196E4048F793DB25DA97D391

Function 010323F4 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2565660773.0000000001032000.00000040.00000800.00020000.00000000.sdmp, Offset: 01032000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_1032000_unarchiver.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 095fbfca722f863644ed3c684244dab4cc206f8dee668cbfeb57d42067496ece
Instruction ID: 3a2a0bf18a07905200b8979ce30553175ffe1caa4e4f918ef78cb86a9d3fbe9b
Opcode Fuzzy Hash: 095fbfca722f863644ed3c684244dab4cc206f8dee668cbfeb57d42067496ece
Instruction Fuzzy Hash: 8DD02E392086804FF3129A1CC1A4B853BE8AB80704F0A00FAA8408B363CB28E8D1C200

Function 010323BC Relevance: .0, Instructions: 14COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2565660773.0000000001032000.00000040.00000800.00020000.00000000.sdmp, Offset: 01032000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_1032000_unarchiver.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 086ad5ac8d07b79779a372f5014905df779c1595ccb88166e95e69347a7123a4
Instruction ID: c25e5fb2a7e8fd1333896d177ec12292b95655f271705c31a3dfba9f8d757635
Opcode Fuzzy Hash: 086ad5ac8d07b79779a372f5014905df779c1595ccb88166e95e69347a7123a4
Instruction Fuzzy Hash: D3D05E352402814BE715DA1CC2D4F5977D8AB80B14F0A84E9AC508B266C7A8E8C0CA00

Function 011B0DE0 Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2566168271.00000000011B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 011B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_11b0000_unarchiver.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7f59b05102f926e37987a9bb122dc287e7c06b78b41920404fe01ae98a13ee15
Instruction ID: 2224ed2f51c349ed368d4648d42d1ba3bbe8d7e6242f9dcac8b291a3200101b5
Opcode Fuzzy Hash: 7f59b05102f926e37987a9bb122dc287e7c06b78b41920404fe01ae98a13ee15
Instruction Fuzzy Hash: A5C012342002148BDB0CA768D559A6A77A65BD8308F46C564E5080B355DF70E881C680

Description:	Adversaries may send spearphishing emails with a malicious link in an attempt to gain access to victim systems. Spearphishing with a link is a specific variant of spearphishing. It is different from other forms of spearphishing in that it employs the use of links to download malware contained in email, instead of attaching malicious files to the email itself, to avoid defenses that may inspect email attachments. Spearphishing may also involve social engineering techniques, such as posing as a trusted source.
Tactics:	Initial Access
Data Sources:	Application Log: Application Log Content, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Google Workspace, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may encrypt data on target systems or on large numbers of systems in a network to interrupt availability to system and network resources. They can attempt to render stored data inaccessible by encrypting files or data on local and remote drives and withholding access to a decryption key. This may be done in order to extract monetary compensation from a victim in exchange for decryption or a decryption key (ransomware) or to render data permanently inaccessible in cases where the key is not saved or transmitted.
Tactics:	Impact
Data Sources:	Cloud Storage: Cloud Storage Modification, Command: Command Execution, File: File Creation, File: File Modification, Network Share: Network Share Access, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report https://github.com/netwrix/pingcastle/releases/download/3.3.0.1/PingCastle_3.3.0.1.zip

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Dropped Files

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

Compliance

Networking

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

LLM Input / Output

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.7124

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AdobeFnt23.lst.7124

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner

Windows Analysis Report
https://github.com/netwrix/pingcastle/releases/download/3.3.0.1/PingCastle_3.3.0.1.zip